ML20118C231

Draft NRC Guidance for Determining Safety Impact

ML20118C231
Person / Time
Issue date:	05/04/2020
From:	Audrey Klett, Antonios Zoulis NRC/NRR/DORL/LPL2-1
To:
Klett, A L
References
Download: ML20118C231 (28)

Text

U.S. NUCLEAR REGULATORY COMMISSION GUIDELINES FOR CHARACTERIZING THE SAFETY IMPACT OF ISSUES Prepared by:

Antonios M. Zoulis Office of Nuclear Reactor Regulation 2

TABLE OF CONTENTS

1.0 INTRODUCTION

............................................................................................................... 1 1.1 Purpose ................................................................................................................ 1 1.2 Scope ................................................................................................................... 2 1.3 Content of this Guidance Document .................................................................... 2 2.0 DEFINING THE ISSUE ..................................................................................................... 4 2.1 Assessing the Preliminary Screening Questions ................................................. 4 2.2 Assessing the Preliminary Risk Impact using Quantitative Analysis .................... 6 2.3 Important Considerations ..................................................................................... 7 2.4 Documentation ..................................................................................................... 8 3.0 EXPLORING THE IMPACT OF THE ISSUE..................................................................... 9 3.1 Generic Assessment Expert Team (GAET) ......................................................... 9 3.2 Plant Integrated Decision-Making Panel (IDP)................................................... 10 3.3 Documentation ................................................................................................... 11 4.0 FINALIZING THE SAFETY IMPACT CHARACTERIZATION ......................................... 12 4.1 Step 1 - Screening for No Impact ....................................................................... 14 4.2 Step 2 - Screening for Minimal Impact ............................................................... 14 4.3 Step 3 - Determining Safety Impact Using Quantitative Analyses ..................... 18 4.4 Step 4 - Assess need for Risk Management Actions ........................................ 19 5.0 ASSESSING CUMULATIVE RISK .................................................................................. 20 6.0 REGULATORY PROCESS FOR LICENSE MODIFICATION ......................................... 23

7.0 REFERENCES

................................................................................................................ 23 i

LIST OF FIGURES AND TABLES Figure 1-1: Safety Impact Characterization Process Overview.................................................... 3 Figure 4-1: Safety Impact Characterization Detailed Process Overview ................................... 13 Figure 5-1: Safety Impact Criteria for Permanent Changes Impacting CDF .............................. 21 Figure 5-2: Safety Impact Criteria for Permanent Changes Impacting LERF ............................ 22 Table 5-1: CDF Safety Impact Criteria ....................................................................................... 21 Table 5-2: LERF Safety Impact Criteria ..................................................................................... 22 ii

ABBREVIATIONS AND ACRONYMS ACRS Advisory Committee on Reactor Safeguards ASME American Society of Mechanical Engineers ATWS Anticipated Transient without Scram CDF Core Damage Frequency EDG Emergency Diesel Generators EDMG Extensive Damage Mitigation Guidelines EOP Emergency Operating Procedure EP Emergency Planning FLEX Diverse and Flexible Coping Strategy for Extended Loss of Power GAET Generic Assessment Expert Team IDP Integrated Decision Panel IPE Individual Plant Examination IPEEE Individual Plant Examination External Events ISI In Service Inspection LERF Large Early Release Frequency LOCA Loss of Coolant Accident MSPI Mitigating Systems Performance Index NEI Nuclear Energy Institute NFPA-805 National Fire Protection Association (Standard) 805 NRC Nuclear Regulatory Commission NTTF NRC (Fukushima Lessons Learned) Near Term Task Force PI Performance Indicator PORV Power Operated Relief Valve PRA Probabilistic Risk Assessment RCP Reactor Coolant Pump RMA Risk Management Action ROP Reactor Oversight Process SDP Significance Determination Process SGTR Steam Generator Tube Rupture SME Subject Matter Expert SRO Senior Reactor Operator SSC Structures, Systems and Components iii

1.0 INTRODUCTION

1.1 Purpose This guidance provides an acceptable means for characterizing the safety impact of issues (e.g., non-compliances) at licensee facilities for which the licensee requests an NRC streamlined regulatory review process (e.g., expedited review of licensing action requests, exemption requests, responses to orders, or responses to generic issues). Use of this guidance is limited to issues for which the safety impact associated with the issue can be modeled using probabilistic risk assessment (PRA). These issues may be identified through inspections, corrective actions, or other licensee or regulatory processes.

This process can only be used by and for licensees that have implemented risk-informed initiatives 10 CFR 50.69, Risk-informed Categorization and Treatment of Systems, Structures and Components of Nuclear Power Plants, and Technical Specification Task Force (TSTF)

Traveler 505 Risk Initiative 4b - Risk Informed Completion Times. This process is intended to build on licensees expanded use of PRA models for making day-to-day decisions and benefit from the use of integrated decision-making panels (IDPs) that were developed as part of implementation of 10 CFR 50.69. Licensees need to have implemented the IDP process and completed any license conditions associated with implementation of 10 CFR 50.69 and TSTF-505 to use this process, but do not need to have characterized any systems, structures, or components in accordance with 10 CFR 50.69.

Those licensees with a PRA model that was found acceptable to support 10 CFR 50.69 and TSTF-505 applications by the NRC can leverage their PRA models to perform safety impact characterizations using this process and request licensing actions with the expectation that the NRC would use a streamlined review process if the issue is characterized as having a minimal safety impact. For this process, all of the following must apply in order to characterize an issue as having a minimal safety impact:

• The issue contributes less than 1 x 10-7/year to core damage frequency (CDF).

• The issue contributes less than 1 x 10-8/year to large early release frequency (LERF).

• The issue contributes less than 1% of total CDF and LERF.

• The issue screens to no impact (per Step 1, Section 4.1) or minimal impact (per Step 2, Section 4.2).

• Cumulative risk is acceptable using the guidelines in Section 5.

If the safety impact cannot be characterized as minimal, then the licensee may still submit the issue to the NRC for review, but the submittal does not qualify for an NRC streamlined review process.

Figure 1-1 provides a high-level overview of the process.

The process described in this guidance document does not replace or affect the NRCs use of the Reactor Oversight Process Significance Determination Process (SDP) for assessing the safety significance of more-than-minor performance deficiencies.

1

1.2 Scope This guidance is intended to be used when NRC regulatory actions (e.g., reviewing licensing action requests or considering generic issues for further regulatory actions) are needed for licensees to address an issue. This process is anticipated to be useful when the corrective actions for an issue would result in a minimal safety impact. This process may also be used for issues in which there is a safety benefit to not implementing costly or burdensome actions to restore compliance or conformance.

Examples of issues for which this process may be used include, but is not limited to, the following:

• Actions needed to address inspection findings

• Resolution of non-compliance issues identified through other regulatory or licensee processes

• Responses to orders requiring changes or modifications to the plant

• Generic issues requiring changes or modifications to the plant For issues having generic implications, a generic safety characterization may be performed by an industry or NRC generic assessment expert team (GAET). This generic assessment could then be used to inform a plant-specific assessment of the generic issue which accounts for plant-specific risk contributors, such as seismic or flooding risk. The plant-specific assessment is performed by a licensees multi-disciplinary plant IDP.

This process may not be used for the following:

• Any immediate actions necessary for continued safe operation (e.g., to support an NRC finding of adequate protection, to restore compliance with a Technical Specification, to resolve an environmental compliance issue with an adverse effect on public health and safety, or to remove a threat to personnel safety).

• Any immediate repairs necessary for continued power production (e.g., replacing a damaged main transformer).

• Any issues for which the safety impact cannot be directly assessed using PRA (e.g., fuel changes or changes to emergency planning programs).

1.3 Content of this Guidance Document Section 2 presents guidance for defining the issue being assessed.

Section 3 presents guidance for exploring the issue in detail using the GAET and/or IDP.

Section 4 presents guidance for the finalizing the safety impact characterization.

Section 5 presents guidance for assessing the cumulative risk impact.

Section 6 presents guidance for using the safety impact characterization in the regulatory process.

Figure 1-1, shown below, provides a high-level overview of the process.

2

Figure 1-1: Safety Impact Characterization Process Overview 3

2.0 DEFINING THE ISSUE This guidance is applied after identifying an issue (e.g., non-compliance) that requires NRC review for resolution. The issue can be NRC- or licensee-identified. Once it is identified that some action is needed to address the issue, then the licensee (or NRC) would need to define the range of possible resolutions, choose a path forward, and then determine the safety impact of that resolution. This guidance can also be applied after the partial resolution of an issue initially having a more than minimal safety impact results in the remaining unresolved aspects of the issue having a minimal safety impact.

The safety impact characterization process starts with defining the specific issue for which the safety impact is being assessed. This should be done by a subject matter expert (SME) who is knowledgeable about the issue. The SME collects any available NRC and industry information.

When evaluating an issue, the safety impact being characterized is the difference between the safety of the plant if it were fully compliant and that of the plant with the existing issue.

Defining the issue may begin at a generic or plant-specific level. A generic evaluation characterizes the importance of the regulatory issue at a generic level and provides an overall assessment and important attributes for consideration in the plant-specific evaluation. The generic evaluation may be carried out by an industry or NRC SME or team of experts. The generic SME evaluation is then reviewed by the GAET for implementation at applicable plants.

The licensees SME will revise the generic evaluation as needed to address all the plant-specific considerations identified by the GAET and any plant-specific differences from the information provided by the GAET. The plant-specific process is carried out by the licensee using a plant IDP, which reviews the generic characterization provided by the GAET and the plant-specific evaluation provided by the licensees SME. If the issue does not apply generically, then the issue is only defined at the plant-specific level by the licensees SME and reviewed by the plant IDP.

The SME should define the issue in enough detail for the GAET and/or plant IDP to review the issue and make a final determination about the safety impact. However, the process can be iterative if needed. The SME should collect any readily available information for the GAET or plant IDP to review but may identify unknowns for the GAET or plant IDP to consider further.

The GAET or plant IDP may decide they need additional information in order to complete their review and direct the SME to obtain additional information. Completely defining the issue includes two essential activities:

1. Performing a detailed assessment of the preliminary screening questions.

2. Performing a preliminary risk assessment using a PRA model.

2.1 Assessing the Preliminary Screening Questions The SME should document the initial assessment of the preliminary screening questions. This phase of the process involves screening the issue for any impact on safety, regardless of whether the impact is adverse or beneficial. While the answers to the questions are either yes or no, all the answers must be explained in detail for consideration by the GAET or plant IDP.

The plant IDP will develop final responses to similar screening questions.

4

The preliminary screening for any safety impact involves addressing the following set of questions:

Does the issue:

1. YES NO Result in any impact on the frequency of occurrence of a risk significant accident initiator or result in a new risk significant accident initiator?

2. YES NO Result in any impact on the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a risk significant transient, accident, or natural hazard?

3. YES NO Result in any impact on the consequences of a risk significant accident sequence?

4. YES NO Result in any impact on the capability of a fission product barrier?

5. YES NO Result in any impact on defense-in-depth capability or impact in safety margin?

Although the answers to the questions are either yes or no, all of the answers must be explained in detail. If any of the questions are answered YES, then the SME should discuss whether the impact is adverse or beneficial. The SME should discuss any adverse impacts with the risk analyst who will be performing the preliminary risk evaluation and have the risk analyst quantify the risk impact, if possible.

In determining whether there is any impact on safety, the first step is to determine what structures, systems, and components (SSCs) and human actions are affected by the issue.

Next, the effects of the issue should be determined. This evaluation should include both direct and indirect effects. Direct effects are those where the issue (e.g., changing the motor on a pump or changing the mounting of an electrical cabinet) changes the performance of the SSC directly, such as by decreasing its reliability or decreasing its margin to failure under accident conditions. One can directly attribute the overall impact in how the SSC performs by quantitative analysis, operating experience, or engineering judgment. Indirect effects are those where the issue could affect other risk contributors.

In addressing the preliminary screening questions, the following should be noted:

• The term risk-significant in Questions 1 through 3 refers to SSCs performing risk-significant functions, including non-safety related and safety-related SSCs and human performance. NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants (Reference 2), provides specific guidance on risk-significant criteria.

• Risk impact should be based on the relative change in risk associated with baseline core damage frequency (CDF) and large early release frequency (LERF). Generally, items that are not risk-significant are those that contribute:

o less than 1 x 10-7/year and 1 x 10-8/year for CDF and LERF, respectively, OR o less than 1% of total CDF and LERF (consistent with RG 1.174).

• There is similarity in Screening Question 3 with the questions in 10 CFR 50.59 and the guidance in Nuclear Energy Institute (NEI) 96-07, Guidelines for 10 CFR 50.59 Implementation (Reference 1). For Screening Question 3 above, consequence is intended to mean radiological dose from risk-significant accident sequences. The impact could be direct, such as an improved containment spray system that could reduce radiological releases in a core damage accident, or indirect, such as an 5

increase in containment bypass events. Reducing the frequency of core damage is addressed elsewhere and is not the intent of this question.

• The term capability in Questions 2 and 4 addresses the capacity of SSCs or personnel. Consider the following examples:

o The flow capacity of a system could be increased by replacing a pump with a higher capacity pump.

o The tornado resistance of a wall could be increased by adding additional supports.

o The seismic capacity of a relay could be increased by replacing the relay with a higher capacity relay.

2.2 Assessing the Preliminary Risk Impact using Quantitative Analysis The quantitative evaluation of risk impact is an important factor in determining that the total safety impact of an issue is low enough to allow for streamlined NRC review of a regulatory action. Therefore, only those licensees with an acceptable PRA model can leverage their PRA models to perform quantitative risk assessments to support using this process, if all the following conditions apply:

• The issue is completely within the scope of the licensees PRA model or can be bounded using surrogates.

• The licensee has implemented risk-informed initiatives 10 CFR 50.69 and TSTF-505 and has completed all license conditions from the safety evaluation.

• The licensees PRA model was found acceptable to support approvals of 10 CFR 50.69 and TSTF-505 applications by the NRC.

• The issue is within the scope of the portion(s) of the PRA model that was found acceptable by the NRC (e.g., if seismic was screened out of acceptability, then seismic issues cannot be addressed using this process).

The PRA model must include the capability to assess the change in CDF and LERF, and the risk evaluation must include a quantified assessment of all significant sources of risk (i.e.,

external events, internal flooding, and fires) that can be impacted by the issue being assessed.

Where PRA models are not available, conservative or bounding analyses may be performed to quantify the risk impact (e.g., low power and shutdown).

A risk analyst must use an acceptable PRA model to calculate the change in CDF and LERF.

The change in CDF and LERF must be calculated as the difference in the risk to the plant with the existing non-compliance and the risk to the plant if it were fully compliant. The risk analysis may not include any credit for proposed risk management actions, compensatory actions, or any other activities implemented to reduce the risk impact associated with the issue. The risk analyst should document whether there are any beneficial safety impacts associated with the issue.

The preliminary risk evaluation may initially be performed on a generic level. For a generic assessment, the risk analyst may need to perform multiple risk calculations using a representative sample of plant PRA models. The representative sample of plants will depend on the issue being addressed and what plants have acceptable PRA models. For example, if the issue applies to a certain plant design or vendor, then the risk evaluation should be performed using a sample of plants of that design or vendor, respectively. Once the generic risk evaluation is reviewed by the GAET, a plant-specific risk evaluation must be completed in order to apply this process on a plant-specific level. The plant-specific risk evaluation for a generic 6

issue must address any considerations identified by the GAET. If the issue does not apply generically, then the risk is only calculated at the plant-specific level by a plant risk analyst and reviewed by the plant IDP.

The risk analyst should document any assumptions made when performing the risk evaluation, whether the issue was within the scope of the licensees PRA, and whether any surrogates were used to account for the impact of the issue. The impact of uncertainty on the evaluation should be considered. For any initial screening questions that were answered YES, the risk analyst should quantify the risk impact associated with the adverse impact.

2.3 Important Considerations In order to fully understand the safety impact of an issue and account for relevant insights in an integrated manner, the assessment should consider the following important common elements:

• Ensuring the issue is well-defined Although the goal of the overall process is to have clearly defined issues prior to evaluation by the GAET or IDP, the actual assessment may indicate that additional definition is appropriate. As the assessment progresses to subsequent steps, the actual conduct of the assessment may identify additional considerations not identified in the initial definition(s). Thus, it is critical that the specific issue is appropriately defined and communicated in order to illustrate the safety impact due to the issue.

• Being realistic as to not bias the assessment The level of realism and analyses will vary depending on the issue, but in order to avoid bias, realistic analysis is the objective. The process should include sensitivity analyses to address the key assumptions and sources of uncertainty that are driving the results. If the risk impact is exceedingly small, or clearly large, then a bounding evaluation may suffice.

• Considering uncertainty Both the GAET and IDP need to be aware of any specific issues, including external events, for which there is uncertainty. Sensitivity analysis should be performed, commensurate with the impact of the issue, to address any key assumptions and sources of uncertainty that may influence the results.

• Evaluating the overall nature of the risk impact of a potential action Both beneficial and adverse effects should be considered (e.g., replacing a small pump with a large pump could reduce the available margin of an emergency diesel generator, or closing and depowering pressurizer power operated relief valve block valves to prevent spurious operation could reduce effectiveness of feed and bleed operations).

• Identifying the extent of the impact The specific intended impact of the issue, as well as other related or indirect effects, should be considered (e.g., FLEX provides mitigation for more than external hazards even though that is its fundamental intended purpose). In other words, one specific issue could impact the specific function under consideration as well as multiple other separate plant functions. As discussed above, this could include both positive and negative impacts that may not be immediately evident if the impacts of issue are considered independently.

7

2.4 Documentation The issue should be documented in enough detail so that a person who is not familiar with the issue can understand the issue and how the safety impact characterization was made.

Documentation should include:

• A detailed description of the specific regulatory issue.

• Related and publicly available references, such as:

o Regulatory documents including regulatory analyses; orders; Commission papers (SECYs and associated staff requirements memoranda); NUREG and NUREG/CR reports; relevant Commission and Advisory Commission on Reactor Safeguards meeting slides and transcripts; regulatory guides and interim staff guidance; and generic communications such as bulletins and information notices.

Safeguards information shall be treated consistent with current practice.

o Industry documents including NEI guidance documents and correspondence with the NRC; research reports (e.g., Electric Power Research Institute and owners groups); and conference papers o International Atomic Energy Agency and Nuclear Energy Agency reports

• Screening question results, including explanations.

• Quantitative safety impact characterization results and associated discussions, including sensitivity analyses.

• Technical bases for conclusions regarding safety impact.

8

3.0 EXPLORING THE IMPACT OF THE ISSUE After the issue has been defined by the SME, the potential impact of the issue is explored in depth by a multi-disciplinary team of experts. This team of experts is responsible for ensuring the issue is fully defined and all the potential safety impacts have been identified. If the team identifies that it needs additional information in order to make a final recommendation regarding the safety impact, additional experts should be consulted. The goal of this phase of the review is to identify and review all the available information regarding the issue and characterize its safety impact.

This review may be performed on a generic or plant level. The generic and plant-specific processes involve similar steps. The generic evaluation may be carried out by an industry expert team in combination with an NRC expert team or individually by the NRC or industry.

The GAET evaluation characterizes the importance of the regulatory issue at a generic level and provides an overall assessment and important attributes for consideration in the plant-specific evaluation. The plant-specific process is carried out with the use of a plant IDP, which reviews the generic characterization provided by the GAET and the plant-specific evaluation provided by a plant SME, to arrive at plant-specific safety impact characterization. This safety impact is characterized as having either no impact or minimal impact.

The GAET can provide generic importance characterization information and attributes to the industry or can be used by the NRC to determine if additional regulatory action is required.

Using this information in conjunction with a plant-specific evaluation, the plant IDP is responsible for making the plant-specific safety impact characterization. The following guidance is provided relative to the makeup of these two panels.

3.1 Generic Assessment Expert Team (GAET)

The GAET is comprised of industry or NRC experts with relevant expertise about the issue being evaluated. The GAET composition will vary depending upon the issue. Generally, the GAET is composed of knowledgeable personnel whose expertise represents the important process and functional elements of the industry and regulatory processes, such as operations, engineering, nuclear risk management, industry operating experience, and licensing. The GAET members are expected to have the essential understanding of the issues safety impact, and familiarity with the safety impact characterization process guidance and approach. The team can call upon additional personnel, SMEs, or external consultants, as necessary, to assist in the characterization of issues. Experience, plant knowledge, familiarity with current regulatory issues, and availability to attend the most meetings, are important elements in the selection of GAET members. Members may be experts in more than one field; however, excessive reliance on any one members judgment should be avoided. In general, there should be at least five experts designated as members of the GAET with joint expertise in the following fields:

• plant operations

• design and systems engineering

• safety analysis

• PRA and risk-informed decision-making

• licensing

• other SMEs as needed 9

An SME knowledgeable in the technical discipline or disciplines relevant to the issue being evaluated should function as the lead presenter of the regulatory issue to the GAET. The SME should provide its evaluation and present the results of the preliminary screening questions and preliminary risk evaluation to the GAET. The SME should take responsibility to ensure that all relevant documents are available to the GAET. The SME should also ensure that the results of the GAET deliberation are documented and records are maintained.

A consensus process should be used for decision-making for both the GAET and plant IDP.

Differing opinions should be documented and resolved. However, a simple majority of the panel is enough for final decisions regarding the safety impact of the issues. The GAET should apply objective criteria and minimize subjectivity.

3.2 Plant Integrated Decision-Making Panel (IDP)

The composition of the plant IDP is the same as for the GAET, except that the members of the plant IDP and the SME for the plant IDP should have plant-specific knowledge and experience.

The IDP is composed of knowledgeable plant personnel whose expertise represents the important process and functional elements of the plant organization, such as operations, engineering, nuclear risk management, industry operating experience, licensing and maintenance. The plant IDP can call upon additional plant personnel or external consultants, as necessary, to assist in the evaluation of issues. The precise makeup of the plant IDP is determined by the licensee. Experience, plant knowledge, and availability to attend the meetings, are important elements in the selection of plant IDP members. Members may be experts in more than one field; however, excessive reliance on any one members judgment should be avoided. In general, consistent with other licensee expert panels, there should be experts designated as members of the plant IDP with joint expertise in the following fields:

• plant operations

• design and systems engineering

• safety analysis

• PRA and risk-informed decision-making

• licensing

• other SMEs as needed An SME knowledgeable in the technical disciplines relevant to the issue being evaluated should function as the lead presenter of the regulatory issue to the plant IDP. If a generic assessment is available, this assessment is used by the SME as a key input into the plant-specific assessment, along with relevant plant-specific information. The SME should provide its evaluation and present the results of the preliminary screening questions and preliminary risk evaluation to the plant IDP. The SME should take responsibility to ensure that all relevant generic and plant-specific documents are available to the plant IDP. The SME should ensure that the results of the plant IDP deliberation are documented and records are maintained.

The plant IDP should be aware of the benefits and limitations of the plant-specific PRA and other analyses, and, where necessary, should receive training on the plant-specific PRA, its assumptions, and appropriate implementation. This training facilitates making well-supported technical assumptions whether quantitative or qualitative information is used. The plant IDP should be familiar with the technical issue and the safety impact characterization process. In order to have a full understanding of the issue being characterized, all questions in each applicable step of the guidance should be answered, even if an initial yes response has already determined the outcome of that step.

10

A consensus process should be used for decision-making for both GAET and plant IDP.

Differing opinions should be documented and resolved. However, a simple majority of the panel is enough for final decisions regarding the safety impact of the issues. The plant IDP should apply objective criteria and minimize subjectivity. The plant IDP should be described in a plant administrative procedure that includes the designated chairman, panel members, and panel alternates; required training and expectations for the chairman, members, and alternates; requirements for a quorum; attendance records; agendas; and meeting minutes.

3.3 Documentation GAET: The GAET evaluation results, including a description of any important considerations that should be addressed in the plant-specific assessment, will be documented and provided to the industry and the NRC. Documentation will be maintained to facilitate any subsequent generic update or re-evaluation of the issue, as appropriate.

The GAET should document any considerations and characteristics that may affect the plant-specific assessment, particularly for safety. For example, the GAET may determine that based on reactor fleet considerations, the existing level of risk of an external initiator is 10-5 to 10-4/yr CDF on average. If information is available, the GAET would convey what attributes could make the plant-specific assessment higher or lower.

IDP: The IDP evaluation results, including a summary of the basis for each decision will be documented and provided to the NRC. In particular, the assessment of any GAET-identified important considerations and how they apply to the plant and a basis for any plant-specific departures from the GAET assessment should be noted. The level of documentation should be such that a sufficient basis is provided for a knowledgeable individual to independently review the information and reach the same conclusion. The basis for any engineering judgment and the logic used in the assessment should be documented to the extent practicable and to a degree commensurate with the safety impact and complexity of the issue. The items considered by the GAET, SME, and IDP must be clearly stated.

For each issue, licensees should maintain:

• a copy of the generic package, if applicable

• a copy of the plant-specific package the SME submits to the plant IDP

• a summary of the plant IDP discussion on the issue

• a revised copy of the package, if applicable

• the final safety impact characterization assigned to the issue 11

4.0 FINALIZING THE SAFETY IMPACT CHARACTERIZATION After the plant IDP has reviewed the initial characterization of the issue provided by the SME, the plant IDP is responsible for providing the final safety impact characterization. The final safety impact characterization consists of assessing:

1. the final screening questions, and

2. the final risk impact using a PRA.

Both of these activities are essential to characterizing the safety impact of the issue. The final screening questions are similar to the preliminary screening questions. The information presented for reviewing the preliminary screening questions also applies to reviewing the final screening questions. Assessing the final screening questions is progressive and includes two basic steps: 1) a series of screening questions to address whether there is any adverse impact to safety, and 2) a series of similar screening questions to address whether the impact to safety is minimal.

Screening determinations are made based on the technical information supporting the issue.

Technical or engineering information that demonstrates that the issue has no adverse effect on functions, or methods of performing or controlling functions may be used as a basis for screening the issue.

The plant IDP reviews the issue until it has confidence that the safety impact characterization results would not change if additional information was obtained or developed. If the plant IDP does not have confidence in the safety impact characterization results, the plant IDP should develop a plan to obtain the information needed to have confidence in the results of the review.

For example, the plan could include interaction with the NRC and conduct of additional analyses.

Figure 4-1 provides a detailed overview of the safety impact characterization process.

12

Figure 4-1: Safety Impact Characterization Detailed Process Overview 13

4.1 Step 1 - Screening for No Impact Step 1 involves screening the issue for any adverse impact on safety. The Step 1 screening process is not intended to be resource intensive and is not concerned with the magnitude of the adverse or beneficial effects that are identified. Any change that adversely affects risk is screened in and must be evaluated in Step 2. The screening for no impact involves addressing the following set of questions:

Does the issue:

1. YES NO Result in an adverse impact on the frequency of occurrence of a risk significant accident initiator or result in a new risk significant accident initiator?

2. YES NO Result in an adverse impact on the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a risk significant transient, accident, or natural hazard?

3. YES NO Result in an adverse impact on the consequences of a risk significant accident sequence?

4. YES NO Result in an adverse impact on the capability of a fission product barrier?

5. YES NO Result in an adverse impact on defense-in-depth capability or impact in safety margin?

If ALL the responses are NO, the issue screens to NO IMPACT. Continue to Step 3 If ANY response is YES, continue to Step 2.

Although the answers to the questions are either yes or no, the answers to all questions must be explained in detail. Beneficial safety impacts should be noted in the responses to each question. If the issue is only associated with beneficial safety impacts, then the Step 1 screening questions would be answered NO, and the issue would screen to no impact.

4.2 Step 2 - Screening for Minimal Impact Step 2 involves screening the issue to determine if the magnitude of the adverse impact on safety identified in Step 1 is minimal. This step involves addressing the following set of questions, which are modified versions of the Step 1 questions:

Does the issue:

1. YES NO Result in more than a minimal increase in frequency of occurrence of a risk significant accident initiator or result in a new risk significant accident initiator?

2. YES NO Result in more than a minimal decrease in the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a risk significant transient, accident, or natural hazard?

3. YES NO Result in more than a minimal increase in the consequences of a risk significant accident sequence?

4. YES NO Result in more than a minimal decrease in the capability of a fission product barrier?

5. YES NO Result in more than a minimal decrease in defense-in-depth capability or safety margin?

14

If ALL the responses are NO, the issue screens to MINIMAL IMPACT. Continue to Step 3 If ANY response is YES, stop. The issue has a more than minimal impact on safety.

Although the answers to the questions are either yes or no, the answers to all questions must be explained in detail. Any question that is answered NO in Step 1, will also be answered NO in Step 2. Guidance on addressing the above questions is provided below.

Question 1: Does the issue result in more than a minimal increase in the frequency of a risk-significant accident initiator or result in a new risk significant accident initiator?

In answering this question, the first step is to identify the risk significant accident initiators that have been evaluated that could be affected by the issue. Then a determination should be made as to whether the frequency of these accident initiators occurring would be more than minimally increased. Finally, the licensee should determine if any new risk significant accident initiators have been created. This could be a result of an increase in the risk significance of an accident initiator that was previously non-risk significant. The table below shows an example of typical accident initiators divided into categories for different operating modes (e.g., at power, low power, or shutdown conditions) that should be considered:

Accident Initiator Categories More than Minimal Risk Significant?

(Representative) Increase?

Transients initiated by frontline systems Transients initiated by support systems Primary system integrity loss (e.g.,

SGTR, RCP seal LOCA, LOCA)

Secondary system integrity loss Internal flooding Internal fires Earthquakes External flooding Tornados and High Winds Other External Hazards Spent Fuel Pool Low power and shutdown conditions External hazards: External hazard frequencies cannot be reduced or increased by a plant-initiated or NRC-initiated change. However, the frequency and severity might be changed for certain external hazards (such as external flooding) with changes beyond the nuclear power plant site. For example, damage to a nearby dam could increase the frequency and severity of an external flood that could affect the nuclear power plant site. Such changes can be considered in this process if under the control of the licensee. Otherwise changes related to external hazards will be considered in the second question.

15

The table below shows several ways that the frequency of accident initiators can be changed.

Accident Initiator Frequency More than Minimal Potential Effect?

Considerations Increase?

Changes in maintenance, training Changes in specific SSCs (e.g., installing a more reliable component)

Changes in materials Equipment replacements to address age related degradation Changes in redundancy or diversity Addition of equipment Changes in operating practices Reasonable engineering practices, engineering judgment, and PRA techniques should be used in determining whether the frequency of occurrence of a risk-significant accident initiator would more than minimally increase as a result of the issue. A large body of knowledge has been developed in the area of accident frequency and risk-significant sequences through plant-specific and generic studies. This knowledge should be used in determining what constitutes more than a minimal increase in the frequency of occurrence.

Question 2: Does the issue result in more than a minimal decrease in the availability, reliability or capability of SSCs or personnel relied upon to mitigate a risk-significant transient, accident or natural hazard?

In answering this question, the first step is to identify the risk significant SSCs and human actions that could be affected by the issue. This question addresses the reactivity control function, including anticipated transients without scram (ATWS). ATWS is not an accident initiator, it is an accident sequence. Next, a determination should be made as to whether availability, reliability, or capability of SSCs or personnel relied upon to mitigate a risk-significant transient, accident or natural hazard would be more than minimally decreased.

Similar to accident initiators, the availability, reliability, or capability of SSCs or personnel can be changed in several ways, as described in the table below:

Availability, Reliability, or Capability More than Minimal Potential Effect?

Considerations Decrease?

Changes in maintenance, testing, training Changes in specific SSCs (e.g., installing a more reliable component)

Changes in materials Equipment replacements to address age related degradation Changes in redundancy and diversity Addition of equipment Strengthening of equipment 16

Moving equipment (to reduce the impacts of spatial events)

Eliminating the need for recovery action (RA)

Improving performance shaping factor related to human performance Changes in operating practices An appropriate calculation can be used to demonstrate the change in likelihood in a quantitative sense, if available and practical. Qualitative engineering judgment and/or an industry precedent is typically used in 10 CFR 50.59 evaluations and can be used here to determine if there is more than a minimal increase in the failure probability. An issue is considered to have a negligible effect on the likelihood of failure when a change in likelihood is so small or the uncertainties in determining whether a change in likelihood has occurred are such that it cannot be reasonably concluded that the likelihood has actually changed (i.e., there is no clear trend toward decreasing the likelihood).

Question 3: Does the issue result in more than a minimal increase in the consequences of a risk-significant accident sequence?

In answering this question, the first step is to identify the risk significant sequences that have been evaluated that could be affected by the issue. The following questions can assist in determining which accidents could have their radiological consequences affected as a direct result of the issue:

• Will the issue change the effectiveness of an action?

• Will the issue play a direct role in mitigating the radiological consequences?

Next, a determination should be made as to whether the consequences would be more than minimally increased. In addressing the definition of what constitutes a more than minimal increase in consequences, an increase of greater than 10% in dose for risk-significant sequences is used as the criterion. This threshold is generally consistent with the 10 CFR 50.59 guidance in NEI 96-07 (Reference 1). There are increasing uncertainties going from the Level 1 portion of a PRA study (core damage frequency estimation) to Level 2 (containment performance) to Level 3 (offsite dose consequences). An increase of less than 10% in calculated consequence is small enough that it cannot be reasonably concluded that the consequences have changed. Small changes in inputs and assumptions could easily have more of an effect than a calculated change of less than 10% in offsite dose from a severe accident sequence.

The following SSCs which indirectly affect dose should also be considered:

• containment bypass

• containment isolation and capacity

• hydrogen control

• long-term containment integrity Question 4: Does the issue result in more than a minimal decrease in the capability of a fission product barrier?

17

This question focuses on the fission product barriersfuel cladding, reactor coolant system boundary and containment. The prior question also indirectly addresses containment.

Guidance on barrier definitions and impacts on barriers can be found in the 10 CFR 50.59 guidance provided in NEI 96-07 (Reference 1). As discussed in NEI 96-07, each barrier is associated with specific design basis parameters such as fuel cladding temperature, reactor coolant system cool-down rate, and containment pressure. It is expected to be rare that an issue will result in an impact on the design basis parameters that can be directly calculated.

Rather, judgment is required here in ascertaining whether the decrease in capability of a fission product barrier is more than minimal.

Question 5: Does the issue result in more than a minimal decrease in defense in depth capability or safety margin?

Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, (Reference 3) provides additional guidance.

4.3 Step 3 - Determining Safety Impact Using Quantitative Analyses A preliminary risk evaluation was completed before the IDP. In Step 3, the preliminary risk evaluation is revised to incorporate any new information and analyses (e.g. focused scope analyses as needed) from the GAET or IDP in order to estimate the final risk impact associated with the issue.

As discussed earlier, only those licensees with an acceptable PRA model can leverage their PRA models to perform quantitative risk assessments to support using this process, if all of the following conditions apply:

• The issue is completely within the scope of the licensees PRA model or can be bounded using surrogates.

• The licensee has implemented risk-informed initiatives 10 CFR 50.69 and TSTF-505 and has completed all license conditions of the safety evaluation.

• The licensees PRA model was found acceptable to support approvals of 10 CFR 50.69 and TSTF-505 applications by the NRC.

• The issue is within the scope of the portion(s) of the PRA model that was found acceptable by the NRC.

The plant-specific PRA must include the capability to assess CDF and LERF and the risk evaluation must include a quantified assessment of all significant sources of risk (i.e., external events, internal flooding, and fires) that can be impacted by the issue being assessed. Where PRA models are not available, conservative or bounding analyses may be performed to quantify the risk impact (e.g., low power and shutdown).

A risk analyst will use the licensees acceptable PRA model to calculate the change in CDF and LERF. The change in CDF and LERF will be calculated as the difference in the risk to the plant with the existing non-compliance and to the plant if it were fully compliant. The risk analysis may not include any credit for proposed risk management actions or other activities implemented to reduce the risk impact associated with the issue. The risk analyst must document any assumptions made when performing the risk evaluation, whether any parts of the issue were outside the scope of the licensees PRA, and whether any surrogates were used to 18

account for the impact of the issue. The final quantitative risk analysis must include an evaluation of the impact on internal events risk, as well as the impact on any relevant external events.

The PRA results will be compared to the relative change in risk of the licensees overall CDF and LERF. An issue is not risk-significant (i.e., minimal or less than minimal) if all of the following apply:

• the issue contributes less than 1 x 10-7/year to CDF, and

• the issue contributes less than 1 x 10-8/year to LERF, and

• the issue contributes less than 1% of total CDF and LERF (consistent with RG 1.174).

If the risk results are less than the criteria above, the issue is considered to have a minimal impact on safety.

4.4 Step 4 - Assess need for Risk Management Actions Based on the assessment of the screening questions in Steps 1 and 2, and the outcome of the final quantitative risk evaluation in Step 3, a final safety impact is determined. If the result of Step 1 indicates that there is no impact on safety, and the result of Step 3 indicates that there is minimal impact on safety, then the issue is characterized as having a minimal impact on safety and risk management actions (RMAs) do not need to be considered. If the results of Steps 2 and 3 both indicate that there is a minimal impact on safety, then the issue is characterized as having a minimal impact on safety and RMAs must be considered to offset the risk increase due to the issue.

RMAs are typically associated with managing configuration risk when equipment is out of service or for temporary non-compliances. However, in this case, the non-compliance will become the permanent plant configuration if the licensing action is approved. Therefore, only long-term actions to reduce risk associated with the new configuration need to be considered, such as permanent procedure changes or simple plant modifications. For example, if an automatic interlock is defeated permanently, procedure changes to verify proper manual operation of the equipment may be appropriate the reduce the risk associated with removal of the automatic interlock.

19

5.0 ASSESSING CUMULATIVE RISK Once an issue has been characterized as having a minimal impact on safety, the cumulative risk impact of permanent changes to the risk profile of the plant must be evaluated. The cumulative risk criteria are based on the premise that the acceptability of a given plant change is a function of the existing baseline level of risk. For example, a plant with an already low level of risk should be allowed somewhat larger changes in relative risk than a plant which has much higher baseline risk. For this reason, a sliding scale of the allowable change in cumulative risk is used, consistent with EPRI TR-105396, PSA Applications Guide (Reference 4).

The cumulative risk impact is evaluated based on the plant-specific percent change in CDF and LERF. Figures 5-1 and 5-2 provide a graphical representation of the cumulative risk screening criteria framework for issues that result in a permanent change in risk. Tables 5-1 and 5-2 provide the same criteria in an equation form. These figures provide sliding cumulative risk impact criteria as a function of the baseline risk value being evaluated. The criteria for acceptable changes vary depending upon the baseline value of the figure of merit (i.e., CDF or LERF). For the case of CDF, the screening of acceptable changes in risk ranges from 0.1% to 100%, depending upon baseline CDF value. For the case of LERF, the acceptable relative changes in risk are similar. Changes in excess of 1 x 10-4/year for CDF or 1 x 10-5/year for LERF are unacceptable, regardless of baseline value.

Cumulative risk is acceptable for the purposes of this guidance if the percent change in baseline risk due to the issue falls in the non-risk significant section of Figures 5-1 and 5-2, and the baseline risk is less than 1 x 10-4/year for CDF and less than 1 x 10-5/year for LERF.

Cumulative risk that falls outside of the non-risk significant section of Figures 5-1 and 5-2 requires further evaluation by the licensee. Further evaluation may include but is not limited to model enhancements and plant modifications to bring the plant to a lower baseline risk.

Cumulative risk thresholds apply to the current as-built as-operated plant. If changes are made to lower the plant baseline risk profile, then a new cumulative risk evaluation may be appropriate.

20

Figure 5-1: Safety Impact Criteria for Permanent Changes Impacting CDF Table 5-1: CDF Safety Impact Criteria CORE DAMAGE FREQUENCY (CDF) SCREENING CRITERIA If the Baseline CDF < 10-4 /year, then CDF% = 10[-0.5*log (CDFBaseline))-1]

Where, CDF% = Maximum Percent Change in CDF considered to be Non-risk Significant CDFBaseline = Baseline CDF If the Baseline CDF > 10-4 /year, then further evaluation is required.

CDF changes greater than 10-4 /year are considered unacceptable.

21

Figure 5-2: Safety Impact Criteria for Permanent Changes Impacting LERF Table 5-2: LERF Safety Impact Criteria LARGE EARLY RELEASE FREQUENCY (LERF) SCREENING CRITERIA If the Baseline LERF < 10-5 /year, then LERF% = 10[-0.5*log (LERFBaseline))-1]

Where, LERF% = Maximum percent change in LERF considered to be non-risk significant LERFBaseline = Baseline LERF If the Baseline LERF > 10-5 /year, then further evaluation is required.

LERF changes greater than 10-5 /year are considered unacceptable.

22

6.0 REGULATORY PROCESS FOR LICENSE MODIFICATION Once the licensee has characterized the safety impact for the proposed issue as having a minimal impact on safety and determined that the cumulative risk impact to the plant due to the issue is acceptable, it can then submit its results to the NRC to request a streamlined licensing action be taken. NRR Office Instructions LIC-101, License Amendment Review Procedures, (Reference 5) and LIC-103, Revision 1, Exemptions from NRC Regulations, (Reference 6) provide specific guidance for processing license amendments and exemptions, respectively.

If the safety impact could not be characterized as minimal or the cumulative risk impact is unacceptable, then the licensee may still submit its results to the NRC for review, but the submittal does not qualify for a streamlined review process.

7.0 REFERENCES

1. NEI 96-07, Guidelines for 10 CFR 50.59 Implementation, Revision 1, November 2000

2. NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, Revision 4A, April 2011

3. Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, May 2011

4. EPRI TR-105396, PSA Applications Guide, August 1995

5. LIC 101, License Amendment Review Procedures

6. LIC-103, Revision 1, Exemptions from NRC Regulations 23