ML19197A140

IMC 0326 Draft Operability Determinations_8_1

ML19197A140
Person / Time
Issue date:	07/16/2019
From:	Research and Test Reactors Licensing Projects Branch
To:
Otto N, NRR/DLP, 415-6695
References
Download: ML19197A140 (33)

Text

NRC INSPECTION MANUAL STSB INSPECTION MANUAL CHAPTER 0326 OPERABILITY DETERMINATIONS

TABLE OF CONTENTS 0326-01 PURPOSE 1 0326-02 OBJECTIVES 1 0326-03 APPLICABILITY 1 03.01 Scope of SSCs for Operability Determinations 1 0326-04 DEFINITIONS 1 0326-05 RESPONSIBILITIES AND AUTHORITIES 4 05.01 Director/Deputy Director, Division of Safety Systems (DSS), Office of Nuclear Reactor Regulation (NRR) 4 05.02 Branch Chief, Technical Specifications Branch (DSS/NRR) 4 0326-06 OPERABILITY DETERMINATION PROCESS 4 06.01 Continuous Assessment of Operability 4 06.02 Presumption of Operability 5 06.03 Review Activities 5 06.04 Reasonable Assurance of Operability 5 06.05 Conditions Warranting Operability Determinations 6 06.06 Timing of Operability Determinations 6 06.07 Scope of Operability Determinations 7 06.08 Compensatory Measures 8 06.09 Operator Awareness and Responsibilities 9 06.10 Documentation 9 06.11 Enforcement Discretion 9 06.12 Issue Resolution and Internal Alignment 10 0326-07 SURVEILLANCES 10 07.01 Operability during Technical Specification Surveillances 10 07.02 System Configuration during Surveillance and Operability Testing 11 07.03 Missed Technical Specification Surveillance 11 0326-08 SPECIFIC OPERABILITY ISSUES 11 08.01 Relationship between the General Design Criteria & the Technical Specifications 11 08.02 Single Failures 13 08.03 Treatment of Consequential Failures in Operability Determinations 13 08.04 Use of Alternative Analytical Methods in Operability Determinations 13 08.05 Use of Temporary Manual Action in Place of Automatic Action in Support of Operability 15 08.06 Use of Probabilistic Risk Assessment in Operability Decisions 15 08.07 Use of Seismic Margin Analysis in Operability Decisions 16 08.08 Environmental Qualification 16 08.09 Technical Specification Operability vs. ASME OM Code Criteria 16 08.10 Support System Operability 17 08.11 Piping and Pipe Support Requirements 18 08.12 Flaw Evaluation 18 08.13 Operational Leakage from Code Class 1, 2, 3 Components 21 Issue Date: DRAFT i 0326

08.14 Structural Requirements 24 0326-09 REFERENCES 25 ATTACHMENT 1 Revision History for IMC 0326 Att1-1 Issue Date: DRAFT ii 0326

0326-01 PURPOSE To assist NRC inspectors in their review of licensees operability determinations (OD). This guidance may not be directly applicable in every case at every plant and inspectors should discuss significant differences among licensee practices with NRC management to ensure that the guidance is applied in an accurate and consistent manner.

0326-02 OBJECTIVES 02.01 To provide inspectors clear guidance regarding the process for evaluating operability determinations performed by licensees 02.02 To ensure inspectors evaluate licensee operability determinations consistently throughout the agency utilizing sound engineering practices 02.03 To provide inspectors references to various guidance/documents available while assessing operability determinations 0326-03 APPLICABILITY Operability is the responsibility of the licensee who continuously assess operability. When conditions affecting structures, system, and components (SSCs) are identified, an input into the Corrective Action Program (CAP) is usually made. It is the responsibility of the licensed Senior Reactor Operator (SRO) to assess the operational impact on the SSC.

03.01 Scope of SSCs for Operability Determinations The OD process is used to assess operability of SSCs described in Technical Specifications (TS). The scope of SSCs considered within the OD process is as follows:

a. SSCs that are required to be operable by TS in accordance with 10 CFR 50.36. These SSCs may perform required support functions for other SSCs required to be operable by TS (e.g., Emergency Diesel Generators and Service Water).

b. SSCs that are not explicitly required to be operable by TS but perform required support functions (as specified by the TS definition of operability) for SSCs are required to be operable by TS. SSCs may also have design functions that do not perform a necessary and related support function for TS SSCs. These design functions are not within the scope of an OD.

For example, (1) Nuclear Service Water supplied to components that do not have a TS specified safety function or a necessary and related support function and, (2) station battery nonconformance with the Station Blackout Rule, 10 CFR 50.63, Loss of all alternating current power, would not necessarily render operating or shutdown DC Source Limiting Condition for Operation (LCO) requirements not met and therefore inoperable.

Issue Date: DRAFT 1 0326

0326-04 DEFINITIONS 04.01 Current Licensing Basis (CLB): The set of NRC requirements applicable to a specific plant for ensuring compliance with, and operation within, applicable NRC requirements and the plant-specific design basis over the life of that facilitys operating license.

The set of NRC requirements applicable to a specific plant CLB include but are not limited to:

a. NRC regulations in 10 CFR Parts 2, 19, 20, 21, 26, 30, 40, 50, 51, 52, 54, 55, 70, 72, 73, and 100 and appendices thereto,

b. Commission Orders,

c. License Conditions,

d. Exemptions,

e. Technical Specifications,

f. Plant-specific design basis information defined in 10 CFR 50.2 and documented in the most recent Updated Final Safety Analysis Report (UFSAR) (as required by 10 CFR 50.71),

g. Licensee commitments remaining in effect that were made in docketed licensing correspondence (such as licensee responses to NRC bulletins, Licensee Event Reports, generic letters, and enforcement actions), and

h. Licensee commitments documented in NRC safety evaluations.

04.02 Defect: A flaw of such size, shape, orientation, location or properties found unacceptable for continued service (i.e. exceeds the acceptance criteria of the American Society of Mechanical Engineers (ASME)Section XI Code, the applicable construction code, or an NRC approved ASME Code Case).

04.03 Design Bases: Design bases information, as defined by 10 CFR 50.2, is documented in the UFSAR as required by 10 CFR 50.71. NRC Regulatory Guide (RG) 1.186, Guidance and Examples for Identifying 10 CFR 50.2 Design Basis, endorses Appendix B to Nuclear Energy Institute (NEI) document NEI 97-04, Guidance and Examples for Identifying 10 CFR 50.2 Design Basis. The design basis of safety-related SSCs is established initially during the original plant licensing and relates primarily to the accident prevention or mitigation functions of safety-related SSCs. The design basis of a safety-related SSC is a subset of the CLB.

04.04 Flaw: An imperfection or unintentional discontinuity that is detectable by non-destructive examination.

04.05 High Energy Systems: Systems where the maximum operating temperature exceeds 200°F or the maximum operating pressure exceeds 275 psig. Inspectors should refer to the facilitys CLB.

04.06 Moderate Energy Systems: Systems where the maximum operating temperature is less than or equal to 200°F and the maximum operating pressure is less than or equal to 275 psig.

Inspectors should refer to the facilitys CLB.

04.07 NDE Indication: The response or evidence resulting from the application of a nondestructive examination.

04.08 Operability Determination (OD): A decision by an SRO on the operating shift crew that there is reasonable assurance that an SSC can perform its specified safety function(s).

Issue Date: DRAFT 2 0326

04.09 Operable - Operability: Improved Standard Technical Specifications (STS) (NUREGs 1430 through 1434 and NUREG-2194) define Operable - Operability as follows:

A system, subsystem, train, component, or device shall be OPERABLE or have OPERABILITY when it is capable of performing its specified safety function(s),

and when all necessary attendant instrumentation, controls, normal or emergency electrical power, cooling and seal water, lubrication and other auxiliary equipment that are required for the system, subsystem, train, component, or device to perform its specified safety function(s) are also capable of performing their related support function(s).

Plant-specific TS that are not based on the improved STS definition typically defines Operable

- Operability as follows:

A system, subsystem, train, component, or device shall be OPERABLE or have OPERABILITY when it is capable of performing its specified function(s), and when all necessary attendant instrumentation, controls, electrical power, cooling or seal water, lubrication and other auxiliary equipment that are required for the system, subsystem, train, component, or device to perform its specified safety function(s) are also capable of performing their related support function(s).

As described above, plant-specific TS may differ from the improved STS definition of Operable

- Operability. Therefore, some judgment is needed in applying this guidance. Word differences that exist are not viewed by the NRC to imply a significant difference in application of the plant-specific TS. Any problems resulting from inconsistencies between a plant-specific definition of operability and this guidance should be discussed with regional managers, who should discuss the issues with NRR if deemed necessary. In all cases, a licensees plant-specific TS definition of Operable - Operability governs.

In this IMC, the term specified safety function is synonymous with the term specified function used in plant-specific (custom) TS that do not use the ISTS definition of Operable-Operability.

When a condition is discovered that calls into question the TS required SSCs ability to perform the specified safety function, an OD should be made to determine if the SSCs specified safety function can be performed. In order to be considered operable, an SSC must be capable of performing the specified safety function(s) of its design, within the required range of physical conditions, initiation times, and mission times in the CLB. In addition, TS operability considerations require that an SSC meet all surveillance requirements (SRs) (as specified in SR Applicability SR 3.0.1). An SSC that does not meet a SR must be declared inoperable because the LCO operability requirement(s) are not met. For OD purposes, the mission time is the duration of SSC operation that is credited in the design basis for the SSC to perform its specified safety function(s). A system is expected to be tested and maintained to perform as designed. When an SSC capability is degraded to a point where it cannot perform with reasonable assurance, the SSC should be judged inoperable.

04.10 Reasonable Assurance: The discovery of a condition may call the operability of one or more SSCs into question. A subsequent determination of operability should be based on the licensees reasonable assurance from the evidence collected that the SSCs are capable of performing their specified safety function and that the OD will support that expectation.

Reasonable assurance does not mean absolute assurance that the SSCs are operable. The SSCs may be considered operable when there is evidence that the possibility of failure of an Issue Date: DRAFT 3 0326

SSC has increased, but not to the point of eroding confidence in the reasonable assurance that the SSC remains operable. The supporting basis for the reasonable assurance of SSC operability should provide a high degree of confidence that the SSCs remain operable. It should be noted that the standard of reasonable assurance is a high standard, and that there is no such thing as an indeterminate state of operability; an SSC is either operable or inoperable.

04.11 Specified Function/Specified Safety Function: The definition of operability refers to the capability to perform the specified function (at non-improved TS plants) and specified safety function (at improved STS plants). The specified function/specified safety function of an SSC is that specified safety function(s) in the CLB for the facility.

In addition to providing its specified safety function(s), an SSC is expected to perform as designed, tested and maintained. When system capability is degraded to a point where it cannot perform with reasonable expectation or reliability, the SSC should be judged inoperable.

0326-05 RESPONSIBILITIES AND AUTHORITIES 05.01 Director/Deputy Director, Division of Safety Systems (DSS), Office of Nuclear Reactor Regulation (NRR)

• Coordinates development and revision preparation to the manual chapter,

• Coordinates regional implementation with the Division of Inspection and Regional Support (DIRS), and

• Serves as the NRR contact with the regional offices for guidance development and implementation.

05.02 Branch Chief, Technical Specifications Branch (DSS/NRR)

• Reviews and approves the technical content of periodic revisions to the content contained in the manual chapter 0326-06 OPERABILITY DETERMINATION PROCESS Operability determinations are appropriate whenever a condition calls into question the ability of SSCs to perform specified safety functions. The OD process is used to assess operability of SSCs and their support functions for compliance with TS when a condition is identified for a specific SSC required to be operable by TS, or when a condition is identified for a necessary and related support function. PRA functionality is used to calculate risk-informed extended TS completion times (CT); however, the concept of PRA Functional - Functionality does not apply to Operable - Operability determinations. An SSC that is determined to be PRA functional could be determined to be TS inoperable. If an immediate threat to public health and safety is identified, actions should be taken quickly to place the plant in a safe condition in accordance with TS.

06.01 Continuous Assessment of Operability Operability of SSCs is continuously assessed by the licensee. This continuous assessment is normally accomplished using operator rounds, log readings, plant alarms and periodic surveillances. When a condition is identified, the licensee should assess the impact of the condition on the specified safety function(s) of the SSC based upon what is known at the time.

Issue Date: DRAFT 4 0326

The content of the functional impact assessment is dictated by the licensees process and the specific condition. Examples such as, an operating log entry, a work order description, screening questions for entry into the CAP, a checked box for operable or not, and extent of condition reviews based on operating experience may provide insights as to the functional impact. If a licensee determines the functional impact does not affect a specified safety function, the inspector should be able to understand the basis for the functional impact decision using the information available at the time. It is acceptable for an inspector to ask the licensee for the basis for the functional impact decision if it is not clear. Note inspection sample selection should be guided by risk insights resulting from the identified condition.

06.02 Presumption of Operability The TS are organized and implemented on the presumption that systems are operable. It is reasonable to assume that once a system or component is declared operable by the SRO it will remain operable. Surveillance testing periodically provides reasonable assurance of operability. It should be noted, that once a condition is identified that may impact the function of an SSC, the presumption of operability is not necessarily lost. The presumption of operability is only lost when it is apparent that a condition has been identified that causes a substantive functional impact or would be expected to have a substantive functional impact during an event requiring the SSC to perform its specified safety function. Furthermore, the loss of the presumption of operability does not mean that the SSC in question is inoperable, only that the licensee must provide an additional basis to support continued operability. Note that a question, concern or presence of a condition alone does not necessarily invalidate the presumption of operability.

06.03 Review Activities Reviewing the performance of SSCs and ensuring their operability is a continual process.

Inspectors review of the following activities may reveal conditions that challenge the presumption of operability:

a. Additions to facilities,

b. Day-to-day operation of the facility,

c. Design modifications to facilities,

d. Engineering design reviews, including design basis reconstitution,

e. Examinations of records,

f. Inservice testing and inspection programs,

g. Maintenance activities,

h. NRC inspections,

i. Observations from the control room,

j. Operational event reviews,

k. Operational experience reports,

l. Part 21 notifications,

m. Plant walkdowns and tours,

n. Allegations,

o. Quality assurance activities such as audits and reviews,

p. SSC performance reviews (including common-cause mode failures), and

q. Vendor reviews or inspections.

Issue Date: DRAFT 5 0326

06.04 Reasonable Assurance of Operability The concept of presumption of operability and reasonable assurance of operability are distinct concepts and do not coexist. An operability determination should be based on the reasonable assurance, from the evidence collected, that the SSCs are capable of performing safety functions and that the OD will support that position. Reasonable assurance does not mean absolute assurance that the SSCs are operable. The SSCs may be considered operable when there is evidence that the possibility of failure of an SSC has increased, but not to the point of eroding confidence in the reasonable assurance that the SSC remains operable. The supporting basis for the reasonable assurance of SSC operability should provide a high degree of confidence that the SSCs remain operable. It should be noted that the standard of reasonable assurance is a high standard.

A TS SSC is either operable or inoperable when the specified safety functions are required in the mode of applicability and there is no indeterminate state of operability. Once a licensee declares an SSC operable it remains operable until enough direct or indirect evidence is present which results or would result in the SSC not performing its specified safety function when or if any licensing basis event occurs.

06.05 Conditions Warranting Operability Determinations Licensees should enter their operability determination process upon discovery of a condition that results in the loss of the presumption of operability. It is the judgement of the SRO to determine if an identified condition has a substantive functional impact on an SSC such that an OD would be necessary. If an SSC is clearly inoperable (e.g. loss of motive power or failed TS surveillance), it must be declared inoperable and an OD would not be required. Documentation of the assessment should be in accordance with Section 06.10 of this IMC. Also, see Sections 03.01.b and 08.10 of this IMC for discussions on the relationship between necessary and related support functions and the operability of SSCs described in TS.

An inspectors review of conditions warranting ODs should be risk informed and focused on conditions that potentially have a substantive functional impact on the SSCs capability. A question or concern from an inspector regarding the substantive functional impact assessment does not change the presumption of operability. An inspectors challenge to an SROs OD should consist of credible technical evidence that is either new or different from the information originally assessed. Also, conditions that do not result in a substantive functional impact can be reviewed under the corrective action program.

For example, a licensee may identify an elevated EDG bearing temperature during a surveillance test and an SRO determines that the presumption of operability is maintained. An inspector may conclude that the SROs determination failed to consider credible technical evidence (vendor manual, operating data, calculations/analysis, operating experience, etc.) that may impact the reasonable assurance of operability. This may include a previously unidentified temperature trend, or vendor manual restrictions on bearing temperatures below the alarm set point that will result in a significant functional impact on the SSC. The inspector should discuss these differences with the licensee to ensure a clear understanding by the licensee and the inspectors that all aspects of the conditions impact on the SSCs ability to perform its specified safety function have been properly addressed in an OD.

Issue Date: DRAFT 6 0326

06.06 Timing of Operability Determinations Operability is assessed continuously and upon identification of a condition, the licensee shall assess the presumption of operability of the SSC immediately and without unnecessary delay. If the condition results in a substantive functional impact on the SSC then the licensee should enter the OD process. While an OD may be based on limited information, the information should be sufficient to conclude that there is reasonable assurance that the SSC is capable of performing the required specified safety function.

In any case, if the available information is incomplete, the licensee should collect any additional information that is material to the determination (i.e., information that could result in a change to determination) commensurate with the safety significance of the condition, and then promptly make an operability determination based on the complete set of information. If, at any time, information emerges that negates a previous determination that there is a reasonable assurance that the SSC is operable the licensee should declare the SSC inoperable. As an example, if operating experience reveals some internal sub-component failure of an SSC, a licensee may investigate, using the corrective action program, to determine whether there is current evidence of the failure on the susceptible SSC. The presence of the failure may not be readily or directly observable. There may be indirect or downstream effects which may indicate the presence of the sub-component failure. The absence of these indirect effects could be used to support a reasonable expectation of continued operability. If no direct or indirect indications are available, then a comparison of key characteristics between the operating units SSC and the failed SSC may be used to support conclusions regarding the condition of the SSC. The types of information which may be considered include but are not limited to run time, operating cycles, maintenance history, SSC failure history, etc. If the result of the corrective action program review concludes there is not enough evidence to call into question the presumption of operability the licensee should respond to the operating experience item in accordance with the corrective action program.

06.07 Scope of Operability Determinations The scope of an OD should be sufficient to address the capability of SSCs to perform their specified safety functions. The operability decision may be based on analysis, a test or partial test, experience with operating events, engineering judgment, or a combination of these factors, considering SSC functional requirements.

a. Possible elements of an OD which may support an OD include:

(1) The SSCs affected by the condition, (2) The extent of condition for all similarly affected SSCs, (3) The CLB requirements or commitments established for the affected SSC, (4) The specified safety function(s) performed by the affected SSCs, (5) The effect or potential effect of the condition on the affected SSCs ability to perform its specified safety function(s), and (6) Whether there is a reasonable expectation of operability, including the basis for the determination and any compensatory measures put in place to establish or Issue Date: DRAFT 7 0326

restore operability.

b. The following things should be considered when performing ODs:

(1) Design basis events are plant-specific, and plant-specific TS, bases, and safety evaluations may contain plant-specific considerations related to operability, (2) The SSC operability requirements are based on safety analysis of specific design basis events for one mode or specified condition of operation and may not be the same for other modes or conditions of operation, so all applicable modes and conditions of operation should be considered, (3) The operability requirements for an SSC encompass all necessary support systems (per the TS definition of operability) regardless of whether the TS explicitly specify operability requirements for the support functions, (4) In order to evaluate conditions, it is assumed in the OD the design basis event occurs. The occurrence of multiple simultaneous design basis events should be considered only to the extent that they are required as a part of the plants CLB, and (5) Compensatory measures may be established to restore or maintain operability of an SSC. See section 06.08 of this IMC for additional guidance on compensatory measures.

06.08 Compensatory Measures When evaluating the effect of a condition on an SSCs capability to perform any of its specified safety functions, a licensee may decide to implement compensatory measures, as an interim action, until final corrective action to resolve the condition is completed.

Compensatory measures purposes include:

a. Maintaining or enhancing an operable SSCs capability to perform its specified safety functions. Compensatory measures for SSCs may restore plant operating margins,

b. Monitoring performance of an SSC to allow the licensee to take additional action prior to the SSC becoming inoperable, and

c. Restoring an inoperable SSCs to an operable status. In general, these measures should have minimal impact on the operators or plant operations, should be relatively simple to implement, and should be documented.

Conditions calling for the compensatory measures can place additional burden on plant operators and inspectors should verify the licensee addresses the condition commensurate with safety significance per 10 CFR 50 Appendix B Criterion XVI. Section 08.05 of this IMC contains guidance on the temporary use of manual actions instead of automatic actions to support ODs. Also, the planned removal of hazard barriers for maintenance is considered a temporary facility alteration. Additional guidance on hazard barriers is provided in Regulatory Issue Summary (RIS) 2001-09, Control of Hazard Barriers, dated April 2, 2001. In all cases, licensees must continue to comply with the plant TS, particularly the operability provisions Issue Date: DRAFT 8 0326

applicable to the protected SSCs. RIS 2001-09 states that the operability guidance in the NRC Inspection Manual can be used to evaluate the operability of protected equipment.

Additionally, if a compensatory measure involves a temporary facility or procedure change, 10 CFR 50.59 applies to the temporary change to determine whether the temporary change/compensatory measure itself (not the condition) impacts other aspects of the facility or procedures described in the UFSAR. In considering whether a temporary facility or procedure change impacts other aspects of the facility, a licensee should apply 10 CFR 50.59, paying particular attention to ancillary aspects of the temporary change that result from actions taken to directly compensate for the degraded condition.

Licensees may use the guidance in NEI 96-07, Revision 1, Guidelines for Implementing 10 CFR 50.59, which is endorsed by Regulatory Guide 1.187, Guidance for Implementation of 10 CFR 50.59, Changes, Tests, and Experiments. Inspectors can also refer to Section 08.05 of this IMC for additional compensatory measures guidance.

06.09 Operator Awareness and Responsibilities The operating shift crew is responsible for overall control of facility operation. As part of that responsibility, the operating shift crew will be aware of conditions that have a functional impact on SSCs and maintained knowledge of the SSCs operability status. A senior licensed operator on the operating shift crew with responsibility for plant operations makes the determination of operability, i.e., makes the call on whether an SSC described in TS is operable or inoperable.

Plant staff in other organizations (e.g., operations, engineering, and licensing) with expertise in the subject matter and appropriate knowledge of plant operations may prepare ODs. Whoever prepares the evaluation of the condition should inform the licensed operators responsible for operating the plant of the discovery, and the status of evaluations that affect plant operation.

Once the OD has been prepared, it is the ultimate responsibility of the senior licensed operator to approve the OD document.

06.10 Documentation Operability determinations should be documented in sufficient detail to allow an individual knowledgeable in the technical discipline associated with the condition to understand the basis for the determination. Adequate documentation is necessary to establish a basis to allow for subsequent independent reviews. Supporting information should be included or appropriately referenced. If the presumption of operability has not been lost then the level of documentation should be consistent with applicable licensee procedures.

06.11 Enforcement Discretion Under unique circumstances, a licensee may experience an unanticipated, temporary noncompliance with a TS or license condition that would result in one or more of the following:

a. An unnecessary plant transient,

b. An unnecessary down-power or the shutdown of a reactor without a corresponding health and safety benefit,

c. The performance of testing, inspection, or system realignment that is inappropriate for Issue Date: DRAFT 9 0326

the specific plant conditions,

d. Unnecessary delays in plant startup without a corresponding health and safety benefit, and

e. The potential for an unexpected plant shutdown during severe weather, a pandemic, other natural phenomena, or a terrorist attack that could exacerbate already degraded electrical grid conditions and could have an adverse impact on the overall public health and safety or common defense and security.

If there is time to obtain an amendment, a licensee should seek to obtain it before taking action that is not in compliance with license conditions, TS or the CLB, except in certain emergency situations when 10 CFR 50.54(x) and (y) apply. If there is not sufficient time to obtain a license amendment, licensees may seek enforcement discretion from the NRC. Guidance applicable to these limited circumstances is provided in IMC 0410, Notices of Enforcement Discretion.

06.12 Issue Resolution and Internal Alignment If the inspector disagrees with an SROs assessment of the operability of an SSC, then the inspector should work through the licensees management to resolve the issue as expeditiously as possible. A good practice is to make sure licensee management is aware of potential operability issues while the inspector is still evaluating the issue. Once the inspector has concluded that there is disagreement with the licensee, then the inspector should brief his/her NRC supervisor as soon as possible and work with NRC management to identify a path forward for resolution of the issue with the licensee.

The region may consult with NRR technical experts regarding a plant-specific operability issue as part of the inspectors review of the licensees operability decision. This consultation may be informal (phone, email, etc.) or may be formalized using the NRCs Task Interface Agreement (TIA) process (COM-106 Control of Task Interface Agreements). If the consultation results in a disagreement between the NRR and the Region regarding the operability of an SSC, then the deciding authority as to the appropriate next steps with regard to the NRCs assessment of the licensees operability decision is the appropriate Regional Administrator, or their delegate.

Regarding the deciding authority, inspectors may utilize Management Directive (MD) 9.29, Organization and Functions, Regional Office and MD 9.27, Organization and Functions, Office of Nuclear Reactor Regulation.

If the inspector believes the issue may be generic, then the inspector should contact the appropriate NRR technical staff through their DORL plant Project Manager for evaluation as to the generic applicability of the issue. If the Region and/or NRR determines the issue is generic, then NRR will take the lead in developing a plan for addressing the issue through NRRs generic issue process. NRR may implement the LIC-504 process which provides a risk-informed method for evaluating the safety significance of the issue options and for deciding on the path forward for resolution. As NRR proceeds through developing and implementing a plan for resolution, they should keep the regions informed of the issue status and progress through regular communication paths.

The NRCs MD 10.160, Open Door Policy, MD 10.158 Non-Concurrence Process, and MD 10.159 Differing Professional Views Process are all options for any staff member who believes that they are not aligned with the NRCs chosen path forward for addressing the issue in question.

Issue Date: DRAFT 10 0326

0326-07 SURVEILLANCES 07.01 Operability during Technical Specification Surveillances Some TS surveillances require the SSC to be rendered incapable of performing their specified safety function in order to perform the surveillance. In this case, the SSCs are to be declared inoperable and the LCO must immediately be declared not met. Upon completion of the surveillance, the licensee should verify restoration to operable status of at least the parts of the SSCs or system features that were altered to accomplish the surveillance.

TS permits use of action statements to perform surveillance testing for several reasons. One reason is that the time needed to perform most surveillance tests is usually only a small fraction of the completion time for the required action. Another reason is that the safety benefits (increased level of assurance of reliability and verification of operability) of meeting surveillance requirements more than compensates for the safety risk for operating the facility when a TS LCO is not met.

07.02 System Configuration during Surveillance and Operability Testing It is preferable that TS surveillances be performed in the same configuration and conditions representative of those the system must be in to perform its specified safety function.

However, testing in other configurations or conditions may be required if testing in the specified safety function configuration would result in unjustifiable safety concerns or transients. In this case, the surveillance requirement acceptance criteria in the TS for the test condition should be based on an extrapolation from the test condition to the condition in which the specified safety function is performed. Operability is based on meeting the acceptance criteria specified in the TS. The system configuration for TS surveillance requirements is usually prescribed, and the acceptance criteria are based on the prescribed configuration.

Test failures should be examined to determine the cause and correct the problem before resumption of testing. Repetitive testing to achieve acceptable test results without identifying the root cause or correction of a problem in a previous test is not acceptable as a means to establish or verify operability and may constitute preconditioning.

07.03 Missed Technical Specification Surveillance When a TS surveillance is missed, the TS for a missed surveillance should be followed. For most plants STS SR 3.0.3 or the equivalent applies.

TSTF-529, Revision 4, Clarify Use and Application Rules, revised SR 3.0.3 to permit this allowance to be used in certain circumstances when an SR has never been performed. For those licensees who have not adopted TSTF-529, SR 3.0.3 may not be applied when it is discovered that a TS surveillance has never been performed. In cases where a specified safety function or a necessary and related support function required for operability has never been demonstrated, then a reasonable expectation of operability does not exist. However, SR 3.0.3 would still apply should the licensee determine that a TS surveillance had been demonstrated outside of routine surveillances, e.g., for post-maintenance testing, or for testing or operation during normal or off-normal plant operations.

Issue Date: DRAFT 11 0326

0326-08 SPECIFIC OPERABILITY ISSUES 08.01 Relationship between the General Design Criteria (GDC) and the Technical Specifications The GDC, or a plant-specific equivalent as incorporated into the CLB, have an important relationship to the operability requirements of the TS. For example, plants with construction permits issued prior to May 21, 1971, may have been approved for construction based on the proposed General Design Criteria published by the Atomic Energy Commission (AEC) in the Federal Register (32 FR 10213) on July 11, 1967, sometimes referred to as the AEC Draft GDC. Comprehending this relationship is critical to understanding how licensees should address nonconformance with CLB design requirements. Some facilities were licensed before the GDC were codified in 10 CFR. As a result, the applicability of the GDC varies among facilities. In all cases, the plant-specific CLB governs.

The GDC and the TS differ from each other in that the GDC specify requirements for the design of nuclear power reactors, whereas the TS specifies requirements for the operation of nuclear power reactors. As such, the GDC cover a broad category of SSCs that are important to safety, including those SSCs that are covered by TS. Failure to meet GDC, as described in the licensing basis (e.g., nonconformance with the CLB for protection against flooding, seismic events, tornadoes) should be treated as a condition and evaluated to determine if the condition calls into question the ability of SSCs to perform their specified safety function(s) or necessary and related support function(s) and perform an OD if necessary. If the licensee determination concludes that the TS SSC is operable or the necessary and related support function is capable of providing the required support to the SSCs ability to perform the specified safety function , it would be appropriate to address the condition through the licensees corrective action program.

However, if the licensees evaluation concludes that the TS SSC is inoperable, then the licensee must enter its TS and follow the applicable required actions.

The GDC Correspond Both Directly and Indirectly to TS Operational Requirements Design requirements, such as GDC or similar requirements, are typically included in the licensing basis for every nuclear power plant. The GDC, according to Appendix A to 10 CFR Part 50, establish the necessary design, fabrication, construction, testing, and performance requirements for structures, systems, and components important to safety. As such, the GDC cover a broad category of SSCs that are important to safety, including those SSCs that are covered by TS. The safety analysis report describes the design capability of the facility to meet the GDC (or a plant-specific equivalent). The staff safety evaluation report documents the acceptability of safety analysis report analyses. The analyses and evaluation included in the safety analysis serve as the basis for TS issued with the operating license.

The TS limiting conditions for operation, according to 10 CFR 50.36(c)(2)(i), are the lowest functional capability or performance levels of equipment required for safe operation of the facility. Section 182 of the Atomic Energy Act of 1954, as amended and as implemented by 10 CFR 50.36, requires that those design features of the facility that, if altered or modified, would have a significant effect on safety, be included in the TS. Thus, TS are intended to ensure that the most safety significant design features of a plant, as determined by the safety analysis, maintain their capability to perform their safety functions, i.e., that SSCs are capable of performing their specified safety functions or necessary and related support functions.

Issue Date: DRAFT 12 0326

Required actions and completion times of the TS illustrate the relationship between the GDC and the TS. For example, the GDC may require redundancy of function for safety systems.

This is normally accomplished by incorporating at least two redundant trains into the design of the safety systems. The TS typically allows a facility to continue to operate for a specified time with only one train of a two-train safety system operable. In that case, the GDC are met because the system design provides the necessary redundancy. The TS permit the operation of the system with only a single train based on an evaluation of the protection provided by the unique system lineup for the specified period. Not all GDC that are included in the CLB are explicitly identified in TS. However, those that are not explicitly identified may still need to be considered when either determining or establishing the basis for operability of TS SSCs.

08.02 Single Failures A single failure is defined as follows in 10 CFR Part 50, Appendix A, General Design Criteria for Nuclear Power Plants.

A single failure means an occurrence which results in the loss of capability of a component to perform its intended safety functions. Multiple failures resulting from a single occurrence are considered to be a single failure.

Appendix A contains GDC for SSCs that perform major safety functions. Many of the GDC, for example GDC 17, 21, 34, 35, 38, 41, and 44, contain a statement similar to the following:

Suitable redundancy in components and features and suitable interconnections, leak detection, isolation and containment capabilities shall be provided to assure that for onsite electrical power system operation (assuming offsite power is not available) and for offsite electrical power system operation (assuming onsite power is not available) the system safety function can be accomplished assuming a single failure.

Therefore, if these provisions are incorporated into the licensing basis the capability to withstand a single failure in fluid or electrical systems becomes a plant-specific design requirement ensuring that a single failure does not result in a loss of the capability of the system to perform its specified safety function or necessary and related functions. Where the licensing basis does not require redundancy, the single failure guidance herein does not apply. A single SSC cannot deliver redundant functions.

Any nonconformance with a GDC incorporated in the licensing basis by which the capability of an SSC to withstand a single failure is compromised should be treated as a condition and evaluated to determine if an OD is warranted.

08.03 Treatment of Consequential Failures in Operability Determinations A consequential failure is a failure of an SSC caused by a postulated accident within the design basis. For example, if during a loss-of-coolant accident (a design basis event) a broken pipe whips and incapacitates a pump such that it cannot function; such a pump failure is called a consequential failure because the pump fails as a result of the design basis event itself. In general, facility design takes into consideration any consequential failures that are deemed credible. In this case, the broken pump cannot be credited in the safety analysis for loss of coolant accident mitigation.

Issue Date: DRAFT 13 0326

When a condition is identified with an SSC and this condition requires an OD, the OD should assess credible consequential failures previously considered in the design (i.e., the SSC failures that are the direct consequence of a design basis event for which the SSC needs to function).

Where a consequential failure (i.e., considering the degraded or nonconforming condition) would cause the loss of a specified safety function, the affected SSC is inoperable. Such situations are most likely discovered during design basis reconstitution studies, or when new credible failure modes are identified.

08.04 Use of Alternative Analytical Methods in Operability Determinations 10 CFR 50.59 requires that if a licensee makes a change that results in a departure from a method of evaluation described in the UFSAR then prior NRC approval is required. When performing ODs, licensees sometimes use analytical methods or computer codes different from those originally used in the calculations supporting the plant design. This practice involves applying engineering judgment to determine if an SSC remains capable of performing its specified safety function during the corrective action period. The use of alternative methods for the purpose of evaluating operability is not subject to 10 CFR 50.59 unless the methods are used in the final corrective action. Section 50.59 is applicable upon implementation of the corrective action.

Although the use of alternative and normally more recent methods or computer codes may raise complex plant-specific issues, their use may be useful and acceptable in ODs. Therefore, the inspector should consult with the region and NRR when reviewing such determinations. The use of alternative methods should generally be handled as follows:

a. Occasionally, a regulation or license condition may specify the name of the analytic method for a particular application. In such instances, the application of the alternative analysis must be consistent with the TS, license condition, or regulation.

For example, the methods used to determine limits placed in the core operating limits report (COLR) may be specified in TS. An evaluation of an SSC performance capability may be determined with a non-COLR method, but the limits in the COLR must continue to comply with the technical specification.

b. The use of any analytical method must be technically appropriate to characterize the SSCs involved, the nature of the condition, and specific facility design. General considerations for establishing this adequacy include:

(1) If the analytic method in question is described in the CLB, the licensee should evaluate the situation-specific application of this method, including the differences between the CLB-described analyses and the proposed application in support of the OD process, (2) Utilizing a new method because it has been approved for use at a similar facility does not alone constitute adequate justification, (3) The method should produce results consistent with the applicable acceptance criteria in the CLB. For example, if the current performance levels are expressed in terms of Rem, the method cannot generate results expressed in TEDE, (4) If the analytic method is not currently described in the CLB, the models employed Issue Date: DRAFT 14 0326

must be capable of properly characterizing the SSCs performance. This includes modeling of the effect of the condition, (5) Acceptable alternative methods such as the use of best estimate codes, methods, and techniques. In these cases, the evaluation should ensure that the SSCs performance is not over-predicted by performing a benchmark comparison of the non-CLB analysis methods to the applicable CLB analysis methods, and (6) The use of the software should be controlled in accordance with the licensees quality assurance program, as applicable. This includes the availability of reviewers qualified to verify results.

08.05 Use of Temporary Manual Action in Place of Automatic Action in Support of Operability Automatic action is frequently provided as a design feature specific to each SSC to ensure that specified safety functions will be accomplished. Limiting safety system settings for nuclear reactors are defined in 10 CFR Part 50.36, Technical Specifications, as settings for automatic protective devices related to those variables having significant safety functions. Where a limiting safety system setting is specified for a variable on which a safety limit has been placed, the setting must be so chosen that automatic protective action will correct the abnormal situation before a safety limit is exceeded. Accordingly, it is not appropriate to consider SSCs operable by taking credit for manual action in place of automatic action for protection of safety limits.

This does not forbid operator action to put the plant in a safe condition, but operator action cannot be a substitute for automatic safety limit protection. Refer to compensatory measures discussion in Section 06.08 of this IMC.

Credit for manual initiation of a specified safety function should be established as part of the licensing review of a facility. Although the licensing of specific facility designs includes consideration of automatic and manual action in the performance of specified safety functions, not all combinations of circumstances have been reviewed from an operability standpoint.

For situations where substitution of manual action for automatic action is proposed for an OD, the evaluation of manual action must focus on the physical differences between automatic and manual action and the ability of the manual action to accomplish the specified safety function or functions. The physical differences to be considered include the ability to recognize input signals for action, ready access to or recognition of setpoints, design nuances that may complicate subsequent manual operation (such as auto-reset, repositioning on temperature or pressure), timing required for automatic action, minimum staffing requirements, and emergency operating procedures written for the automatic mode of operation. The licensee should have written procedures in place and personnel should be trained on the procedures before any manual action is substituted for the loss of an automatic action.

The assignment of a designated operator for a manual action requires written procedures and full consideration of all pertinent differences. The consideration of a manual action in remote areas must include the abilities of the assigned personnel and how much time is needed to reach the area, training of personnel to accomplish the task, and occupational hazards such as radiation, temperature, chemical, sound, or visibility hazards. One reasonable test of the reliability and effectiveness of a manual action may be the approval of the manual action for the same function at a similar facility. Nevertheless, a manual action is expected to be a temporary measure and to promptly end when the automatic action is corrected in accordance with 10 CFR Part 50, Appendix B, and the licensees corrective action program.

Issue Date: DRAFT 15 0326

08.06 Use of Probabilistic Risk Assessment in Operability Decisions Probabilistic risk assessment is a valuable tool for evaluating accident scenarios because it can consider the probabilities of occurrence of accidents or external events. Nevertheless, the definition of operability is that the SSC must be capable of performing its specified safety function or functions, which inherently assumes that the event occurs and that the safety function or functions can be performed. Therefore, the use of PRA or probabilities of occurrence of accidents or external events is not consistent with the assumption that the event occurs and is not acceptable for making operability decisions.

However, PRA may provide valid and useful supporting information on the timeliness of a operability decision and a corrective action. PRA is also useful for determining the safety significance of SSCs. The safety significance, whether determined by PRA or other analyses, is a factor in making decisions about the timeliness of ODs. Inspectors can reference TSTF 505, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b when evaluating risk-informed completion times.

08.07 Use of Seismic Margin Assessment in Operability Decisions Seismic Margin Assessment (SMA) methodologies have been used to demonstrate that seismic margin exists for ground motion levels above the safe shutdown earthquake (SSE). These analyses have been used for beyond design basis calculations; however, the SMA approach may be appropriate for demonstrating operability on a temporary basis until compliance with the licensing basis is achieved. If an SMA is used, the seismic demand shall be the recently developed Ground Motion Response Spectra (GMRS) for the Fukushima 2.1 seismic evaluation, and its application shall be consistent with EPRI NP-6041-SL.

08.08 Environmental Qualification When a licensee identifies a condition that affects compliance with 10 CFR 50.49, (i.e., a licensee does not have an adequate basis to establish qualification), the licensee should determine if this condition results in the loss of the presumption of operability and if so enter the OD process. apply the guidance of this manual chapter. The licensee may use the criteria of Section 06.04 to establish reasonable assurance that SSCs will perform their specified safety functions. In this connection, it must also be shown that a subsequent failure of the equipment, if likely under accident conditions, will not result in a consequential failure as discussed in Section 08.03.

08.09 Technical Specification Operability vs. ASME OM Code Criteria The TS normally applies to the overall performance of plant systems, but sometimes contains limiting values for the performance of certain components. The limiting values are specified to ensure that the design basis and safety analysis are satisfied. The values (e.g., pump flow rate, valve closure time, valve leakage rate, safety/relief valve set point pressure) are criteria that can be used to verify operability. If the values are not met at any time, the system must be declared inoperable, the LCO must be declared not met, and the applicable conditions must be entered.

Issue Date: DRAFT 16 0326

The ASME Operation and Maintenance of Nuclear Power Plants (OM) Code establishes the requirements for preservice and inservice testing and the examination of certain components to assess their operational readiness. ASME OM Code acceptance criteria for inservice testing (IST) include required action ranges or limiting values for certain component performance parameters. These required action ranges or limiting values, defined by the ASME OM Code as component performance parameters, may be more limiting than the TS values (which are accident analysis limits). Position 8 in Attachment 1 to Generic Letter 89-04, Guidance on Developing Acceptable Inservice Testing Programs, defines the starting point for the completion time in TS actions for ASME pump and valve testing. When performance data fall outside the required action range, regardless of whether the limit is equal to the TS limit or more restrictive, the pump or valve must be declared inoperable immediately (the word inoperative is used in the text of the ASME Code, i.e., the pump or valve is both inoperative and inoperable) and the LCO must be declared not met and the applicable conditions must be entered.

When the required action range is more limiting than its corresponding TS, the corrective action need not be limited to replacement or repair; it could be an analysis to demonstrate that the specific performance degradation does not impair operability and that the pump or valve will still fulfill its specified safety function(s), such as delivering the required flow. A new required action range may be established after such analysis, allowing a new OD.

The NRC does not accept durations specified by the ASME OM Code for analyzing test results as a reason for postponing entry into a TS action statement. As soon as data are recognized as being within the required action range for pumps or as exceeding the limiting-value full-stroke time for valves, the associated component must be declared inoperable, and if subject to the TS, the completion time specified in the action statement must be started at the time the component was declared inoperable. For inoperable pumps and valves that are part of an ASME IST program but not subject to TS, the actions required by the applicable sections of the ASME code are applicable.

Recalibrating test instruments and then repeating pump or valve tests are acceptable as an alternative to repair or replacement but cannot be done before declaring the pump or valve inoperable. However, if during a test it is obvious that a test instrument is malfunctioning, the test may be halted and the instruments promptly recalibrated or replaced. During a test, anomalous data with no clear indication of the cause must be attributed to the pump or valve under test. In that case, the licensee should evaluate to determine if this condition results in the loss of the presumption of operability and if so enter the OD process.

08.10 Support System Operability The definition of operability assumes that an SSC described in TS can perform its specified safety function when all necessary support systems are capable of performing their related support functions. Each licensee must understand which support systems are necessary to ensure operability of supported TS systems. In some cases, the licensee could use engineering judgment in determining whether a support system that is not described in TS is necessary and is, therefore, required to be capable of performing its related support function.

The licensee may need to apply engineering principles in the final analysis of the basis for the decision. For example, a ventilation system may be required in the summer to ensure that SSCs can perform their specified safety functions but may not be required in the winter.

Similarly, the electrical power supply for heat tracing may be required in the winter to ensure Issue Date: DRAFT 17 0326

that SSCs can perform their specified safety functions but may not be required in the summer.

In all such cases, the licensee should periodically review the basis for determining that a support system is not required to ensure (a) that the conclusion remains valid, and (b) that there is timely restoration of the support system (the review may be done as part of the corrective action program). As an alternative to restoration, the licensee may modify the support function (as it would make any other change to the facility) by following the 10 CFR 50.59 change process and updating the UFSAR.

Upon discovery of a support system that is not capable of performing its related support function(s), the most important consideration is the possibility of having lost all capability to perform a specified safety function. Upon declaring a support or supported system inoperable in one train, the required actions in the TS should be implemented. The licensee must verify that the facility has not lost the complete capability to perform the specified safety function.

The word "verify" as used here, covers examining logs or other information to determine if required features are out of service for maintenance or other reasons. The TS may contain specific requirements or allowances regarding support systems. In all cases, a licensees plant-specific TS is governing.

08.11 Piping and Pipe Support Requirements Piping and pipe supports found to be degraded or not conforming, as defined by the ASME Code, and that support SSCs described in TS should be subject to an OD evaluation to determine if this condition results in the loss of the presumption of operability and if so enter the OD process. The following criteria are provided to address various components, including piping, supports, support plates, and anchor bolts. Inspection and Enforcement (IE)

Bulletin 79-14, Seismic Analyses for As-Built Safety-Related Piping Systems, including Supplements 1 and 2, provides additional guidance. SQUG GIP-2 also provides acceptable criteria that can be used to confirm operability of mechanical component anchorages consistent with design basis loadings. RG 1.199, Anchoring Components and Structural Supports in Concrete, November 2003 which endorses American Concrete Institute (ACI) 349, Code Requirements for Nuclear Safety Related Concrete Structures, 2001 provides acceptance criteria for evaluation of nonconforming or degraded anchors (steel embedments).

Specific operability criteria for concrete anchor bolts and pipe supports are given in IE Bulletin 79-02, Pipe Support Base Plate Designs Using Concrete Expansion Anchor Bolts (see Revision 1, Supplement 1, and Revision 2). The criteria for evaluating the operability of seismic design piping supports and anchor bolts relating to Bulletins 79-02 and 79-14 are described in NRC memo dated July 16, 1979 (ADAMS Accession No. ML993430206). When a degradation or nonconformance associated with piping or pipe supports is discovered, the licensee may use the criteria in Appendix XXVII of Section III of the ASME Boiler and Pressure Vessel Code for ODs. Additionally, licensees may choose to perform inelastic analysis of an affected piping system using strain limits to demonstrate structural integrity. The licensee may use these criteria until compliance with CLB criteria can be satisfied. Where a piping support is determined to be inoperable, the licensee should determine the operability of the associated piping system.

08.12 Flaw Evaluation In accordance with Title 10 of the Code of Federal Regulations (10 CFR) 50.55a(g), structural integrity must be maintained in conformance with ASME Code Section XI for those parts of a system that are subject to ASME Code requirements. 10 CFR 50.55a(g)(4) further requires, Issue Date: DRAFT 18 0326

Throughout the service life of a boiling or pressurized water-cooled nuclear power facility, components (including supports) which are classified as ASME Code Class 1, Class 2, and Class 3 must meet the requirements, except design and access provisions and pre-service examination requirements, set forth in Section XI ASME Section XI is generally written for pre-service and in-service examinations and any identified flaw. ASME Section XI, Article IWA 3000 contains material and weld examination flaw acceptance standards. If flaws are found in components for which ASME Section XI has no acceptance standards, then the construction code is to be used to establish the acceptance standards. This is supported by Sub-article IWA-3100(b) which states if acceptance standards for a particular component, Examination Category, or examination method are not specified in this Division [Division 1] then flaws that exceed the acceptance standards for materials and welds specified in the Section III Edition applicable to the construction of the component shall be evaluated to determine disposition. The ASME Code contains requirements describing acceptable means of performing pre-service and in-service inspection of welds and certain other locations in piping, vessels, and other pressure boundary components. For pre-service and in-service inspections, the ASME Code also specifies acceptable flaw sizes based on the material type, location, and service of the system within which the flaw is discovered. If the flaw exceeds these specified acceptable flaw sizes, the ASME Code describes an alternate method by which a calculation may be performed to evaluate the acceptability of the flaw. Several Nonmandatory Appendices in Section XI provide evaluation methodology for flaws in ASME Code components. While ASME Section XI does not specifically provide flaw acceptance standards for components other than those specified in Table IWB-2500-1, Table IWC-2500-1 and Table IWD-2500-1, its methods and standards may be applied to other components when appropriate as determined by the licensee.

The NRC is aware that the ASME Section XI Executive Committee stated through Code Interpretations (XI-1-92-03 and XI-1-92-19 [Question 2]) that the corrective action requirements of the ASME Code Section XI IWA-5250 are not required to be implemented when leakage is found outside of the performance of an ASME Code required pressure test and VT-2 examination. However, it is the NRCs position that the provisions of the ASME BPV Code Section XI are incorporated by reference in 10 CFR 50.55a and are applicable at all times because they do not, by their own terms, limit application to ASME Code examinations. For potentially degraded components discovered between in-service inspections, licensees may use reasonable engineering judgment to determine whether the component is degraded but operable unless the ASME Code explicitly states otherwise. For Class 1, 2, and 3 components, ASME BPV Section XI provides specific criteria for determining whether a component is acceptable for service, and there are no provisions for temporary acceptance of flaws.

However, Nonmandatory Appendix U to Chapter XI provides criteria for temporary acceptance of flaws or degradation in some Class 2 and 3 moderate energy components (i.e., all piping, vessels, and tanks that are below a certain temperature and pressure threshold). Licensees may use Nonmandatory Appendix U to determine that a flawed component is temporarily acceptable for service under the ASME Code. However, the Nonmandatory Appendix U provides criteria only for the integrity of the degraded component. Nonmandatory Appendix U specifically makes the Owner (i.e., licensee) responsible for demonstrating operability in light of the flaw. To determine that Class 2 or 3 piping is degraded but operable, licensees must evaluate the integrity of the component according to Nonmandatory Appendix U, but may use reasonable engineering judgment to select methods for other operability considerations.

ASME Class 1 Components Issue Date: DRAFT 19 0326

When flaws in ASME Class 1 components do not meet ASME Code or construction code acceptance standards, the requirements of an NRC accepted ASME code case as listed in Section C.1 and C.2 of Regulatory Guide (RG) 1.147, Inservice Inspection Code Case Acceptability, ASME Section XI, Division (herein RG 1.147), the component should be declared inoperable because this is indicative of unacceptable material degradation which could cause further deterioration if left in service. The NRC position is that satisfaction of ASME Code acceptance standards is the minimum necessary for operability of Class 1 pressure boundary components because of the importance of the safety function being performed.

ASME Class 2 and 3 Components When a flaw is identified in ASME Class 2 or Class 3 components, the licensee should evaluate and determine if the flaw meets ASME Code, construction code acceptance standards, or the requirements of an NRC-accepted ASME code case as listed in RG 1.147. NRC issued Generic Letter (GL) 90-05, Guidance for Performing Temporary Non-Code Repair of ASME Code Class 1, 2, and 3 Piping, to provide analysis tools, acceptance standards and allow non-code repairs of code Class 3 piping when a code repair was determined to be impractical. The scope of GL 90-05 is limited to Class 3 systems, but it does address moderate and high-energy systems. GL 90-05 preceded the ASME Code cases, which address the structural integrity of components containing flaws. However, the definition of moderate energy systems is consistent with these code cases, which came later. GL 90-05 permits licensees to consider either the through-wall flaw or the wall thinning flaw evaluation approach when assessing the structural integrity of Class 3 piping with identified flaws where no leakage is present. If the flaw is found acceptable by the wall thinning approach, or by the through-wall flaw approach, and no leakage is present, immediate repair of the flaw is not required and the component can be declared operable. However, the licensee should promptly submit a relief request and comply with the guidelines provided for flaw repair and monitoring. The relief request is to justify the impracticality of performing the required code repair at the time. Compensatory actions may be implemented by the licensee without NRC staff review and approval, provided the compensatory action does not involve a non-code repair to the piping system or supports and the compensatory action can be implemented in accordance with 10 CFR 50.59.

If it is identified that a flaw does not meet the criteria in ASME Code, construction code acceptance standards, or an NRC-accepted ASME code case as listed in RG 1.147, the component should be declared inoperable and the applicable TS action statement is to be addressed at that time. Alternatively, a relief request/alternative can be submitted and at a minimum, verbally approved by the NRC before the completion time expires.

The table below summarizes methods for evaluating structural integrity of defects found in boiling or pressurized water-cooled nuclear power facilities on components (including supports) classified as ASME Code Class 1, Class 2, and Class 3 components.

Methods Acceptable to Evaluate Structural Integrity Issue Date: DRAFT 20 0326

Pipe ASME Code Section NRC Approved code case Class/Energy XI/ Construction Alternative e.g. RG GL 90-05 approved code case N-5131 Code Class 1/HE X X Class 2/HE X X Class 2/ME X X X Class 3/HE X X X Class 3/ME X X X X When a defect is identified, the component must be restored to meet ASME Code, construction code requirements or an NRC-accepted ASME code case as listed in RG 1.147., or an NRC approved alternative. If this involves physical changes to the components, these changes must be completed in accordance with ASME Section XI, IWA-4000.

08.13 Operational Leakage from ASME Code Class 1, 2, and 3 Components The NRC staff does not consider through-wall conditions in components to be in accordance with the intent of the ASME Code or construction code, unless intentionally designed to be there such as sparger flow holes. Therefore, components with through-wall conditions would not meet ASME Section XI or construction code requirements. Thus, unless a through-wall flaw is evaluated and found acceptable using an applicable methodology as described in the table above and in which all provisions are met including any additional requirements or limitations imposed (e.g. by the RG endorsing the code case), the system or component does not demonstrate structural integrity.

10 CFR 50.55a requires that the structural integrity of ASME Code Class 1, 2, and 3 components be maintained in accordance with the ASME Code or construction code acceptance standards. If a leak is discovered in a Class 1, 2, or 3 component while conducting an inservice inspection, maintenance activity, or during facility operation, any corrective measures to repair or replace the leaking component must be performed in accordance with IWA-4000 of Section XI.

ASME Class 1 Components Leakage from the reactor coolant system is limited to specified values in the TS depending on whether the leakage is from identified, unidentified, or specified sources such as the steam generator tubes or reactor coolant system pressure isolation valves. If the leakage exceeds TS limits, the limiting condition for operation (LCO) must be declared not met and the applicable TS conditions must be entered. For identified reactor coolant system leakage within the TS limits, the licensee should evaluate the condition (i.e., the leaking component) to determine if an OD is required. The licensee should also evaluate any impact the leakage has (if any) on nearby components and their ability to perform their specified safety function(s).

The operational leakage TS LCO does not permit any reactor coolant pressure boundary leakage. Upon discovery of leakage from a Class 1 pressure boundary component (pipe wall, valve body, pump casing, etc.), the licensee must isolate the component or take actions in accordance with TS. If the leak cannot be isolated, the leaking component should be declared inoperable.

Issue Date: DRAFT 21 0326

ASME Class 2 and 3 Components Upon discovery of leakage from a TS-required Class 2 or Class 3 component (Time of Discovery for Performance Indicator and risk/PRA evaluations), the component should be evaluated to determine if the flaw is acceptable and demonstrate structural integrity.

The licensee must also assess the impact of the leak on the SSCs ability to provide sufficient flow for the associated mission time and any impact the leakage has (if any) on nearby components and their ability to perform their specified safety function(s).

To evaluate the structural integrity of the leaking component, the licensee may use the criteria in the ASME Code, the construction code, or an applicable NRC-accepted ASME code cases as listed in RG 1.147. In addition, the licensee may evaluate the structural integrity of Class 3 piping by evaluating the flaw using the criteria of paragraph C.3.a of Enclosure 1 to GL 90-05.

If the flaw meets the GL 90-05 through-wall flaw criteria, the piping is operable. If the flaw is found acceptable by the through-wall flaw approach, a non-code repair may be proposed and made following NRC staff review and approval. A non-code repair is a repair not in compliance with the construction code or ASME Section XI. GL 90-05 requires non-code repairs of Class 3 high-energy systems to have load-bearing capability similar to that provided by engineered weld overlays or engineered mechanical clamps. Whenever a through-wall flaw in an ASME Code component is evaluated and accepted using GL 90-05, a relief request from ASME Code requirements needs to be submitted in a timely manner after completing the OD process documentation and prior to implementing a non-code repair/replacement activity to the SSC.

The relief request is to justify the impracticality of performing the required code repair, the acceptability of the non-code repair and the flaw monitoring. Compensatory actions may be implemented by the licensee without NRC staff review and approval, provided the compensatory action does not involve a non-code repair to the piping system or supports and the compensatory action can be implemented in accordance with 10 CFR 50.59.

Alternatively, the licensee may evaluate the structural integrity of leaking Class 2 or Class 3 moderate-energy components using the criteria of ASME code case N-513, N-705 or any other applicable NRC approved methodology as indicated in the table in Section 08.12, Flaw Evaluation. If the flaw in the leaking component has adequate structural integrity in accordance with the mentioned criteria, the component can be deemed operable. A relief request/alternative is not necessary when an evaluation in accordance with the table in Appendix C.12, demonstrates adequate structural integrity (except as required by GL 90-05).

Other compensatory actions may be taken by the licensee, provided these compensatory actions are within the limitations of 10 CFR 50.59.

If the licensee decides to maintain structural integrity by mechanical clamping means, the requirements of ASME Section XI, appendix titled Mechanical Clamping Devices for Class 2 and 3 Piping Pressure Boundary subject to any conditions imposed by 10 CFR 50.55a(b)(2) must be used (in the 1995 Edition w/1997 Addenda through the 2011 Addenda this was Mandatory Appendix IX and in the 2013 Edition it is NonMandatory Appendix W) . This Appendix permits the use of mechanical clamping devices on a temporary basis to maintain piping pressure boundary of Class 2 and 3 piping which is 6 inches (nominal pipe size) and smaller and should not be used on piping larger than 2 inches (nominal pipe size) when the nominal operating temperature or pressure exceeds 200°F or 275 psig. In addition, this Appendix cannot be applied to Class 1 piping or portions of a piping system that forms the containment boundary.

Issue Date: DRAFT 22 0326

The NRC has no specific guidance or generically approved alternatives for temporary repair of defects (through-wall or non-through-wall) in system pressure boundary components other than piping in Class 1, 2, or 3 high-energy system components, or for Class 2 or 3 moderate-energy system components. Therefore, all such defects in these components must be repaired in accordance with ASME Code requirements, or relief/alternative from ASME Code requirements should be requested of and approval obtained from the NRC.

Class 2 and 3 Heat Exchanger Tube Leakage Note - This guidance is applicable to a through-wall defect in an internal heat exchanger tube causing leakage/loss of inventory in an ASME Section XI Code Class 2 or 3 system (e.g. not Class 1 systems). If a portion of a HX internal tube develops a through-wall defect, a nonconformance with the design tube wall thickness and/or the tube material product specifications may exist. Specifically, a safety-related HX is procured to meet a Construction Code/Standard and a HX Design Specification/Drawing which typically includes details such as the number of internal tubes, tube wall thickness, tube diameter and tube material - product specification (e.g. 1800 tubes, 1 diameter, and 0.1 minimum wall thickness, stainless steel type 304; SA-213/SA-213M).

The ASME Code Section XI does not provide for inservice examination or acceptance criteria for Class 2 or 3 heat exchanger (HX) internal tubing and a minor tube leak would not normally preclude the HX from supporting system safety functions. Therefore, if immediate repairs to correct the leaking HX tube are not practical, continued service can be justified by establishing an adequate technical basis. For example, HX operability could be demonstrated with an analysis that confirms failure of a single, or additional tubes (if multiple tubes failures are possible) will not preclude the HX from performing its safety function(s), impact other system safety functions, or exceed NRC regulatory limits for licensed material.

Alternatively, continued HX operability could be confirmed based on an analysis that adequately addresses each of the following elements:

• Tube Structural Integrity - An evaluation of the structural integrity of the degraded HX tube(s) is established that considers the cause of the degradation, possible failure mode(s), prediction of degradation growth, stability of flaw(s) under the applicable applied load combinations. For example, the ASME Code Case N-705 Evaluation Criteria for Temporary Acceptance of Degradation in Moderate Energy Class 2 or 3 Vessels and Tanks, provides a methodology for evaluation and acceptance of through wall flaws in Class 2 and 3 components which is acceptable to the NRC.

• Tube Leakage Limiting Condition - An assessment of the HX tube degradation progression/growth is performed which enables the establishment of the maximum time available before reaching a limiting condition as described below:

o Time to reach the maximum structurally allowable size in accordance with the tube structural integrity acceptance criteria established above, o Time to reach a leakage condition that causes unacceptable HX thermal performance or challenges other components within the system that impact system safety functions (e.g. inventory loss from tube leakage results in inadequate net positive suction head for system pumps),

Issue Date: DRAFT 23 0326

o Time to reach a leakage condition which would result in exceeding NRC regulatory limits for licensed materials (e.g. 10 CFR Part 20 discharge limits for radioactive material), and o Time to reach a leakage condition with an unacceptable impact to other systems structures or components (e.g. over-pressurization of systems with lower design pressures).

• Frequent monitoring is established to estimate and track increases in the tube leakage for the affected HX. This surveillance frequency is adequate to ensure the HX is removed from service prior to reaching a limiting leakage condition and should be at least daily until the tube leakage impacts have been fully evaluated and a less frequent monitoring schedule is justified.

08.14 Structural Requirements Structures may be required to be operable by the TS, or they may be providing related support functions for SSCs in the TS. Examples of structural degradation are concrete cracking and spalling, excessive deflection or deformation, water leakage, rebar corrosion, cracked welds, missing or bent anchor bolts or structural bolting, and degradation of door and penetration sealing. If a structure is degraded, the licensee should assess the capability of the structure to perform its safety function. For structures and related support functions, OD evaluations need to include applicable design and licensing basis loads and load combinations. When a degradation or nonconformance associated with a structure is discovered, an OD evaluation should ensure that a presumption of operability remains for meeting acceptance limits for expected load combinations. Unless adequately justified in the operability evaluation, design basis load factors should be used for all applicable load combinations.

Physical degradation such as concrete cracking and spalling, excessive deflection or deformation of structures, water leakage, corrosion of rebar, cracked welds, corrosion of steel members, corrosion of anchor bolts, bent anchor bolt(s) or structural bolting of a structure or component may be evaluated in accordance with generally accepted industry standards and guidance documents. Where consensus standards or guidance documents are not consistent with the physical degradation (e.g., alkali-silica reaction (ASR)) the NRC inspector should consult with NRR staff.

Later versions of ACI-318, ACI-349, ACI-359, ASME Section III, Division 1 and Division 2, American National Standards Institute (ANSI) N-690, American Society of Civil Engineers (ASCE) /SEI 43-05, ASCE 4, or American Institute of Steel Construction (AISC) codes/standards may be used for operability/functionality evaluations, in lieu of the versions specified in the design basis documents, provided all additional requirements are met, as applicable. Additional codes/standards, recognized technical reports, or regulatory guidance may be used; however, the licensee must justify the use of additional codes/standards or guidance for the specific application.

ODs may rely on as-built material properties when the properties of the materials are established based on test data and a sound statistical basis, for example:

a. Structural steel yield and tensile strength from Certified Material Test Reports may be used in lieu of the specified minimum yield and tensile strength.

Issue Date: DRAFT 24 0326

b. Concrete compressive strength from cylinder tests may be used in lieu of the specified minimum design strength.

ODs may apply current regulatory guidance to reduce design basis conservatism, if applicable.

For example:

• Damping values from Regulatory Guide 1.61, Damping Values for Seismic Design of Nuclear Power Plants and

• Tornado and tornado missile characteristics from Regulatory Guide 1.76, Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants.

The NRR staff is available to support NRC inspector reviews of ODs and plant licensing bases as necessary.

An operability evaluation that relies on methodology, modeling, or assumptions that are outside the licensing basis, implies a condition that should be addressed in a reasonably timely manner consistent with requirements in 10 CFR 50, Appendix B, Criterion XVI.

0326-09 REFERENCES

• 10 CFR 2, Agency Rules of Practice and Procedure

• 10 CFR 19, Notices, instructions and reports to workers: inspection and investigations

• 10 CFR 20, Standards for protection against radiation

• 10 CFR 21, Reporting of defects and noncompliance

• 10 CFR 26, Fitness for duty programs

• 10 CFR 30, Rules of general applicability to domestic licensing of byproduct material

• 10 CFR 40, Domestic licensing of source material

• 10 CFR 50, Domestic licensing of production and utilization facilities

• 10 CFR 50, Appendix A, General Design Criteria for Nuclear Power Plants

• 10 CFR 50, Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants

• 10 CFR 50.2, Definitions

• 10 CFR 50.36, Technical specifications

• 10 CFR 50.49, Environmental qualification of electric equipment important to safety for nuclear power plants

• 10 CFR 50.54, Conditions of licenses

• 10 CFR 50.55, Conditions of construction permits, early site permits, combined licenses, and manufacturing licenses

• 10 CFR 50.59, Changes, tests and experiments

• 10 CFR 50.63, Loss of all alternating current power

• 10 CFR 50.71, Maintenance of records, making of reports

• 10 CFR 51, Environmental protection regulations for domestic licensing and related regulatory functions

• 10 CFR 52, Licenses, certifications, and approvals for nuclear power plants

• 10 CFR 54, Requirements for renewal of operating licenses for nuclear power plants

• 10 CFR 55, Operator's licenses

• 10 CFR 70, Domestic licensing of special nuclear material Issue Date: DRAFT 25 0326

• 10 CFR 72, Licensing requirements for the independent storage of spent nuclear fuel and high-level radioactive waste, and reactor- related greater than Class C waste

• 10 CFR 73, Physical protection of plants and materials

• 10 CFR 100, Reactor site criteria

• ASME Code, Sections III and XI

• Atomic Energy Act, Section 182

• COM-106, Control of Task Interface Agreements

• GDC 17, Electric Power Systems

• GDC 21, Protection System Reliability and Testability

• GDC 34, Residual Heat Removal

• GDC 35, Emergency Core Cooling

• GDC 38, Containment Heat Removal

• GDC 41, Containment Atmosphere Cleanup

• GDC 44, Cooling Water

• GL 89-04, Guidance on Developing Acceptable Inservice Testing Programs

• GL 90-05, Guidance for Performing Temporary Non-Code Repair of ASME Code Class 1, 2, and 3 Piping

• IMC 0410, Notices of Enforcement Discretion

• LIC 504, Integrated Risk-Informed Decision-Making Process for Emergent Issues

• MD 9.27, Organization and Functions, Office of Nuclear Reactor Regulation

• MD 9.29, Organization and Functions, Regional Offices

• MD 10.158, NRC Non-Concurrence Process

• MD 10.159, NRC Differing Professional Opinion Program

• MD 10.160, Open Door Policy

• NEI 96-07, Guidelines for 10 CFR 50.59 Evaluations

• NEI 97-04, Design Bases Program Guidelines

• NUREG 1430, Standard Technical Specifications Babcock and Wilcox Plants

• NUREG 1431, Standard Technical Specifications Westinghouse Plants

• NUREG 1432, Standard Technical Specifications Combustion Engineering Plants

• NUREG 1433, Standard Technical Specifications General Electric Plants (BWR/4)

• NUREG 1434, Standard Technical Specifications General Electric Plants (BWR/6)

• NUREG 2194, Standard Technical Specifications, Westinghouse Advanced Passive 1000 (AP 1000) Plants

• RG 1.147, Inservice Inspection Code Case Acceptability, ASME Section XI, Division 1

• RG 1.186, Guidance and Examples for Identifying 10 CFR 50.2 Design Bases

• RG 1.187, Guidance for Implementation of 10 CFR 50.59, Changes, Tests, and Experiments

• RG 1.199, Anchoring Components and Structural Supports in Concrete

• RG 1.61, Damping Values for Seismic Design of Nuclear Power Plants

• RG 1.76, Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants

• RIS 2001-09, Control of Hazard Barriers

• TSTF-505, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b"

• TSTF-529, Clarify Use and Application Rules Issue Date: DRAFT 26 0326

Attachment 1 - Revision History for IMC 0326, Operability Determinations Commitment Accession Description of Change Description of Comment Tracking Number Training Resolution and Number Issue Date Required and Closed Feedback Change Notice Completion Form Accession Date Number (Pre-Decisional, Non-Public Information)

None ML12345A578 TG Part 9900 Technical Guidance STSODP Operability Incorporated into None 01/31/14 Determinations & Functionality Assessments for Resolution of iLearn Operability CN 14-004 Degraded or Nonconforming Conditions Adverse to Quality or Refresher Safety is updated and reissued as IMC 0326, Operability Training Determinations & Functionality Assessments For Conditions Adverse To Quality Or Safety. The pertinent changes includes the following:

• Scope of SSCs for Operability Determinations. The parenthetical reference to the support systems (diesel fuel oil, lube oil and starting air) in the guidance is replaced with Nuclear Service Water and Station Battery examples in a footnote. The footnote discussion states that all design functions may not be within the scope of an operability determination, but may be within the scope of a Functionality Assessment.

• Definition Functional - Functionality. CLB function(s) of SSCs not controlled by TS may include the ability to perform a necessary and related support function for an SSC(s) controlled by TS. Definition Operable/Operability. Plant-specific operability definitions may refer to either specified functions or specified safety functions when describing the CLB of a structure, system or component and that these are descriptive terms that have the same meaning when used in operability determinations Issue Date: DRAFT Att 1-1 0326

Commitment Accession Description of Change Description of Comment Tracking Number Training Required Resolution and Number Issue Date and Completion Closed Feedback Change Notice Date Form Accession Number (Pre-Decisional, Non-Public Information)

• Definition Specified Function/Specified Safety Function.

Refers to the specified safety functions in the facility CLB.

• Operability Determination Process. PRA functional is used to calculate risk-informed Completion Times but the term does not apply to operability determinations.

• Assessing Potential Degraded or Nonconforming Conditions. The time required should be limited to the time necessary to understand the known or expected extent of degradation or nonconforming condition and that an extended delay to complete an investigation or cause analysis is not appropriate.

• Presumption of Operability. Includes performing TS surveillances to assure the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met.

• Functionality Assessments. Functionality assessments are appropriate whenever a review, TS surveillance, or other information calls into question the ability of an SSC not required to be operable by TS to perform its CLB function(s). A CLB function(s) may also perform a Issue Date: DRAFT Att 1-2 0326

Commitment Accession Description of Change Description of Comment Tracking Number Training Required Resolution and Number Issue Date and Completion Closed Feedback Change Notice Date Form Accession Number (Pre-Decisional, Non-Public Information)

• Compensatory Measures. Used to restore inoperable SSCS to operable but degraded status should be documented in a prompt operability determination. Compensatory measures may include temporary facility or procedure changes that impact other aspects of the facility which may require applying the requirements of 10 CFR 50.59.

• Missed Technical Specifications Surveillance. Revised to clarify use of SR 3.0.3 does not apply when a TS Surveillance has never been performed.

• Relationship Between the General Design Criteria and the Technical Specifications. Revised to address recent staff licensing issues on the need to clarify the relation between TS and the GDC.

• Single Failures. Revised to complete the list of applicable Issue Date: DRAFT Att 1-3 0326

Commitment Accession Description of Change Description of Comment Tracking Number Training Resolution and Number Issue Date Required and Closed Feedback Change Notice Completion Date Form Accession Number (Pre-Decisional, Non-Public Information)

None ML15237A077 Added Appendix C.07 to allow the use of Seismic Margin None ML15236A055 11/05/15 Analyses 9900-1794 CN 15-023 ML15308A230 Appendix C.13, Structural Requirements is revised to include reinforced concrete and steel structural components inspection acceptance criteria guidance for operability determinations and functionality assessments. This change is proposed by Reactor Oversight Program Feedback Form 9900 1794.

ML15328A099 This is an ERRATA to correct the inadvertent release of a None ML15236A055 12/03/15 previous version. 9900-1794 CN 15-028 ML15308A230 ML16306A386 Appendixes C.12 and C.13 are revised to clarify expectations None ML16309A001 11/20/17 with focus on methodologies acceptable for NRC when 0326-2281 CN 17-026 evaluating operational leakage and timing of relief request. A ML17324A409 new section on heat exchanger tube leakage is added. A general revision of IMC 0326 was made to improve clarity and flow.

Complete re-write. Title changed to Operability Determinations. New sections added to bring the format consistent with other IMCs (Objectives (0326-02),

Responsibilities and Authorities (0326-05), and Reference (0326-09)) Items removed (Functionality Assessment, Anything CAP related, Immediate and Prompt Operability Determinations, Appendix B, and Attachments 1 and 2)

Items relocated (Appendix A is now Section 0326-07 and Appendix C is now Section 0326-08)

Issue Date: DRAFT 2 0326