ML19206A489

Draft Regulatory Guide DG-1287, an Approach for Plant-Specific, risk-Informed Decisionmaking: Technical Specifications

ML19206A489
Person / Time
Issue date:	02/06/2020
From:	George Wang Office of Nuclear Regulatory Research
To:
Karagiannis H
Shared Package
ML19206A480	List: ML19206A489 ML19206A491 ML19206A493
References
DG-1287 RG-1.177, Rev 2
Download: ML19206A489 (40)

Text

U.S. NUCLEAR REGULATORY COMMISSION DRAFT REGULATORY GUIDE DG-1287 Proposed Revision 2 to Regulatory Guide 1.177 Issue Date: February 2020 Technical Lead: G. Wang AN APPROACH FOR PLANT-SPECIFIC, RISK-INFORMED DECISIONMAKING: TECHNICAL SPECIFICATIONS A. INTRODUCTION Purpose This regulatory guide (RG) describes an approach that is acceptable to the staff of the U.S. Nuclear Regulatory Commission (NRC) for developing risk-informed applications for changes to completion times (CTs) and surveillance frequencies (SFs) of plant technical specifications (TS). This guide provides specific guidance for considering engineering issues and using risk information to evaluate changes to nuclear power plant TS CTs and SFs.

This RG supplements the guidance provided in RG 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, (Ref. 1) and includes precise terminology to ensure that the defense-in-depth philosophy is interpreted and implemented consistently.

Applicability This RG applies to light-water reactor (LWR) licensees subject to Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic Licensing of Production and Utilization Facilities (Ref. 2), and 10 CFR Part 52, Licenses, Certifications, and Approvals for Nuclear Power Plants (Ref. 3).

Applicable Regulations

• 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities, provides regulations for licensing production and utilization facilities.

o 10 CFR 50.36, Technical specifications, requires applicants to submit proposed TS for their facilities. The TS include items in the categories of (1) safety limits, limiting safety system settings, and limiting control settings, (2) limiting conditions for operation, (3) surveillance requirements, (4) design features, and (5) administrative controls (stating that each licensee This RG is being issued in draft form to involve the public in the development of regulatory guidance in this area. It has not received final staff review or approval and does not represent an NRC final staff position. Public comments are being solicited on this DG and its associated regulatory analysis. Comments should be accompanied by appropriate supporting data. Comments may be submitted through the Federal Rulemaking Web site, http://www.regulations.gov, by searching for draft regulatory guide DG-1287. Alternatively, comments may be submitted to the Office of Administration, Mailstop: TWFN 7A-06M, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, ATTN:

Program Management, Announcements and Editing Staff. Comments must be submitted by the date indicated in the Federal Register notice.

Electronic copies of this DG, previous versions of DGs, and other recently issued guides are available through the NRCs public Web site under the Regulatory Guides document collection of the NRC Library at https://nrcweb.nrc.gov/reading-rm/doc-collections/reg-guides/. The DG is also available through the NRCs Agencywide Documents Access and Management System (ADAMS) at http://www.nrc.gov/reading-rm/adams.html, under Accession No. ML19206A489. The regulatory analysis may be found in ADAMS under Accession No. ML19206A493. The responses to public comments on the 2012 version of DG-1287 (ADAMS Accession No. ML12017A054) can be found in ADAMS under ML19220A094.

shall submit any reports to the Commission pursuant to approved TS as specified in 10 CFR 50.4, Written communications.

o 10 CFR 50.90, Application for amendment of a license, construction permit, or early site permit, requires that applications for license amendments must fully describe the changes desired.

• 10 CFR Part 52, Licenses, Certifications, and Approvals for Nuclear Power Plants, governs the issuance of early site permits, standard design certifications, combined licenses, standard design approvals, and manufacturing licenses for nuclear power facilities.

Related Guidance

• NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition (SRP) (Ref. 4), provides guidance to the NRC staff in performing safety reviews of construction permit or operating license applications (including requests for amendments) under 10 CFR Part 50, and early site permit, design certification, combined license, standard design approval, or manufacturing license applications under 10 CFR Part 52 (including requests for amendments).

o NUREG-0800, Section 16.1, Risk-informed Decision Making: Technical Specifications, addresses risk-informed decisionmaking for TS. The guidance pertaining to TS SF and CT changes in Section 16.1 is consistent with the guidance in this RG.

o NUREG-0800, Section 19.1, Determining the Technical Adequacy of Probabilistic Risk Assessment for Risk-Informed License Amendment Requests after Initial Fuel Load, addresses the acceptability of a baseline probabilistic risk assessment (PRA) that a licensee uses to support license amendments for an operating reactor, as well as license amendment requests submitted after initial fuel load for new reactors.

o NUREG-0800, Section 19.2, Review of Risk Information Used to Support Permanent Plant-Specific Changes to the Licensing Basis: General Guidance, addresses the review of risk information used to support permanent plant-specific changes to the licensing basis.

• NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking, Final Report, (Ref. 5) provides guidance on how to treat uncertainties associated with PRA in risk-informed decisionmaking. This guidance is intended to foster an understanding of the uncertainties associated with PRA and their impact on the results of PRA.

• RG 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, provides methods demonstrating compliance with the provisions of 10 CFR 50.65, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants (Ref. 6).

• RG 1.174 provides guidance on an acceptable approach for developing risk-informed applications for a licensing basis change that considers engineering issues and applies risk insights.

• RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities (Ref. 7), provides an approach for determining whether the base PRA, in total or the parts used to support an application, is acceptable for use in DG-1287, Page 2

regulatory decisionmaking for LWRs. Also note that RG 1.200 will be updated periodically as new PRA standards are adopted.

Purpose of Regulatory Guides The NRC issues RGs to describe to the public methods that the staff considers acceptable for use in implementing specific parts of the agencys regulations, to explain techniques that the staff uses in evaluating specific problems or postulated events, and to provide guidance to applicants. Regulatory guides are not substitutes for regulations and compliance with them is not required. Methods and solutions that differ from those set forth in RGs will be deemed acceptable if they provide a sufficient basis for the findings required for the issuance or continuance of a permit or license by the Commission.

Paperwork Reduction Act This RG provides voluntary guidance for implementing the mandatory information collections in 10 CFR Parts 50 and 52 that are subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et.

seq.). These information collections were approved by the Office of Management and Budget (OMB),

approval numbers 3150-0011 and 3150-0151. Send comments regarding this information collection to the Information Services Branch (T6-A10M), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the OMB reviewer at: OMB Office of Information and Regulatory Affairs (3150-0010), Attn: Desk Officer for the Nuclear Regulatory Commission, 725 17th Street, NW Washington, DC 20503; e-mail: oira_submission@omb.eop.gov.

Public Protection Notification The NRC may not conduct or sponsor, and a person is not required to respond to, a collection of information unless the document requesting or requiring the collection displays a currently valid OMB control number.

DG-1287, Page 3

B. DISCUSSION Reason for Revision This revision of the guide (Revision 2) provides updated guidance on the defense-in-depth philosophy to be consistent with the related guidance described in RG 1.174. RG 1.174 was revised in 2018 to expand the guidance on the meaning of, and the process for, assessing defense-in-depth considerations. Specifically, this revision of RG 1.177 references the defense-in-depth guidance in RG 1.174 in several staff regulatory positions.

Additionally, the staff revised this guide to (1) adopt the term PRA acceptability, and related phrasing variants, instead of terms such as PRA quality, PRA technical adequacy, and technical adequacy to describe the appropriateness of the PRA used to support risk-informed licensing submittals, (2) update Section C.2.3, Evaluation of Risk Impact, of this RG, (3) delineate that long-term CT extension requests will increase the depth and level of detail of the staffs review and the need for proposed measures to reduce the risk impact of the TS change commensurate with the proposed CT extension, and (4) add new Section C.2.6 on integrated decisionmaking consistent with RG 1.174, Section C.2.6.

Background

The Commission established its regulatory requirements for TS in 10 CFR 50.36. In doing this, the Commission emphasized matters related to the prevention of accidents and the mitigation of accident consequences; the Commission noted that applicants were expected to incorporate into their TS those items that are directly related to maintaining the integrity of the physical barriers designed to contain radioactivity (Ref. 8).

In August 1995, the NRC issued a final Commission policy statement on the use of PRA methods in nuclear regulatory activities, titled Use of Probabilistic Risk Assessment Methods in Nuclear Activities: Final Policy Statement (Ref. 9), which encourages greater use of this analysis technique to improve safety decisionmaking and regulatory efficiency. One activity undertaken in response to the policy statement is the use of PRA to support decisions to modify an individual plants licensing basis.

Such modifications are related to decisions to modify an individual plants TS.

In support of the use of risk-informed decisionmaking, the NRC developed RG 1.174, which provides guidance on an acceptable approach for developing risk-informed applications for a licensing basis change and considers engineering issues and applies risk insights. This RG supplements the guidance provided in RG 1.174.

The staff normally uses deterministic engineering analysis to evaluate license amendment requests for TS changes that are consistent with approved staff positions (e.g., generic letters, regulatory guides, standard review plans, branch technical positions, or the Standard Technical Specifications (STS)

(Refs. 10-14)). For TS change requests that go beyond current staff positions, in which a licensee elects to use risk information in support of the proposed TS change, the staffs evaluation may use deterministic engineering analyses and the risk-informed approach set forth in this RG. The staff will review the information provided by the licensee to determine whether it can approve the application based on the information provided using deterministic and risk-informed methods, as applicable, and will either approve or reject the application based upon the review.

DG-1287, Page 4

The guidance provided within this guide does not preclude other approaches for requesting changes to the TS. Rather, this RG is intended to improve consistency in regulatory decisions when the results of risk analyses are used to help justify TS changes.

This regulatory guide describes an acceptable approach for assessing the nature and impact of proposed TS changes in CTs and SFs by considering engineering issues and applying risk insights.

As presented in detail under Regulatory Position C of this RG, assessments should consider relevant safety margins and defense-in-depth attributes, including considering success criteria as well as equipment functionality, reliability, and availability.

In addition, this RG describes acceptable TS change implementation strategies and performance monitoring plans that will help ensure that assumptions and analyses supporting the change are verified. It also indicates an acceptable level of documentation to reach a finding that the licensee has performed a sufficiently complete and scrutable TS change analysis and that the results of the engineering evaluations support the licensees proposed TS change.

Risk-informed TS submittals may address either permanent changes to TS requirements or one-time-only changes. Once approved, permanent changes apply to all future occurrences. Licensees request a one-time-only change to a TS requirement for a particular condition and for a specified period, typically for a CT. This RG provides guidance for both permanent and one-time-only CT changes to TS.

In addition, the term operable used in this document and the single-failure criterion should be understood within the context of this RG. All TS should contain a definition of terms operable and operability that is similar to the following definition from NUREG-1431, Standard Technical Specifications: Westinghouse Plants (Ref. 11):

A system, subsystem, train, component, or device shall be OPERABLE or have OPERABILITY when it is capable of performing its specified safety function(s) and when all necessary attendant instrumentation, controls, normal or emergency electrical power, cooling and seal water, lubrication, and other auxiliary equipment that are required for the system, subsystem, train, component, or device to perform its specified safety function(s) are also capable of performing their related support function(s)

As described above, a plant-specific TS may differ from the STS definition of Operable -

Operability. Therefore, some judgment is needed in applying the guidance in the Inspection Manual Chapter 0326, Operability Determinations (Ref. 15).

The staff gives the historical basis for this definition in Generic Letter (GL) 80-30, Clarification of the Term Operable as It Applies to Single Failure Criterion for Safety Systems Required by TS, dated April 10, 1980 (Ref. 16). As stated in GL 80-30, the TS were formulated to preserve the single-failure criterion for systems that are relied upon in the safety analysis report. When the required redundancy is not maintained, the TS require action within a specified time. GL 80-30 calls the specified time to take action an equipment out-of-service time. This term is equivalent to the term completion time used in the STS. This limited time is a temporary relaxation of the single-failure criterion to take action so that the equipment can be restored to an operable status in accordance with the TS.

DG-1287, Page 5

Since the issuance of GL 80-30, the NRC has issued various initial operating licenses, combined licenses, and amendments to licenses, each of which contains a definition of operable similar to the GL 80-30 definition. These definitions do not require a licensee to assume an additional failure when assessing operability of a degraded or nonfunctional safety system or component.

Harmonization with International Standards The NRCs goal is to harmonize its guidance with international standards. The International Atomic Energy Agency (IAEA) has established a series of safety guides and standards constituting a high level of safety for protecting people and the environment. The IAEA safety guides present international good practices to help users to achieve high levels of safety. The information in this RG is generally consistent with the principles in the below IAEA documents:

• IAEA Safety Guide SSG-3, Development and Application of Level 1 Probabilistic Safety Assessment for Nuclear Power Plants Specific Safety Guide (Ref. 17)

• IAEA Safety Guide SSG-4, Development and Application of Level 2 Probabilistic Safety Assessment for Nuclear Power Plants Specific Safety Guide (Ref. 18)

• IAEA Safety Standards SSR-2/1, Revision 1, Safety of Nuclear Power Plants: Design (Ref. 19)

These safety guides provide recommendations for performing or managing a probabilistic safety assessment for nuclear power plants and using the assessment to support safe design and operation. This RG discusses some of the same principles with respect to changes to a plants licensing basis.

DG-1287, Page 6

C. STAFF REGULATORY GUIDANCE This section provides detailed descriptions of the methods, approaches, or data that the staff considers acceptable for meeting the requirements of the applicable regulations cited in the Introduction of this guide.

RG 1.174 identifies five key principles that all risk-informed applications are expected to meet and that risk-informed changes to plant TS should explicitly address. The five key principles listed in RG 1.174 are as follows:

• Principle 1: The proposed licensing basis change meets the current regulations unless it is explicitly related to a requested exemption (i.e., a specific exemption under 10 CFR 50.12).

• Principle 2: The proposed licensing basis change is consistent with the defense-in-depth philosophy.

• Principle 3: The proposed licensing basis change maintains sufficient safety margins.

• Principle 4: When proposed licensing basis changes result in an increase in risk, the increases should be small and consistent with the intent of the Commissions policy statement on safety goals for the operations of nuclear power plants.

• Principle 5: The impact of the proposed licensing basis change should be monitored using performance measurement strategies.

RG 1.174 identifies a four-element approach to evaluating proposed licensing basis changes. This section addresses the applicability of these key principles and elements to TS changes.

1. Element 1: Define the Proposed Change 1.1 Reason for Proposed Change The submittals should state the reasons for requesting the TS change or changes, along with information that demonstrates that the extent of the change is needed. Generally, acceptable reasons for requesting TS changes fall into one or more of the categories below. RG 1.174, Section C.1, provides additional guidance on defining the proposed change.

1.1.1 Improvement in Operational Safety A licensee may request the TS change to improve operational safety (i.e., a reduction in the plant risk or a reduction in occupational exposure of plant personnel in complying with the requirements).

1.1.2 Consistency of Risk Basis in Regulatory Requirements The TS change can be supported based on its risk implications. TS requirements can be changed to reflect improved design features in a plant or to reflect equipment reliability improvements that make a previous requirement unnecessarily stringent or ineffective. The TS may also be changed to establish consistently based requirements across the industry or across an industry group. The licensee must ensure that the risk resulting from the change remains acceptable.

DG-1287, Page 7

1.1.3 Reduce Unnecessary Burdens A licensee may request the TS change to reduce unnecessary burdens in complying with current TS requirements based on the operating history of the plant or industry in general. For example, in specific instances, the repair time needed may be longer than the CT defined in the TS. The required surveillance may lead to plant transients, result in unnecessary equipment wear, result in excessive radiation exposure to plant personnel, or place unnecessary administrative burdens on plant personnel that are not justified by the safety significance of the surveillance requirement. In some cases, the change may provide operational flexibility; in those cases, the change might allow an increased allocation of the plant personnels time to more safety-significant aspects.

In some cases, licensees may determine that there is a common need for a TS change among several licensees and that it is beneficial to request the changes as a group rather than individually. Group submittals can be advantageous when the equipment being considered in the change is similar across all plants in the group. The submittal must still provide plant-specific information with regard to the engineering evaluations described in Staff Regulatory Position C.2. However, the group may be able to draw generic conclusions from a compilation of the plant-specific data. In addition, there will be benefits from cross comparison of the results of the plant-specific evaluations.

2. Element 2: Perform Engineering Analysis As part of the second element, the licensee should evaluate the proposed TS change with regard to the key principles that (1) current regulations are met, (2) adequate defense in depth is maintained, (3) sufficient safety margins are maintained, and (4) proposed increases in risk are small and are consistent with the intent of the Commissions policy statement on safety goals for the operation of nuclear power plants.

The staff expects licensees to provide strong technical bases for any TS change. The technical bases should be rooted in deterministic engineering and system analyses. TS change requests based on PRA results alone should not be submitted for review. TS change requests should give proper attention to the integration of considerations, such as conformance to the STS, generic applicability of the requested change if it is different from the STS, operational constraints, manufacturer recommendations, and practical considerations for test and maintenance. Standard practices used in setting CTs and SFs should be followed (e.g., CTs normally are 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, 7 days, 14 days, and so on, and SFs normally are once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, 7 days, 1 month, 3 months, and so on). Using such standards greatly simplifies implementation, scheduling, monitoring, and auditing. Logical consistency among the requirements should be maintained, (e.g., CT requirements for multiple trains out of service should not be longer than that for one of the constituent trains).

2.1 Compliance with Current Regulations (Principle 1)

In evaluating proposed changes to TS, the licensee must ensure that the current regulations, orders, and license conditions are met, consistent with Principle 1 in RG 1.174. The 10 CFR 50.36 regulations are specific to TS. The NRCs final policy statement on TS improvements (Ref. 20) provides additional information on the agencys TS policies. These documents define the main elements of TS and provide criteria for items to be included in the TS.

The final policy statement and the Statements of Consideration for 10 CFR 50.36, as published in Volume 60 of the Federal Register, page 36953 (60 FR 36953, July 19, 1995) (Ref. 21), also discuss the use of probabilistic approaches to improve TS. Regulations on applications for and the issuance of license amendments appear in 10 CFR 50.90, 10 CFR 50.91, and 10 CFR 50.92. In addition, the licensee should DG-1287, Page 8

ensure that the evaluation identifies and considers any discrepancies between the proposed TS change and licensee commitments.

2.2 Deterministic Engineering Considerations 2.2.1 Technical Specification Change Is Consistent with Defense-in-Depth Philosophy (Principle 2)

Defense in depth is an element of the NRCs safety philosophy that employs multiple independent and redundant layers of defense to compensate for potential human and mechanical failures so that no single layer, no matter how robust, is exclusively relied upon. Defense in depth includes the use of access controls, physical barriers, redundant and diverse key safety functions, and emergency response measures to prevent accidents or mitigate damage if a malfunction, accident, or naturally caused event occurs at a nuclear facility. The defense-in-depth philosophy has traditionally been applied in plant design and operation to provide multiple means to accomplish safety functions and prevent the release of radioactive material. It has been and continues to be an effective way to account for uncertainties in equipment and human performance and, in particular, to account for the potential for unknown and unforeseen failure mechanisms or phenomena that, because they are unknown or unforeseen, are not reflected in either the PRA or deterministic engineering analyses. Staff Requirements Memorandum (SRM)-SECY-98-144, Staff RequirementsSECY-98-144White Paper on Risk-Informed and Performance-Based Regulation, dated March 1, 1999 (Ref. 22), provides additional information on defense in depth as an element of the NRCs safety philosophy.

The engineering evaluation should demonstrate whether the implementation of the proposed TS change is consistent with the defense-in-depth philosophy (Principle 2 in RG 1.174). The intent of this key principle of risk-informed decisionmaking is to ensure that the licensee fully understands, and the submittal addresses any impact of the proposed licensing basis change on defense in depth and that the change maintains consistency with the defense-in-depth philosophy. The intent is not to prevent changes in the way defense in depth is achieved. The licensee should fully understand how the proposed licensing basis change impacts plant design and operation from both risk and deterministic engineering perspectives.

RG 1.174 provides guidance on how to evaluate the impact of a proposed licensing basis change on defense in depth to determine whether that consistency is achieved. The seven defense-in-depth considerations in Section C.2.1.1 of RG 1.174 should be used to evaluate the impact of a proposed TS change on defense in depth to determine whether it maintains consistency with the defense-in-depth philosophy.

Additionally, the licensee should select engineering analysis techniqueswhether quantitative or qualitative, deterministic or probabilisticappropriate for the proposed TS change, that address:

a. whether there are appropriate restrictions in place to preclude simultaneous equipment outages that would erode the principles of redundancy and diversity,

b. whether compensatory measures that should be taken when entering the modified CT for preplanned maintenance are identified,

c. whether voluntary removal of equipment from service during plant operation is scheduled when adverse weather conditions are predicted, or when the plant may be subjected to other abnormal conditions, and DG-1287, Page 9

d. whether the impact of the TS change on the safety function should be taken into consideration (e.g., the impact of a change in the CT for the low-pressure safety injection system on the overall availability and reliability of the low-pressure injection function).

2.2.2 Technical Specification Change Maintains Sufficient Safety Margin (Principle 3)

The licensees engineering evaluation should assess whether the impact of the proposed TS CT or SF change is consistent with the principle that sufficient safety margins are maintained (Principle 3 in RG 1.174). An acceptable set of guidelines for making that assessment is summarized below. Other equivalent decision guidelines are acceptable.

Sufficient safety margins are maintained under the following circumstances:

a. Codes and standards (e.g., American Society of Mechanical Engineers, Institute of Electrical and Electronics Engineers) or alternatives approved for use by the NRC are met (e.g., the proposed TS CT or SF change does not conflict with approved codes and standards relevant to the subject system).

b. Safety analysis acceptance criteria in the final safety analysis report are met, or proposed revisions provide sufficient margin to account for analysis and data uncertainties (e.g., the proposed TS CT or SF change does not adversely affect any assumptions or inputs to the safety analysis, or, if such inputs are affected, justification is provided to ensure sufficient safety margin will continue to exist). For TS CT changes, an assessment should be made of the effect on the final safety analysis report acceptance criteria, assuming the plant is in the condition addressed by the proposed CT (i.e., the subject equipment is inoperable) and there are no additional failures.

Such an assessment should result in identifying all situations in which entry into the condition addressed by the proposed CT could result in failure to meet an intended safety function.

2.3 Evaluation of Risk Impact (Principle 4)

Consistent with Principle 4 in RG 1.174, the NRC staff has identified the following three-tiered approach for licensees to evaluate the risk associated with proposed TS CT changes:

a. Tier 1 is an evaluation of the impact on plant risk of the proposed TS change as expressed by the change in core damage frequency (CDF), the incremental conditional core damage probability (ICCDP),1 the change in large early release frequency (LERF), and the incremental conditional large early release probability (ICLERP).2 To support this evaluation, two aspects are to be considered: (1) the acceptability of the PRA and (2) the PRA insights and results. The licensee should demonstrate that its PRA is acceptable for assessing the proposed TS change, identify the impact of the TS change on plant risk, and demonstrated that this impact on plant risk is acceptable.

b. Tier 2 is an identification of potentially high-risk configurations that could exist if equipment, in addition to that associated with the change, is taken out of service simultaneously or if other risk-significant operational factors, such as concurrent system or equipment testing, are also 1 ICCDP = ((conditional CDF with the subject equipment out of service and nominal expected equipment unavailabilities for other equipment permitted to be out of service by the TS) (baseline CDF with nominal expected equipment unavailabilities)) x (total duration of a single CT under consideration).

2 ICLERP = ((conditional LERF with the subject equipment out of service and nominal expected equipment unavailabilities for other equipment permitted to be out of service by the TS) (baseline LERF with nominal expected equipment unavailabilities)) x (total duration of a single CT under consideration).

DG-1287, Page 10

involved. The objective of this part of the evaluation is to ensure that appropriate restrictions on dominant risk-significant configurations associated with the change are in place. In addition, compensatory measures that can mitigate any corresponding increase in risk (e.g., backup equipment, increased surveillance frequency, or upgraded procedures and training) should be identified and evaluated.

c. Tier 3 is the establishment of a risk-informed plant configuration control program (i.e., configuration risk management program (CRMP)) to ensure that other potentially lower probability, but nonetheless risk-significant, configurations resulting from maintenance and other operational activities are identified and compensated for. If the Tier 2 assessment demonstrates, with reasonable assurance, that there are no risk-significant configurations involving the subject equipment, the application of Tier 3 to the condition addressed by the proposed CT may not be necessary. Although defense in depth is protected, to some degree, by the most current TS, application of the three-tiered approach to risk-informed TS CT changes will provide additional assurance that such changes to the licensing basis will not significantly impact defense in depth.

Regulatory Positions C.2.3.1-2.3.7 and Appendix A to this RG discuss various issues related to the three-tiered approach. Specifically, Regulatory Positions C.2.3.1-2.3.5 and Appendix A outline issues associated with Tier 1, and Regulatory Positions C.2.3.6 and C.2.3.7 outline issues associated with Tier 2 and Tier 3, respectively.

The NRC staff has identified several factors, discussed below, that should be considered in proposals for SF changes. In summary, the licensee should identify the SFs to be evaluated, determine the risk contribution associated with the subject SFs, determine the risk impact from the change to the proposed SF, and perform sensitivity and uncertainty evaluations to address uncertainties associated with the SF evaluations. Regulatory Positions C.2.3.1-2.3.6 and Appendix A to this RG provide more detail on risk evaluation for SF changes.

2.3.1 Acceptability of the Probabilistic Risk Assessment The PRA used to support the TS change evaluation is measured in terms of its appropriateness with respect to scope, level of detail, conformance with the technical elements, and plant representation. These aspects of the PRA are to be commensurate with its intended use and the role the PRA results play in justifying the TS change. This applies to Tier 1 and to Tiers 2 and 3 to the extent that a PRA model is used. Regulatory Position C.2.3 of RG 1.174 provides guidance on evaluating the acceptability of the PRA with respect to these PRA aspects and should be applied to evaluate the acceptability of the PRA used to support TS change evaluations. In addition, Regulatory Positions C.2.3.2 and C.2.3.3 of this RG provide additional guidance on assessing the acceptability of the PRA scope and PRA level of detail, respectively, for TS change evaluations.

2.3.2 Scope of the Probabilistic Risk Assessment for Technical Specification Change Evaluations The scope necessary to fully support the evaluation of a TS change depends on the type of TS change being sought. The scope required is discussed below for a variety of cases. However, in some cases, a PRA of sufficient scope may not be available. This will have to be compensated for by qualitative arguments, bounding analyses, or compensatory measures.

At a minimum, evaluations of CDF and LERF should be performed to support any risk-informed changes to TS. The scope of the analysis should include all hazard groups (i.e., internal events, internal flood, internal fires, seismic events, high winds, transportation events, and other external hazards) unless the contribution from specific hazard groups does not affect the decision. When the risk associated with a DG-1287, Page 11

particular hazard group or operating mode would affect the decision being made, the Commissions policy is to assess the risk using a staff-endorsed PRA standard for that hazard group or operating mode.

Regulatory Positions C.2.3.1 and C.2.5 of RG 1.174 provide more detail.

When changes to the requirements for systems needed for decay heat removal are considered, an appropriate assessment of shutdown risk should also be considered. Examples of such systems are auxiliary feedwater, residual heat removal, emergency diesel generator, and service water. In addition, when CTs are being modified to facilitate online maintenance (i.e., transferring scheduled preventive maintenance from shutdown to power operation), the impact on the shutdown modes should also be considered. Using both power operation and shutdown models, when available, a comparative evaluation may be presented to decide the appropriate condition for scheduling maintenance based on risk evaluations. In some cases, a semiquantitative analysis of shutdown risk may be adequate (e.g., fault tree analysis or failure modes and effects analysis).

When CTs are being modified in anticipation of the need for additional time for corrective maintenance, an assessment of transition risk (the risk of transitioning from power operation to the mode required by the current TS in question) that could be incurred under the current, shorter CT may be desirable if the initial calculated risk increase is near or somewhat above the acceptance guidelines. In addition, TS changes to requirements for a controlled shutdown (i.e., the time allocated to transit through hot standby to hot shutdown to cold shutdown or to the final state that should be reached) should be evaluated using a model for the transition risk covering these periods or at least a qualitative evaluation of the transition risk, if possible.

2.3.3 Probabilistic Risk Assessment Modeling and Level of Detail 2.3.3.1 Detail Needed for Technical Specification Changes To evaluate a TS change, the PRA should model specific systems or components involved in the change. The model should also be able to treat the alignments of components during periods when testing and maintenance are being carried out. Typically, limiting conditions for operations (LCOs) and surveillance requirements relate to the system trains or components that are modeled in the system fault trees of a PRA. System fault trees should be sufficiently detailed to specifically include all the components for which surveillance tests and maintenance are performed and are to be evaluated.

Additional detail that should be incorporated in the PRA in support of TS changes includes the following:

a. For CT evaluations, system train-level models are adequate if all components belonging to the train are clearly identified (i.e., all those components that could cause the train to fail).

b. For evaluating SFs, individual component-level models are necessary.

c. Since PRAs typically model the plant at the individual component level, they may be used directly to analyze both CTs and SFs.

d. Component unavailability models should include contributions from random failure, common-cause failure (CCF), test downtime, and maintenance downtime.

e. Changes to the component unavailability model for test downtime and maintenance downtime should be based on a realistic estimate of expected surveillance and maintenance practices after DG-1287, Page 12

the TS change is approved and implemented (e.g., how often the CT is expected to be entered for preplanned maintenance or surveillance).

f. The component unavailability model for test downtime and maintenance downtime should be based on plant-specific or industrywide operating experience, or both, as appropriate.

g. The component unavailability model should have the flexibility to separate the unavailability contribution from test and maintenance downtime. For evaluating a CT, the contribution from maintenance downtime can be equated to zero to delete maintenance activities, if desired. For an SF evaluation, the contribution from test downtime determines a contribution to risk from carrying out the test.

h. Additional details in terms of separating the failure rate contributions into cyclic demand-related and standby time-related contributions can be incorporated, if justifiable, for evaluating surveillance requirements.

The CCF contributions should be modeled so that they can be modified to reflect the condition in which one or more of the components is unavailable. Note that CCF modeling of components is not only dependent on the number of remaining inservice components, but it is also dependent on the reason the components were removed from service (i.e., whether for preventive or corrective maintenance). For appropriate configuration risk management and control, preventive and corrective maintenance activities need to be considered, and licensees should, therefore, have the ability to address the subtle difference that exists between maintenance activities (Section A-1.3.2 of Appendix A to this guide provides details).

To account for the effects of test placements for redundant components in relation to each other (e.g., staggered or sequential test strategy), time-dependent models and additional evaluations with specialized codes may be used.

If the PRA does not model the system for which the TS change is being requested, specialized analyses may be necessary to demonstrate the sufficiency of the proposal. Examples of these situations follow:

a. When a system is modeled in the event tree, but a detailed fault tree model is not provided (direct estimate of system unavailability from experience data or expert judgment is used), the TS evaluation can proceed in several ways, such as for example:

(1) A separate fault tree can be developed for the system for TS evaluation and used to complement the existing PRA model without directly modifying the PRA (e.g., detailed separate fault tree modeling of the reactor protection system combined with the existing PRA model).

(2) A bounding evaluation can be conducted based on the impact of system failures that are modeled in the PRA event trees; that is, failure of any component in the system can be assumed to cause system failure.

b. When a separate fault tree is developed, specific TS requirements within the system can be changed and changes in the system unavailability can be measured, which can then be used in the PRA model to obtain the corresponding risk measures, as appropriate. Such evaluations can be considered like those evaluations made directly using PRA models, but they should satisfy the following conditions:

DG-1287, Page 13

(1) Failures within the system should not affect any other system or component failure.

(2) The effect of system failure should not influence any initiating event frequency (or it should have a minimal or negligible effect).

(3) The system should not share components with another system.

c. When bounding evaluations are performed assuming any failure in the system as a system failure, the calculated risk impacts for TS changes are expected to be overestimated. The corresponding changes that may be acceptable will also be fewer than those that could have been justified using a detailed model. When considering the incorporation of non-PRA factors, this perspective should be kept, while at the same time considering the lack of a detailed model. Here also, the above three conditions discussed for the previous case apply.

In some cases, since the risk-informed evaluation will be limited and some misestimation of the risk may have been incorporated, nonrisk-related engineering considerations gain importance in the overall decision. In such cases, arguments for the change also should be for small increments from current requirements.

2.3.3.2 Modeling of Initiating Events The PRA explicitly models (i.e., use of detailed fault tree models in the PRA) some initiating events resulting from support system failure (e.g., service water, component cooling water, instrument air). Any TS change for these systems will affect the corresponding initiating event frequency as well as the system unavailability and availability of other supported systems. The effect of TS changes on these initiating event frequencies should be considered.

Some test and maintenance activities can contribute to some transients. Initiating event frequencies used in the PRA do not typically separate out this contribution, but such a separation may be needed during TS change evaluations. For example, the effect of test-caused transients may be evaluated in determining an SF. Initiating event frequencies from conduct of the test (i.e., test-caused transients) could then be modeled separately to evaluate the risk contribution from test-caused transients.

Section A-2 of the appendix to this RG discusses data needs for estimating initiating event frequencies from test-caused transients.

2.3.3.3 Screening Criteria The main qualitative consideration for the screening of sequences in TS change evaluations is the inclusion of sequences directly affected by the TS change that would have been truncated by frequency-based screening alone. For example, if the TS change involves accumulators in a pressurized-water reactor, qualitative considerations imply the inclusion of sequences that contain the accumulators, even if these sequences do not meet the frequency criteria. Excluding these sequences would result in an underestimate of the risk impact of the proposed TS changes; and therefore, could have a significant influence on the ultimate acceptability of these changes.

2.3.3.4 Truncation Limits Truncation levels should be used appropriately to ensure that significant underestimation caused by truncation of cutsets does not occur, as discussed below. Additional precautions relevant to the cutset manipulation method of analysis are needed to avoid truncation errors in calculating risk measures.

DG-1287, Page 14

When failure or outage of a single component is considered, as in the case of a CT or SF risk evaluation, the truncation levels in evaluating R1 and R0 are of concern. R1 is the increased CDF, with the component assumed to be inoperable (or equivalently, the component unavailability set to true), and R0 is the reduced CDF, with the component assumed to be operable (or equivalently, the component unavailability set to false). If the component in question appears in the cutsets near the truncation limit (e.g., all appearances are in cutsets within a factor of 10 of the truncation limit), it may be necessary to reduce the truncation limit. If R1 is marginally larger than the base case value, then one order of additional cutsets should be generated to ensure that any underestimation did not take place.

When considering risk from plant configurations involving multiple components, a cutset with a relatively small frequency can become a significant contributor to the CDF. This is because more than one of the affected components may appear in the same minimal cutset, and the unavailability (increased by the TS change) of more than one of these components could cause a significant increase in the cutsets frequency. For such cases, truncation levels must be reduced by a larger amount than would be the case for single components. Particular care should be taken if the evaluation of R1 is based on requantification of pre-solved cutsets, as the events related to the component of concern may not even appear in the cutsets.

2.3.4 Assumptions in Completion Time and Surveillance Frequency Evaluations When using PRA to evaluate TS changes, the evaluation should consider the assumptions made within the PRA that could have a significant influence on the ultimate acceptability of the proposed changes. The submittal requesting the TS changes should discuss such assumptions. Assumptions that CT change evaluations should consider include the following:

a. If CT risk evaluations are performed using only the PRA for power operation (i.e., to calculate the risk associated with (1) the equipment being unavailable during power operation for the duration of the CT and (2) any change in the CT), the risk associated with shutting the plant down because of exceeding the CT is not considered. In most cases, this risk has not been considered or, if considered, is assumed to further justify the requested change. If the risk evaluation results are marginal or exceed the guidelines for a proposed CT increase and the systems involve those needed for shutdown (e.g., residual heat removal systems, service water systems, auxiliary feedwater systems), the licensee may want to perform comparative risk evaluations of continued power operation versus plant shutdown to justify the proposed CT increase (Regulatory Position C.2.5 provides additional discussion on comparative risk evaluations).

b. When calculating the risk impacts (i.e., a change in CDF or LERF caused by CT changes), the change in average CDF should be estimated using the mean outage times (or an appropriate surrogate) for the current and proposed CTs. If a licensee chooses to use the zero-maintenance state as the base case (i.e., the case in which no equipment is unavailable because of maintenance), the submittal should include an explanation stating so. Usually, data for outage times correspond to the current CT, not to the proposed CT. Different assumptions are made to estimate the outage time corresponding to the proposed CT. The submittal should discuss assumptions concerning changes in maintenance practices under the extended CT regime and characterize their impact on the results of the analysis.

c. When the risk impact of a CT change is evaluated, the yearly risk impact that is calculated takes into account the outage frequency. A CT extension may imply that the maintenance of the component is improved, which may reduce the components failure rate and, consequently, reduce the frequency of outages needed for correcting degradations or failure. There are no experience data for the extended CT; therefore, the assumption should be made that both the DG-1287, Page 15

frequency of outage for corrective maintenance and the components failure rate remain the same.

Here, the beneficial aspect of maintenance is not quantified, and this may give a slightly higher estimate of the yearly CT risk measure for the proposed CT.

d. Often, CT extensions are requested to facilitate online (or at-power) preventive maintenance of safety-system components. The frequency and duration of the extension may be estimated and the risk impact from the resulting unavailability of such equipment can be calculated.

e. When CTs of multiple safety system trains are extended, the likelihood of simultaneous outages of multiple components increases (resulting from combinations of failures, testing, and maintenances) because the increased duration increases the probability of the individual events that constitute the simultaneous multiple outages; hence, overlapping of routinely scheduled activities and random failures becomes more likely. The impact of such occurrences on the average plant risk (e.g., CDF) is small, but the conditional risk can be large. This issue is addressed as part of the implementation considerations (see Regulatory Position C.2.3.7).

SF evaluations should consider the following assumptions:

a. Surveillance tests usually are assumed to detect failures that have occurred in the standby period.

The component failure rate, , represents these failures in the formulation of component unavailability. The test-limited risk is normally estimated by assuming that a surveillance test of a component detects the failures, and that after the test, the components unavailability resets to zero, or false in the Boolean expression. A few component failures, depending on a components design and the test performed, may not be detected by a routine surveillance test.

Usually, their contribution to risk is considered negligible.

b. Regular surveillance testing of a component, as performed for safety system components, is considered to influence its performance. Generally, for most components, the increase of a surveillance interval beyond a certain value may reduce the components performance (i.e., increase the failure rate). Experience data are not available to assess the SF values beyond which the component failure rate, , increases. In a risk-informed evaluation of surveillance requirements, if the failure rate is assumed to remain the same (i.e., unaffected by a change in the SF), this assumption implies that the SFs are not being changed beyond the value at which may be affected. Care should be taken not to reduce the SFs beyond such values using risk-informed analyses only.

c. The timing of surveillance tests for redundant components relative to each other (i.e., the test strategy used) impacts the risk measures calculated. Staggered or sequential test strategies are commonly used. The risk impacts of adopting different test strategies (e.g., sequential versus staggered) should be evaluated to determine whether there is an impact on the evaluation of the change being considered (Ref. 23).

d. Notwithstanding the beneficial aspects of testing to detect failures that occur in a standby period, several adverse effects may be associated with the test that should be considered in the SF evaluation, including downtime to conduct the test, errors of restoration after the test, test-caused transients, and test-caused wear of the equipment. A PRA usually models downtime and errors of restoration, unless they are negligible. Test-caused transients and wear of the equipment are applicable to a few tests but are not generally modeled separately in a PRA. However, they can be evaluated using PRA models supplemented with additional data and analysis. Methods are available to quantitatively address these aspects (Ref. 24); however, qualitative arguments can DG-1287, Page 16

also be presented to support the reduction of an SF. If the adverse impact of testing is considered significant, such cases should be addressed quantitatively.

2.3.5 Sensitivity and Uncertainty Analyses Relating to Assumptions in Technical Specification Change Evaluations As in any risk-informed study, numerous uncertainties about the assumptions made during the PRA models development and application can affect risk-informed analyses of TS changes.

Sensitivity analyses may be necessary to address the important assumptions in the submittal with respect to TS change analyses. Such sensitivity analyses may include, as appropriate, the following:

a. the impact of a variation in repair or maintenance policy because of CT changes (e.g., scheduling preventive maintenance of longer duration at power),

b. the impact of variation in assumed mean downtimes or frequencies,

c. the effect of separating the cyclic demand versus standby time-related contribution to the components unavailability in deciding changes to an SF,

d. the effect of details about how CCFs are modeled in the PRA, and

e. the effect of modeling compensatory measures in the PRA.

Risk resulting from TS CT changes may be relatively insensitive to uncertainties (compared to the effect on risk from uncertainties in assumptions about plant design changes or significant changes to plant operating procedures, for example). This is because the uncertainties associated with CT changes tend to similarly affect the base case (i.e., before the change) and the changed case (i.e., with the change in place). That is, the risks result from similar causes in both cases (i.e., no new initiating transients or subsequent failure modes are likely to have been introduced by relatively minor CT changes). CT changes subject the plant to a variation in its exposure to the same type of risk, and the PRA model can predict, with relative surety based on data from operating experience, how much that risk will change based on that changed exposure. Similar results are expected for SF changes. The staff expects licensees to justify any deviations from these expectations.

The effects of multiple outages may become significant during relatively large increases in CTs or SFs. In those cases, however, the Tier 2 and Tier 3 aspects of TS changes (i.e., configuration monitoring, risk predictions, and configuration control based on the risk predictions) are expected to be robust and will be relied upon to control the resulting potential for significant risk increases. Therefore, the Tier 2 and Tier 3 aspects of such TS changes should be justified as robust and adequate to control the resulting potential for significant risk increases.

NUREG-1855 provides additional guidance on the treatment of uncertainties.

2.3.6 Restrictions on Dominant Risk-Significant Configurations and Compensatory Measures (Tier 2)

Consistent with the key principle that changes to TS should result in only small increases in the risk to public health and safety (Principle 4 in RG 1.174), and as part of proposed TS change evaluations, certain compensatory measures (discussed below) that balance the calculated risk increase caused by the DG-1287, Page 17

changes may be considered. This consideration should be made in light of the acceptance guidelines given in RG 1.174. Note that these considerations may be part of Tier 2 or Tier 3 programs.

The licensee should demonstrate that there are appropriate restrictions on dominant risk-significant configurations associated with the TS change. An effective way to perform such an assessment is to evaluate equipment according to its contribution to plant risk (or safety) while the equipment covered by the proposed CT change is out of service. Evaluation of such combinations of equipment out of service against the Tier 1 ICCDP and ICLERP acceptance guidelines could be one appropriate method of identifying risk-significant configurations. Once plant equipment is so evaluated, an assessment can be made about whether certain enhancements to the TS or procedures are needed to avoid risk-significant plant configurations.

When the licensee wishes to reduce the risk increase resulting from a proposed change even though the licensee judges the individual change to meet the acceptance guidelines in Regulatory Position C.2.4, the licensee might consider taking compensatory measures such as those suggested below. If compensatory measures are considered part of the analysis of the change, the overall application for the TS change should include them. However, overreliance on programmatic activities such as compensatory measures associated with the change in the licensing basis should be avoided. Compensatory measures included in the submittal for a TS change should be measures for which the licensee is not already taking credit. Any such compensatory measures would become part of the licensing basis if the TS change were approved. The following are examples of compensatory measures:

a. adding a test of a redundant train before initiating a scheduled maintenance activity as part of a CT extension application,

b. limiting simultaneous testing (e.g., surveillance tests) and maintenance of redundant or diverse systems as part of a CT extension application, especially if the testing causes unavailability of the redundant train or component,

c. incorporating a staggered test strategy as part of the SF reduction application,

d. improving test and maintenance procedures to reduce test- and maintenance-related errors,

e. improving operating procedures and operator training to reduce the impact of human errors, and

f. improving system designs, which reduces overall system unavailability and plant risk.

When compensatory measures are part of the TS change evaluation, the risk impact of these measures should be considered and presented, either quantitatively or qualitatively. When a quantitative evaluation is used, the total impact of these measures should be evaluated by comparison to the small guideline (Principle 4 in RG 1,174). This includes (1) evaluation of the proposed TS changes without the compensatory measures, (2) evaluation of the proposed TS changes with the compensatory measures, and (3) specific discussion of how each of the compensatory measures is credited in the PRA model or during the evaluation process.

2.3.7 Risk-Informed Plant Configuration Control Program (Tier 3)

Consistent with the key principle that changes to TS result in small increases in the risk to public health and safety (Principle 4 in RG 1.174), certain configuration controls should be used. To support TS changes, a risk-informed plant configuration control program would uncover risk-significant plant equipment outage configurations in a timely manner during normal plant operation. This can be DG-1287, Page 18

accomplished by evaluating the impact on plant risk of, for example, equipment unavailability, operational activities like surveillance testing or load dispatching, or weather conditions. The importance of this third-tier stems from the difficulty of identifying all possible risk-significant configurations under Tier 2 that will ever be encountered over extended periods of plant operation.

2.3.7.1 Configuration Risk Management Program Licensees should describe their capability to perform a contemporaneous assessment of the overall impact on the safety of proposed plant configurations before and during maintenance activities that remove equipment from service. Licensees should explain how these tools or other processes will be used to ensure that risk-significant plant configurations will not be entered and that appropriate actions will be taken when unforeseen events put the plant in a risk-significant configuration.

2.3.7.2 Components of the Configuration Risk Management Program The licensee should ensure the CRMP contains the following components.

Component 1: Implementation of Configuration Risk Management Program The intent of the CRMP is to implement 10 CFR 50.65(a)(4) (part of the Maintenance Rule) for online maintenance for risk-informed TS, with the following additions and clarifications:

a. The scope of structures, systems, and components (SSCs) to be included in the CRMP is all SSCs modeled in the licensees plant PRA, in addition to all SSCs considered high safety significant in accordance with RG 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, that are not modeled in the PRA.

b. The CRMP assessment tool is informed by the PRA and may be in the form of a risk matrix, an online assessment, or a direct PRA assessment.

c. The CRMP should be invoked as follows:

(1) For preplanned entrance into the plant configuration described by a TS action with a risk-informed CT, a risk assessment, including, at a minimum, a search for risk-significant configurations, should be performed before entering the action.

(2) For unplanned entrance into the plant configuration described by a TS action with a risk-informed CT, a similar assessment should be performed in a timeframe defined by the plants corrective action program (10 CFR Part 50, Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, Criteria XVI).

(3) In the plant configuration described by a TS action with a risk-informed CT, when additional SSCs become inoperable or nonfunctional, a risk assessment, including, at a minimum, a search for risk-significant configurations, should be performed in a timeframe defined by the plants corrective action program (10 CFR Part 50, Appendix B, Criteria XVI).

d. Tier 2 commitments apply only for planned maintenance but should be evaluated as part of the Tier 3 assessment for unplanned occurrences.

DG-1287, Page 19

Component 2: Control and Use of the Configuration Risk Management Program Assessment Tool

a. Plant modifications and procedure changes should be monitored, assessed, and dispositioned as follows:

(1) Evaluations of changes in plant configuration or PRA model features should be dispositioned by implementing PRA model changes or by the qualitative assessment of the impact of the changes on the CRMP assessment tool. This qualitative assessment recognizes that changes to the PRA take time to implement and that changes can be effectively compensated for without compromising the ability to make sound engineering judgments.

(2) Limitations of the CRMP assessment tool are identified and understood for each specific CT extension.

b. Procedures exist for the control and application of CRMP assessment tools, including a description of the process when the plant configuration of concern is outside the scope of the CRMP assessment tool.

Component 3: Level 1 Risk-Informed Assessment The CRMP assessment tool uses at least a Level 1, at-power, internal events PRA model. CRMP assessments can reference a risk matrix, preexisting calculations, or new PRA analyses. The CRMP assessment may use any combination of quantitative and qualitative input:

a. Quantitative assessments should be performed whenever necessary for sound decisionmaking.

b. When quantitative assessments are not necessary for sound decisionmaking, qualitative assessments can be performed. Qualitative assessments should consider applicable existing insights from previous quantitative assessments.

Component 4: Level 2 Issues and External Hazards The licensee should treat external hazards and Level 2 issues either qualitatively or quantitatively, or both.

2.4 Acceptance Guidelines for Technical Specification Changes The guidelines discussed in Staff Regulatory Positions C.2.4 and C.2.5 of RG 1.174 are applicable to TS CT and SF change requests. Those sections present risk-acceptance guidelines as a function of the result of the licensees risk analysis in terms of total CDF and total LERF predicted for the plant and the change in CDF and LERF predicted for the proposed licensing basis changes. TS submittals for changes to CTs should also be evaluated against the risk-acceptance guidelines in this guide in addition to those in RG 1.174. Application of all the risk-acceptance guidelines to individual proposals for TS changes will be done in a manner consistent with Principle 4 in RG 1.174changes to TS result in small increases in the risk to public health and safety.

TS change evaluations may involve some small increase in risk, as quantified by PRA models. It is usually argued that such a small increase is offset by the many beneficial effects of the change that are not modeled by the PRA. The role of numerical guidelines is to ensure that the increase in risk is small and to provide a quantitative basis for the risk increase based on aspects of the TS change that are modeled or quantified.

DG-1287, Page 20

In some instances, risk information submitted by a licensee may support a long-term CT extension (e.g. greater than 90 days). Limiting CT extensions to a backstop or a maximum CT limits extended exposure to single-failure susceptibility and compensates for the inherent uncertainty associated with PRAs. TS conditions addressed by CTs are entered infrequently and are inherently temporary by their very nature. As stated in Section 4.1.2 of Nuclear Energy Institute (NEI) 96-07, Guidelines for Title 10 of the Code of Federal Regulations (10 CFR) Part 50.59 Evaluations (Ref. 25), if a temporary change in support of maintenance activities is expected to be in effect during at-power operations for more than 90 days, then the provisions of 10 CFR 50.59, Changes, Tests and Experiments, would be applied to the temporary change in the same manner as a permanent change. Even though NEI 96-07 applies to conducting 10 CFR 50.59 evaluations, a parallel can be drawn to TS CT extensions, in that temporary configurations or modifications extending beyond 90 days may no longer be considered temporary. Licensees requesting long-term CT extensions should be cognizant that such a request would increase the depth and level of detail of the staffs review, and should ensure that any proposed measures to reduce the risk impact of the TS change (e.g., risk management actions, Tier 2 and 3 analyses, less reliance on programmatic activities as compensatory measures, demonstrating backup equipment reliability/availability) are commensurate with the proposed CT extension.

Using the risk measures discussed in this RG, the change in risk should be calculated for TS changes and compared against the numerical guidelines referenced in RG 1.174; for CT changes, against the numerical guidelines presented below. In calculating the risk impact of the changed case, additional changes to be implemented as part of the change can be credited. For example, in seeking an SF change, if the test strategy is also to be changed, the effect of this should also be incorporated in the risk evaluation.

TS conditions addressed by CTs are entered infrequently and are temporary by their very nature.

However, TS do not typically restrict the frequency of entry into conditions addressed by CTs. Therefore, the staff provides the following TS acceptance guidelines specific to permanent CT changes for evaluating the risk associated with the revised CT, in addition to those acceptance guidelines in RG 1.174:

a. The licensee has demonstrated that the TS CT change has only a small quantitative impact on plant risk. An ICCDP of less than 1x10-6 and an ICLERP of less than 1x10-7 are considered small for a single TS condition entry3 (Tier 1).

b. The licensee has demonstrated that there are appropriate restrictions on dominant risk-significant configurations associated with the change (Tier 2).

c. The licensee has implemented a risk-informed plant configuration control program. The licensee has implemented procedures to use, maintain, and control such a program (Tier 3).

For one-time-only changes to TS CTs, the frequency of entry into the CT may be known, and the configuration of the plant SSCs may be established. Further, there is no permanent change to the plant CDF or LERF, and hence the risk guidelines of RG 1.174 cannot be applied directly. The staff provides 3 The ICCDP and ICLERP acceptance guidelines of 1x10-6 and 1x10-7, respectively, are established for consistency with the ICDP and ILERP limits of Section 11 in Nuclear Management and Resources Council (NUMARC) 93-01, Industry Guidelines for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, (Ref. 26) applicable for maintenance activities involving normal work controls. RG 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, endorses, with certain provisions and clarifications, NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants.

DG-1287, Page 21

the following TS acceptance guidelines specific to one-time-only CT changes for evaluating the risk associated with the revised CT:

a. The licensee has demonstrated that the impact on plant risk from implementation of the one-time-only TS CT change is acceptable (Tier 1):

(1) ICCDP of less than 1x10-6 and an ICLERP of less than 1x10-7, or (2) ICCDP of less than 1x10-5 and an ICLERP of less than 1x10-6 with effective compensatory measures implemented to reduce the sources of increased risk.4

b. The licensee has demonstrated that there are appropriate restrictions on dominant risk-significant configurations associated with the change (Tier 2).

c. The licensee has implemented a risk-informed plant configuration control program. The licensee has implemented procedures to use, maintain, and control such a program (Tier 3).

In the context of integrated decisionmaking, the acceptance guidelines should not be interpreted as overly prescriptive. They are intended to provide an indication, in numerical terms, of what is considered acceptable. As such, the numerical values above are approximate values that provide an indication of the changes that are generally acceptable. Furthermore, the state of knowledge, or epistemic uncertainties associated with PRA calculations preclude a definitive decision with respect to the acceptance of the proposed change based purely on the numerical results. The intent in comparing the PRA results with the acceptance guidelines is to demonstrate with reasonable assurance that Principle 4 is being met. This decision must be based on a full understanding of the contributors to the PRA results and the impacts of the uncertainties, both those that are explicitly accounted for in the results and those that are not. In accordance with Regulatory Position C.2.6 of RG 1.174, NRC management would give increased attention to the application if the calculated values of the changes in the risk metrics and their base values, when appropriate, approach the acceptance guidelines. Therefore, if the risk metrics approach or even slightly exceed the acceptance guidelines, the licensees submittal should address the additional aspects of plant risk and operation discussed in Section C.2.6 of RG 1.174.

There may be situations in which a nonquantitative assessment of risk (either alone or accompanied by quantitative assessment) is sufficient to justify the proposed TS changes. The licensee is expected to use judgment in developing an appropriate (to support regulatory decisionmaking) risk argument to justify the proposed TS changes, including the appropriate blend of quantitative and qualitative assessments.

2.5 Comparison of Risk of Available Alternatives In support of a TS change, available alternatives are sometimes compared to justify the TS change. For changes in TS CTs, such cases primarily involve comparing the risk of shutting down with the risk of continuing power operation, given that the plant is not meeting one or more TS LCOs. Such comparisons can be used to justify the increase in at-power risk associated with the TS change by averting some transition or shutdown risk.

In the case of an SF change, the beneficial and adverse impacts similarly can be compared. The modified SF should be chosen so that the benefit of testing is at least equal to or greater than the adverse 4 For one-time-only CT changes, the ICCDP and ICLERP acceptance guidelines of 1x10-5 and 1x10-6, respectively, are established for compatibility with the ICDP and ILERP limits of Section 11 in NUMARC 93-01, which is applicable for voluntary maintenance activities requiring risk-management actions.

DG-1287, Page 22

effects of testing. For example, if the calibration of relays in the reactor protection system causes plant transients, the risk from the test-caused transients is then estimated and compared with the test-limited risk of a reduced SF.

In using such guidelines, the following considerations apply:

a. The uncertainty associated with the two measures being compared can differ and should be considered in deciding on an acceptable change.

b. When the risk measures associated with all alternatives are unacceptably large, ways to reduce the risk should be explored instead of only extending the TS requirement. That is, a large risk from one of the alternatives should not justify relaxing TS without giving appropriate attention to risk-reduction options. If the risk from test-caused transients is large, attention may then be given to exploring changes in test procedures to reduce such risk, rather than only reducing the SF.

However, a combination of the two also may be appropriate.

2.6 Integrated Decisionmaking In accordance with Regulatory Position C.2.6 of RG 1.174, the results of the evaluations under Sections C.1, C.2, and C.3 should be considered in an integrated manner to determine the final acceptability of the proposed TS change. The comparison of PRA results to numerical acceptance guidelines are considered along with other deterministic considerations, operating experience, lessons learned from previous changes, practical considerations associated with test and maintenance practices, and the implementation and monitoring program. The final acceptability of the proposed TS change should be based on all these considerations and not solely on the numerical results of the PRA. These results are one input into the decisionmaking and help in building an overall picture of the risk implications of the proposed TS change. As discussed previously, the numerical guidelines are used to ensure that any increase in risk is within acceptable limits, deterministic considerations are used to ensure that the change satisfies rules and regulations that are in effect, practical considerations judge the acceptability of implementing the change, lessons learned from past experience ensure that mistakes are not repeated, and monitoring ensures the TS change does not degrade operational safety over time. RG 1.174, Section C.2.6, provides additional guidance on the integrated decisionmaking process.

3. Element 3: Define Implementation and Monitoring Program 3.1 Three-Tiered Implementation Approach As described in Regulatory Position C.2.3, the licensee should use a three-tiered approach in implementing the proposed TS CT changes. Application of the three-tiered approach is consistent with the fundamental principle that the proposed change is consistent with the defense-in-depth philosophy.

Application of the three-tiered approach provides assurance that the proposed change will not significantly impact defense in depth.

3.2 Technical Specification Change Monitored Using Performance Measurement Strategies (Principle 5)

Consistent with Principle 5 in RG 1.174, extension of a TS CT or reduction of a TS SF should not degrade operational safety over time. The licensee should ensure, as part of its Maintenance Rule program (10 CFR 50.65, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants), that when equipment does not meet its performance criteria, the evaluation required under the Maintenance Rule includes prior related TS changes in its scope. If the licensee concludes that the DG-1287, Page 23

performance or condition of TS equipment affected by a TS change does not meet established performance criteria, the licensee should take appropriate corrective action, in accordance with the Maintenance Rule. Such corrective action could consider another TS change to shorten the revised CT or increase the revised SF, or impose a more restrictive administrative limit if the licensee determines this to be an important factor in reversing the negative trend.

4. Element 4: Submit Proposed Change The evaluations performed to justify the proposed TS changes should be documented, maintained, and included in the license amendment request submittal in accordance with Section C.6 of RG 1.174. Specifically, documentation for risk-informed TS change submittals should include a description or discussion of the following:

a. the TS changes being proposed and the reasons for seeking the changes (Regulatory Position C.1, Element 1),

b. summary of the engineering analyses conducted to justify the proposed TS changes, and evidence that they meet the principles described in this RG (Regulatory Position C.2, Element 2),

c. compliance with current regulations, orders, and license conditions (Regulatory Position C.2.1, Principle 1),

d. defense-in-depth evaluation (Regulatory Position C.2.2.1, Principle 2),

e. safety margins evaluation (Regulatory Position C.2.2.2, Principle 3),

f. risk impact evaluation (Regulatory Positions C.2.3-2.5, Principle 4):

(1) acceptability of the PRA models used to evaluate proposed TS changes (Regulatory Positions C.2.3.1, C.2.3.2, and C.2.3.3),

(2) changes made to the PRA models used to evaluate proposed TS changes (including data developed and used in addition to the plants PRA database) (Regulatory Position C.2.3.3),

(3) assumptions of the PRA analysis used to evaluate proposed TS changes (Regulatory Position C.2.3.4),

(4) sensitivity and uncertainty analyses performed and associated results (Regulatory Position C.2.3.5),

(5) approach used for identifying the dominant risk-significant plant configurations associated with proposed TS changes and identifying these plant configurations; discussion of how these plant configurations will be prohibited (e.g., by TS or plant procedures) during the TS outage; discussion of any compensatory measures proposed as part of the TS change evaluation; presentation of the risk impact of these compensatory measures either quantitatively or qualitatively (Regulatory Position C.2.3.6, Tier 2),

(6) capability of the risk-informed plant configuration control program to perform contemporaneous assessments of the overall impact on safety of proposed plant configurations, including an explanation of how these tools or other processes will be used to ensure that risk-significant plant configurations will not be entered and that appropriate DG-1287, Page 24

actions will be taken when unforeseen events put the plant in a risk-significant configuration (Regulatory Position C.2.3.7, Tier 3),

(7) risk measures used in evaluating the proposed TS changes, providing the calculated risk measure values associated with the TS change evaluation (including intermediate results) and discussing how they align with the risk-acceptance guidelines presented in this RG in addition to those in RG 1.174, as applicable; if the risk metrics approach or slightly exceed the acceptance guidelines, address the additional aspects of plant risk and operation identified in Section C.2.6 of RG 1.174 (Regulatory Position C.2.4), and (8) comparison of the risk of available alternatives, as applicable (Regulatory Position C.2.5).

g. the integrated decision to determine final acceptability of the proposed TS change (Regulatory Position C.2.6),

h. implementation and monitoring program (Principle 5), including use of the Maintenance Rule program (10 CFR 50.65) (Regulatory Position C.3, Element 3),

i. a marked-up copy (e.g., redline markup) of the relevant TS and bases, including adequate information to provide the technical basis for the revised CT or SF, and

j. all other documentation required to be submitted with a license amendment request.

DG-1287, Page 25

D. IMPLEMENTATION The NRC staff may use this regulatory guide as a reference in its regulatory processes, such as licensing, inspection, or enforcement. However, the NRC staff does not intend to use the guidance in this regulatory guide to support NRC staff actions in a manner that would constitute backfitting as that term is defined in 10 CFR 50.109, Backfitting, and as described in NRC Management Directive 8.4, Management of Backfitting, Forward Fitting, Issue Finality, and Information Requests, nor does the NRC staff intend to use the guidance to affect the issue finality of an approval under 10 CFR Part 52, Licenses, Certifications, and Approvals for Nuclear Power Plants. The staff also does not intend to use the guidance to support NRC staff actions in a manner that constitutes forward fitting as that term is defined and described in Management Directive 8.4. If a licensee believes that the NRC is using this regulatory guide in a manner inconsistent with the discussion in this Implementation section, then the licensee may file a backfitting or forward fitting appeal with the NRC in accordance with the process in Management Directive 8.4.

DG-1287, Page 26

REFERENCES

1. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 3, January 2018, Washington, DC. 5

2. Code of Federal Regulations, Domestic Licensing of Production and Utilization Facilities, Part 50, Chapter I, Title 10, Energy.

3. Code of Federal regulation, Licenses, Certifications, and Approvals for Nuclear Power Plants, Part 52, Chapter I, Title 10, Energy.

4. U.S. Nuclear Regulatory Commission, NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, Washington, DC.

5. U.S. Nuclear Regulatory Commission, NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed DecisionmakingFinal Report, Revision 1, March 2017, Washington, DC.

6. U.S. Nuclear Regulatory Commission, RG 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, Revision 4, August 2018, Washington, DC.

7. U.S. Nuclear Regulatory Commission, RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009, Washington, DC.

8. Atomic Energy Commission, Part 50Licensing of Production and Utilization Facilities Technical Specifications for Facility Licensees; Safety Analyses Reports, Federal Register, Vol. 33, No. 244, December 17, 1968, pp. 18610-18613.

9. NRC, Use of Probabilistic Risk Assessment Methods in Nuclear Regulatory Activities; Final Policy Statement, Federal Register, Vol. 60, No. 158, August 16, 1995, pp. 42622-42629.

10. NRC, NUREG-1430, Standard Technical Specifications, Babcock and Wilcox Plants, Washington, DC.

11. NRC, NUREG-1431, Standard Technical Specifications, Westinghouse Plants, Washington, DC.

12. NRC, NUREG-1432, Standard Technical Specifications, Combustion Engineering Plants, Washington, DC.

13. NRC, NUREG-1433, Standard Technical Specifications, General Electric Plants, BWR/4, Washington, DC.

5 Publicly available NRC published documents are available electronically through the NRC Library on the NRCs public Web site at http://www.nrc.gov/reading-rm/doc-collections/ and through the NRCs Agencywide Documents Access and Management System (ADAMS) at http://www.nrc.gov/reading-rm/adams.html. The documents can also be viewed online or printed for a fee in the NRCs Public Document Room (PDR) at 11555 Rockville Pike, Rockville, MD. For problems with ADAMS, contact the PDR staff at 301-415-4737 or (800) 397-4209; fax (301) 415-3548; or e-mail pdr.resource@nrc.gov.

DG-1287, Page 27

14. NRC, NUREG-1434, Standard Technical Specifications, General Electric Plants, BWR/6, Washington, DC.

15. NRC Inspection Manual Chapter 0326, Operability Determinations, October 1, 2019, Washington, DC (ADAMS Accession No. ML19273A878).

16. NRC, Generic Letter 80-30, Clarification of the Term Operable as It Applies to Single Failure Criterion for Safety Systems Required by TS, April 10, 1980, Washington, DC.

17. International Atomic Energy Agency Safety Guide SSG-3, Development and Application of Level 1 Probabilistic Safety Assessment for Nuclear Power Plants Specific Safety Guide, Vienna, Austria, 2010.6

18. International Atomic Energy Agency Safety Guide SSG-4, Development and Application of Level 2 Probabilistic Safety Assessment for Nuclear Power Plants Specific Safety Guide, Vienna, Austria, 2010.

19. International Atomic Energy Agency Safety Standards SSR-2/1, Safety of Nuclear Power Plants:

Design, Vienna, Austria, 2016.

20. NRC, Final Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors, Federal Register, Vol. 58, No. 139, July 22, 1993, pp. 39132-39139.

21. NRC, Technical SpecificationsFinal Rule, Federal Register, Vol. 60, No. 138, July 19, 1995, pp. 36953-36959.

22. NRC, SRM on SECY-98-144, Staff RequirementsSECY-98-144White Paper on Risk-Informed and Performance-Based Regulation, March 1, 1999, Washington, DC (ADAMS Accession No. ML003753601).

23. NRC, NUREG/CR-6141, BNL-NUREG-52398, Handbook of Methods for Risk-Based Analyses of Technical Specifications, December 1994, Washington, DC (ADAMS Accession No. ML093090361).

24. NRC, NUREG/CR-5775, BNL-NUREG-52296, Quantitative Evaluation of Surveillance Test Intervals Including Test-Caused Risks, February 1992, Washington, DC (ADAMS Accession No. ML19172A254).

25. Nuclear Energy Institute (NEI) 96-07, Guidelines for 10 CFR 50.59 Evaluations, February 22, 2000, Washington, DC (ADAMS Accession No. ML003686043).

26. Nuclear Management and Resources Council (NUMARC) 93-01, Revision 4F, Industry Guidelines for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, April 2018, Washington, DC (ADAMS Accession No. ML18120A069). 7 6 Copies of International Atomic Energy Agency (IAEA) documents may be obtained through the IAEA Web site:

WWW.IAEA.Org/ or by writing the International Atomic Energy Agency, P.O. Box 100 Wagramer Strasse 5, A-400 Vienna, Austria.

7 Publications from the Nuclear Energy Institute (NEI) are available at their Web site: http://www.nei.org/ or by contacting the headquarters at Nuclear Energy Institute, 1776 I Street NW, Washington DC 20006-3708, Phone: 202-739-800, Fax 202-785-4019.

DG-1287, Page 28

27. NRC, Management Directive 8.4, Management of Facility-Specific Backfitting and Information Collection.

DG-1287, Page 2

APPENDIX A CONSIDERATIONS AND DATA NEEDS FOR TECHNICAL SPECIFICATION CHANGE RISK EVALUATIONS A-1 Other Considerations in Technical Specification Change Risk Evaluations A-1.1 Risk-Informed Measures for Technical Specification Changes to Completion Times and Surveillance Frequencies This section lists the risk-informed measures used in completion time (CT) and surveillance frequency (SF) evaluations.1 NUREG/CR-6141, Handbook of Methods for Risk-Based Analyses of Technical Specifications, issued December 1994 (Ref. 1), discusses these measures in more detail.

The measures applicable for CT evaluations include the following:

a. conditional risk given the limiting condition of operation (LCO),

b. incremental conditional core damage probability (ICCDP), and

c. yearly CT risk.

When comparing the risk of shutting down with the risk of continuing power operation for a given LCO, the following measures apply:

a. risk of continued power operation for a given downtime, like ICCDP, and

b. risk of shutting down the plant for the same downtime.

The following measures apply for SF evaluations:

a. test-limited risk, and

b. test-caused risk.

Similar to the CT evaluations, the risk contributions for preventive maintenance (PM) include the following:

a. single PM risk, and

b. yearly PM risk.

The risk associated with simultaneous outages of multiple components, called configuration risk, is calculated as part of CT changes. The three-tiered approach discussed in Regulatory Position 2.3 of this regulatory guide (RG) includes calculations of risks for multiple components that may be taken down together. The following applicable measures are similar to the CT measures stated above:

a. conditional risk (e.g., increase in core damage frequency (CDF)) caused by the configuration, and

b. increase in risk (e.g., core damage probability, which is obtained by multiplying the increase in CDF by the duration of the configuration for the occurrence of a given configuration).

1 The improved Standard Technical Specifications (NUREGs 1430-1434) use completion time and surveillance frequency in place of allowed outage time and surveillance test interval.

DG-1287, Appendix A, Page A-1

If different measures are used, the licensee should provide adequate discussions of them in its submittal.

A-1.2 Measures for Multiple Technical Specification Changes When multiple technical specification (TS) changes are being considered, the combined impact of the individual changes should also be considered. The following sections discuss the considerations related to the calculation of total impacts.

A-1.2.1 Measures That Can Be Combined for Multiple Technical Specification Changes When considering risk contributions from several CTs, the risk measures can be combined according to the following guidelines:

a. The ICCDPs from several CTs do not generally interact nor accumulate to give a total contribution because the single CT risks are conditional risks per event, and the downtime events for the different CTs are different events. The only time that ICCDPs should be considered simultaneously is when multiple components can be down at the same time, constituting the same event. Such a case is referred to as a downed configuration, or simply a configuration. The risk contribution associated with a configuration is referred to as the configuration risk and is evaluated separately as a multiple component downtime. Conducting maintenance on several components is a principal cause of potentially high configuration risks.

b. Yearly CT risk contributions from several CTs can interact and should be accumulated to give the total yearly contribution from all the CTs being considered. When the CTs do not interact (i.e., when the downed components are not in the same minimal cutset), the yearly CT risk contribution from several CTs is the sum of the individual yearly CT risk contributions. When the CTs do interact (i.e., when two or more of the downed components are in the same minimal cutset), interaction of the CT risk contributions should be considered.

c. When calculating the test-limited risk for changes in multiple SFs, the total test-limited risk should be properly evaluated. Simple addition of individual test-limited risks will not provide the combined test-limited risk. In a simple addition, the total test-limited risk contribution is underestimated because the interacting terms are neglected.

A-1.2.2 Total Impact of Multiple Changes When multiple changes are requested, the total collective risk impact from all the changes should be evaluated. For example, for a group of CT and SF changes, this includes the total impact of all the requested CT changes, SF changes, and CT and SF changes.

If multiple changes are made, the impact of each change is assessed individually; as a check, the plant probabilistic risk assessment (PRA) should be used to quantify the total impact.

A-1.3 Quantification of Risk Measures A-1.3.1 Alternative Ways of Calculating Technical Specification Change Risk Measures In calculating the measures discussed for evaluating TS changes, two specific risk levels should be quantified using PRA. Focusing on the CDF level, the risk levels are R1, the increased risk level (e.g., CDF) with the component assumed down or equivalent component unavailability set to true, and DG-1287, Appendix A, Page A-2

R0, the reduced CDF with the component assumed up; that is, the component unavailability is set to false.

A-1.3.1.1 Using Probabilistic Risk Assessment to Obtain Completion Time, Preventive Maintenance, and Configuration Risk Contributions R1 can be calculated by setting the component-down event to a true state in the PRA. Similarly, R0 can be calculated by setting the component-down event to a false state in the PRA. The component-down event in the PRA is the event describing that the component is down for repair or maintenance. If the existing minimal cutsets include the component-down event, these minimal cutsets can be used to determine R1 and R0 provided the minimal cutsets sufficiently cover the contribution of the down event. The existing minimal cutsets are sufficient if those containing the down event are not all near the truncation limit (i.e., are not all within a factor of 10 of the truncation limit).

Alternatively, the minimal cutsets are sufficient if those containing the down event have a nonnegligible contribution (i.e., a contribution greater than or equal to 1 percent). If the existing minimal cutsets are sufficient, the increased risk level R1 can be determined by setting the component-down unavailability to 1 and deleting larger minimal cutsets that contain smaller minimal cutsets (i.e., those absorbed by the smaller minimal cutsets). If any minimal cutsets contain complementary events, they also should be removed if they are inconsistent with the component being down. The reduced risk level R0 can be determined analogously by setting the down unavailability to zero.

If the existing minimal cutsets do not contain the component-down event, or if there is a question on the coverage of the existing minimal cutsets, the minimal cutsets should be regenerated. R1 is determined by setting the down-component event in the PRA models to a true state. The truncation limit of the minimal cutset can be reduced by at least a factor of 10 to give added assurance of sufficient coverage. The minimal cutsets that are generated using the reduced truncation limit can then be used to determine R1 by setting the down unavailability to zero.

Contributions from common-cause failures (CCFs) need special attention when calculating the increased risk level R1. If the component is down because of a failure, the common-cause contributions involving the component should be divided by the probability of the component being down because of failure since the component is given to be down. If the component is down because it is being brought down for maintenance (but not failed), the CCF contributions involving the component should be modified to remove the component and to only include failures of the remaining components (also see Regulatory Position 2.3.3 of this RG).

If other components are reconfigured while the component is down, these reconfigurations can be incorporated in estimating R1 or R using the PRA. If other components are tested before repair or if maintenance is carried out on the downed components, the conduct of these tests and their outcomes also can be modeled. If other components are more frequently tested when the component is down for the conditions addressed by the CT, this increased frequency of testing also can be incorporated into the PRA.

These modeling details are sometimes neglected in the PRA because of their apparently small contribution. However, when isolating the CT risk contributions and in justifying modified CTs, these details can become significant.

DG-1287, Appendix A, Page A-3

A-1.3.1.2 Appropriate Use of Probabilistic Risk Assessment Minimal Cutsets As indicated, a PRA computes the yearly CT risk contribution to the yearly CDF. Basically, the yearly CT risk contribution is the sum of the minimal cutset contributions containing the component-down unavailability (typically for maintenance) qm, qm = f d where f is the downtime frequency and d is the downtime associated with the CT. The downtime d usually is estimated as an average downtime associated with the CT. If the minimal cutsets sufficiently cover the downed unavailability, those that contain the downed unavailability, qm, can be summed to give the yearly CT risk contribution, Ry.

A-1.3.1.3 Using the Probabilistic Risk Assessment to Determine the Test-Limited Risk Contribution The PRA can be used to calculate the increase in the risk-level R and to obtain the component unavailability, q, which are the contributing factors in calculating the test-limited risk contribution. The preceding and following sections discuss considerations involved in calculating R1 and R0 to obtain R.

When the effect of change in SF for one or more components is being evaluated, the PRA can directly calculate the change in the risk measure (e.g., in the CDF). The calculation of PRA results, when changed SFs are included, incorporates interactions among the SFs. The differences between the results (i.e., CDF when the SFs are changed from the baseline CDF) provide the test-limited risk contribution for changing the SFs.

Such a calculation should include appropriately modified contributions of CCFs. The common-failure terms modeled as a function of the SF should be modified to reflect the new SF.

Typically, CCFs are modeled using a -factor or multiple Greek letter model when the CCF of multiple components is a function of the SF. When changing SFs, care should be taken to change this term within the common-cause contribution. The common cause of failing multiple components resulting from human error following a test is not a function of the SF, but it may be affected by the test strategy used.

When different test strategies are being evaluated, the human error term should be evaluated.

Specific assumptions that were used in quantifying the human error common-cause term should be identified and checked if they apply to the test strategy being analyzed. For example, if the term was developed assuming a sequential test strategy, but a staggered test strategy is being analyzed, the term should be modified to reflect this change. The failure probability from a common-cause human error for a staggered test strategy is expected to be significantly lower than that for the sequential test strategy.

A-1.3.1.4 Using Minimal Cutsets To Calculate Test-Limited Risks The test-limited risk for a component or a set of components also can be determined by identifying those minimal cutsets that contain one or more of the SF contributions. The sum of the relevant minimal cutset contributions is then equal to the test-limited risk. To evaluate changes in the test-limited risks for changes in the SFs, the difference between the minimal cutset contributions with and without the SF changes will be the difference between the test-limited risks. In using the minimal cutsets, the SF contributions should all be included in the set of minimal cutsets used. Even though use of the minimal cutsets gives the same results, the above basic description of methods for obtaining the test-limited risks is useful because it shows the basic contributing factors to the SF risk.

DG-1287, Appendix A, Page A-4

A-1.3.1.5 Specific Considerations for Evaluating Multiple Test-Limited Risks When multiple SFs are modified or defined, the total test-limited risk from the multiple SF changes or definitions should be properly evaluated. Instead of using the PRA to evaluate all the changes in a given run, the individual test-limited risks can be evaluated one at a time, provided that the updated SFs are used for the other relevant components. An iterative procedure can then be used, in which individual SFs are successively updated using the methods described above for individual component SF risk contributors. These one-at-a-time, or iterative, evaluations are useful if acceptable guidelines on test-limited risks are defined and the SFs are selected to satisfy the risk guidelines.

A-1.3.2 Appropriate Calculation of Conditional Core Damage Frequency A-1.3.2.1 Conditional Core Damage Frequency for Failure of a Component To calculate the conditional CDF when a component is failed (typically represented by R1 in this RG), the component unavailability is changed to the true, or T, state. However, the component unavailability may be modeled in terms of many contributors: random failure, maintenance downtime, test downtime, and CCF. The CCF term represents the failure probability of two or more redundant components that include the failed component in question. The CCF term is modeled as a product of multiple terms (e.g., using the -factor model for two redundant components, the CCF term is times the component unavailability from random failures) but may be represented by one parameter.

Consider a component Q in train A of a safety system and let QLA, QMA, and QTA represent the components unavailability from random failures, maintenance downtimes, and test downtimes, respectively. Also, let QC = QL be the term for CCF of the redundant components in trains A and B, where QL is numerically equal to QLA and represents QLA or QLB. QLB is the unavailability of a component in train B from random failure. Usually, the terms QLA, QMA, QTA, and QC will be part of the PRA input data.

To calculate the conditional CDF, given that the component is failed, the component unavailability should be represented by the T state. This means that QLA, QMA, and QTA should be changed to the T state and QC should be divided by QLA since the component is down because of failure. In principle, changing one of the three conditions (QLA, QMA, QTA) to the T state should suffice. However, in many cases, truncated cutsets are used to calculate the conditional CDF, and changing all three will ensure that the failed state of the component is represented. For this example, QC will be changed to , which represents the conditional failure probability of the redundant component.

When QC represents the failure of more than two components, QC will be converted to the failure probability of the remaining componentsin this case, two components.

A-1.3.2.2 Conditional Core Damage Frequency When a Component Is Down (but Not Failed) for Preventive Maintenance To calculate the conditional CDF when a component is taken down for PM (R1 for PM analyses),

the CCF term should be treated differently from that described above for the failure of the component.

Considering the same example as above, the down state of the component is represented by changing QLA, QMA, and QTA to T and by changing QC to QL, which is numerically the same as QLB or QLA. The CCF term is changed to represent the unavailability of the remaining component and not because the initial component is already down for PM and not because of failure. If the redundant component is successfully tested before taking the component down for PM, QC can then be equated to zero for a short-duration PM (i.e., when the duration of the PM is much less than the test interval).

DG-1287, Appendix A, Page A-5

A-1.3.2.3 Conditional Core Damage Frequency When the Component Is Not Down for Maintenance or Is Tested Operable The conditional CDF is reduced when the component is not down for maintenance or when it has just successfully been tested. The calculation of CT and SF risk contributions involves calculating this conditional CDF (R0). For evaluating the CT risk contribution, R0 signifies that the component is not down for test or maintenance, and setting test and maintenance downtime unavailabilities to the false, or F, state represents this condition. In this example, QMA and QTA should be changed to the F state. For SF evaluations, R0 signifies that the component is up, which is known from the test and is represented by setting its unavailability to false. In this example, QLA, QMA, and QTA should be changed to the F state. In many cases, the reduction in CDF from the baseline CDF is negligible.

A-1.3.2.4 Conditional Core Damage Frequency When Multiple Components Are Involved To calculate conditional CDFs (R1 and R0) when multiple components are involved, the corresponding terms relating to each of the components should be changed to the T or F state. For each component, the corresponding terms relating to random failures, CCFs, test downtimes, and maintenance downtimes should be converted, as discussed above. When all the components modeled by a common-cause term are failed, this term changes to the T state for calculating R1. Otherwise, it is modeled as discussed above, representing the unavailability of the remaining components. In many PRA computer codes, the CCF term does not retain the specific component designator (e.g., a unique notation identifying the specific component involved may not be part of the name of the CCF term), and the relevant term cannot directly be identified by searching the names of the input parameters of the PRA.

The description of the CCF terms modeled in the PRA may need to be examined to identify the relevant term or the input parameter.

A-1.3.3 Treatment of Common-Cause Failure and Recovery Factors The treatment of CCF in estimating the conditional CDF for CT and SF evaluations was discussed earlier. Also discussed are the appropriate considerations in modifying CCF terms modeled in the PRA (to include the effect of a component being unavailable because of failure, maintenance, or testing and for implementing a staggered test strategy). In addition, since the CCF contributions can be a dominant contributor, sensitivity analyses with respect to these parameters may be appropriate (see Regulatory Position 2.3.5 of this RG). Recovery factors used in the PRA model perhaps should be reviewed to learn whether the component assumed to be down because of failure is credited to be recovered. For example, consider that a TS change for an emergency diesel generator (EDG) is being evaluated, and conditional CDF for the EDG being down is being calculated. Then, if the cutsets used to calculate the conditional CDF take credit for the same EDG being recovered, such recovery factors should be modified. In such cases, no credit should be taken.

A-1.3.4 Calculations of Transition Risk Transition risk is calculated to compare the risk of continuing operation in a given LCO to that of a transition to plant shutdown. Such companions can be used to decide which option is preferable and which alternatives may be used. Such evaluations particularly apply to systems used to remove decay heat. The following considerations apply in calculating transition risk:

a. Various stages of the shutdown cooling phases and the operators interactions should be modeled to assess the impact on the CDF of shutting down the plant in an LCO.

DG-1287, Appendix A, Page A-6

b. Any initiating event not modeled in the basic PRA but important during the shutdown phases should be modeled. Specific examples are those events that challenge the residual heat removal (RHR) system and that can render part of it unavailable. Additionally, the frequency of initiating events during the transition to shutdown may have to be reassessed since it may differ from that during power operation (e.g., more frequent loss of offsite power or loss of main feedwater during the transition to shutdown).

c. Different recovery paths applicable at various stages of shutdown should be modeled to realistically quantify the risk of shutting down, considering the diminishing levels of decay heat.

d. Available time margins for uncovering the reactor core and heating up the suppression pool (in a boiling-water reactor) or drying out the steam generator (in a pressurized-water reactor) should be modeled to evaluate specific accident sequences.

A-2 Data Needs for Technical Specification Change Evaluations A request for plant-specific TS changes should use plant-specific data and not rely solely on generic data or data from similar plant designs. Usually, TS changes are requested because plant operation indicates that such changes are needed and, accordingly, plant-specific data are expected to be available. For the components or systems for which TS changes are being considered, plant-specific data should be evaluated, and assurance should be obtained that the data used are consistent with the plant experience. The use of other than plant-specific data should be justified.

When a generic analysis uses a representative plant model, the incorporation of generic data from similar plants is acceptable. The generic data should bound the specific plants under consideration, not an average plant.

A-2.1 Care in Using Plant-Specific Data When using plant-specific data to update input parameters of the PRA during a TS change evaluation (in addition to those used during the latest update of the PRA), care should be taken to ensure that such data are consistently used both for the base case, where existing TS requirements apply, and the change case, where TS changes are incorporated. This provides assurance that the increase in the risk measure obtained is associated with the TS change only and not with the use of plant-specific data in aspects of plant operation.

This situation typically arises when recent plant-specific data are evaluated and reduced values of the parameters are obtained. Use of the reduced values may negate the risk increase from the TS change and may give an erroneous impression that the TS change has reduced the risk. When the base case is also updated, such difficulties are avoided. Sensitivity and uncertainty analyses should also be performed using the same set of input data.

A-2.2 Considerations When Generic Data Are Used When using generic data for the TS parameters in evaluating TS changes, the focus should be on justifying small changes that do not strongly depend on the data parameters. The reasons why generic data are being used and why generic data apply to plant-specific evaluations should be presented. In many cases, because of limited experience, the use of plant-specific data may result in very optimistic values justifying the use of generic data.

DG-1287, Appendix A, Page A-7

A-2.3 Specific Data Needs Basic data needed for a TS change evaluation (using PRA information) for risk-informed regulation are those collected as part of the PRA. Comparative risk calculations for LCO changes require no additional data beyond those in the full-power operations Level 1 and the low-power/shutdown Level 1 PRAs. The following sections discuss additional data needs for evaluating changes in TS requirements, such as SFs and CTs.

A-2.3.1 Maintenance Downtime Data Maintenance downtime data should be partitioned into plant-specific unplanned unavailability for unscheduled maintenance and planned unavailability for PM or testing. For this purpose, data are needed on the frequency of events leading to planned and unplanned maintenance (i.e., the number of occurrences of each type of downtime event during a given time period) and the time interval for each occasion the component was out of service. These data are also needed for judging whether an adequate CT is being provided to complete a repair. The distribution of downtimes also can be used to estimate the expected risk for a given CT.

The distribution of time for unscheduled maintenance may shift with a change in a CT. For this reason, information about such an influence on the distribution is not expected to be available when the CT change is being evaluated. The average downtime can be assumed to proportionally increase with the increase in the proposed CT for downtimes associated with unscheduled maintenance. For scheduled (preventive) maintenance, the downtime assumed can be representative of plant practices (e.g., one-half of the CT).

A-2.3.2 Maintenance Schedules and Frequency Maintenance schedule and frequency data include the maintenance scheduling used by the plant for defining the situations in which multiple equipment or system trains may be taken down for PM.

These schedules are important to ensure that high risks from components being down simultaneously, implicitly allowed by the TS change, do not occur. The maintenance frequency or frequency of downtime for a component may be from 3 to 10 times higher than the failure frequency. Since CTs can be used for maintenance, the frequency of maintenance should be incorporated in estimating the downtime frequency.

A-2.3.3 Data Relating to Component Testing The following data related to component testing, in addition to those available as part of the PRA study, form part of a TS change evaluation relating to surveillance requirements:

a. The evaluation should list the components being tested, any component realigned from the safety position during a test, the duration of the test, and the test frequency recommended by the manufacturer.

b. The evaluation should include the efficiency of the test (i.e., the failure modes detected by the test with regard to aspects such as components and support system interfaces). Bounding assumptions can be made if obtaining detailed data or related information is costly.

c. The analyses should account for any potential negative effects of surveillance testing (e.g., that may cause the potential for introducing plant transients or that may cause unnecessary wear of the equipment). Preliminary evaluations can be used to determine the need for a more detailed analysis.

DG-1287, Appendix A, Page A-8

d. The evaluation should state the test strategy used for the redundant components in a system (i.e., whether staggered or sequential testing is performed). The standard PRA quantification assumes that components follow no specific schedule and are randomly placed. Staggering the test times of components in different trains will reduce the test-limited risk contribution for the same SFs as compared to the PRA assumption. Conversely, if the tests are carried out sequentially, the test-limited risk will increase compared to the PRA assumptions.

A-2.3.4 Parameters for Component Unavailability The component unavailabilities used in a PRA contain several relevant parameters for evaluating TS changes. These parameters should be delineated, as modeled, to facilitate evaluations to be conducted and their review by the regulatory authority. The following desirable parameters contribute to the estimated component unavailability:

a. component failure rate,

b. component test interval,

c. maintenance/repair downtime contribution (i.e., maintenance frequency, downtime for scheduled and unscheduled maintenance),

d. test downtime, if applicable,

e. human errors following test or maintenance, if modeled, and

f. separation of cyclic-demand versus standby time contribution, if modeled.

A-2.3.5 Separating Demand and Standby Time Contributions to Unavailability Since the test-limited risk (typically defined as RD) is associated with a failure occurring between tests, the standby time-related failure rate should be used in calculating the test-limited risk. The standby time-related failure rate is associated with what could occur while the component is in standby between tests. Test-limited risk contributes to increases in risk associated with longer test intervals caused by the longer time to detect standby-stress failures. The time-related failure rate is expressed in units per time period, such as per hour. Estimating RD requires the standby stress failure rate of the component and the proposed SF.

The failure probability of a component consists of a time-related contribution (the standby time-related failure rate) and a cyclic, demand-related contribution (the demand stress failure probability).

The latter is the probability contribution associated with failures that are caused by demanding, starting, or cycling the component, which include (but are not necessarily limited to) test-caused transients (discussed in Section A-2.3.6). Since the test-limited risk, RD, is associated with a failure occurring between tests, the failure rate that should be used in calculating the test-limited risk is the time-related standby stress failure rate. From the total number of failures on demand, the number of failures caused by standby stress and the number of failures from demand stresses can be partitioned by either an engineering analysis of failure causes or by a graphical method based on the relationship between the observed number of failures and the SFs from which the failures came.

The test-caused contribution to risk is primarily composed of Rdown, the risk contribution caused by the unavailability of equipment from aligning the equipment away from its preferred position or state DG-1287, Appendix A, Page A-9

to conduct a test, when there is no automatic return to the preferred position. The additional data needed for estimating this parameter are the SF and the out-of-service time needed for each test.

Dividing the failure probability into a time-related and cyclic demand-related contribution results in a lower test-limited risk because only part of the components failure rate is treated as time related.

However, treating only part of the failure rate as time related when this is not the case underestimates the test-limited risk; therefore, such a breakdown of the failure rate should be justified through data or engineering analyses.

In addition, sometimes only the failure probability (i.e., the component unavailability, q) may be provided without giving a failure rate. In such a case, the effect of a change in the SF cannot be evaluated unless the component test interval previously used for T is used to convert the unavailability, q, in terms of and T. When the breakdown between time-related and cyclic demand-related contribution is unknown, all failures can be assumed to be time related to obtain the maximum test-limited risk contribution.

In summary, the data required for measuring a change in risk with a change in the SF are a breakdown of the failure probability of the component into its time-related and demand-related components, the proposed SF, and the out-of-service time for surveillance testing of the component.

A-2.3.6 Test-Caused Transients To evaluate and identify the test-caused transients risk (typically defined as RC), transient events, as well as those caused by a test, should be identified. In most cases, this requires reading through the description of transients that have occurred and noting those caused by the test. When reduced SFs are allowed, the resulting reduction in test-caused transients per unit time tends to cause decreases in risk because there are fewer adverse effects of testing over that longer test interval (which, however, will be partially or wholly balanced by increases in RD that are caused by the longer time period before detection and correction of failures).

The transient events are obtained from the following plant operating data:

a. Performance indicator reports: These reports list the number of reactor trips and safety system actuations at each plant, the date of the events, and the numbers of the relevant licensee event reports (LERs).

b. LER system: LERs describe reactor trips.

When test-caused transients for a single plant are evaluated, the plant-specific data may be sparse unless the plants operating experience covers a substantial period. When plant-specific data are sparse, more data may be used from the operating experience of other plants of similar vintage (e.g., other Type 4 Boiling-Water Reactors (BWR/4s)), assuming the likelihood of occurrence of test-caused transients is similar for all the plants in the database. (The performance indicator reports categorize plants according to design classes.) Testing, however, tends to be very plant specific; therefore, cross-plant data applicability must be evaluated in detail.

A-2.3.7 Data for Evaluating Transition Risk Data available in a PRA for full-power operation provide the basic information for evaluating the transition risks when a plant is being shut down for an LCO. In addition, the PRA for low-power and shutdown operations, if available, will significantly ease the acquisition of the data necessary for DG-1287, Appendix A, Page A-10

evaluating the risk of shutdown. The low-power and shutdown PRAs typically contain relevant data, such as the durations of shutdown phases and the frequencies of initiators that may occur during shutdown operation (e.g., loss of RHR).

The full-power PRA is available for most operating plants, but the low-power and shutdown PRAs are only available for some plants. Hence, the following data are needed to evaluate transition risk assuming that only data from a full-power PRA are available:

a. Plant-specific data on shutdown operations: To analyze shutdown phases in detail, plant-specific information may be needed, such as operating and abnormal procedures, shift supervisors log books, or monthly operating reports. Data on timing of the plant shutdown and operational preferences of equipment during plant shutdown can be extracted from this information.

b. Plant-specific deterministic data: The evaluation of heatup and recovery scenarios, including estimates of heatup time, requires some design data on the plant, such as the temperature of the ultimate heat sink or the cooling capacity of the RHR system. These data typically are available from the plants final safety analysis report.

c. Frequency of transients during controlled shutdown: The LERs for the plant may need to be reviewed in order to evaluate the likelihood of transients during controlled shutdown. The likelihood of a transient during a shutdown may differ from that during power operation (this should be considered).

REFERENCE2

1. NRC, NUREG/CR-6141, BNL-NUREG-52398, Handbook of Methods for Risk-Based Analyses of Technical Specifications, December 1994, Washington, DC (ADAMS Accession No. ML093090361).

2 Publicly available NRC published documents are available electronically through the NRC Library on the NRCs public Web site at http://www.nrc.gov/reading-rm/doc-collections/ and through the NRCs Agencywide Documents Access and Management System (ADAMS accession No. ML093090361) at http://nrc.gov/reading-rm/adams.html.

The documents can also be viewed online or printed for a fee in the NRCs Public Document Room (PDR) at 11555 Rockville Pike, Rockville, MD. For problems with ADAMS, contact the PDR staff at 301-415-4737 or (800) 397-4209; fax (301) 415-3548; or e-mail pdr.resource@nrc.gov.

DG-1287, Appendix A, Page A-11