ML20128Q143

Discusses Action Plan to Reevaluate 10CFR50.59 Review Process Agreed Upon in 951215 Memo.Plan Goal to Identify Actions to Improve Licensee Implementation & NRC Oversight of 50.59 Process

ML20128Q143
Person / Time
Site:	Palisades, Point Beach, 07201007
Issue date:	04/15/1996
From:	Taylor J NRC OFFICE OF THE EXECUTIVE DIRECTOR FOR OPERATIONS (EDO)
To:	The Chairman NRC COMMISSION (OCM)
Shared Package
ML20127B984	List: ML20127B977 ML20128Q143
References
NUDOCS 9605020110
Download: ML20128Q143 (69)

Text

-. - - -.. -. -

~ _

=- -

. - - - ~

~. -. - ~ ~. -

g sa Mcg I

t k

UNITED STATES

{

[

j NUCLEAR REGULATORY COMMISSION

• ... [g 4

WASHINGTON, D.C. 3086M001 l

April 15, 1996 MEMORANDUM TO: Chairman Jackson i

D p[er,ations FROM:

James M. Taylor Executive Direct i

i

SUBJECT:

ACTION PLAN FOR PROVEMENTS TO 10 CFR 50.59 IMPLEMENTATION J

AND OVERSIGHT

/

i i

l In memoranda of October 27, and November 30, 1995, the staff was requested to i

reexamine the adequacy of the regulatory framework that authorizes licensees to make changes to their facilities without prior approval of the NRC. The j

memoranda also asked for views on how to improve the 50.59 process and on how to improve integration of information learned from oversight of the 50.59 process into the overall regulatory program.

In a memorandum dated December 15, 1995, the staff agreed that a reevaluation of the 50.59 review process would be beneficial, and committed to develop an action plan within 120 days.

The action plan was to address the consistency l

of guidance and evaluation of NRC inspection activities, with the goal of

?

identifying actions that could be undertaken to improve licensee

)

implementation and NRC oversight of the 50.59 process. The staff committed to j

provide a copy of the action plan to the Commission for information.

i s

Attachment I to this memorandum presents the results of the staff's review of j

the regulatory context of 10 CFR 50.59, available guidance documents, inspection findings, and other information related to the implementation of 1

this regulation. The staff's review document addresses some of the variability in the 50.59 process and the underlying reasons for it. On the basis of this analysis, the staff prepared the action plan in Attachment 2 l

which results in a final paper to the Commission in February 1997.

i In summary, under the action plan, the staff objective will be to develop l

guidance that will:

i define the elements of safety evaluation review or screening processes e

within the context of various licensee design or change control processes, j

to provide greater assurance that effects en safety of changes, whether to i

equipment, procedures, or methods of~ system operation, are appropriately j

evaluated.

l define more specifically the scope of applicability of 50.59 (that is, to identify those changes, tests or experiments that need to be evaluated to j

determine if NRC approval is needed). This would include a more comprehensive description of change, and guidance for broader consideration of "as described."

4 CONTACT:

Eileen McKenna (301) 415-2189

,9r#

Rb b50%o D o X A emcios#re i i

N 1

1

The Com.issioners establish the process for resolving nonconforming conditions'such that differences from the FSAR are reconciled (from both safety and regulatory viewpoints) in a time frame commensurate with their safety significance.

improve unreviewed safety question determinations in the following respects:

- address the extent to which short-and long-term compensating actions may be considered as part of change under 50.59 such that it can be determined that the probability has not increased or the margins of safety have not been reduced. Also, address when the consider & tion of compensating actions no longer can be done under 50.59 and should be reviewed by the NRC as part of the basis for approving a proposed license amendment.

- clarify the extent to which PRA techniques may be useful in evaluating the effects on safety of a change and in addressing the " probability may be increased" criterion for unreviewed safety questions.

- clarify what is meant by " margin of safety" in relation to numerical parameters, analysis methods, calculated results of safety analyses, and licensing limits so that changes that might affect the basis for staff's safety conclusions are more consistently identified.

~

The staff has also issued interim inspection guidance (Attachment 3) to assist inspectors in their reviews of 50.59 while the action plan is being implemented. Copies of this paper and its attachments will be made publicly available 5 working days from the date of this memorandum.

The staff is available to meet with you to discuss this matter at your convenience.

1 Attachments: As stated cc: Commissioner Rogers j

Commissioner Dicus i

SECY OGC OCA OPA

I l

l l

l l

1 REVIEW OF 10 CFR 50.59 REGULATORY FRAMEWORK 1

1 ATTACHMENT l l

l l

l

i i

l

)

REVIEW OF 10 CFR 50.59 REGULATORY FRAMEWORK FOR CONTROLLING CHANGE l

I In memoranda of October 27, and November 30, 1995, the staff was requested to reexamine the adequacy of the regulatory framework that authorizes licensees to make changes to their facilities without prior approval of the NRC. The memos also asked for views on how to improve the 50.59 process and how to j

improve integration of information learned into the overall regulatory program.

l In a memorandum dated December 15, 1995, the staff agreed that a reevaluation f

of the 50.59 review process would be beneficial and committed to develop a action plan within 120 days. The action plan was to address the consistency of guidance and evaluation of NRC inspection activities, with the goal of identifying actions that could be undertaken to improve licensee j

implementation and NRC oversight of the 50.59 process.

I DEVELOPMENT OF ACTT6 PLAN 1

To develop an action plan to improve licensee implementation and staff 3

i oversight, the staff conducted a number of reviews to characterize (1) the regulatory framework, (2) available guidance, (3) existing practice, and j

(4) methods and results of staff oversight. The staff also focused on understanding the underlying reasons for inconsistency in implementation; it identified a number of specific areas where the regulatory intent needed to oe j

clarified. This paper gives the results of the staff's review.

It contains:

• Description of review process

• Background

• Overview of findings on licensee implementation

• Overview of findings on staff oversight j

• Discussion of issues needing clarification

• Conclusions i

The actions that the staff plans as a result of this review are addressed in j

the 10 CFR 50.59 Action Plan.

o j

REVIEW PROCESS Reaional Comments The staff asked regional personnel to express their views on the aspects of j

the 50.59 review process that would benefit from clarification and to submit examples of licensee 50.59 evaluations that had raised concerns. Their j

comments touched on a wide range of aspects of 50.59 implementation and are reflected in the issues discussed below.

J j

Documents Reviewed 4

The guidance documents that the staff reviewed included NRC Inspection Manual j

chapters (governing various inspections as well as technical and regulatory I'

1 i

4 i

i guidance sections that are part of section 9900 of the manual), and sections i

of the Enforcement Policy Manual.

The staff reviewed these documents for j

consistency, as well as for areas where further clarification might be needed.

The staff also reviewed the rulemaking documents underlying 50.59 and documents relating to the other regulatory processes that control change' as noted below, as well as rule language or pending rulemakings on 10 CFR 50.66, 10 CFR Part 52 (advanced reactors), and 10 CFR 72.48 (change control for cask fuel storage). The Office of the General Counsel (OGC) performed a review of l

judicial, Commission, licensing board, and director's decisions that relate to 50.59 (15 cases were found in which 50.59 was a factor; results are discussed l

where applicable).

1 In addition, the staff reviewed the chronology of interactions with the i

industry on Nuclear Safety Analysis Center document NSAC-125, inclu' ding the j

significant internal efforts to develop a position endorsing it.

l A search was also made for other documents that include staff positions with respect to 50.59. A number of generic coanunications as well as some plant-i specific documents were found. These include Generic Letter (GL) 95-02 (on i

digital instrumentation and GL 84-07, (on replacement of recirculation piping).

The documents reviewed are provided in the list at the end of this report.

Inspection findings, as documented in inspection and enforcement reports, were also reviewed to gain an understanding of issues that have arisen with licensee 50.59 evaluations.

' To gain insight on how other safety regulatory bodies have dealt with the question of control of change, the staff reviewed the regulations and practices of the Federal Aviation Administration (FAA). The FAA regulations in 14 CFR Part 21 (Aircraft Certification Procedures for Products and Parts) and 14 CFR Part 43 (Maintenance, Preventive Maintenance, Rebuilding and Alteration) are most pcrtInent. With respect to certifications issued to aircraft (or engines), tee FAA regulations classify changes as major and minor; for minor changes, the appi hant or certificate holder may make the change "before submitting any substantiating data" (with post-implementation reporting). For major changes, the applicant must submit substantiating data e d receive approval. As defined in 14 CFR 21.93, a " minor change" is one that has no appreciable effect on the weight, balance, structural strength, reliability, operational characteristics, or other characteristics affecting airvorthiness of the product.

Inforeation on those aspects of the aircraft that the FAA considers constitute "cajor alterations or repairs" is given in Appendix A to 14 CFR 43 which provides a detailed list of parts, structural elements, or characteristics. The staff at FAA noted that even with a detailed list, questions about major / minor changes still arise when applied to different aircraft designs.

(Note that 50.59 as promulgated in 1962 contained Appendix A, a detailed list of parameters as guidance on matters the Commission would expect in Technical Specifications. This appendix was deleted in the 1968 amendment.)

2

/

J BACKGROUND l

The regulatory framework that provides the basis for licensing a power reactor facility encompasses a range of regulatory tools, including the regulations themselves, the license (and technical specifications), controlled plans which implement certain regulations (quality assurance, security, emergency preparedness), the safety analysis report (SAR), and other comitments.

Each of these elements has an associated change process (except "other comitments" ), with the extent of NRC approval tied to the safety and regulatory importance of the element being changed.

Serving as a focal point for a framework of cegulations that control change is 50.59. However, as noted below, 50.59 is not the sole regulation addressing change without NRC approval, and staff has already initiated activities in other areas.

j Interrelationships among the various documents that define the design, licensing and operating basis of a facility have been studied by the staff for some time (for instance in the development of 10 CFR Part 54, in the policy on design basis reconstitution, and in the 1993 Regulatory Review Group report and subsequent status reports, most recently SECY-96-024, Items 8, 9, and 54).

Specificactionshavebeencompleted,andfurtherstepsareplanngdwith respect to change processes for licensee plans (quality assurance, security, emergency preparedness) and comitment management (see SECY-95-300).

The parts of the " regulatory framework" consisting of 50.59 and a set of i

interrelated regulations involving the TS and final SAR, notably 50.34, 50.36, 50.71, and 50.91 have evolved over the last 40 years in response to the question of control of change. Table 1 presents a sumary of key milestones

~

in this evolution.

1 1

~

4 2The Nuclear Energy Institute (NEI) has developed a process for Comitment Management as discussed in SECY-95-300.

In a letter dated January 24, 1996, to NEI, the NRC stated:

"We believe that the Nd! guideHnes provide a logical method for evaluating comitments for possible modification or elimination and can reduce unnecessary regulatory burden by providing the l

industry the necessary flexibility to manage comitments with only limited NRC involvement."

3Quality assurance and emergency preparedness plans are listed in 10 CFR 50.34(b) as part of the final safety analysis report (subject to 50.59) and are also subject to change control requirements in 50.54(a) and 50.54(q) respectively.

(Security plans are addressed in 50.34(c) and change control is 4

1 addressed by 50.54(p).) The criteria for change without prior approval and the timeframes for notifying the NRC of such changes are all different. These 2

differences prompted the Regulatory Review Group recommendations.

Refer also i

to DPRM-86-4 24 NRC 635 (1986) and the NEI petition dated November 28, 1995, on 50.54a.

3 i

1 i

l currently,10 CFR 50.59 reads (in part) as follows:

f 50.59 Changes, tests and experiments j

(a)(1) The holder of a license authorizing operation of a production or j

utilization facility may (1) make changes in the facility as described in i

the safety analysis report, (ii) make changes in the procedures as i

described in the safety analysis report, and (iii) conduct tests or experiments not described in the safety analysis report, without prior Commission approval, unless the proposed change, test, or experiment i

involves a change to the technical specifications incorporated in the license or an unreviewed safety question.

(2) A proposed change, test, or experiment shall be deemed to involve an unreviewed safety question (i) if the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report may be increased; or (ii) if a possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report may be created; or (iii) if the margin of safety as defined in the basis for any technical specification is reduced.

(Recordkeeping, reporting, and approval processes for technical specifications or unreviewed safety questions are addressed in the remaining sections of 50.59). See Attachment A for the full text of 10 CFR 50.59.

The NRC promulgated 10 CFR 50.59 before probabilistic risk assessment (PRA)

' techniques were developed, and structured it around the licensing approach which addresses Design Basis Events (initiating events in two classes -

Anticipated Operational Occurrences and Postulated Accidents); safety-related mitigation systems (e.g., reactor protection system, emergency core cooling systems); and consequence calculations for mitigated Design Basis Events (e.g., a mitigated design basis loss of coolant accident judged aaainst 10 CFR Part 100 guidelines). The initiating event frequencies were broadly defined -

c as " anticipated" (expected to occur and thus consequences should be low), and

" design basis" (not expected, but sufficiently credible that consequences should meet acceptance limits).

The USQ criteria are directly related to this design basis approach by preserving (1) the design basis assumptions used in licensing by not allowing different types of accidents or increased probability of occurrences; (2) the effectiveness (reliability) of mitigating systems by not allowing a different type of equipment malfunction, increased probability of equipment malfunction, or a reduction in the margin of safety (which reflects the capability of key systems); and (3) the acceptability of the (mitigated) design basis event consequences by not allowing an increase.in the (dose) consequences.

i l

4

I i

1, i

The research done in preparing this paper led to the conclusion that the

]

differences in interpreting the rule by both licensees and the staff have been the major contributor to inconsistent licensee implementation and staff oversight.

(Specific issues are discussed in more detail in the ISSUES section). As noted in Table 1, the scope and depth of the TS have changed a number of times over the last thirty years; the TS would become more i

comprehensive in response to technical staff preference for exhaustive I

enumeration in technical specifications over interpretation and enforcement of the non-TS aspects of 50.59 for controlling certain aspects of plant design and operation.

In proceeding with less specificity in TS, the staff recognized the need to expand the guidance on and attention to 50.59.

In the 1987 development of the Technical Specification Improvement Program (TSIP) i Policy Statement (52 FR 3788), the staff acknowledged that if conditions and limitations currently in the T3 were relocated to other documents, the NRC

{

would need to give increased attention to changes made pursuant to 10 CFR i

50.59. The policy statement further noted that the staff would work with industry to develop a standard for the conduct of 50.59 reviews.

j In response, in the 1988 timeframe, a joint Nuclear Nanagement and Resources Council (NUMARC) and NSAC working group developed a draft guidance document on i

50.59. The staff provided comments on this draft document, and on later versions that ultimately became NSAC-125. Since the publication of NSAC-125 in 1989, the staff has attempted to prepare a position that would endorse (with comment) NSAC-125. These efforts were not successful due in large part i

to the issues relating to understanding of the meaning of the rule language

_~

l discussed below.

i j

LICENSEE INPLENENTATION 1

l Review of licensee implementation (through the vehicle of cases discussed in j

inspection reports) shows lack of distinction between assessment of " safety" and a 50.59 evaluation with respect to licensee activities. The former is the process of determining whether an activity is " safe," which can be judged by whether it is addressed by existing plant procedures and the SAR or whether it is a " change" that has been found not to adversely affect the functions of systems, structures, and components (SSC). The latter is a regulatory test of j

whether NRC review and approval of a change are needed. Both of these i

assessments are performed by the licensee. Note that the NSAC-125 safety review process (Figure 1-1 of NSAC, copy attached) poses as its first question, 'Is the activity safe?" before moving on to steps about whether a j

change in TS or the SAR are involved.

Associated with the 50.59 process are requirements for written evaluations, j

recordkeeping, and reporting and possible need for a license amendment.

Some l

j licensees currently use the interpretation that, if an activity is not within 3

the scope (not "as described in the SAR"), there is no requirerdnt for even a i

3 l!

i 5

i 4

)

~

i i

l written " safety evaluation" (except to the extent that Appendix B to 10 CFR Part 50, requiring design change control, would apply) or for a written record j

of determination that the change is not "as described" in the SAR'.

i Considering the volume of changes, many facilities have screening processes to j

detemine when a 50.59 evaluation is needed; such screening may focus on the j.

part of the definition of "as described in,SAR." rather than on whether there has been a change that might affect safety. The regions submitted examples of a licensee stating that the words in the SAR were not changed and thus that they did not need to perfom a safety evaluation for a particular chan j

NSAC-125 encourages a broad view of the scope for evaluation purposes,ge.and the staff believes that this is good practice.

If an activity is not recognized as potentially affecting safety functions, an adequate safety assessment j

(which focuses on the SSC affected, failure modes, interactions) may not be performed, and this screening could also conclude that a 50.59 evaluation is 1

l l

j

' Note that 50.59(b)(1) states, "The licensee shall maintain records of changes in the facility and of changes in procedures made pursuant to this i

section, to the extent that these changes constitute changes in the facility l

as described in the safety analysis report or to the extent that they constitute changes in procedures as described in the safety analysis j

report.... These records must include a written safety evaluation which provides the basis for the determination that the change, test or experiment i

does not involve an unreviewed safety question."

+

l

'As discussed in the Denial of a Petition for Rulemaking that would have the 50.59(b) reporting requirements satisfied by the 50.71(e) SAR update requirements, a commenter agrees that the reports could be combined if i

50.59(b) were rewritten to reflect accurately, what he thinks is, its intent.

l That is, the commenter thinks the requirement is intended to provide the NRC i

an opportunity for reflective review of each change made by a licensee to see whether it compromises safety, and ultimately, constitutes an USQ. The i

commenter thinks that the words " change in the facility (procedure) as described in the SAR" actually lead to a prescriptive or cursory review to 1

determine whether or not a figure or text in the FSAR sust be altered by the change. The commenter is concerned that such a prescriptive approach often j

causes one to lose sight of the basic purpose of 50.59(b).

I l

The commenter adds that these words are interpreted inconsistently within the nuclear industry. The commenter thinks that some licensees apply this j

terminology if any portion of the facility or procedure being changed is l

described in any manner in the SAR, and others, perhaps most, apply this j

requirement only if the portion of the facility or procedure being changed is specifically described in the SAR. The consenter believes that this latter

?

application can lead to a prejudgment on erroneous grounds as to whether a i

change can compromise safety. He suggests rewriting 50.59(b) to remove troublesome and unnecessary terminology from the regulations and focus the i

attention in 50.59(b) on the performance of safety evaluations in support of j

conclusions as to whether er not proposed changes involve an unreviewed safety question.

(DPRM-86-4 24 NRC 635 (1986)).

l 6

i l

i i

-=-

J l

i I

j not required. The staff intends to examine the relationship of the safety and

~

regulatory assessments, and how they fit within the regulatory framework of 10 j

CFR 50.59 as part of its action plan.

i The staff also reviewed enforcement cases citing 50.59 (about 65 cases over j

the last 6 years were discovered - see Table 2 for summary). These cases were reviewed to determine whether any patterns concerning types of changes j

existed, or what aspect of 50.59 implementation was the basis for the violation. About 60 percent of the violations involved failure to perform a 4

safety evaluation for a change; that is, the licensee did not recognize that a change affecting safety had occurred. Six instances involved temporary modifications. Another seven cases involved " margin reductions" associated with changes in water system (or heat exchanger) flows, temperatures, or valve i

alignments. Other types of changes were " replacements" with some different characteristics (breakers, motors, test requirements), addition of equipment, or removal of a design feature (alarm, switch, heat tracing). Generally, in the cases where an evaluation was performed, the licensee was cited for i

failing to identify a USQ arising from a reduction in the margin of safety.

l This review of licensee implementation and the staff previous efforts in i

review of NSAC-125 identified a number of specific areas, which are discussed i

in more detail below (see ISSUES section).

I j

STAFF OVERSIGHT In February 1991, a team reviewed the existing process for NRC review and inspection of licensee implementation of 50.59. The team found the existing processes to be inconsistent, and recommended a number of imp-ovements. As a result, Inspection Procedure (IP)37001, "10 CFR 50.59 Safety Evaluation Program," was issued in 1992 to provide a procedure for inspection of licensee 50.59 evaluation programs. The procedure directs the inspector to review the i

licensee's screening process and USQ criteria against 50.59.

Further, it calls for a review of a sample of 50.59 evaluations, and of changes that were a

determined not to require a 50.59 evaluation, as well as a review of FSAR l

l updating and 50.59 reporting. The inspection procedure was not made part of i

the core inspection program.

It also states that it is intended that the i

facility's NRR project manager (and another inspector) participate in the j-inspection.

Review of inspection reports over the last 2 years indicates that the way prograsmaatic evaluations of licensee 50.59 programs are conducted by i

the NRC vary.

In some cases, the project manager conducted this review

]

independently and the results were included in regional inspection reports.

In others, this inspection procedure was implemented in conjunction with a i

team inspection of engineering, or of design Changes or modifications. As j

part of the action plan, the staff will assess the roles of project managers, t

regional and resident inspectors for reviews of licen'see 50.59 evaluations.

i l

As noted in the December 15, 1995, memorandum, staff reviews of licensee 50.59 i

evaluations have arisen in different ways. These include the systematic j

evaluation of the licensee process (using IP 37001), inspections of modifications, inspections of tamporary modifications, followup on operational problems and observation of review comittee meetings. A word search of inspection reports from the last 2 years uncovered more than 400 inspection i

f i

7 i

l

i i

t i

reports that referenced 50.59. Of these, about 100 reports containing the J

most citations of 50.59 were examined in more detail to characterize the nature of the 50.59 review. Of these, 22 were " programmatic inspections" (generally citing IP 37001), evaluating the licensee's screening and review 1

process (as well as implementation). Another 25 were associated with review of " change packages" as part of engineering, modification, and design control 4

inspections. Another 15 specifically addressed control of temporary modifications. Another 25 were associated with operational issues, equipment 3

{

problems, tests, or procedures. A number also noted staff observation of

^

committee meetings where licensee 50.59 evaluations were reviewed. Thus, j

staff oversight of licensee 50.59 evaluations (both their programs and their implementation) is integrated with other aspects of the NRC inspection j

program.

1 i

At a fundamental level, improvements of the oversight process that address the "when" and "by whos" will have limited impact unless guidance on the l

acceptable interpretation of key rule language is forthcoming through i

resolution of the issues presented below.

Thus, improvement in both staff l

oversight and licensee implementation are linked to this activity.

j ISSUES i

In this section, each of the issues identified by the staff's review are discussed from the perspective of how they arise from the rule language and the effects they have on licensee implementation of the 50.59 process.

Attachment B provides summary descriptions of examples, chosen from those offered by the regions and from review of inspection reports, that help illustrate these issues.

f l

Definition of a "chanae" 1

\\

j When a license undertakes an activity at its facility, several different l

prv edures or processes may be involved, depending on the nature of the acu vity (procedure, temporary alteration, maintenance, test, design i

i modification).

For activities that are recognized to be " planned" changes j

that can affect safety, control processes (Appendix B to 10 CFR Part 50), as implemented by the facility Quality Assurance Plan and procedures, address the licensee review processes, including the necessary approvals, such as the review to determine if a 50.59 evaluation is required.

Further, in accordance i

with administrative control requirements, all licensee 50.59 evaluations are subject to multidisciplinary review.

i These processes sometimes are not effective if an activity is not i

characterized as a change (so no evaluation of the effect on safety is performed). These situations could arise from improper use of screening criteria or inadequate understanding of the implications of the activity.

Some guidance is available on whether a particular activity is a " change."

For example, inspection guidance on 50.59 in Section 9900 of the NRC i

Inspection Manual that was issued in 1984 gives some examples of changes that l

require (or do not require) a 50.59 evaluation.

IP 37001 also contains some i

guidance on " change", as it pertains to procedures, temporary modifications, removing equipment from service for maintenance, etc. NSAC-125 also addresses j

8 i

I t -

1 b

" change" in Section 4.

The guidance in these documents is generally l

consistent, except for procedural examples, but may not be comprehensive.

Comments from staff and the example 50.59 evaluations suggest that further i

guidance in this area may be helpful.

Resoonse to Dearaded or Nonconformino Conditions I

The 50.59 process was established to coatrol how a licensee may "make changes in the facility," such that changes to the TS or changes raising a USQ are reviewed by the s:.aff before they are ind rented by the licensee. The role of the 50.59 process for an " unplanned".hange, that is, when it is discovered that the facility does not conform in son.4 respect with the TS or FSAR, is less clear. Generic Letter 91-18 forwarded sections of the NRC Inspection Manual addressing Nonconforming Conditions and Operability.

(See also letter of October 21, 1994, to Northeast Utilities on this subject, as well as Section 8.1.2 of the NRC Enforcement Manual).

i 4

In this instance, the safety assessment of the " change" is the operability determination and appropriate resulting actions. The condition then must be "dispositioned," in accordance with 10 CFR Part 50 Appendix B Criterion XVI,

" Corrective Action" in a timeframe commensurate with the safety significance of the deviation and the bases of the operability determination. A licensee may choose to restore the facility to the SAR condition, make other changes (compensating actions) to the facility to satisfy the corrective action requirements, or revise the SAR to reflect the rew "as-found" condition.

These latter two options require review to determine if the proposed changes meet the 50.59 criteria for allowed changes.

If a USQ is involved, prior NRC approv.1 of the change is required.

In the context of the earlier discussion on " safety" evaluation and " regulatory" (50.59) evaluation, some experience with non-conforming conditions suggests that the converse situation has occurred; the safety evaluation (operability) is done, but the regulatory approval (50.59) criterion has not always been evaluated.

An issue that has arisen with respect to nonconforming conditions is the time i

frames in which the corrective actions and 50.59 evaluations should be performed (given that a determination of operability has been made). The staff has generally accepted the position that 50.59 reviews are not required for temporarily acceptgd nonconfonnances that will be restored to their original configuration. However, on occasion the " temporary" condition has existed for many months or years without either restoration or a 50.59 evaluation. Further, a licensee may have to take into account certain compensating actions in order to make a positive operability determination with the nonconforming condition. The timeframe for resolving the nonconforming condition needs to be linked to the basis of t% operability

'If the nonconforming condition is (promptly) restored "as described in the SAR", it may reasonably be argued that no " change" has occurred. Long-term operation with such a nonconforming condition would suggest that the condition is a " change" that should be evaluated.

9

determination and the extent to which compensating actions are needed. The need for clarification on these aspects will be addressed as part of the action plan.

Definition of "as described in the SAR" The criterion for requiring a documented 50.59 safety evaluation for a change is "to the extent that these changes constitute changes in the facility as described in the safety analysis report or to the extent that they constitute changes in procedures as described in the safety analysis report."

Recent guidance to the staff on the meaning of "a change in the facility or procedures as described in the safety analysis report" is contained in IP 37001. According to this procedure, this criterion means that a change in a structure, system, or component (SSC) or a procedure requires a 5G.59 safety evaluation only if the following statements are both true:

(a) the SSC or procedure being changed is described in the most recently updated FSAR submitted to the NRC in accordance with Section 50.71(e), and (b) the FSAR description of the SSC or procedure being changed would be affected by the change.

The " safety analysis report" means the most recently updated FSAR submitted to the NRC in accordance with 50.71(e).

SECY-92-314 noted that the updating frequency and licensee interpretation of "the effects of" language in 50.71(e) have resulted in variability in the depth and completeness of licensee SARs.

Further, the most recently submitted SAR update may be almost 30 months old.

The narrow focus specified in IP 37001 (which is consistent with one literal interpretation of 50.59), tends to foster emphasis on the regulatory approval process at the expense of the evaluation of the safety of the change. The regions submitted some examples of a system being operated in a manner different from that described in the SAR (although not explicitly prohibited by the words of the SAR), and the discussion with the licensee revolved around the interpretation of the words " procedures as described", rather than on whether the operation affected safety functions. How change to procedures-that delineate methods of system operation, or control of processes, but that themselves are not " described in the SAR", should be evaluated pursuant to 50.59 needs clarification. The staff plans activities to address this issue as part of its action plan.

Test or erneriment not described in the SAR In a similar vein, questions have easionally arisen as to whether a particular activity is a test or experiment (not described in the SAR) for which a 50.59 evaluation is required.

(See for instance the example at the end of Attachment B).

Inspection manual Section 9900 on 50.59 (1984), in addressing conduct of tests and experiments, notes:

"This pertains to the perfonnance of an operation not described in the SAR which could have an adverse effect on safety-related systems." The need for clarification on this aspect will also be considered.

10

.~

I i

l 1

3 l

Increase in nrobability or consecuences s

NSAC-125 guidance differs from the explicit language in 50.59 in that it suggests that if a change in probability (or increase in consequences) is i

small (or still within the acceptance limit) a USQ does not exist. This language is not in strict agreement with the language of 50.59

" probability t

...or consequences may be increased".

In its May 10, 1989, letter to NUMARC l

on the NSAC-125 guidelines, the staff supported this interpretation to the 1

extent that it stated that if a change in probability of occurrence or increase in consequences is so small, or the uncertainties in determining whether an increase has occurred are such that it cannot be reasonably j

concluded that they have changed, the change need not be considered an j

increase. More recently, in Generic Letter 95-02, on digital instrumentation system upgrades, the staff provided clarification that uncertainty about a

whether the probability or consequences may increase (or whether the l

possibility of a different type of accident may be created) should lead j

licensee to conclude that a USQ is involved.

i The meaning of " increase in probability" also needs to be considered in the i

context of the licensing approach at the time 50.59 was promulgated, when j

event and equipment malfunction frequencies were largely qualitative. Modern probabilistic risk assessment techniques allow quantitative calculation of i

changes in probability, but leave open the question of how results should be judged (see examples in attachment B). The staff views the question of "small l

increases" as a process concern, not a safety concern. This conclusion is j

supported by the reviews of enforcement history and inspection results (only l

isolated cases citing probability or consequences, and as noted, only small l

increases are in question),

1 Ccmoensatina actions A related aspect to the " increase in probability or consequence" determination 1

is the extent to which compensating actions may be considered in offsetting uncertainties about whether a change has led to a USQ. An OGC memorandum of j

January 31, 1984, to Commissioner Gilinsky provides some perspective on this j

point.

In commenting on proposed staff guidance on recirculation piping systems in boiling water reactors, the memorandum states:

j If any of a plant's technical specifications is explicitly based l

upon the margin of safety for some individual component, then it would be contrary to section 50.59 to allow any plant change which decreases that margin of safety without a license amendment, and the

{

fact that the 'overall" margin of safety for the " system" was 1

unchanged would not affect this conclusion.

(footnote follows here).

i i

Footnote: Tradeoffs are not strictly permissible in applying the

{

other two unreviewed safety question criteria of section 50.59.

There is an unreviewed safety question either if the change may j

increase the probability or consequences of an accident or j

malfunction of equipment important to safety evaluated in the FSAR, j

11 j

1 i

l

or if the change creates the possibility of some new accident or malfunction. An increase in the accident or malfunction probability for one piece of " equipment important to safety" cannot be offset by a decrease in another. However, as explained below, there is considerable leeway in the section.

First, it may be consistent with section 50.59 to define " accident" or " malfunction" broadly without regard to cause.

For example, if one defines a loss of coolant accident (LOCA) broadly without regard to cause, then an increase in LOCA probability because of reduced margins in strength of welds or supports could be offset by a decrease in LOCA probability because of the use of pipe materials less susceptible to cracking.

Such broad definitions also make it less likely that the criteria relating to new accidents would be tripped.

Second, these other criteria in section 50.59 do not relate specifically to safety margins.

Under these criteria, one may offset decreases in nominal safety margins by increased conservatism in the use of data or analytical techniques so long as the " bottom line" estimated accident probability is not increased...

The above discussion would suggest that compensating actions can be considered within certain constraints. The nature of the compensating actions may also i

need to be considered with respect to their duration or the extent of the change of which they are a part.

For instance, reliance on manual action rather than automapic may be reasonable for A temporary situation, but not as a permanent change.

Compensating actions is also an issue in the context of resolution of nonconforming conditions. The staff plans to develop clarifying guidance on this point.

Use of PRA in licensee 50.59 evaluations d

The Regulatory Review Group Report (Item 2.3.19, tracked in status reports as Area 30), discussed the possible application of PRA (risk technology) in licensee 50.59 evaluations.

Some licensees have used PRA techniques to assess planned changes.

In a few instances, questions have been forwarded from the regions about specific changes where a PRA calculation that the licensee performed as part of its evaluation of a change shows a small, but finite increase in probability of occurrence (of an " accident" or " malfunction of equipment important to safety"). The staff is working on a position that would provide guidance to inspectors (and licensees) on this issue.

7The OGC review of precedents identified a director's decision (00-93-13) on Turkey Point that explicitly discussed certain compensating actions, such as use of manual tank level control instead of automatic, as part of an interim fire protection configuration for plant restart after Hurricane Andrew.

12

.--- - -.-.. -.~ -. - - -

4 i

Marcin of safety l

The 1968 amendments to 50.59 added to the definition of a USQ the " malfunction i

of equipment important to safety" and reduction in "the margin of safety as defined in the basis for any technical specification" criteria. At the same time, changes were made to 50.2 and 50.34. The intent of these changes was to establish a system of TS that would focus attention on items more directly related to public safety, to provide for systematic documentation of the bases i

for specifications, and to require that the SAR include information describing j

the facility, an explanation of the design bases and limits on facility i

operation, and evaluations to show that safety functions will be accomplished.

Thus, it was believed that the margin of safety would be derived from the l

j design basis information contained in the SAR'.

In practice, questions arise i

about what is "a margin of safety" and which margins of safety are " defined in the basis for any TS."

Ifaspecificstatementaboutaparticylarparameter or " margin" is not explicitly included in any TS Basis section, the degree i

a here the information on margin of safety for the TS is to be found can W

be understood by considering the 1968 rulemaking that revised 50.2, 50.34, l

50.36, and 50.59. Specifically, a definition of design basis was added; i

50.34(a)(4) (on the preliminary SAR) was revised to require submittal of "a preliminary analysis and evaluation of the design and performance of j

structures, systems, and components of the facility... including detemination i

of (1) the margins of safety during normal operations and transient conditions... and (ii) the adequacy of structures, systems, and components e

provided for the prevention of accidents and the mitigation of consequences of i

accidents". Also, 50.34(b) stated, "The final safety evaluation report shall include information that describes the facility, presents the design bases and the limits on its operation, and presents a safety analysis...and shall t

l include...(4) a final analysis and evaluation of the design and performance of i

structures, systems and components with the objective stated in paragraph (a)(4)...."

I i

{

The Statement of Considerations stated, "The analysis and evaluation of the i

facility required under the proposed amendment to 50.34 should provide (1) the necessary infomation from which technical specifications will be selected, j

and (2) the detailed bases for the specifications."

i Paragraph 50.36(a) states that "a summary statement of the bases or reasons for such specifications....shall also be included in the application, but j

shall not become part of the technical specifications."

Finally, 50.36(b) states that technical specifications will be derived from

}

the analyses and evaluation presented in the SAR.

r i

4 i

' Examination of the comments on the 1966 proposed rulemaking and their l

i resolution sheds some interesting light on these points. Some commenters noted that in order for the reference to " margin of safety" to be meaningful.

1 it would be necessary to add a definition for it, or to expand the definition 2

i 13 i

i i

j i.

to which other documents (SAR, staff safety evaluation report, etc.) must be consulted to determine whether there are margins.d.ich define the underlying basis for any TS requirements that may be affected by the change is unclear.

Both NSAC-125 and IP 37001 acknowledge that documents other than the TS Bases or SAR may need to be consulted. Also, no position has been established on what type of change determines whether a reduction in margin of safety for TS requirements has occurred; a change that affects numerical values predicted by the safety analysis, a change that results in a safety analysis value exceeding the acceptance limit approved by the NRC in the SER, or a change in assumptions or physical parameters that are inputs to the safety analysis.

NSAC-125 guidance seems to support the approach of the numerical value

}

exceeding the acceptance limit, but also recognizes that if the licensee makes changes to certain analysis assumptions or methods in performing analyses to demonstrate that acceptance limits are not exceeded, a reduction in margin of safety may be involved (see following section).

Use of new analysis assumotions and methods Another area for possible clarification is the use of new analysis methodologies. Staff judgments on the acceptability of safety analysis results generally depend on certain conservatisms in input assumptions and validity and conservatisms of methods; however, these " implicit margine are

)

not always explicitly documented in the SER.

In evaluating a change., a licensee may perform a new analysis (with different methods and asst.mptions) i to demonstrate that there has been no increase in consequences (or as part of an operability determination to demonstrate that a condition is " safe").

If J

f i

l l

of " design bases" to include the concept. The resolution was to revise the

~

definition of design bases and expand 50.34(a)(4) which links design bases with margin of safety (see previous footnote).

Second, coiunenters stated that the requirements of subparagraphs (1) and (2) (of the USQ definition) are redundant with regard to subparagraph (3) (margin of safety). For example, one coinnenter noted:

"The criteria given in subparagraphs (1) and (2) depend on changes in probabilities that may be difficult to quantify and of subjective assessments of possibilities. This can lead to uncertainty and misunderstanding.

If the " margin of safety" were quantitatively defined, it should be possible to eliminate subparagraphs (1) and (2) and to retain subparagraph (3) as the sole and unequivocal criterion of an unreviewed safety i

question." The staff's comment resolution addressed the redundancy issue in the converse (i.e., the question of deleting (3) rather than the suggested

1) and (2)) stating; " Subparagraphs (1) and (2) address deletion of (ly to accident situations, whereas subparagraph (3) includes themselves on considerations of normal operation and anticipated. transient conditions as well as accident conditions. These provisions therefore, are complementary rather than redundant." This response is also illuminating about the contemporaneous view of " accident" in subparagraphs (1) and (2).

14 i

/

\\

I

the new analysis reduces the margins relied on by the NRC, such cases might constitute a USQ (reduction in margin of safety). The conditions under which new methodologies may be used in 50.59 evaluations is an area where clarification may be needed.

CONCLUSIONS The above discussion addresses some of the ambiguities in the 50.59 implementation process that contribute to differences between and among the staff and licensees when considering particular " changes." Close scrutiny of the rule, related documents, and licensee 50.59 evaluations has tended to highlight the areas where inconsistencies can arise. But it must be recognized that the staff and the industry have had 30 years of experience in wrestling with these problems and that although specific 50.59 guidance documents may be few, a reasonable body of other documents exists that has 4

shaped the implementation of 50.59.

The examples of 50.59 implementation problems are only a small subset of the total 50.59 situations that licensees address, or even of the total number of evaluations that the NRC has reviewed as part of its oversight.

Further, despite the existence of the issues noted above, the overall approach of permitting changes (without approval) that do not erode the basis of the NRC's licensing decision has provided needed flexibility and has generally been successful in preserving safety margins.

NSAC-125 was written to provide guidance to licensees in preparing adequate safety evaluations in support of 50.59 determinations. Although the staff has not been able to endorse NSAC-125 in its particulars, it has concluded that NSAC-125 has given the nuclear power industry a sound foundation to establish a process that will produce effective evaluations related to changes to plant design or procedures. Changes of safety significance are highly likely to be flagged by implementation of the NSAC-125 guidance.

Inspection results have confirmed that the quality of the evaluations of changes has improved since licensees began implementing the NSAC guidance.

Licensee efforts on design basis reconstitution, and for conversion to Standard Technical Specifications have also helped reduce the uncertainties through better understanding of the facility safety basis and of the bases for TS.

The staff believes that the overall processes licensees use to control changes to the facility and the substance of licensee safety evaluations warrant more attention than the precise thresholds for NRC approval that 50.59 attempts to address.

For this reason, the staff will keep in mind the impacts on the adequacy of safety evaluations and screening criteria while addressing issues relating to the 50.59 regulatory approval process.

'" Note that a significant part of the basis for relocation of certain TS requirements, such as core operating limits and pressure / temperature limits, to controlled documents other than the TS is use of methods specifically approved by NRC for these calculational purposes.

15

]

j With respect to implementation of the 50.59 eva'uation process, the staff's

)

review shows that the difficulties with day-to-day use of the process arise j

when meanings of the rule language are not clear. The staff has examined a number of issues that have arisen over the last several years as part of the TSIP and the review of NSAC-125, and as specific problems are identified 4

through inspections and reviews. The variability in licensee SARs and TS also l

contributes to lack of consistency in results of licensee 50.59 evaluations.

Some interpretations of the language of 50.59 could lead to situations where conditions with a small increase from an already low probability of occurrence require staff review and approval, while other conditions that do not happen to be " described in the SAR," but that may be of more safety significance, do not. In the above discussion, the staff has attempted to frame the issues, how they arise from the underlying regulatory framework, and their practical implications.

Staff plans for future actions to address these issues are discussed in the attached action plan.

a In summary, under the action plan, the staff objective will be to develop guidance that will:

t

• define the elements of safety evaluation review or screening processes i

within the context of various licensee design or change contrcl processes, j

to provide greater assurance that effects on safety of changes, whether to equipment, procedures, or methods of system operation, are appropriately evaluated.

5

• define more specifically the scope of applicability of 50.59 (that is, to identify those changes, tests or experiments that need to be evaluated to e

j determine if NRC approval is needed). This would include a more 1

comprehensive description of change, and guidance for broader consideration j

of 'as described."

t

• establish the process for resolving nonconforming conditions such that differences from the FSAR are reconciled (from both safety and regulatory 3

viewpoints) in a time frame coismensurate with their safety significance.

]

• improve unreviewed safety question determinations in the following respects:

- address the extent to which short-and long-tem compensating actions may be considered as part of change under 50.59 such that it can be determined that the probability has not increased or the margins of safety. Also, address when consideration of compensating actions should be reviewed as part of. the basis for approving a proposed license amendment.

)

l

- clarify the extent to which PRA techniques may be useful in evaluating the effects on safety of a change and in addressing the ' probability may be increased" criterion for unreviewed safety questions.

- clarify what is meant by " margin of safety" in relation to numerical parameters, analysis methods, calculated results of safety analyses, and 3

licensing limits so that changes that might affect the basis for staff's safety conclusions are more consistently identified.

1 16 i

l 4

LIST OF DOCUMENTS REVIEWED 50.59 Rulemaking record (statements of considerations, comments, staff papers, f_gderal Reaister notices)

Documents pertaining to Technical Specification Improvement Program (including SECY-86-10 (Recommendations for Improving Technical Specifications, January 13,1986), and Federal Reaister notices of policy statements and rulemakings)

Pressure vessel annealing final rule FR Notice (60 FR 65456) December 19, 1995 Rulemaking packages (in progress) on Part 50 (Decommissioning), and Part 52 (design certification change processes)

NRC Inspection Manual (Section 9900, Procedures 37001, 37550/1, 40500, 93808, 50001)

NRC Enforcement Manual, NUREG/BR-195.

1 Generic Letter 80-09, " Low-level Radioactive Waste Disposal," January 29 1980.

Generic Letter 80-29, " Modifications to BWR Control Rod Drive Systems,"

April 4, 1980.

Generic Letter 80-51, "On-site Storage of Low-level waste," June 9,1980.

Generic Letter 81-38, " Storage of Low-level Radioactive wastes at power reactor sites," November 11, 1981.

Generic Letter 84-07, " Procedural Guidance for Pipe Replacement at BWRs",

March 14, 1984 (also OGC memorandum of January 31, 1984 on this subject)

Generic Letter 85-22, " Potential for loss of Post-LOCA Recirculation Capability due to Insulation Debris Blockage," December 3, 1985.

Generic Letter 86-02 " Technical Resolution of Generic Issue B-19, Thermal Hydraulic Stability," January 27, 1986.

Generic Letter 87-02, " Verification of Seismic Adequacy of Mechanical and Electrical Equipment in Current Operating Reactors (USI A-46)".

Generic Letter 88-07, " Modified Enforcement policy relating to 10 CFR 50.49, Environmental Qualification of Electrical Equipment Important to Safety,"

April 7, 1988.

Generic Letter 89-16, " Installation of a Hardened Wetwell Vent," September 1.

1989.

Generic Letter 90-02, " Alternative Requirements for Fuel Assemblies in the Design Features Section of Technical Specifications," February 1,1990.

i l

Generic Letter 91-08, " Removal of Component Lists from Technical-Specifications," May 6, 1991.

Generic Letter 91-18, "Information to Licensees Regarding Two NRC Inspection i

Manual Sections on resolution of Degraded and Nonconforming Conditions and Operability," November 7, 1991.

i Generic Letter 93-08, " Relocation of Technical Specification Tables of I

Instrument Response Time Limits," December 29, 1993.

7 Generic Letter 95-02, "Use of NUMARC/EPRI Report TR-102348, ' Guideline on i

i Licensing Digital Upgrades' in Determining the Acceptability of Performing l

Analog-to-Digital Replacements under 10 CFR 50.59," April 26, 1995.

4 l

Generic Letter 95-08, "10 CFR 50.54(p) Process for changes to Security Plans l

without prior NRC approval," October, 31, 1995, i

IE Bulletin 80-10. " Contamination of Nonradioactive System and Resulting j

Potential for Unmonitored, Uncontrolled Release to the Environment,"

l May 6, 1980.

i IE Circular 80-18, "10 CFR Safety Evaluations for Changes to Radioactive Waste Treatment Systems," August 22, 1980.

Information Notice 83-23, " Inoperable Containment Atmospheric Sensing System,"

April 25, 1983.

Information Notice 83-64, " Lead Shielding Attached to Safety-Related Systems without 10 CFR 50.59 Evaluation," September 29, 1983.

Information Notice 87-04, " Diesel Generator Falls Test Because of Degraded Fuel," January 16, 1987.

J Information Notice 89-81, " Inadequate Control of Temporary Modifications to Safety-Related Systems," December 6, 1989.

Infomation Notice 91-40, " Contamination of Nonradioactive system and resulting possibility for Unmonitored, Uncontrolled Release to the environment," June 19, 1991.

Information Notice 91-63, " Natural Gas Hazards at Fort St. Vrain Nuclear Generating Facility", October 3, 1991.

Information Notice 95-46, " Unplanned. Undetected Release of Radioactivity From the Exhaust Ventilation System of a BWR," October 6, 1995.

Information Notice 95-54, " Decay Heat Man'agement Practices during Refueling Outages," December 1, 1995.

Information Notice 96-17, " Reactor Operation Inconsistent with the Updated Final Safety Analysis Report," March 18, 1996.

NRC Inspection reports and notices of violation

NUREG-1449, " Shutdown and Low-Power Operation at Commercial Nuclear Power Plants in the United States," February 1992 (addresses freeze seals as 4

temporary modification).

Regulatory Review Group report (1993) and related correspondence.

NSAC-125 Nuclear Safety Analysis Center Guidelines for 10 CFR 50.59 Safety Evaluations, June 1989 Letters from NRC to NUMARC dated May 12, 1988, May 10, 1989 and June 23, 1993 on NSAC-125 (Plus additional internal memoranda reporting on progress, issues, plans),

i SECY-96-024, Semiannual Status Report on the Implementation of Regulatory Review Group Recommendations, February 2, 1996 SECY-92-314, Current Licensing Basis for Operating Plants, September 10, 1992 i

SECY-95-300, Nuclear Energy Institute's Guidance Document, " Guideline for Managing NRC Commitments", December 20, 1995 Letter from NRC to Commonwealth Edison Company, September 15, 1995, on redued seismic criteria.

i Letter from NRC to Northeast Utilities, October 21, 1994 on Degraded or Nonconforming Conditions.

i Letter from NRC to Millstone 3, June 7,1993 on diesel fuel oil capacities.

i Meeting summary, December 11, 1995, on Grand Gulf graded quality assurance i

program, regarding changes in seismic or Code classifications under 50.59.

Casks, shield plugs - heavy loads (generic communications under development)

(see also Generic Letter 85-11) i

-l

~

Table 1 CONTP,0L OF FACILITY CHANGES - KrY REGULATORY MILESTONES Date Action Sunnaq 1954 Atomic Energy Act TS to be stated in application and become part of license. Hearing requirements i

specified i

1 1956 Final Rule Comission will indicate which part of j

(50.34,50.36)

Hazard Sumary Report (HSR) will be deemed to be TS. Two approaches:

Yankee - detailed TS, no control of HSR Vallecitos - entire HSR to become TS j

l 1960 r, omission Decision Decision reduced information in on Vallecitos TS and added license conditions for changes that could be made without prior approval (USQ - prob. of occurrence / consequences of accident analyzed, credible possibility of different type of accident) 1962 Final Rule 50.59 (similar to Vallecitos conditions)

(50.36, Appendix A, added to regulations. Detailed list of

)

and 50.59) parameters was given in Appendix A to serve as guide on matters Commission would expect to be in TS.

1968 Final Rule Appendix A was deleted.

Five general (50.2,50.34,50.36, categories of information defined which 50.59) weretobeinTS;lesslpformationinTS, more information in SAR (design basis, margin of safety). Revised USQ criteria to include " malfunction of equipment important to safety" and " reduction in margin of safety."

1972 Standard Technical STS prograr. was in. 'tuted to develop Specifications model TS for eact ndor type in order to make TS more c6.;istent and to reduce disagreements "A final rule changing " hazards sumary report" to " safety analysis report" was issued on September 30, 1966.

i

l 1980 Advanced Notice of Changes to 50.36 were contemplated to Proposed Rulemaking establishstangardforitemstobe included in TS ; and to define new category of requirements of lesser significance that could be revised without prior approval, under certain conditions.

198')

Final Rule 50.71 was revised to require submittal of (50.71(e) updates.to SAR annually (subsequently increased to refueling outage), up to date as of 6 months earlier.

Update to include " effects of" changes to facility, evaluations in support of license i

1 amendments or USQ determinations and i

analyses of new issues 1982 Proposed Rule Rule would have divided existing TS into (50.36) two categories; second supplemental set would not have generally requiref prior approval.

1987 Policy Statement Above rule change was deferred. Technical Specification Improvement Program Criteria j

may be used to transfer control of certain requirements to other mechanisms (such as FSAR, QA plan, procedures) 1995 Final Rule Policy statement criteria were added to (50.36 criteria) 50.36 as criteria to be applicable for TS (not backfit) trPortland General Electric Co., (Trojan Nuclear Plant), ALAB-531, 9 NRC 263 (1979), in which the issue was whether the licensee needed to include spent fuel water chemistry limits in the TS, was one of the reasons cited for this ANPR.

i l

l i

f TABLE 2 i

ENFORCEMENT EXAMPLES REFERENCING 10 CFR 50.59 l

J Plant Name Date Reff Description i

j St Lucie 3/96 9603050093 Inadequate 50.59 evaluation for procedure change for i

ESCALATED manual boron dilution directly to pump suction WNP2 8/95 9508220165 Failure to perform 50.59 evaluation for temp. mod to l

remove RCIC valve position indication Zion 4/95 9504070165 Diesel generator test sequence changed under 50.59; ESCALATED test not in accordance with RG 1.108 as required by TS.

Fermi 3/95 9504280021 Failed to perform safety eval for installation of 2 1

data acquisition units on reactor vessel level &

pressure instrument loops Peach 2/95 9502220008 Failed to perform safety eval for temporary l

Bottom shielding above hydraulic control units l

Vermont 1/95 9502210054 Modified reactor vessel water level instrument by l

Yankee adding recorder without performing safety eval Vogtle 1/95 9502210009 Inadequate safety eval for change to leak test j

requirement on 10 isolation valves l

Arkansas 10/94 9501030021 Failed to perform safety eval for; temp change to I

decay heat removal pump cooler with rubber hose, l

copper tubing & epoxy l

Zion 11/94 9412080147 Failed to perform safety eval for change in design

{

basis differential pressure l

Arkansas 1 8/94 9410130010 Failed to perform safety eval, update FSAR & tech spec after calculation showed need to increase level in cooling pond i

Sales 4/94 9410110014 Failed to perform safety eval on modified controller for SG PORV to not open on loss of condenser heat sink without manual operator action Sales 5/94 9407070083 Failed to perform safety eval for vital bus transformer change in kva Byron 5/94 9406290040 Failed to perform safety eval on open watertight closures in auxiliary feedwater tunnel D.C. Cook 4/94 9406070069 Failed to perform safety eval on ops authorized increase to ccw heat exchanger temperature from 95 *F to 110 *F.

l 2

)

l 4

Plant Name Date Reff Description Quad 3/94 9403280072 Failed to perform safety eval for; 1 of 2 pumpback air compressors which had never been operational but which were in UFSAR, replaced yoke to actuator bolts with stronger bolts on rhr valve, replaced motor on rhr mov with larger motor Sequoyah 2/94 9403150113 Failed to perform safety eval on smoke detectors in control room which did not meet fsar design J

requirement Crystal 12/93 9402230279 Failed to do adequate safety eval of emergency l

River operating procedures in that eval stated eop': wre in strict accordance with vendor guidelines but procedures deviated from vendor guidance St. Lucie 10/93 9312140049 Failed to perform safety eval for temp mod on air supply to ultimate heat sink valve actuators in support of maintenance WNP2 10/93 9312130019 Made change to facility as described in FSAR & tech spec without submitting tech spec change l

Indian Pt 3 10/93 9312030201 Failed to maintain safety eval for removal of heat trace on service water system as described in FSAR Indian Pt 3 10/93 9312030201 Failed to submit description & sumary of safety evals for temp mods such as jumparing a battery cell LaSalle 9/93 9311020131 Failed to perform safety eval for removal of shielding on control room ventilation rad monitors &

removed fire proofing material from structural steel Zion 3/93 9309150103 Failed to perform safety eval for keeping aux bldg l

ESCALATED mi:sile door open for extended time and not considering loss of 1/4" water pressure diff &

4 potential dose from dropped fuel accident i

Seabrook 5/93 9308270235 Failed to perform safety eval for deletion of loss-of-charger output current alarms described in fsar Crystal 7/93 9308250380 Failed to perform safety eval on change to makeup 1

River tank hydrogen pressure i

Dresden 1/93 9307220033 Failed to perform adequate safety eval for ccsw flow ESCALATED reduction which effected short & long term l

containment pressure response, also failed to validate new computer codes for containment pressure 4

response & decay heat, & did not use limiting case for core spray pump npsh calc Seabrook 4/93 9304300229 Failed to perform saf ety eval prior to changing design basis tornado as described in FSAR

a i

OTHER-EXAMPLES d

St Lucie, Inspection Report 50-335/389/96003. Followup to a boron ai!ution event at St. Lucie revealed that the licensee had been operating the facility 1

in a nanner different from the FSAR description.

The UFSAR stated that in the dilute mode, a preset quantity of reactor nakeup water is added to the volume i

control tank at a preset rate.

The procriure in place in January 1996 allowed adding a mixture of boric acid and primary water in manual control directly to the suction of the charging pump; it did not include baron dilution by adding primary water, with no boric acid, in manual (the evolution that occurred on l

January 22, 1996). After the dilution event, the licensee revised the i

procedure to add guidance on manual dilution allowing addition of water alone; the 50.59 screening concluded that the revision was not a " change to a

procedures as described in the SAR". The inspectors concluded that the licensee had failed to perform an adequate 50.59 evaluation in that t.his nethod of dilution was different from that described in the UFSAR. Further i

review found that the dilution procedure had been changed to allow a mixture I

{

of water and boric acid in manual directly to the pump suction in January 1976, before the license was issued.

An enforcement action was issued on 1

l this event on March 28, 1996.

1

+

Crystal River, Inspection Report 50-302/95022. Hydrogen overpressure for the nakeup tank (connected to the reactor coolant systen) is required to be maintained with a certain band relative to tank level to prevent safety l

injection pump failure (due to hydrogen gas binding), and still provide i

adequate hydrogen to absorb dissolved oxygen.

The narrow band required i

frequent pressure adjustments as tank level varied during operations.

i Operations personnel, believing the curve to be inaccurate, performed l

l evolutions in September 1994, to gather data to verify the pressure / level 1

relationship by increasing and decreasing pressure and level. During these i

evolutions, the operators exceeded the pressure limits.

The operators did not perform a 50.59 evaluation before performing these actions. The NRC inspectors concluded that since these evolutions were not required by plant conditions at i

k the time, but were instead initiated by operators for the purpose of gathering data relative to the makeup tank curve, they are considered to have been a test or experiment.

Thus, failure to perform a written safety evaluation for l

this evolution was found to be a violation of 10 CFR 50.59. Enforcement action on this issue is pending.

i i

i l

17 l

l l

1

4 4

1 1

10 CFR 50.59 ACTION PLAN S

(

G

l

)

i 10 CFR 50.59 ACTION PLAN i

Descriotion: This action plan defines measures to improve licensee j

implementation and WRC staff oversight of the 10 CFR 50.59 process.

l Historical Backaround:

The NRC promulgated 10 CFR 50.59 in 1962 to describe the circumstances under which licensees may make changes to their facility (or l

to make changes to procedures, or to conduct tests and experiments) without j

prior NRC approval when the change does not involve the technical j

specifications or an unreviewed safety question.

Licensees are required to i

submit periodically information on changes made pursuant to 50.59. The NRC has programs for monitoring licensee processes for implementing 50.59.

In a i

memorandum dated October 27, 1995, Chairman Jackson raised a number of j

questions concerning licensee implementation and NRC oversight of 50.59, and proposed a systematic reconsideration and reevaluation of the process.

I In a December 15, 1995, memorandum, the Executive Director for Operations l

responded to Chairman Jackson's questions and stated that within 120 days from the date of the memorandum, the staff would review previously issued guidance on implementation of the 50.59 process to define areas where the guidance i

needs to be amended and to develop an action plan to identify actions to be i

undertaken to improve both the licensee's implementation and the NRC staff's oversight of the 50.59 process.

In a memorandum to the Commission dated April 15, 1996, the staff forwarded the results of its review of existing guidance; as a result of the review, the staff has identified certain issues for further examination, which this action plan addresses.

]

Discussion:

The policy questions raised in the October 27 and November 30, 1995, memoranda i

and the staff responses of December 15 and December 30, 1995, are focused in three major areas:

licensee implementation, staff oversight and intergration (feedback).

In preparing its action plan, the staff considered the policy questions and possible actions in all three areas. As discussed below, some c

actions have already been undertaken to improve staff oversight and feedback.

}

The resolution of the issues that came to light during the review of guidance i

are relevant to the area of licensee implementation, but would also affect i

staff oversight through the guidance provided to inspectors. As discussed in more detail below, the staff intends to pursue development of regulatory guidance (within the context of the existing rules) to address these issues.

If the staff determines that in order to improve licensee implementation (or 2

staff oversight), rulemaking is necessary, it will develop actions and schedules accordingly.

Planned Actions:

LICENSEE IMPLEMENTATION Policy Questions: (a) Do requirements adequately define changes that involse USQs?

(b)

Is there a cumulative safety impact of changes erodina safety margins?

+

i 4

i The staff's approach to developing regulatory guidance will proceed in phases.

i l

Over the next several months, the staff will attempt to provide specific j

positions (guidance) to accomplish the objectives listed below, and will i

evaluate the feasibility of implementing such guidance within the existing regulatory framework. At the end of the first phase, estimated to take about t

8 months, the staff will take stock of its progre:s and make recommendations j

on issuing guidance, undertaking rulemaking or other actions.

l Specifically, the objectives of this effort are to develop guidance that would:

= define the elements of safety evaluation review or screening processes j

within the context of various licensee design or change control processes, i

to provide greater assurance that effects on safety of changes, whether to i

equipment, procedures, or methods of system operation, are appropr!ately l

evaluated.

l

• define more specifically the scope of applicability of 50.59 (that it, to identify those changes, tests, or experiments that need to be evaluated to determine if NRC approval is needed). This would include a more comprehensive description of change, and guidance for broader consideration l

of "as described".

i l

• establish the process for resolving nonconfoming conditions such that differences from the FSAR are reconciled (from both safety and regulatory j

viewpoints) in a time frame commensurate with their safety significance.

1

+ improve unreviewed safety question determinations in the following respects:

- address the extent to which short-and long-term compensating actions may i

be considered as part of change under 50.59 such that it can be determined l

that the probability has not increased or the margins of safety have not been reduced. Also, address when consideration of compensating actions i

should be reviewed as part cf the basis for approving a proposed license amendment.

j

- clarify the extent to which PRA techniques may be useful in evaluating the j

effects on safety of a change and in addressing the " probability may be increased" criterion for unreviewed safety questions.

- clarify what is meant by " margin of safety' in relation to numerical parameters, analysis methods, calculated results of safety analyses, and licensing limits so that changes that might affect the basis for staff's safety conclusions are more consistently identified.

To formulate these positions, the staff will form a working group with representatives from Office of Nuclear Reactor Regulation (NRR) divisions, the regions and the Office of the General Counsel (0GC), to work under the direction of a management steering group. The working group will consist of about 10 people, some of whom may be participating on a part-time basis, with an estimated resource comitment of 4 full-time equivalent (FTE) employees.

The work group (which may be subdivided into smaller teams for some issues) 2

l will prepare position papers and obtain ir,ternal management consensus on the desired regulatory positions or the wording of draft regulatory guidance.

0GC will assist the technical staff in assessing whether these regulatory positions may be implemented within the existing rule requirements.

Public comments on the position paper (s) will be obtained by posting the document on the NRC electronic bulletin board, making it available in the Public Document Room, and by issuing a Federal Reoister notice.

The staff will ask the Advisory Committee on Reactor Safeguards to comment on these positions.

The staff will develop actions, milestones and schedules for further phases of this effort after the results of the first phase are assessed.

4 The Nuclear Energy Institute (NEI) has expressed interest in developing a guidance document, based on NSAC-125 that would incorporate additional experience.

The staff will review and comment on such a guidance document if asked to do so.

STAFF OVERSIGHT 1

Policy questions:

(a) How can consistency of staff reviews be improved?

(b) What should be the roles of headquarters, regions and residents in review of 50.59 changes?

(c) How are risk insights used in sampling of 50.59 evaluations to be inspected?

The. staff reviews licensee implementation of 50.59 in a number of ways.

A number of changes were made in the last few months to improve consistency of 4

staff oversight of the 50.59 process. The guidance issued on January 26, j

1996, for a short-term effort to review applicable updated FSAR sections as part of all inspections was extended indefinitely pending a permanent change to the NRC Inspection Manual in a memorandum dated March 15, 1996.

SECY-96-024 (Semiannual Status Report on RRG recommendations) noted that as part of topic area 54 (Control over material removed from TS), the staff would

}

develop interim inspection guidance as a short-term action for use while the j

action plan was being implemented.

This guidance was issued on April 9, 1996.

1 1

1 i

As part of the action plan, the staff also plans to hold a "round-table discussion" with regional staff, resident inspectors, and NRR staff who have participated in 50.59 inspection efforts, with Inspection Program Branch coordination, to share experiences and to discuss such topics as the mix of 1

programatic and implementation reviews, sampling, and team composition.

Changes to inspection procedures to assure specific attention to change controls and safety evaluations, will be. considered.

Based on these discussions, modifications to inspection procedures will be developed. Note that any revisions to the current guidance provided to inspectors concerning i

acceptability of licensee screening or USQ determinations will follow the results of actions to resolve the issues noted under Licensee Implementation 4

Resources are estimated at 0.3 FTE.

3

/

j

?

l Over the next several months, the staff expects to gather additional data about the quality of licensee 50.59 evaluations and the consistency of staff oversight from the FSAR inspections, spent fuel pool licensing basis reviews, and the NRR team inspection at Millstone. The NRR Division of Inspection Programs staff will conduct a broad-based review of program and inspection guidance associated with oversight of the UFSAR, nonconforming conditions related to the UFSAR, 50.59 evaluations and licensee corrective action verification.

This comprehensive program review to identify program weaknesses and to recommend corrective actions is scheduled for completion by i

July 30, 1996. This review is a related activity that is not part of the 50.59 action plan.

The staff is also developing guidance to assist inspectors in making a risk-informed decision regarding the planning and conduct of inspections, including the selection of a sample of items for inspection. Since the use of PRA information could benefit any inspection involving sampling from a population of interest, the approach is to develop guidance within one or two inspection program documents that can be referenced by individual inspection procedures.

The target date for issuing these reference documents is July 1996 (linked to the implementation schedule for the maintenance rule). The use of these risk insights would be applicable to sampling of 50.59 evaluations. A parallel effort is being undertaken to develop a PRA training curriculum to specifically address the needs of inspectors and reviewers, with feedback on the use of PRA planned through the periodic inspector newsletter. This initiative is being separately tracked under the PRA Implementation Plan (Item 1.3), and is not a part of the 10 CFR 50.59 action plan.

The December 15, 1995, memorandum noted that as part of the action plan, the staff planned to examine 50.59 changes made over the past year, focusing particular attention on how the licensees documented the basis for their unreviewed safety question (USQ) determinations, specifically looking at how the possibility of a change in probability or consequences is addressed in licensee safety evaluations. Review of inspection experience and the regional coments suggest that more focus is needed on the " screening" aspects (decision to perform the 50.59 evaluation) and adequacy of safety evaluations

(

themselves rather than on the USQ documentation.

Further, resolution of the issues will likely result in revised inspection guidance for staff oversight of 50.59 implementation. Accordingly, the staff intends to defer inspection activity focusing specifically on the USQ documentation, but will continue to examine USQ determinations as they arise in the course of the various activities that result in staff review or inspection of licensee 50.59 evaluations.

INTEGRATION INT 0 OVERALL REGULATORY PROGRAM Policy Questions:

(a) How can the quality and timeliness of response when discrepancies with FSAR are identified be improved?

(b) How can the integration and feedback of review of 50.59 changes into the overall regulatory program be improved?

4

b j

l l

j The staff has actions under way to improve quality and timeliness of regulatory response to FSAR discrepancies, with a scheduled completion date of October 1, 1996. These actions are responsive to the policy questions, are i

being separately tracked as a commitment (Item II.B.3.b. of Chairman's tracking list), and are therefore not an explicit part of this 50.59 action plan.

I The actions noted above under Staff Oversight will improve the quality and i

consistency of staff reviews of licensee 50.59 evaluations and will enable i

existing processes for integration (see below) to address findings from these

)

reviews.

Further, as noted above, a broad-based review which integrates both inspection and licensing aspects relating to FSAR oversight, 50.59 and corrective action is planned.

With respect to existing processes, as discussed in a Commission briefing on 3

December 19, 1995, the NRC has a systematic process for reviewing events, inspecMen findings, technical studies, and other information for generic i

significance (see Management Directive 8.5 and NRR Office Letter 503).

)

i Possible outcomes of these evaluations include revision of regulatory

]

requirements, collection of data, generic communications or other changes to the NRC's regulatory programs. The responses to questions 9 and 10 in the l

December 15, 1995, memorandum provided some examples of feedback. Two additional examples are noted below.

First, questions about the removal of biological shield blocks (above the reactor vessel) during power operations at 1

i boiling water reactors, and the licensee 50.59 evaluations addressing the control of heavy loads for two plants led the staff to perform a survey of 3

i shield plug movement practices at all BWRs and to review past generic guidance 1

on the heavy load issue, in particular Generic Letter 85-11. The results of this review indicated to the staff that further generic communications were needed on this subject. Another example related to use of reduced seismic j

j criteria for temporary modifications. This approach was being used by one j

licensee; the staff sent a letter advising that licensee that a USQ may be

)

N olved if such criteria are used, and the staff plans a generic l

communication to inform other licensees.

l Another feedback process that considers both overall licensee perforrance and adequacy of the regulatory program is the Integrated Performance Assessment Program (IPAP) inspections. With respect to licensee performance, such issues as problem analysis and resolution, operability determinations, modification i

quality, and safety assessments are considered during the IPAP inspection. A specific element of the IPAP procedure is assessment of the regulatory l

program, considering such questions as the completeness and quality of 3

i inspections and consistency of the characterization of licensee performance.

The staff plans to revise the IPAP procedure to include an engineering

" vertical slice" review. Such indepth reviews of the design and modifications to a system have been performed as part of past inspection and provide insight i

on the cumulative effect of change controls, safety evaluations, and j

engineering modifications.

i grigj.natina Document: December 15, 1995 memorandum from the EDO to j

r Chairn:an Jackson,

Subject:

Response to Questions on Facility Changes Pursuant to 10 CFR 50.59.

i

)

l Reaulatory Assessment: The action olan was developed to identify actions to improve implementation of the 50.59 process. A number of improvements have already been made, such as directing :taff conducting routine inspections to specifically address FSAR compliance and reviewing spent fuel pool and core offloading procedures and practices at all facilities. As stated in the December 15, 1995, memorandum, "The staff concludes that there is currently no indication that implementation of 10 CFR 50.59, as it is carried out today, has led to decreased safety, based on inspection experience. While improvements can be made to achieve a higher degree of uniformity of review, the current process as it is being implemented provides reasonable assurance that plant safety has not been decreased." Therefore, non-urgent regulatory action and continued facility operation are justified.

Resource Reauirements :

Estimated for completion:

5 FTE i

i Priority: 2 NRR Technical

Contact:

E. McKenna, PECB, 415-2189 l

References:

October 27, 1995, memorandum from Chairman Jackson to EDO i

November 30, 1995, memorandum from Chairman Jackson to EDO i

December 15, 1995, memorandum from EDO to Chairman Jackson December 28, 1995, memorandum from EDO to Chairman Jackson i

=

J 6

1 MILESTONES ACTION PLAN 1.

Plan approval 4/15/96 (a)

Provide information copy to the Commission I

(b)

Information Notice 2.

Identify work group members 4/25/96 3.

Brief NRR Office Director 6/1/96 on key issues 4.

Conduct workshop 6/14/96 5.

Brief NRR Office Director on 7/15/96 proposed positions Note:

(Program review of oversight 7/30/96 complete) 6.

Send draft position papers to Regions 8/15/96 and other offices for comment

~

7.

Comments due from Regions and other 9/15/96 offices 8.

Issue FRN reguesting comments 10/15/96 9.

Receive public comments 12/15/96 i

10. ACRS Review 12/96 9

11. Issue revised Inspection guidance and other pronram changes; Assessment of results of regulatory guidance development 1/97

12. Consnission paper 2/97 (with recommendations for any additional followup actions)

13. Initiate followup actions TBD 7

l 10 CFR 50.59 ACTION PLAN TAC No. M94269 Last Update: 4/08/96 i

Lead NRR Division: DRPM Supporting Divisions: all MILESTONES DATE (T/C) 1.

Action plan approval / copy to Commission

'" (04/15/96)(T)* "

j 2.

Identify work group members 04/25/96(T)

)

3.

Brief D/NRR on issues 06/01/96(T) 4.

Conduct workshop 06/14/96(T) 5.

Brief D/NRR on proposed positions 07/15/96(T) 6.

Draft position papers 08/15/96(T) 7.

Obtain regional comments 09/15/96(T) 8.

Obtain public comments 12/96(T) 9.

ACRS Review 12/96(T)

10. Issue inspection guidance / Assess results 01/97(T)

/ prepare recommendations

11. Commission Paper 02/97(T)

12. Followon Actions TBD

• * *THIS MILESTONE IS BEING TRACKED IN CHAIRMAN TRACKING SYSTEM * *

• Descriotion: This action plan defines measures to improve licensee implementation and NRC staff oversight of the 10 CFR 50.59 process.

Historical Backaround: 10 CFR 50.59 was promulgated in 1962 to describe the circumstances under which licensees may make changes to their facility (or to make changes to procedures, or to conduct tests and experiments) without prior NRC approval when the change does not involve the Technical Specifications or an unreviewed safety question. Licensees are required to submit periodically information related to changes made pursuant to 50.59. The NRC has programs for monitoring licensee processes for implementing 50.59. In a memorandum dated October 27.

1995, Chairman Jackson raised a number of questions concerning 50.59 implementation and NRC oversight, and proposed a systematic reconsideration and reevaluation of the process.

The December 15,1995, memorandum from the EDO responded to the specific questions and stated that within 120 days from the date of the memorandum, the staff would review previousiv issued guidance on implementation of the 50.59 process to define areas where the guidance needs to be amended and to develop an action plan to identify actions to be undertaken to improve both the licensee's implementation and the NRC staff's oversight of the 50.59. The staff has completed its review of exisr*g guidance and has identified certain issues for further examination, which th.s action plan addresses. Interim inspection guidance was issued on April 9,1996.

- - --.. - ~ - _ _ --.. -

i f

6 J

1 The staff plans to make the results of its review of guidance, the action plan, and its interim inspection guidance publicly available.

I Planned Actions:

}

}

The staff's approach to development of regulatory guidance would proceed in phases. Over the i

next several months, the staff will attempt to provide specific positions (guidance) to accomplish j

the objectives listed below, and will evaluate the feasibility of implementing such guidance within j

the existing regulatory framework. At the end of the first phase, estimated to take six to eight months, the staff would take stock of its progress and make recommendations on issuing guidanct undertaking rulemaking or other actions.

1 i

Specifically, the objectives of this effort are to develop guidance that would:

1 4

i o define the elements of safety evaluation review or screening processes within the context of

{

various licensee design or change control processes, to provide greater assurance that effects on safety of changes, whether to equipment, procedures, or methods of system operation, are j

appropriately evaluated.

i o define more specifically the scope of applicability of 50.59 (that is, to identify those changes, j

tests, or experiments) that need to be evaluated to determine if NRC approvalis needed). This i

would include a more comprehensive description of change, and guidance for broader consideration 1

of "as described."

l

}

o establish the process for resolving nonconforming conditions such that differences from the FSAR j

4 are reconciled (from both safety and regulatory viewpoints) in a time frame commensurate with j

their safety significance.

o improve USO determinations in the following respects:

j

- address the extent to which short and long term compensating actions may be considered as part i

of change under 50.59 so that it can be determined that the probability has not increased or l

margins of safety has not been reduced. Also address when consideration of compensating actions should be reviewed as part of the basis for approving a proposed license amendment.

- clarify the extent to which PRA techniques may be usefulin evaluating the effects on safety of a change, and in addressing the " probability may be increased" criterion for unreviewed safety questions.

- clarify what is meant by " margin of safety" in relation to numerical parameters, analysis methods, t

calculated results of safety analyses, and licensing limits such that changes that might affect the basis for staff's safety conclusions are more consistently identified.

Public comments on the position paper (s) will be obtained. The ACRS will be requested to provide its comments on these positions. Actions, milestones and schedules for further phases of this effort will be developed after the results of the first phase are assessed.

In the area of staff oversight, the staff plans to conduct a roundtable discussion with regional staff resident inspectors and NRR staff who have participated in 50.59 inspection efforts to share experiences and to discuss such topics as the mix of programmatic and implementation reviews.

sampling and team composition. Appropriate changes to inspection procedures will be made.

Other related efforts are being tracked under other programs.

/

1 1

4 Orioinatino Document: December 15,1995 memorandum from the EDO to Chairman Jackson,

Subject:

Response to Questions on Facility Changes Pursuant to 10 CFR 50.59 i

Raoulatory Assessment:

The action plan was developed to identify actions to improve implementation of the 50.59 process. A number of improvements have been implemented in the 4

last few months, such as directing inspectors conducting all routine inspections to specifically 4

address FSAR compliance, and reviewing spent fuel pool / core offload procedures and practices at

{

all f acilities. As stated in the December 15,1995, memorandum,

• The staff concludes that there l

is currently no indication that implementation of 10 CFR 50.59, as it is carried out today, has led to decreased safety, base on inspection experience. While improvements can be made to achieve a higher degree of uniformity of review, the current process as it is being implemented provides reasonable assurance that plant safety has not been decreased." The above conclusion is confirmed by the additional analysis of inspection experience presented in the staff review j

document. Therefore, non-urgent regulatory action and continued facility operation are justified.

Current Status: The action plan will be issued shortly for implementation. An information copy is l

being sent to the Commission.

1 Potential Problems: Action plan schedule is very ambitious.

Proposed Resolution of Potential Problems: Management steering group will monitor progress.

l Resource Recuirements : Expended to date: 242 hours0.0028 days <br />0.0672 hours <br />4.001323e-4 weeks <br />9.2081e-5 months <br />. Estimated for completion: 5 FTE i

Priority: 2 l

=

.NRR Technical

Contact:

E. McKenna, PECB, 415 2189 i

i

References:

October 27,1995 memorandum from Chairman Jackson to EDO 4

l November 30,1995 memorandum from Chairman Jackson to EDO December 15,1995 memorandum from EDO to Chairman Jackson December 28,1995 memorandum from EDO to Chairman Jackson 4

i

'i i

i l

i i

4 I

i i

a 3

d

a INTERIM INSPECTION GUIDANCE l

i i

0 A*8 #IO%

/

UNITED STATES I

E NUCLEAR REGULATORY COMMISSION i

WASHINGTON; D.C. 20066-0001

/

NRC INSPECTION MANUAL DRPW PART 9900:

10 CFR GUIDANCE

~

10 CFR 50.59 INTERIM GUIDANCE ON THE REQUIREMENTS RELATED TO CHANGES TO FACILITIES, PROCEDURES AND TESTS (OR EXPERIMENT)

A.

PURPOSE The purpcse of this interim guidance is to further clarify current staff practices with respect to 10 CFR 50.59, beyond that which is already contained in NRC Inspection Manual, Part 9900, "10 CFR 50.59, Changes to Facilities, Procecures and Test (or Experiments)."

i B.

POLICY This interim guidance does not represent a change in NRR policy. The discussion section provides further clarification beyond that which is already contained in NRC Inspection Manual, Part 9900, "10 CFR 50.59, Changes to Facilities,

~-

Procedures and Test (or Experiments)," on the scope covered by 10 CFR 50.59 and the thresholds for determining if an Unreviewed Safety Question (USQ) exists.

i It is recognized that several areas of the 50.59 process require clarification.

NCR has reviewed its previously issued guidance on licensee implementation of the 50.59 process, including generic letters, inspection procedures, and guidance the hRC provided to its inspectors to determine the extent to which this information was internally consistent, and to define areas where further guidance or other An action plan has been developed and will be issued actions may be necessary.

shortly to evaluate how consistently 10 CFR 50.59 is being applied, and to identify actions to be undertaken to improve the agency's control of the process.

In the meantime, this interim guidance has been developed to assist the inspectors in their reviews of 10 CFR 50.59.

C.

DISCUSSION This provides further clarifying guidance on the implementation of 10 CFR 50.59 in the following areas:

1. Thresholds for determining if an USQ exists.

2. The scope of 10 CFR 50.59.

10 CFR 50.59 L.

Issue Date: 04/09/96 -

i I

D.

BACKGROUND j

In 1962, 10 CFR Part 50 was modified to revise Section 50.36 and add a new Section 50.59. As dist.ussed in the Statements of Consideration (SOC) supporting i

the changes to 10 CFR Part 50, the intent of 10 CFR 50.59 was to permit licensees to make changes, and conduct tests and experiments, which are not specifically i

provided for in their facility licenses as described in more detail below. The SOC also provided that certain significant design and operating limitations were i

designated as technical specifications (TS) which must be adhered to in the absence of specific authorization from the Commission.

The new section 50.59 provided that the licensee may make changes in the facility as described in the 4

hazards summary reoort (now called the Updated Safety Analysis Report), make changes in the procedures described in the hazards summary report, and conduct l

tests or experiments, unless the proposed change, test or experiment involved a change in the TS or a USQ. Section 50.59 was designed to allow licensees to make i

plant modifications provided those modifications maintain the level of safety i

documented in the original licensing basis as defined by specific criteria set l-forth below. The regulation also required licensees to identify those changes

]

which require prior NRC approval.

10 CFR 50.59 was promulgated before probabilistic risk assessment (PRA) i techniques were developed, and is structured around the licensing approach which addresses Design Basis Events (Initiating Events in two classes - Anticipated Operational Occurrences and Postulated Accidents); safety-related mitigation systems (e.g., RPS, ECCS); and consequence calculations for mitigated Design l

Basis Events (e.g., a mitigated design basis LOCA judged against 10 CFR Part 100 guidelines).

The criteria in 10 CFR 50.59 for determining whether or not a j

change, test or experiment involves a USQ are directly related to the design bases approach as follows

1. Preserve the Design Basis Event assumptions used in licensing (the specific licensing decisions for that plant as reflected in the FSAR, the staff SER, and any other portion of the " licensing basis"). Note that d

i the Design Basis Events in this context are " initiating events," not the entire event sequence or " cut sets" as considered in PRAs. The licensing 4

basis is preserved by not allowing: a different tvoe of (desian basis initiatina) event: or an increased orobability of occurrence of desian basis initiatina events.

2. Preserve the effectiveness (reliability) of the mitigation systems by not allowing: a different tvoe of eauioment malfunction: or an increased i

orobability of eauioment malfunction: or-a reduction in the marain of j

safety (which reflects the canability of the system).

3. Preserve the acceptability of the (mitigated design basis event) i consequences by not allowing: an increase in the (dose) consecuences.

i Note that the process, as outlined above, does not involve core damage j

assessments, probabilistic or otherwise. However, it could, and in many cases it should, involve reliability engineering assessments to address potential changes in the probability of initiating events and changes in the probabilitf j

of equipment malfunctions.

It should be remembered that 50.59 is a licensina basis test and not a safety or j

acceptability test.

Chances which are not allowed under 10 CFR 50.59 may ta i

accentable when reviewed as license amendments.

They may even be saf*'1 l

imorovementi,,

i 10 CFR 50.59 Rev Issue Date:

04,09 %

i

I E.

CURRENT fSSUES Use of NSAC-125 NSAC-125, " Guidelines for 10 CFR 50.59 Safety Evaluations" was prepared by NUMARC in 1988 to provide guidelines for developing consistent and more effective safety evaluation processes and associated 10 CFR 50.59 findings by individual utilities.

NSAC-125 received extensive review by the industry and NRC and is widely used by licensees.

NSAC-125 is consistent with the approach that most i

licensees have been using to implement the requirements of 10 CFR 50.59 in that it recommends a broad interpretation of the language of 10 CFR 50.59. The NRC conducted pilot inspections based on the guidance, with the expectation that the differences between the staff and the industry views would be resolved, and 1

industry guidance could be formally endorsed by the NRC.

Although the staff I

believes that the industry guidance is an appropriate extension of good design control practices, the NRC has n.gl endorsed NSAC-125. While the guidelines of NSAC-125 can be useful in the evaluation of proposed changes to the facility design or procedures, and are representative of logic used in making a 50.59 i

determination, the actual determination of whether or not an unreviewed safety question exists must be done in accordance with 10 CFR 50.59.

The-following is a discussion of current staff practices on determining the (a) probability or consequences of an accident or malfunction previously evaluated in the safety analysis report; (b) defining the margin of safety; and (c) the scope of 10 CFR 50.59.

probability or Consecuences of an Accident or Malfunction Industry guidance (NSAC-125) states that a small increase in the probability or consequences of an accident or malfunction previously evaluated in the safety analysis report does not involve a USQ.

This guidance conflicts with 10 CFR 50.59 which says that a USQ exists if the probability of occurrence or consequences of such an accident "may be increased."

In considering the acceptability of a licensee's 10 CFR 50.59 evaluation, the staff has found compensating effects such as changes in administrative controls acceptable in offsetting uncertainties and increases in the probability of occurrence or consequences of an accident previously evaluated in the SAR or reductions in a margin of safety, provided the potential increases or reductions in margin are negligible.

Normally, the determination of whether there is an increase in the probability of' occurrence or consequences of an accident previously evaluated in the SAR or a reduction in a margin of safety and whether such increases are negligible is based upon a qualitative assessment using engineering evaluations consistent with the original SAR analysis assumptions.

The compensatory actions must clearly outweigh any potential increase in probability of occurrence or consequences or reduction in margin.

j Questions have also been raised with regard to uncertainty. In Generic Letter 95-02, "Use of NUMARC/EPRI Report TR-102348, ' Guideline on Licensing Digital Upgrades,' In Determining the Acceptability of Performing Analog-to-Digital Replacements under 10 CFR 50.59," the staff provided clarification on uncertainty for analog to digital conversions.

GL 95-02 states that if during the 10 CFR 50.59 determination there is an uncertainty about whether the probability or consequences may increase, or whether the possibility of a different type of accident or malfunction may be created, the uncertainty should lead the licenset to conclude that the probability or consequences may increase or a new type o' malfunction may be created.

If the uncertainty is only on the degree c' Issue Date: 04/09/96 10 CFR 50.59 A

i improvement the digital system cill provide, the modification would not involve

{

a USQ.

If, however, the uncertainty involves whether or not this modification is more or less safe than the previous analog system, or if no degree of safety i

has been determined, a USQ is involved.

i j

Licensers are expected to utilize a combination of reasonable engineering l

practices, engineering judgment, and analytical techniques, as appropriate, in i.

determining whether the probability increases as a result of implementing a proposed change.

A large body of knowledge has been developed in the area of equipment reliability and initiating event frequency through plant-specific and generic studies.

Licensees are expected to draw on this knowledge when determining what constitutes an increase in the probability of occurrence of an j

accident or malfunction of equipment important to safety and should include any equipment that could either cause, exacerbate, or mitigate events or accident j

j sequences described in the updated SAR.

t l

However, when reviewing 50.59 safety evaluations, the staff should also consider the environment in which the plant was originally reviewed and licensed and the

)

background surrounding the development of 10 CFR 50.59. Our analytical ability is much more sophisticated than in previous years. The staff will not impose, through inappropriate backfits, the use of improved analytic methodologies, such as PRA, on licensees.

1 Marcin of Safety 10 CFR 50.59 states that a " proposed change, test, or experiment shall be deemed to involve a USQ...if the margin of safety as defined in the basis for any TS is reduced."

1 The NSAC-125 guidance is broader than the rule regarding where a' licensee must look to find a margin of safety in that it recommends looking beyond the TS Bases.

The question on margin of safety is, measured from whera?

A broad interpretation would provide that the margin should be near:::ed against that margin described in the facility UFSAR, or the staff's SER if the UFSAR does not describe the margin.

In some cases, neither the SER nor the UFSAR provide a description of the margin; in such cases, the margin has to be inferred from the description of the calculated consequences and the design capability.

Current Staff Practice In determining whether the margin of safety has been reduced by a proposed change, test or experiment, the licensee should first look to the bases for the particular TS.

If a margin of safety is contained in the bases of the TS, any reduction in that margin must be considered a reduction in the margin of safety, and not allowed under the 50.59 process.

If~ the TS Bases do not specifically address margin of safety, then the licensee's safety analysis report, the staff's safety evaluation report (SER) and appropriate other licensing basis documents should be reviewed to determine if the proposed change, test or experiment would result in a reduction in the margin of safety.

In each case, a determination must be made to establish what constitutes the original licensing basis.

The change should be based on changes to physical parameters (or conditions which can be observed or calculated).

Since the margin may be implicit rather than being explicitly expressed as a numerical value, the precise. determination of a numerical value associated witn a change is not always required to comply with 10 CFR 50.59.

It may be 10 CFR 50.59 Rev

-4/

Issue Date:

04/09 96

l t

i sufficient to determine only the direction of the margin change (i.e., increasing or decreasing). If the margin is reduced, the change, test, or experiment would I

involve a USQ.

In making the judgment on whether the margin is reduced, the i

decision should be based on physical parameters or conditions which can be j

observed or calculated.

l l

For the purpose of performing evaluations in accordance with 10 CFR 50.59, the j

margin of safety should normally be considered the difference between the regulatory limit (i.e., the limit specified by the regulations or technical i

specifications) and the value of the parameter reviewed and approved by the staff i

e as part of the licensing basis for the plant. Proposed changes that would affect l

margins beyond the regulatory limit (e.g., the margin between the TS Limit and

}

the assumed systemLfailure point) would most likely require an exemption from the i

i regulation or a license amendment, and are by definition, not within the scope of 10 CFR 50.59.

1 i

As stated above, lic'ensees should use a combination of reasonable engineering l

practices, engineering judgment, and analytical techniques, as appropriate, in determining whether there is a decrease in the margin of safety.

~

I Stone of 10 CFR 50.59 i

The rule applies to the facility "as described in the safety analysis report,"

rather than a staff evaluation.

Even though the language of the rule is very i

specific, licensees typically apply the requirements of the rule more broadly than the language dictates This is consistent with guidance in NSAC-125. Most licensees apply the 50.59 review process to all facility design and procedure changes that could affect safety, regardless of whether that portion of the facility is described in the FSAR. Some licensees perform a 50.59-type review l

as a " screening process" when considering a proposed facility or procedure change.

l Recent Guidance Recent guidance to the staff on the scope of 50.59 evaluations is contained in Inspection Procedure 37001, "10 CFR 50.59 Safety Evaluation Program."

The inspection procedure delineates that the criterion for requiring a 50.59 safety evaluation for a change in the facility (or procedure) is "a change in the facility or procedures as described in the safety analysis report."

This criterion means that a change in a structure, system, or component (SSC) or a procedure requires a 50.59 safety evaluation only if the following statements are both true:

(a) the SSC (or procedure) being changed is described in the most

-recently updated FSAR submitted to the NRC in accordance with Section 50.71(e),

and (b) the FSAR description of the SSC (or procedure) being changed would be affected by the change.

IP 37001 also states that the FSAR description of a SSC or procedure must be affected by the change in order for a Section 50.59 safety evaluation to be required. However, IP 37001 also states that " preparation of an adequate Section 50.59 safety evaluation often requires looking at licensing and design information not included in the FSAR. Important sources of such information are NRC safety evaluation reports, docketed correspondence, and records of safety and transient analyses." For further clarification, IP 37001 should be consulted The inspector needs to be aware that tM staff has not conclusively resolved what constitutes the scope of the 50.59 evaluation. If significant modifications ar*

j Issue Date: 04/09/96 10 CFR 50.59 ;*.

9 l

being psrformed or propossd to the facility that are not described in the FSAR.

1 and the modifications appear to be outside the scope of 10 CFR 50.59, NRR should be consulted for further guidance via the Task Interface Agreement (TIA) process.

i j

Commitment Manaaement While the NRC continues to develop a clear and unambiguous definition of the content of the licensing basis, there continue to be differences between the practice and the requirements.

The staff has promoted the position that the licensing basis is broad and includes all docketed commitments; however, the NRC has not interpreted 50.71(e) to require that all licensing basis commitments be included in the updated FSAR. Regulatory commitments are specific actions that have been voluntarily agreed to or that have been offered by a licensee in docketed correspondence to the Commission on a voluntary basis.

Unlike regulatory requirements contained in regulations, TS, licenses and orders, regulatory commitments are not legally binding. Many regulatory comitments are not contained in the FSAR but in other docketed correspondence such as LERs, responses to NOVs and responses to generic letters. Therefore, those commitments not contained in the FSAR are not controlled by 10 CFR 50.59.

Consequently, licensees have the ability to change docketed commitments not contained in the FSAR without informing the Commission.

However, although licensees have the ability to change regulatory comitments not contained in the FSAR without informing the Comission, the staff has found no indication that this activity has occurred. Typically, licensees are reluctant to modify or delete a regulatory commitment without first consulting with the NRC.

Further, licensees occasionally choose to retain regulatory commitments that have been shown to be inefficient or ineffective rather than expend the resources necessary to revisit the issue with the staff.

NEI has developed guidance for the industry on managing commitments, which provides a structured process _ that licensees can use on a voluntary basis. This guidance describes a process that can be used by licensees to modify or delete commitments and defines the circumstances in which interaction with the staff is appropriate. Although the use of the NEI guidance by licensees is not mandatory, indications are that many licensees intend to incorporate the.NEI guidance in their procedures when NRC formally indicates its acceptance of the process. In a letter to NEI ' dated January 24, 1996, the staff documented completion of its review of the NEI guidance. On the basis of its review, the staff determined, with two comments, that NEI's " Guidance for Managing NRC Commitments" is an acceptable method for licensees to follow for managing and changing their NRC commitments.

F.

DEGRADED AND NON-CONFORMING CONDITIONS The design and operation of a nuclear plant is to be consistent with the current licensing basis. Where 50.59 is being used by a licensee to address degraded or failed equipment, the licensee must also address the requirements for equipment operability (as included in the TS) and 10 CFR 50 Appendix B, Criterion XVI.

Corrective Actions. In fact, the operability assessment must be given precedence and be done promptly.

The purpose of the TS is to ensure that the plant is operated within the design bases, and to preserve the validity of the safety analyses, which are concerned with both the prevention and mitigation of accidents.

Licensees are obligated to ensure the continued operability of SSCs as speci'ied by TS, or to take tea remedial actions provided in the TSs.

Whenever degraded or nonconformwc conditions of structures, systems or components are identified, the determinatw 10 CFR 50.59 Rev Issue Date:

04/09 h

of operability for systems is to be made promptly, with a timeliness that commensurate with the potential safety significance of the issue.

^

operability verification or other processes indicate a potential deficiency c loss of quality, licensees should make a prompt determination of operability and act on the results of that determination. The licensee should also restore the 4

quality of the system in accordance with 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action.

A licensee may change the design of its plant as described in the FSAR in accordance with 10 CFR 50.59 as discussed above.

Whenever such changes are sufficient to resolve a degraded or nonconforming condition involving an SSC that is subject both to Appendix B and 50.59, they may be used to satisfy the l

corrective action requirements of Appendix B, in lieu of restoring the affected equipment to its original design. However, whenever such a change involves a USQ or a change in a technical specification, the licensee must obtain a license J

amendment in accordance with 10 CFR 50.90 prior to operating the plant with the degraded or nonconforming condition.

1 Generic Letter 91-18, "Information to Licensees Regarding two NRC Inspection Manual Sections on Resolution of Degraded and Nonconforming Conditions and on Operability," should be consulted for further information and clarification.

G.

QUESTIONS ON 10 CFR 50.59 This guidance is directed toward NRC inspectors that are reviewing actions of licensees that hold an operating license.

Although this guidance generally reflects existing staff practices, application on specific plants may constitute a backfit as discussed above. Consequently, significant differences in licensee

~

practices or any concerns on the part of the inspector should be add.ressed to NRR J

management via a TIA to ensure that the guidance is applied in a reasonable and consistent manner for all licensees.

H.

FURTHER CLARIFICATION C

It is recognized that further clarification of the 50.59 process is necessary.

NRR has reviewed its previously issued guidance on implementation of the 50.59 process, including generic letters, inspection procedures, and guidance the NRC provided to its inspectors. An action plan has been developed and will be issued shortly to define and address inconsistencies in the implementation and oversight of the 50.59 process, which includes plans to develop and issue more definitive i

i guidance.

END Issue Date:

04/09/96 10 CFR 50.59 :a.

pa rrog

)

[

k UNITED STATES

)

E NUCLEAR REGULATORY COMMISSION I

wasMiworow, o.c.

a=== -i IM001

/

NRC INSPECTION MANUAL PIPB Change Notice 96-008 DELETED:

TRANSMITTED:

Number D. gig Number QLt.g 10 CFR Guidance 04/09/96 50.59 TRAINING:

No special training requirements have been identified for any documents issued with this change notice.

REMARKS:

10 CFR Guidance - 50.59 (Interim Guidance On The Requirements Related To Changes To Facilities, Procedures, And Tests (Or Experiment)) is issued to further clarify current staff practices with respect to 10 CFR 50.5iir, beyond that which is already contained in NRC Inspection Manual, Part 9900, "10 CFR 59.59, Changes to Facilities, Procedures and Tests (or experiments)."

This interim guidance does not represent a change in NRR policy, but rather 1

provides further clarification on the scope covered by 10 CFR 50.59 and the thresholds for determining if an Unreviewed Safety Question (USQ) exists.

DISTRIBUTION:

Standard END 96-008 Issue Date: 04/09/96 3

Plant Name Date Reff Description WNP2 10/92 9212300037 Did not update FSAR for TG radioactive sump Susquehanna 8/92 9210270104 Reduced flowrate to Chilled Water System without i

safety eval Dresden 5/92 9209090091 Safety eval did not contain checklist used for 50.59 3

evaluation / screening for temp alteration to install mate equipment Comanche 5/92 9207290074 Failed to do safety eval for change in CCW valve ESCALATED lineup to spent fuel cooling heat exchanger as described in FSAR and cross tie both units Surry 6/92 9207140036 No safety eval for procedures that operated systems 2

differently than described in UFSAR WNP2 12/91 9204140010 Performed test procedure which would have exceeded TS bypass leakage Sequoyah 2/92 9204080085 Failed to perform safety eval for disabling annunciators for narrow range RTD i

Maine 2/92 9203260094 Failed to perform safety eval for replacement of Yankee feeder breaker with one of different capacity D.C. Cook 1/92 9202050053 Failed to perform safety eval for; addition of RLS wide range temp & pressure recorders to safety circuits, increased sensitivity of power range ni's, removed diesel air start check valve internals, modified reactor trip breaker circuit & cabinets, modified aux feed pump circuity

)

WNP2 12/91 9201220089 Inadequate justification for setpoint change Vermont 8/91 9201210043 Failed to perform safety eval for valve realignment Yankee of service water discharge from circulating water ESCALATED discharge structure to cooling tower basin Vogtle 9/91 9111220075 Westinghouse guidance on water hammer not incorporated into ops procedure Big Rock 10/91 9111210003 Failed to provide bases in safety eval for change to i

operating the emergency condenser from control room to in the containment River Bend 9/91 9110230071 Failed to perform safety eval for removal of heater switch on fuel building ventilation charcoal filtration subsystem Maine 8/91 9109240063 Failed to perform safety eval for replacement Yankee circuit breaker on diesel generator with one of different manufacture & physical characteristics i

)

i J

i 4

i Plant Name Date Reff Description 1

I Prairie 7/91 9107230012 Failed to prepare safety eval & tech spec change mod Island to containment penetration i

Trojan 3/91 9104160118 Changed PASS system & procedures as described in FSAR without written safety eval 2

1 i

TMll 12/90 9104090054 Installed 2 maintenance cranes above diesels without 1

j safety eval 1

i Shearon 11/90 9012170036 Spent fuel pool manganese & cobalt exceeded FSAR j

Harris design concentrations l

Dresden 10/90 9012060126 Failure to identify USQ with use of temp. sample ESCALATED pump to obtain drywell air sample created 1

unmonitored, unattended vent path from primary to secondary containment, without auto, isolation; violated TS allowable leakage.

LaSalle 10/90 9011190220 Failed to identify changes to ufsar for non-safety related items Sales 10/90 9011130383 Modified pump performance after maintenance and used non-ASME code leak sealant with no safety eval Vermont 8/90 9010100146 Changes made to nonnal ops procedures prior to Yankee preparing safety eval and PORC review i

Salem 4/90 9009060035 Modified hatch covers for service water rooms did not meet water tightness specified in UFSAR

~~

Monticello 7/90 9008010144 Failure to document review of FSAR " Loss of feedwater heating" transient prior to replacement of feedwater heaters Ginna 4/90 9007230119 Failed to do safety eval for change of storage b1dg to long term radwaste storage bldg & replace NI source range detector housing without drain hole to one with drain hole Peach 3/90 9007200165 Inadequate safety eval for emergency service water Bottom flow reduction due to change in valve lineup &

ESCALATED procedures from FSAR description Quad Cities 5/90 9006210341 Inadequate safety eval for mod to feedwater isol valve Oyster 3/90 9005010094 Failure to perform safety eval on contaminated aux Creek boiler Sequoyah 1/90 9004230123 Performed an inadequate safety review of emergency instructions for reactor trip & safety injection Sales 3/90 9004180200 Design change package for both diesel fire pumps did not receive safety eval

1 1

l 5

d Plant Name Date Reff Description Nine Mile 1 8/89 9003130058 Failed to perform safety eval for temporary storage of solid & liquid radwaste Millstone 1/90 9003060245 Failure to perform review for safety question prior j

to removing auto start capability from service water booster pumps q

i Sequoyah 1/90 9002260251 Safety eval failed to consider effects of freezing j

on RWST level transmitters I

Surry 11/89 9001310096 Safety eval did not address ventilation system air j

flow changes resulting from modifications

[

Quad Cities 12/89 9001250126 Failed to submit updates to F5AR on modifications made to facility (sodium hypochlorite system, rod worth minimizer, RWCU, 345kv line, high rad isolation signal)

Salem 11/89 9001240306 Emergency operating procedure change introduced unreviewed safety question in ECCS system as described in UFSAR River Bend 11/89 9001180048 With reactor 9 power, placed temporary material in containment without safety eval

/

4 i

Figure 1-1 (from NSAC-125) i i

f

(

Desgn Change. Procoeure Change or Test

}

i n

l Per%rm Sasety Analyse ser Regulaeons l

1 l^

I r

is the Acevey Safe' no %

Amend or Cancel Acewy l

3 a

1 yes

.l 4

j the eity invesw a Change y,j osann a Tece spec Change ano '

to the Tecn soscs?

InsetAs ACOWy no 4

s the Change Covered try Anosien NAC or non.Nmc Reguiaton or yee H Aspry other Regulaeon l

4 1

u=n.o meauvemenn

}

no 1

4 Does m Change. Test or Essenment Anect the Facesy or Document ser 1oCFR$o and insetAG n,

i Procedures as Descreed vi m Acevtly

's sAa?

l i

{

The ouween. Perians ya Pnma,vy e a siens we 4

Heavy symmee

[

Portorm toCFR50 Se safety Evanaasen l

1 1

Presere a unenne Amenemen

%,,, %,,,,,n, t.

is an unrev d saimy

y..

i ousseen invoeved' i

no*

r useine AmeWy ans uomene m FsAn' l

Occurnent Safety Eva#uanon per toCFA50 50 H

as Neossaary and include an Penode Roomt Figure 1-1.

Safety Review Process 1-2

t i

ATTACHMENT A i

10 C.F.R. i 50.59 (1995)

I i 50.59 Changes, tests and experiments (a)(1) The holder of a license authorizing operation of a production or i

utilization facility may (i) make changes in the facility as described in the l

safety analysis report, (ii) make changes in the procedures as described in j

the safety analysis report, and (iii) conduct tests or experiments not described in the safety analysis report, without prior Commission approval, I

unless the proposed change, test or experiment involves a change in the j

technical specifications incorporated in the license or an unreviewed safety question.

(2) A proposed change, test, or experiment shall be deemed to involve an unreviewed safety question (1) if the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report may be increased; or (ii) if a possibility for an accident or malfunction of a different type than any l

evaluated previously in the safety analysis report may be created; or (iii) if j

the Targin of safety as defined in the basis for any technical specification is reduced.

i (b)(1) The licensee shall maintain records of changes in the facility i

and of changes in procedures made pursuant to this section, tc the extent that j

these changes constitute changes in the facility as des:ribed in the safety

=

analysis report or to the extent that they constitute changes in procedures as i

described in the safety analysis report. The licensee shall alto maintain j

records of tests and experiments carried out pursuant to paragraph (a) of this section. These records must include a written safety evaluation which provides

]

the bases for the determination that the change, test, or experiment does not involve an unreviewed safety question.

(2) The licensee shall submit, as specified in (10 CJ.R.] { 50.4, a report containing a brief description of any changes, tests, and experiments, including a summary of the safety evaluation of each. Ife report may be submitted annually or along with the FSAR updates as required by (10 C.F.R.]

i i 50.71(e), or at such shorter intervals as may be specified in the license.

l (3) The records of changes in the facility shall be maintained until the date of termination of the license, and records of changes in procedures and records of tests and experiments shall be maintained for a period of five years.

(c) The holder of a licente authorizing operation of a production or utilization facility who desires (1) a change in technical specifications or (2) to make a change in the facility or the procedures described in the safety analysis report or to conduct tests or experiments not described in the safety analysis report, which involve an unreviewed safety question or a change in technical specifications, shall submit an application for amendment of his license pursuant to [10 C.F.R.] 5 50.90.

Attachment B i

J W

i EXAMPLES OF ISSUES RELATING TO 50.59 IMPLEMENTATION 4

0 0

O

i i

SCREENING l

]

DC Cook, Inspection Report 315/316-93012: The licensee temporarily modified

}

both main feed pump speed control circuits by installing two 1/1 (current to current) converters between the main feed pump pressure setters and the

)

auto / manual control stations to correct a problem with the automatic mode and

{

to provide ground fault isolation between the pressure setters and the l

hand / auto stations. Seventeen days later, one of the ill converters failed l

resulting in a reduction of feedwater flow and a Unit 2 reactor trip on low

• l low steam generator level.

The licensee did not perform a 50.59 evaluation due to the licensee's overly restricted interpretation of the main feed pump speed control systen UFSAR description. Section 10.5.1.1 of the UFSAR stated l

that the variable speed turbine driven nain feedwater pumps were designed to l

provide the required feedwater to the steam generators.

The 1icensee stated i

that the failure of the ill converter was determined to have the same effect i

as the failure of the hand / auto station already in the circuit. However, in i

reality, the failure of the ill converter, which had not previously been part l

of the speed control circuit, resulted in a significant plant transient.

1 DC Cook, inspection Report 315/316-94007:

In January 1994 the licensee raised i

the CCW supply temperature from the procedural limit of 95'F to 105'F.

The f

reason for the increase was to reduce the amount of PCP-12 seal leakage in an effort to keep reactor coolant leakage below TS limits until the planned i

refueling outage shutdown a month later.

This was based on engineering judgement that the increase in temperature would not damage the systen or the equipment it cooled. Because the actual CCW temperature alars was not reset fron 95*F, the operator was not alerted when CCW temperature increased above 105'F during a transient caused by boric acid evaporator operations and was unable to control the transient before the temperature rose to 110*F. Section i

9.5.3 Table 9.5-3 of the UFSAR states that the shelI side CCW heat exchanger outlet design water temperature is 95'F. No safety evaluation was done prior i.

to the limit being raised to 105'F.

i Prairie Island, Inspection Report 50-282/306-95014: Prairie Island discovered that the preoperational test of the seisnically qualified energency intake line for the cooling (service) water systen had not been adequately reviewed following the test and the line did not neet its design requirements.

In i

order to confirm the test results, and to determine if any degradation had l

occurred since the time of the preoperational test, the licensee wrote a work order to isolate the normal source of water to the energency cooling water

}u pumps and to run one pump solely on the energency intake line. No safety evaluation was parformed prior to running the test, because the licensee believed "they were operating the equipment in accordance with its design.'

However, had a loss of offsite power occurred during the test, the suction for all three energency cocling water pumps would have been lost within minutes.

i The UFSAR only mentioneo that the cooling water systen had been preoperatinnally tested.

i i

i i

1

1 i

)

SCREENING z

]

Prairie Island, Inspection Report 50-282/306-93010:

The licensee identified that around 1977 the vendor for the steam dump system valves had changed the design of the tria (valve internal) packages for the steam dump valves to a

improve stability in the valve characteristic; this resulted in the new trim having a stroke length was approximately one inch greater than the original i

1 valves.

The licensee would either repair the steam dump valves using either the new trim or refurbished original trin, resulting in a variety of

?

combinations of original, refurbished, and new trin packages in the plant at any one time.

This resulted in a reduced steam flow capacity, which varied dependent upon how many steam dump valves contained the new trin.

The licensee concluded that operating the plant with reduced steam dump capacity i

from that specified in the UFSAR was acceptable, although no safety evaluation had been performed to address whether or not operation with reduced steam dump

)

capacity constituted an unreviewed safety question, based in part on the stenta i

dump system being a non safety-related system, that it provided no safety l

function, and that the existing steam dump system configuration would not be i

permanent. Additionally, the licensee originally erroneously noted that the

{

dump valves weru only mentioned in one section the UFSAR and the reduced flow

)

was beneficial to that accident analysis.

3

}

Washington Nuclear Power 2, Inspection Report 50-397/95020, The licensee performed a temporary modification to remove position indication from a vr*ve in the reactor core isolation system because the position indication lights i

were providing false indication to the operators.

The Ifcensee's screening review concluded that no 50.59 evaluation was needed for this activity because there were no licensing basis documents requiring this indication, and a 50.59 evaluation was not needed for interim disposition when the timeliness of corrective action was such that the degraded condition would not become a defacto change. The inspector found that a section of the FSAR did address position indication for this valve; further, it was concluded that the temporary modification was likely to be in place for about a year, and thus should be evaluated as a change.

2

l RECOGNITION OF CHANGE Big Rock Point, Inspection Report 50-155/92007: During performance of a primary system hydrostatic test, the primary recirculating system rapidly depressurized from the test pressure (1450 psig) to atmospheric. Discussions I

with the maintenance staff indicated that compression fittings, instead of the j

socket welds used previously, were used to reinstall a heat exchanger following repairs.

This appeared to be a change in the design of the originally installed equipment. A safety evaluation was not performed to ensure that the change did not involve an unreviewed safety question as defined in 10 CFR 50.59.

Braidwood, Inspection Report 50-456/457-95011: While performing a walkdown of the 125-Volt D.C. system, a NRC inspector noted that a portable fan was chained to a fire damper exhausting air from the 211 battery room. Further investigation revealed that two days earlier the room exhaust fan tripped on high differential pressure and the portable fan was installed to provide an alternate means of ventilation.

The ifcensee failed to recognize that the portable fan installation constituted a change to the configuration of the plant by altering the air flow throughout the battery room, which could have resulted in an unreviewed safety question. Specifically, the battery exhaust ventilation system, as described in the facility's UFSAR, was a safety-related, safety category I system that includes as part of its safety design basis the requirement to maintain the battery area hydrogen concentration less than two percent.

Fermi, Inspection Report 50-341/95005: Fermi UFSAR Section 7.5.1.4.2.1 describes the function of the Reactor Water Level Instrumentatidn'and Section 7.5.1.4.2.2 describes the function of the Reactor Pressure Instrumentation.

Sections 7.5.2.4.2.1 and 7.5.2.4.2.2 provide the analysis.

The UFSAR states, in part, that redundancy and independence or diversity are provided in all of the information systems used for the basis of operator controlled safeguards actions.

The licensee used two DAS units simultaneously to monitor the reactor water level and pressure instrument loops on both divisions. During the test both divisions of the wide and narrow range reactor water level and pressure indications were adversely affected. Prior to the test, the licensee did not perform a safety evaluation, to ensure that the test / experiment performed did not involve an unreviewed safety question, because they considered the test to be non-intrusive, and, as such, a 50.59 analysis was not applicable.

DC Cook, Inspection Report 315/316-94002: A residual heat removal (RHR) pump suction containment isolation valve, ICM-129, unexpectedly closed due to a signal from the RCS pressure switch that had been removed from service for a reactor protection system modification. During follow-up investigation, the licensee identified that Section 9.3.3 of the UFSAR stipulated that ICM-129 had to be deenergized when the RCS was open to the atmosphere.

The licensee determined that no safety evaluation was performed for the change to the UFSAR, as required by 10 CFR 50.59.

3

/

3 1

RECOGNITION OF CHANGE i

j LaSalle, Inspection Report 50-346/347-93020: A safety evaluation was not i

performed for isolation of a feedwater energency drain valve (EDV) when it was removed from service for an planned extended duration.

The UFSAR, Section 10.4.7.5, stated that an automatic dump to condenser action on high level was provided. Shutting the EDV and operating in that condition for an extended period constituted a change to the facility as described in the UFSAR.

1 Therefore, performance of a safety evaluation was required.

Instead, the i

licensee designated this action as a maintenance activity and failed to perform even a screening evaluation. Delaying the required repair for a year i

and a half, extending over a refuel outage, placed this action well outside classification of a maintenance activity. Several statements made by the j

i licensee during review of this issue indicated licensee misunderstandings of 10 CFR 50.59. For example, the licensee reasoning that " loss of a feedwater heater is a transient, not an accident and therefore of no special concern" is incorrect.

Increasing the probability of occurrence of malfunctions of equipment important to safety must also be considered since removing the subject EDV from service increases the probabi1ity of a loss of feedwater l

heater transient. Furthermore, in stating that removing the subject EDV fron

^

service does not increase the probability that a level increasing transient will occur, the licensee igno* red the conclusion reached in the deviation report on the loss of feedwater transient which occurred in December 1990.

Perry, Inspection Report 50-440-94010:

Two of four comparable 480/120Vac non-regulating transformer were replaced under a modification with regulating

=

transformers.

Although the new regulating transformer was intrinsically different and more complex than the non-regulating unit, there was no objective evidence that these differences were evaluated.

The safety evaluation did not provide a basis for omitting this protective feature and did not evaluate the consequences of a different type of malfunction due to L

the postulated failure of the voltage regulating systen but stated that the consequences due to a new transformer failure would be the same as for the existing unit. Similarly the impact on the Perry Probabilistic Risk Analysis was evaluated by stating in part that a one-for-one replacement of a non-regulating to a regulating type of transformer would not change the generic failure probability of the components used in the analysis and would not lead to a change in the core damage frequency.

These statements were not substantiated by industry guidance, which indicated that regulating transformers had different levels of reliability.

In addition to different failure probabilities, the regulating transformer could produce higher than normal output voltages under certain control systen failures, a failure node which can not be postulated for non-regulating transformers.

The new transformer control systen failed causing intermittent voltage fluctuations greater than 165V on the 120V bus.

This 2 to 3 minute overvoltage transient damaged a number of safety related electrical components prior to the 480V primary transformer fuse protection actuation.

RECOGNITION OF CHANGE 4

1 San Onofre Inspection Report 50-361/362/95026. This report identified two examples of a violation related to inadequate 10 CFR 50.59 evaluations.

The reactor coolant system gas vent flow-limiting orifice, described and depicted in the design bases of the UFSAR, was replaced with an orifice gate valve by a field change notice.

The field change notice did not provide for the performance of a safety evaluation of this change.

In addition, the UFSAR was not changed to reflect the replacement of a flow-limiting orifice in the reactor coolant system gas vent with an orifice gate valve.

l j

l

~.

. ~.

--.u-+-

O I

a l

5

_ _ - _ ~

DEGRADED / NONCONFORMING CONDITIONS Pilgrim Inspection Reports 50-293/95021 and 50-293/95022.

These reports documented concerns about operation of the facility with elevated station service water inlet temperature for extended periods of time without a 50.59 evaluation.

The licenseee interprets GL-91-18 to allow continued operation without a 50.59 to address nonconforming conditions.

The plant operated for approximately two years in this condition.

Hope Creek, 50-354 - The licensee discovered in 1992 that the configuration of the ventilation dampers was not in accordance with the FSAR.

They conducted an extensive engineering evaluation that concludes that the configuration would not impair their ability to achieve safe shutdown, but this was not a 50.59.

Their stated intent was to eventually correct the configuration, but to date, they have not corrected it, nor revised the FSAR.

Point Beach, Inspection Report 50-266/301-95013: A concern was identified that JC0 92-003-01, which justified both units to operate at a T of 570'F, inlieuofthe573.9'FasdescribedintheUFSAR,didnothaveaNafety evaluation performed in accordance with 10 CFR 50.59 to determine if the deviation presented an unreviewed safety question. Between November 1992 and October 1993, when the NRC approved a T of 570*F for Unit 2 and the safety analysis also provided justification foYthe lower T in Unit 1, no formal safetyevaluationhadbeenperformedinaccordancewNh10CFR50.59.

An evaluation was performed by Westinghouse in October 1992 that concluded that both units could be operated at 570*F but the evaluation did not address all

~

of the questions posed by 10 CFR 50.59.

In addition, the licensee did not appear to have adequate procedures in place to ensure that JCOs receive safety evaluations in accordance with 10 CFR 50.59, which could lead to the licensee i

operating outside of the licensing basis for the plant.

i 6

DEGRADED / NONCONFORMING CONDITIONS Point Beach, inspection Report 50-266/301-95011: Data from a containment accident recirculation heat exchanger performance test was obtained to determine a 0.0014 fouling factor for the heat exchanger. Using this fouling factor, the licensee calculated that the heat removal rate for the heat exchanger was less than the 50 million BTU /hr specified in the UFSAR.

However, the engineering staff disregarded the data due to uncertainties associated with the test and instead used a fouling factor of 0.001 in numerous calculations. Review of a justification for cantinued operation for the heat exchanger as well as previous monthly surveillances showed that cooler flow rates less than the 1000 gpa for assumed accident conditions specified in the UFSAR have been previously accepted.

The containment accident recirculation cooling system is designed to recirculate and cool the containment atmosphere in the event of a loss-of-coolant accident and thereby ensure that the containment is not overpressurized beyond design.

If the containment cooling units are not operable both containment spray pumps are required to provide sufficient heat removal capability to maintain the post-accident containment pressure below the design value. Neither a formal 50.59 screening nor a complete safety evaluation was performed to ensure an unreviewed safety question did not exist by using a flow rate of less than 1000 gps.

The licensee stated that the 0.001 fouling factor was per the containment cooler design data and that the UFSAR stated that a fouling factor of 0.001 was assumed for cooling coil design purposes under normal and design basis accident conditions. However, the UFSAR actually stated that computer i

analysisofthecoilsshowedthatthepost-accidentheftremovalratecouldbe A fouling achieved with a fouling factor approaching D.002 hr-ft -0F/ BTU.

factor of > 0.001 was never used to bound any of the calculations, even af ter the 0 0014 fouling factor was calculated after the containment fan cooler test. Additionally, the inspectors noted that a non-conservative service water temperature of 70*F and flow rate of 1000 gpa were used in the computer program which determined the 0.0014 fouling factor, despite the fact that the JC0 was in place and allowed service water temperatures up to 76*F and flow

)

rates down to 920 gps.

7 i

DEGRADED / NONCONFORMING' CONDITIONS Prairie Island, Inspection Report 50-282/306-95014:

As part of their self-assessment on their service water system, Prairie Island discovered that the preoperational test results for the emergency intake line had been misinterpreted and that the line had never met design flow requirements.

The licensee prepared a safety evaluation documenting acceptability of leaving the design "as-is."

However, the safety evaluation concluded that, in order to provide sufficient net positive suction head to the service water pumps following an earthquake, credit would have to be taken for the non-seismic intake canal remaining intact for over an hour.

This differed from the conclusions in the USAR and the initial safety evaluation report which stated that the emergency intake line supplied sufficient cooling water to meet design basis heat load requirements.

The inspectors considered the failure of the emergency intake line to meet its design requirements to increase the consequences of an accident - making this an unreviewed safety question - and submitted the issue to NRR.

The licensee's position was that nothing required them to go to NRC for approval of this "de facto" design change.

8

M DESCRIBED IN.THE SAR Davis Besse, Inspection Report 50-346/93016:

The containment air cooler (CAC) valve alignment was changed during the eighth refueling outage for the standby CAC unit to resolve a water hammer condition.

The supply motor operated valve (MOV) position was changed from normally closed to normally open, whereas discharge air operated valve (A0V) was changed from normally open to normally closed.

The downstream manual isolation valve was also changed from normally open to normally closed.

This change in alignment met the definition of "a i

change in the facility as described in the UFSAR" as provided in the l

licensee's procedure on performing safety evaluations because the CAC alignment was shown in USAR Figure 9.2-1, Revision 1.

Also, this change in i

alignment resulted in a trapped volume between the A0V and the manual 1

isolation valves. Additionally, this alignment change eliminated the supply 1

containment isolation of the standby CAC unit.

The original safety review identified the change as only an operational procedure change and failed to

\\

identify that this change constituted a change in the facility as described in the UFSAR.

Also, the safety review failed to identify the trapped volume between the discharge isolation valves. Furthermore, the original safety review did not provide any description of valve position changes; but only referenced the applicable TS and UFSAR sections. A second safety review l

identified the trapped air volume concern, but still failed to identify that this change constituted a change in the facility as described in the UFSAR and did not address the change in containment isolation function.

DC Cook, Inspection Report 315/316-95012:

The design change relocated the starting relays (one for each of the four safety related diesels) from side panels to a stiffer front panel.

The safety evaluation was performed in accordance with 10 CFR S0.59 to evaluate the relocation of the relays.

The licensee answered the question "Does the proposed design change represent a change to the plant as described in the SAR, Emergency Plant or Security Plan?" with "...The diesel generators are not explicitly described in the SAR.

This design change does not affect the diesel generator controls as describec in sections 6.1.1 and 8.4 of the UFSAR." While this statement was true, the answer did not address that the relays were important for the proper functioning of the emergency diesels and that if the relays fail a function that was described in the UFSAR (emergency diesel generator operation) would not occur.

9

/

t Fermi, inspection Report 50-341/95009:

The inspectors had concerns with the licensee's process to determine if a safety evaluation was requ. ired.

Fermi's 1

philosophy on 50.59 Safety Evaluations was that a safety analysis need not be performed unless the words in the UFSAR were changed.

The licensee failed to recognize that a component, system or function that is described in the safety analysis report can be adversely affected by a newly added design change (e.g., pressure regulator modification, PIP cable assemblies modification), or by a change to a part (e.g., pump impeller or RPS system relay) which affects existing system functionality, but which does not change the actual words in the UFSAR. A 50.59 Safety Evaluation appears appropriate to determine whether the proposed change affects the design and/or function of any SSC described in the UFSAR.

This issue will be tracked as an Unresolved item pending receipt of an interpretation of 50.59 applicability from NRR.

LaSalle, Inspection Report 50-346/347-93036: A Nay 1993 work request requested that a bracket support be installed on damper lVR04YA to relieve the damper blade sag.

The safety evaluation screening asked if the change "will change alter the design or function of any system, structure or component as described in the SAR."

The licensee answered "no, the damper's function will not be altered and its design is not described in the SAR."

Although the design details of the damper were not described in the UFSAR, the closing function of the VR system dampers was.

No safety evaluation was performed.

I i

10

i AS DESCRIBED IN THE SAR Braidwood, Inspection Report 50-456/457-92023:

The Chemistry Department inadvertently caused a chemical variation on the Unit 1 steam generators after injecting approximately 15 standard cubic feet of sulfur hexafluoride (SF )

s gas into the Unit 2 condensate system.

The technicians did not evaluate the possibility of SF, going in the steam generators.

They also did not evaluate the effects of the alkaline steam generator water chemistry on SF, which resulted in the SF breaking down into fluorine and sulfonates. gThe Updated s

Final Safety Analyhis Report (UFSAR) describes the methods for maintaining water chemistry in the steam generators.

The addition of ammonia in the form of ammonium hydroxide, or an equivalent amine, and hydrozine to the condensate is in Section 10.3.5.1 of the UFSAR.

The addition of SF gas to the s

condensate is not in the safety analysis report. However a safety evaluation was nct performed prior to the injection.

Fermi, Inspection Report 50-341/92010: A modification removed the reactor head vent line bypass valves and associated instrumentation, includ'ng the removal of the capability to remotely operate the system from the control room.

The safety evaluation failed to address the system function as described in the NRC initial Safety Evaluation Report (SER) NUREG-0798 in consideration of the TMI Action Plan (NUREG-0737) Item 11.B.1 requirements for licensing of the Fermi 2 reactor.

Prairie Island, Inspection Report 50-282/306-95014: Prairie Island determined that the method they used to test check valves in the cooling water system was inadequate.

They changed their test method to require slamming the valves shut under full system pressure - which would accelerate valve degradation.

The region was divided as to whether this change in a test method - where neither the original or the current method is described in the USAR - required a 50.59.

11 j

I INCREASE IN PROBABILITY OR CONSEQUENCES Beaver Valley, inspection Report 50-334/412/94020, In order to perform a

.i repsir of Ienking buried coo 1ing water 1ine to energency diese1 generators, the licensee performed a 50.59 evaluation of uncovering the lines.

The licensee stated in its evaluation that there was no change in probability of occurrence of a malfunction of equipment important to safety (damage from natural phenomena missile generation); the basis for this statement was a probability analysis showing strike probability on the order of 10E-10. which the licensee argued was low enough that it need not be considered a credible event.

The Ifcensee also identified compensatory measures.

The inspectors i

had no safety concerns with the evaluation, but referred to NRR the " process" issue of altering the design basis by showing very small increase in probability of failure of equipment important to safety.

LaSalle, Inspection Report 50-346/347/93020: An engineering work request involved a change to an electronic circuit card for the control roon ventilation systen (VC) inlet radiation monitors. These radiation monitors had been spuriously actuating and placing the VC systen in the energency mode. The proposed change was to increase the time delay in the monitors' response circuit by replacing four capacitors and resistors on the circuit boards.

Only a safety evaluation screening was performed. An enclosure to this safety

\\

screening stated that if the VC systen was in the purge mode, the GDC 19 limit of 30 Ren in the thyroid of the control room operators would be exceeded in a design basis accident.

The licensee implemented a procedure change to ensure

~

both VC subsystens were <ieclared inoperable and TS 3.0.3 entered when the VC system was placed in the purge mode of operation. UFSAR Section 6.4.4 stated that the energency make-up filter train was designed to limit occupational dose below levels required by GDC 19.

Despite this, the modification safety evaluation concluded that no unreviewed safety question existed. NRC questioned this conclusion and forwarded the licensee's safety evaluation to NRR. NRR agreed that an unreviewed safety question existed, and the licensee removed the modification.

Perry, Inspection Report 50-440/96002:

The licensee normally left the drywell shield door open during operation. The initial 10CFR50.59 evaluation used a PRA approach and showed this situation was acceptable for short periods of time. The issue is based on the force of the suppression pool swell in the event of a blowdown and the excessive stresses on structural components.

The resident inspectors questioned the evaluation and their perception was concurred in by ORS and NRR. 5inu1taneous1y and independent 1y, the 1icensee PORC found this situation to be an unresolved safety question and the licensee is reevalulting.

i 12

4 i

j.

INCREASE IN PROBABILITY OR CONSEQUENCES St. Lucie, Inspection Report 50-35/389/95014, St. Lucie prepared a safety j

evaluation to support operation with a manual isolation valve closed in the 1

diesel fuel oil line the underground storage tank to the day tanks (the line.

was leaking). As a compensatory measure, the licensee proposed dedicating an equipment operator to the task of opening the closed valve in the event of T

diesel start. As part of their evaluation, the licensee employed PRA ii techniques to estimate the risk of loss of the bus powered by the diesel due to failure of operator to open the valve, or failure of valve to open. An increase in probability of 6% was calculated.

The licensee's USQ deterninstion was that there was no increase in probability when the existence of procedural guidance and heightened awareness were balanced against the l

calcv'ated 6% increase.

This " balancing" question was referred to NRR for

]

rest'ution.

k I

i 5

i i

4 i

I i

13

~

l COMPENSATING ACTIONS j

1 l

l Davis Besse, Inspection Report 50-346/93012:

The check valves in the main

.Leam ifne to the AFW pump turbines experienced increased wear due to valve fluttering. A modification was planned and installed to replace the valves with ones featuring an external shaft with a packing arrangement. As part of the modification process, a safety evaluation per 10 CFR 50.59 was prepared which determined the valve was a "Iike-for-like" replacement. During post-installation testing, it was determined that application of about 40 to 45 ft-

\\

lbs of torque was required before the packing load could be overcome and disc movement would occur.

The licensee postulated that with the valves initially fully open, the valves might not seat during a high energy line break (HELB) l as a result of the packing load.

As a result, a standing order was issued to

\\

have equipment operators manually close/ check closed the valves each shift as well as after each evolution which could open the check valves. Although safety evaluations were prepared in accordance with 10 CFR 50.59 and licensee procedures, the associated engineering analysis was weak in that the additional effects of packing loads were not addressed prior to installation of the new check valves. Although the licensee determined the modification l

was not a change to the facility as described in the UFSAR nor was it a test j

or experiment, it was subsequently identified that there were some conditions in which the valves, if fully open, would not seat during a HELB.

(Although i

no plant conditions were identified which would cause the subject check valves

\\

to fully open.) Consequently, compensatory measures had to be established to ensure continued system operability and the valves were removed during the i

next refueling outage.

Palisades, Inspection Report 50-255/94014:

The condensate storage tank (CST) i water temperature was found to be 130*F, 10 degrees above the assumptions used for the UFSAR accident analyses for a loss of normal feedwater event.

The temperature increase resulted from modifications made during the steam generator replacements resulted in reduced dilution of hot water sent to the CST causing higher temperature transients in the tank. An analysis of AFW performance concluded that the safety function of the system to cool down the plant on a loss of feedwater could still be aehieved.

The licensee concluded that the systen should be operated below 120*, but that actual temperatures to 130' were acceptable. Accordingly, more controls were added on the CST temperature that consisted of shiftly operator rounds which added acceptable temperature criteria of 40-120*. A high temperature alarm was established a year later of 125* to provide for instrument error and operator action prior to reaching D0*.

The system operating procedure S0P 11 was changed to specify that the CST be maintained between 40* and 120'.

The increase in temperature had a nonconservative impact on several accident analyses in Chapter 14 of the UFSAR that were not evaluated as part of the change.

14

~

i 1

COMPENSATING ACTIONS Perry, Inspection Report 50-440/95006: A Safety evaluation documented the acceptability of removing four FPCC valves from the GL 89-10 program.

This i

evaluation attempted to take credit for manual operator actions to close these valves and argued that the failure of the automatic isolation function of 1

these valves would not result in significant adverse consequences. A second i

i safety evaluation documented the removal of twelve ECCW valves from the GL 89-i l

10 program and presented similar arguments to attempt to justify the i

acceptability of manual operation cf these valves.

The inspectors were unable to determine whether or not the removal of these valves was acceptable and l

forwarded this issue to NRR for review and resolution.

i Point Beach, Inspection Report 50-266/301-95013:

In November 1995,' operations 1

tested the ATWS mitigating system actuation circuit, automatic actuation of the AFW on steam generator "10-1o" level, and automatic trip of the AFW pumps on low suction pressure using procedure ORT 3A while an l&C technician was concurrently performing a quarterly reactor protection and emergency safety features test.

ORT 3A required in its Initial Conditions that all safeguards systems-related work or testing on either or both units be suspended for the duration of the test.

The 10 CFR 50.59 safety evaluation for ORT 3A also i

stated the restriction that no safeguards systems work or testing occurred i

during the test as the basi.-for no increase in the probability of occurrence j

or consequences of an accident previously evaluated in the FSAR. Performance of Unit 1 safeguards testing concurrent with ORT 3A was discussed in the morning meeting and was agreed to by the shift supervisor, the test dtrector and test coontinator and the DCS present. Also, the l&C technician's analog j

testing was noted during the pre-job brief to ORT 3A. Despite these discussion, no change was made to ORT 3A nor was a 10 CFR 50.59 review or j'

safety evaluation performed to evaluate doing safeguards testing concurrent i

with ORT 3A. No one from operations and engineering questioned whether a

}

change had been made to ORT 3A to allow concurrent testing or if this affected the 10 CFR 50.59 safety evaluation even after the inspector raised concerns about this issue while observing this portion of ORT 3A.

Summer, Inspection Report 50-395/94016 The FSAR states that the licensee will i

perform monthly inservice testing of the main turbine stop and control valves.

}

The purpose of the testing is to ensure valves will isolate main steam to the turbine to prevent missile generation which could damage safety-related t

i equipment.

The Ifcensee performed a 50.59 evaluation to justify a one-time l

change from nonthly control valve testing to quarterly.

The basis was that the increased stop valve testing frequency (licensee performs this test weekly) offsets the decreased control valve testing frequency and therefore 1

that there is no increase in probability of missile generation.

The 50.59 i

evaluation was sent to NRR for review.

4 1

4 4

15 l

/

ii

HARGIN OF SAFETY Dresden, inspection Report 50-237/249-92034: #RC acceptance of the containment heat removal system (CHRS) was based on a duty of 102 MBTU/Hr at a 1

river temperature of 95'F.

The heat removal requirements were correctly translated into system design criteria which specified the Hx duty of at least that to match the assumption in the heat removal.1nalysis.

To assure the heat removal capability, 7,000 gpm CCSW flow was specified as a design criteria.

The validity of the safety analysis assumption of 7,000 gpm CCSW flow was

+

maintained by TS 3.5.B, which required a minimum of two CCSW pumps, at 3500 gpm each, available during reactor operation.

The Ifcensee, in a safety i

evaluation, changed the plant design, as described in the UFSAR, by reducing the minimum number of CCSW pumps from two to one, and by reducing the CCSW train flow from 7,000 gpm to 5,600 gps.

The resulting 1 LPCl/l CCSW containment analysis indicated the long ters containment pressure exceeded 8 psig.

The change reduced the Hx capacity below the value stated in the SER i

as a basis for approving the containment cooling system; reduced containment cooling (due to the reduced CCSW flow) to the point containment over pressure was required to demonstrate ECCS pump NPSH for the 2 LPCl/2 CCSW pump cases; resulted in the UFSAR post DBA LOCA containment pressure and temperature response curves being exceeded and was based on an unapproved computer code and an unapproved decay heat model.

Collectively, these changes reduced the margin of safety as defined in the bases for TS 3.5.B and 3.7.A.c and involved l

an unreviewed safety question.

1 4

4 k

n 16

..._.~ _ _ _ ___ __ _.._

b*

k UNITED STATES 8

NUCLEAR REGULATORY COMMISSION d

y caenectoss,s.c sones May 10.1989 i

Mr. Thon.as E. Tipton Pirector DMSS Division NUMARC 1776 Eye Street, N.W.

j A ite 300 j

nugington,D.C. 20006-2496

Dear Mr. Tipton:

i l

1 l

The NRC staff has carvleted its review of the joint NUMARC/NSAC working gmup's

" final draft" 10 CFR 50.59 guidance document dated November 7,1988. As in the case of the earlier draft, the final draft was widely distributed for l

review and comment within NRC. including regional offices. By and large, i

the staff found the final draft to be a significant improvement over earlier j

drafts.

)

On F.ay 12.1988 the staff provided NUMARG with coments on an earlier draft.

1 Those coments outilned the NRC's views on several key issues (e.g.. Margin l

of Safety, Consequences of an Accident or Malfunction of Equipment) related i

to 10 CFR 50.59 requirements. We indicated that each of these key issues should be better addressed,before the guidance document could be endorsed by the NRC. We are concer'ned that there are several areas where the guidance.

4 document remains inconsistent with the staff's understanding of how 10 CFR 50.59 should be applied. Therefore, we have clarified our May 12, 1988 comments (see Inclosure 1).

Inasmuch as 10 CFR 50.59 is based on what is in the " safety analysis repert,"

it is important that the FSAR be updated to ensure that the information required by 10 CFR 50.71 accurately reflects the licensing basis for the plant. The infornation reovired to be incorporated in the updated FSAR by 10 CFR 50.71 shculd be consistent with that collection of documents on which the NRC relies in issuing and amending the plant's operating license. The documents which compose the licensing basis consist of documents generated by the licensee as well as documents generated by the NRC. With regard to Itcensee. generated documents, they include (1) the application for an operating license )(2) the Final Safety Analysis Report (FSAR). (3) the environmental report, (4 other reports and plans not associated with the second and third items (e.g., security, antitrust), and (5) evaluations and respceses to NRC requests in generic letters or bulletins. With regard to NRC-generated documents, they include (1) the operating license and Technical Specifications. (2) the Safety Evaluation Report (SER) and its supplements. (3) the Licensing (Board, Appeal Board, and Commission decisions. (4) orders. (5) regulations. 6) safety evaluations and environmental essessments perfoned by the staff, and (7) the final environ.

r e tal statement.

It should be noted that 10 CFR 50.71 specifically identifies that inform 6 tion which is required to be updated in the.FSAR, and the staff is r,ct implying that all aspects of the licensing b6ses are to be incorporated into the FSAR.

j

(,

~h f

~

.. W May 10,1989 2-Mr. Thomas E. Tipton

. to this letter identifies a number of other issues that will need Many of these issues to be addressed in any staff-endorsed guidance document.coments on the earlier draft.

were already described to you in our May 12, 1988 We understand that WUMARC/WSAC plans to revise the 10 CFR 50.59 guidance document based en comments received from the NRC and other laterested parties.

When the issues discussed in the Enclosures to this letter have been femally addressed by WUMARC/NSAC, the staff expects to develop a. Regulatory Guide to As we recognize NSAC-125 as an acceptable method of satisfying 1 the guidance prior to finalizing a Regulatory Guide.'

If you have any questions about our coments on the revised guidance document.

P ease contact Mn, David Fischer at (301) 492-1185.

l 51ncerelbg'nad by Original Chades E Rossi Charles E. Rossi, Director Division of Operational Events Assessment

~_

Office of Nuclear Reactor Regulation

Enclosures:

1.

Discussion of Key Issues 2.

Specific Comments f

4 O

e

1 I

j ENCLOSURE 1 i

DISCUS $10W OF KEY !$$UES I

l, 155UE WD.1: MARGIN 0F SAFETY

}

30 CFR 50.59 requires licensees to obtain prior Comission approval of changes.

{

tests, or experiments that reduce the margin of safety as defined in the basis for any Technical Specification. 10 CFR 50.59(a)_ (2) states in part:

l l

A proposed change, test, or experiment shall be' deemed to involve 1

en unreviewed safety question.... (iii) if the margin of safety as i

defined in the basis for any Technical Specification is reduced, i

To the waximum extent practicable, the Bases for a Technical Specification i

should esplicitly define.or address the margin of safety.

If the Bases do not specifically), address a margin of safety, then the licensee's safety analysis-report (SAR the staff's safety evaluation report (SER), and appropriate other j

licensing basis documents should be reviewed to determine if the proposed change, i

test, or experiment would result in a reduction in the margin of safety. Since j

the margin may be implicit rather than being explicitly expressed as a numerical value, the precise determination of a numerical value associated with a change is not always required to comply with 10 CFR 50.59.

It may be pufficient to determine only the direction of the margin change (i.e., increasing or decreasing).

If the margin is reduced, t reviewed sMety question. Ae change, test, or experiment would involve an un-In making the judgment on whether the margin is reduced, the decision should be based on physical parameters or conditions which can be observed or calculated. Where a change in margin is so small N

or the uncertainties in determining whether a change in margin has occurred 1

are such that it cannot be reasonably concluded that the margin has actually changed (i.e., there is no clear trend toward reducing the margin), the change f,..

need not be considered a reduction in aarpin.

s In detemining whether the margin of safety has been reduced for a Technical Specification by a proposed change, test, or expe'rfment, the licensee should first look to the Bases for the particular Technical Specification. As stated above. if the Bases do not explicitly address margin of safety then the licensee should examine the licensing bests documentation and evaluate the change b based on changes to physical parameters (or conditions which can be observed or calculated). For the purpose of perfoming evaluations in accordance with 20 CFR 50.59, the margin of safety should normally be considered the difference between the regulatory limit (i.e., the limit specified by the regulations or Technical Specifications) and the value of the parameter reviewed and approved by the staff as part of the licensing basis for the plant. The value of the parameter " reviewed and approved by the staff as part of the licensing basis" is typically the value of the parameter proposed by the licensee in the FSAR as modified by the staff's Safety Evaluation Report (s). This value should be incorporated into the Itcensee's updated SAR and is sometimes referred to as the

• acceptance limit." Proposed changes that would affect margins beyond the regulatory limit (e.g., the margin between the Technical Specification Limit and the assuned system failure point) would most likely reoutre an exemption from the regulation or a Ifcense amendment and by definition, are not within the limits of 30 CFR 50.59.

/

.o l

i l 1 l

The staff recognizes that there are " margins" associated with SAR analyses to i

account for unceri,ainties in the design, construction, and operation of a i

nuclear power plant (e.g.. conservatisms in computer modeling and codes.

allowances for instrument drift and system response time). These " margins" may be reduced by licensees without prior staff approval provided the specific i

acceptance conditions, criteria and limits fincluding models, tests.

l uncertainties, penalties, methodology, etc.? are not adversely affected or i

invalidated. For example. if the licensee performed, but did not submit to the,.

j WRC. an analysis to determine the peak pmssure for a system (perhaps as a i

function of time) following an accident, and then asked the NRC to license the plant based on a more conservative (bounding) limit or curve (because of i

analyses uncertainties), and the NRC reviewed and approved the bounding limit i

or curve, then 1he licensee could make a change which would increase the peak 6

i system prest,ure provided a more precise analysis, with reduced uncertainties, left the bounding limit or curve valid. The licensee should apply the same methodology, with and without the pr6 posed change, when evaluating a change to determine its effect upon the margin of safety. However, if the specific methodology for computing the bounding limit or curve or combining uncertainties

-(such as instrument errors) was submitted to the NRC in support of the licensing action, redurctions in margin associated with methodology would constitute an unreviewed.<afety question.

5 The Technical Specification Bases for safety limits on many plants are examples i

of Bases that explicitly ad, dress margins of saMy. Changes in transient or

~

i accident core themal hydraulic conditions or te sk reactor coolant pressure which do not violate the fuel design limits or mactor coolant system design pressure in the Bases for the safety limits specified in the plant Technical t

Specifications do not consti,tute a reduction in the margin of safety as used i

in 10 CFR 5,0.59 provided the changes are made consistent with previously ac-i cepted methods and specific acceptance conditions, criteria, and limits l

(including models, test uncertainties, penalties, methods, etc.).

1 ISSUE NO. 2:

CONSEQUENCES OF AN ACCIDENT OR MALFUNCTION OF EQUIPMENT

{

20 CFR 50.59(a)(2) states in part:

1 j

A proposed change, test, or experiment shall be deemed to involve an unreviewed safety question (1) if... the consequences of an i

accident or malfunction of equipment important to safety previously evaluated in the safety analysis report may be increased; or...

The accidents covered under this regulation include any accident or malfunction of equipment included in the SAR or NRC Safety Evaluations and are not limited to those accidents covered in FSAR Chapters 6 and 15. 10 CFR 50.59 is also applicable to other events described in the SAR with which the plant was designed to cope. For example.10 CFR 50.59 is also applicable to plant modifications and analyses added to the licensing basis and reflected in the updated SAR pursuant to 10 CFR 50.71, including those addressed by NRC regulations (i.e.,

ATWS, Station Blackout). NRC orders (i.e., inter-system loss of coolant accidents) and NRC Generic Letters (i.e.. loss of shutdown cooling during mid-loop operation).

i 1

3-i' The end points of the Ovaluation should be in terms of dose to either onsite er offsite persons that would likely result from any accident or equipment malfunction assoc (ated with the proposed change. The consequences referred to j

in 20 CFR 50.59 do not apply to occupational exposures resulting from other j

than accidents ant) equipment malfunctions e.g., from routine operations.

maintenance, testing, etc. Occupational doses are controlled and maintained As i

Low As Reasonably Achievable (ALARA) through formal licensee programs.

If a i

proposed change, test or experiment, would result in an increase in dose from any accident or equipment malfunction above that previously reviewed and

)

approved by the staff as part of the licensing basis for the plant (i.e., the acceptance limit), then the proposed change, test or experiment involves an unreviewed safety question and would requ' re prior NRC approval. Where a J

change in consequences is so small or the uncertainties in determining whether i

a change in consequences has occurred are such that it cannot be reasonably concluded that the consequences have,actually changed (i.e.. there is no clear j

trend towards increasing the consequences), the change need not be considered an increase in consequences. The staff believes that it is not consistent with 20 CFR 50.59 to allow a licensee to make any change that results in an increase in dose from any accident or equipment malfunction, without prior NRC approval.

~

l simply because the applicable Standard Review Plan NUREG-0800 (SRP) dose guideline is not exceeded.

However if in licensing the plant the staff explicitly found that the plant's response to a particular event was acceptable because the dose was less than the SRP guidelines (without fu.rther qualification)

{

then the staff implicitly 6ccepted the SRP guideline as the licensing basis for the plant and the particulir event, and the licensee may make changes that increase the consequences for the particular event, up to this value without prior NRC approval. However, if the staff cited some value other than the SRP

{

guideline in its SER as its criteria for Itcensing the plant then that value is j

considered the licensing basis for the plant.

l 1SSUE NO. 3: PROBABILITY OF AN ACCIDENT OR MALFUNCTION OF EQUIPMENT 3D CFR 50.59(a)(2), states in part:

~~ '

A proposed change, test, or experiment shall be deemed to involve an i

unreviewed safety question (1) if the probability of occurrence... of i

an accident or malfunction of equipment important to safety previously j

evaluated in the safety analysis report may be increased; or...

Eere again, the accidents covered under this regulation include any accident or malfunction of equipment included in the SAR or NRC Safety Evaluations and are not limited to those accidents covered in FSAR Chapters 6 and 15.

l 20 CFR 50.59 is also applicable to other events described in the SAR with which j

the plant was designed to cope. For example, this regulation is also applicable to significant safety issues added to the licensing basis and reflected in the 3

i updated SAR pursuant to 10 CFR 50.71 including those addressed by NRC regulations i

(i.e.

ATWS, Station Blackout). NRC orders (i.e., inter-system loss of coolant

)

accidents) and NRC Generic letters (i.e., loss of shutdown cooling during j

nid-loop operation).

,i S

Y I

1,-

q 4

In our May 12. 1988 coments on an earlier draft of the 10 CFR 50.59 guidance f document, we stated that "[t]he change in probability under 10 CFR 50.59 is arg

{ emphasis added) change in probability regardless of whether or not it moves from one frequency class [i.e., those defined in ANSI N18.2-1973] to another.

]

A change that involves change in frequency within a frequency class, should be j

reviewed in accordance with 10 CFR 50.59." The staff believes that licensees i

l should utilize reasonable engineering practices, engineering judgment, and PRA i

techniques, as appropriate. in determining whether the probability of occurrence i

of an event increases as a result of implementing a proposed change. A large l

body of knowledge has been developed in the area of event frequency and risk i

significant sequences through plant-specific and generic. studies. The staff 4

believes that licensees should draw on this knowledge when determining what i

i constitutes an increase in the probability of occurrence of an accident or malfunction of equipment important to safety previously evaluated in the safety I

analysis report.

In this context, equipment important to safety should include i

any equipment that could either cause, exacer te, or mitigate events or acci-dent sequences described in the updated SAR.

here a change in probability is l

so small or the uncertainties in determining ther a change in probability has occurred are such that it cannot be reasonably concluded that the prcbability i

bas actually changed (i.e., there is no clear trend towards increasing the probability), the change need not be considered an increase in probability]

i An increase in the probability of many Design Basis Accidents is important primarily insofar as it increases the expected frequency of core damage.

j Therefore, the licensee's evaluations to determine the effect of a proposed t

change.on probability should include an evaluation to ensure that there will j

mot be an increase in the probability of occurrence of potentially important functional sequences that Tead to core damage or unusually poor containment l

performance for the plant. This would allow a licensee to make a change i

that would result in a slight increase, for example. in the probability of j

an initiating event provided the probability of occurrences of some other i

~ ~ -

event (s) in the same sequence is concomitantly decreased and there is no i

adverse effect on other plant-specific accident sequences.

l Qsu f af.c.g.

l J

1

\\

4 4.

ENCLOSURE 2 d

i l

SPECIFIC COMMENTS ON NLEARC/NSAC

)

DRAFT GUIDANCE FOR 10 CFR 50.59 5AFETY EVALUATIONS i

1.

GENERAL CO M NTS 1

i in the November 7.1988, cover letter, NUMARC states that non-radiological j

hazardous effects of an accident were not included.

Any change which could result in a non-radiological hazard such as those that 1

can degrade a safety-related structure, system or component, restrict access to vital areas of the facility or impede activation of emergency response actions to mitigate the consequences cf a reactor accident should be reviewed pursuant

{

to 10 CFR 50.59.

2.

AREAS NOT SPECIFICALLY ADDRESSED THAT SHOULD BE i

j Review of the actual modification implementation process and procedures

)

i to be used in the field for possible development of temporary, unreviewed 1

safety questions associated with changing plant system configurations i

while physical work is in progress, even though the completed modification

)

l itself may not involv9 an unreviewed safety question.

l Evaluation of the change impact on the other units at multiple unit sites.

l Temporary modifications (see previous WRC letter to NUMARC dated j

05/12/88, Connent No. 33).

3.

NSAC PERSPECTIVE PREFACE PAGES I

l The NSAC Preface, by failing to make any reference to procedure changes or tests and experiments, implies that 50.59 is only applicable to design changes. This is probably an oversight that can be corrected by editing.

i j

NSAC states that NRC

• acceptance" of the guidelines would be through the NRC 50.59 working group. NRC endorsement will be through a more femal process such as a Regulatory Guide.

4.

SECTION 2.0, PAGE 2-3, AD H0C 50.59 REVIEWS The last sentence on page 2-3 and the middle paragraph on page 4-4 imply that j~

cases where the plant is found never to have been in compliance with the FSAR description could be considered a failure to have complied with 50.59. It is i

not necessary for the 50.59 guidance document to address these types of I

enforcement issues.

}

5.

SECTION 3.2, PAGE 3-2, EXCERPTS FROM THE REGULATIONS AND USE OF DEFINED l

TERM 5 This section includes both paraphrases and actual quotes from the i

regulations (10 CFR 50.71). As a generai rule for the whole document, all " quotations' should be so indicated.

)

i i.-

l !

i The last s,entence of this section uses an undefined term "licensin; basis." Such terms should be defined or avoided; left undefined tiey 1

moraally don't add useful information and frequently cause misunderstanding j

between licensees and the NRC. Paragraph 3.7 also uses the undefined j

terms

• credible" and " incredible."

5.

SECTION 4.1.3. PAGE 4-5. SCOPE OF TESTS OR EXPERIMENTS RFOUTRING l

EVALUATIDN UNDER 5D.59 i

This section should be expanded to clearly state that tests or experiments on i

both primary and secondary systems are considered within scope. This is particularly true of changes to secondary systems which can affect the 1

frequency of reactor trips and the ability to remove decay heat through the j

secondary systan.

7.

SECTIDN 4.2.2. PAGE 4-7. QUESTIONS RELATED TO DETERMINING WHETHER CHANGES WILL AFFECT 00t:5EQUENCE5 DF AN ACCIDENT I

l Add the following fourth question:

.e (4) Will the proposed activity affect any fission product barrier (e.g., fuel cladding. RC pressure boundary, containment)?

i B.

5ECTION 4.1.1, PAGE 4 3, THE USE OF, " SCREEN 1tlG CRITERIA" TO DETERMINE ITAIN 50.59 5AFETV EVALUATIOh5 ARE NOT REQUIRED This section introduces the concept of using some undefined " screening i

criteria

• to justify exempting "... a subset of the facility..." from 50.59 i

evaluations. The guidelines should not exempt any changes from evaluation, stiless'the grcund rules are included in the guidelines. Many of the problems I

being experienced today are the result of inadequate analysis based on ad hoc

}

criteria. The conservative approach suggested at the top of page 4-3 is ac.

i ceptable. i.e.

perform a " written safety evaluation for any change to the J

facility whether discussed in the SAR or not." even thcugh not specifically l

required by 50.59.

1 l

l i

f i

(

I i

b

.)

<