ML20151U507

Reg Guide 1.177, Approach for Plant-Specific,Risk-Informed Decisionmaking:Tss

ML20151U507
Person / Time
Issue date:	08/31/1998
From:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
To:
References
TASK-*****, TASK-RE FACA, REGGD-01.177, REGGD-1.177, NUDOCS 9809110028
Download: ML20151U507 (27)

Text

_

eo U.S. NUCLEAR REGULATORY COMMISSION August 1998 ewx o~ f 4J.sy**fiREGULATORY GUIDE OFFICE OF NUCLEAR REGULATORY RESET *RCH REGULATORY GUIDE 1.177 (Draft was issued as DG-1065)

AN APPROACH FOR PLANT-SPECIFIC, RISK-INFORMED DECISIONMAKING: TECHNICAL SPECIFICATIONS A. INTRODUCTION is not provided to the staff, the staff will review the in-formation provided by the licensee to determine The NRC's policy statement on probabilistic risk whether the application can be approved based upon the analysis ' 'RA)(Ref.1) encourages greater use of this information provided using traditional methods and analysis technique to improve safety decisionmaking will either approve or reject the application based upon and improve regulatory efficiency. The NRC staff's the review.

PRA lmplementation Plan (Ref. 2) describes activities The guidance provided here does not preclude now under way or planned to expand this use. One ac-other approaches for requesting changes to the TS.

tivity under way in response to the policy statement is Rather, this regulatory guide is intended to improve the use of PRA in support of decisions to modify an in-consistency in regulatory decisions when the results of dividual plant's technical specifications (TS).

risk analyses are used to help justify TS changes.

'm)

Licensee-initiated TS changes that are consistent

Background

v with eurrently approved staff positions [e.g., regulatory Section 182a of the Atomic Energy Act requires guides, standard review plans, branch technical posi-that applicants for nuclear power plant operating li-tions, or the Standard Technical Specifications (STS) censes state:

(Refs. 3-7)] are normally evaluated by the staff using

[S]uch technical specifications, including traditional engineering analyses. A licensee would not information of the amount, kind, and be expected to submit risk information in support of the source of special nuclear material re-proposed change. Licensee-initiated TS change re-quired, the place of the use, the specific quests that go beyond current staff positions may be characteristics of the facility, and such evaluated by the staff using traditional engineering other information as the Commission analyses as well as the risk-informed approach set forth may, by rule or regulation, deem neces-in this regulatory guide. A licensee may be requested to sary in order to enable it to find that the submit supplemental risk information if such informa-utilization..of special nuclear material tion is not provided in the original submittal by the li-will be in accord with the common de-censee. If risk information on the proposed TS change fense and security and will provide ade-USNRC RLGULATORY GUIDF.S The gudes are issued in the following ten broad divisons Regulestory Guides are asued to desenbe and make avalable to the pubhc such informa.

tion as methods accontaDie to the NRC staff for implementing specde parts of the Com.

1 Power Reactors 6 Products misson's regulahans, techruques used by the staff m evaluating specific prob # ems or pos.

2 Research and Test Reactors 7 Transportation tulated acciderns, and data needed by the NRC staff m its review of apphcatone for per.

3 Fuels and Matenals Facalites 8 Occupational Health mits and hcenses Regulatory gwdes are not substitutes for regulations, and comphance 4 Environmental and Seig 9 Antitrust er'd Finaricial Review with them o not required Methods and solutions different from those set out m the guides

5. Metenais and Plant Protection 10 General will be acceptable of they provide a basis for the findings requrate to the msuance or con.

tenuance of a permet or hcense by the Commisson.

Smgie copies of regulatory gwdes may be obtened free of charge by wnting the Repro.

/

Se e

er S Thia gude was maued aaer consideranon of comments recoved from the pubhc. Com-

[on, g

q, m

ments and suggeetrons for improvements e these gudes are encouraged at ali times and

.(N guides will be revised, as appropnate. to accommooste comments and to reflect newin-or by e-mal to GRWi@NRC GOV

~g) ! M

'. f lasued guides may also be purchased from the National Technical Informanon Service on

\\

Wntten comments may be submitted to the Rules Review arid Directives Branen, ADM, a stanomg order bas a Detals on this service may be obtaned by wnting NTIS. 5285 Port

'b U.S. Nuclear Regulatory Commason. Washington DC 20555-0001 Royal Road, Spnngfield, VA 2216'.

9809110028 9808'31 PDR REGGD 01.177 R PDR

.T 4 1

'i ' ' ' d 4 r1 : -

quate protection to the health and safety of The Commission reiterated this point when it is-the public. Such technical specifications sued the revision to 10 CFR 50.36 in July 1995 (Ref.

shall be a part of any license issued.

10).

In Cection 50.36," Technical Specifications," of In August 1995, the NRC adopted the policy state-10 CFR Part 50," Domestic Licensing of Production ment, including the following regarding the expanded and Utilization Facilities," the Commission estab-use of PRA (Ref.1).

lished its regulatory requirements related to the content The use of PRA technology should be in-of TS. In doing this, the Commission emphasized mat-ters related to the prevention of accidents and the miti-creased in all regulatory matters to the ex-gation of accident consequences; the Commission tent supported by the state of the art in noted that applicants were expected to incorporate into PRA methods and data and in a manner their TS "those items that are directly related to main-that complements the NRC's determinis-taining the integrity of the physical barriers designed to tic approach and supports the NRC's contain radioactivity"(33 FR 18612)(Ref. 8). Pursuant traditional defense-in-depth philosophy.

to 10 CFR 50.36, TS are required to contain items in the PRA and associated analyses (e.g., sensi-following five specific categories: (1) safety limits, tivity studies, uncertainty analyses, and limiting safety system settings, and limiting control Importance measures) should be used in settings, (2) limiting conditions for operation, (3) sur.

regulatory matters,where practical withm veillance requirements,(4) design features, and (5) ad-the bounds of the state of the art,to reduce ministrative controls.

unnecessary conservatism associated Since the mid-1980s, the NRC has been reviewing with current regulatory requireme nts, reg-and granting improvements to TS based, at least in part, ulatory guides, license commitments, and on PRA insights. Some of these improvements have staff practices. Where appropriate, PRA been proposed by the Nuclear Steam Supply System should be used to support the proposal of (NSSS) owners groups to apply to an entire class of additional regulatory requirements in ac-plants. Many others have been proposed by individual cordance with 10 CFR 50.109 (Backfit licensees. Typically, the proposed improvements in-Rule). Appropriate procedures for includ-l volved a relaxation of one or more allowed outage ing PRA in the process for changing regu-times (AOTs) or surveillance test intervals (STIs) in the latory requirements should be developed TS.1 and followed. It is, of course, understood that the intent of this policy is that existing in its July 22,1993, final policy statement on TS rules and regulations shall be complied improvements (Ref. 9), the Commission stated that it:

with unless these rules and regulations are revised.

... expects that licensees,in preparing their Technical Specification related submit-PRA evaluations in support of regulatory tals,will utilize any plant-specific PS A or decisions should be as realistic as practi-risk survey and any available literature on cable and appropriate supporting data risk insights and PSAs.. Similarly, tne should be publicly available for review.

NRC staff will also employ risk insights The Commission's safety goals for nu-and PSAs in evaluating Technical Speci-fications related submittals. Further, as a clear power plants and subsidiary numeri-part of the Commission's ongoing pro-cal objectives are to be used with ap-gram of improving Technical Specifica-propriate consideration of uncertainties in tions,it will continue to consider methods making regulatory judgments on need for to make better use of risk and reliability proposing and backfitting new generic re-information for defining future generic quirements on nuclear power plant licen-Technical Specification requirements.

sees.

In its approval of the policy statement, the Com-mission articulated its expectation that implementation of the policy statement willimprove the regulatory pro-IThe improved STSs (Refs. 3 7) (NUREGs-14301434) use the ter-cess in three areas: foremost, throu8 safety decision-h mmology" completion times and" surveillance frequency in place making enhanced by the use of PRA insights; through of allowed outage time" and surveillance test interval."

1.177 - 2

more efficient use of agency resources; and through a This regulatory guide mdicates an acceptable level f

reduction in unnecessary burdens on licensees.

of documentation that will enable the staff to reach a finding that the licensee has performed a sufficiently 9

Purpose of this Regulatory Guide complete and scrutable TS change analysis and that the This regulatory guide describes methods accept-f the engineering evaluations support the li-8 able to the NRC staff for assessing the nature and im-

""*"8'*"*'

"8' pact of proposed TS changes by considering engineer-Risk-informed TS submittals primarily deal with ing issues and applying risk insights. Licensees permanent changes to TS requirements, i.e., as the submitting risk information (whether on their own inj.

name suggests, the requirement is permanently tiative or at the request of the staff) should address each changed when approved, and is applicable to all future of the principles of risk-informed regulation discussed occurrences. A one-time change to a TS requirernent, in this regulatory guide. Licensees should identify how in which a different requirement is requested for a par-chosen approaches and methods (whether they are ticular incident, also can use risk-informed evaluations, quantitative or qualitative, traditional or probabilistic),

but it involves slightly different scope and consider-data, and criteria for considering risk are appropriate for ations. This regulatory guide focuses on permanent the decision to be made.

changes to TS.

This regulatory guide provides the staff's recom.

Relationship to Other Guidance Documents mendations for utilizing risk information to evaluate Regulatory Guide 1.174, "An Approach for Using changes to nuclear power plant TS AOTs and STIs in Probabilistic Risk Assessment in Risk-Informed Deci-order to assess the impact of such proposed changes on sions on Plant-Specific Changes to the Licensing Ba-the risk associated with plant operation. Other types of sis" (Ref.11), describes a general approach to risk-TS changes that follow the principles outlined in this informed regulatory decisionmaking and includes dis-regulatory guide may be proposed and will be consid-cussion of specific topics common to all risk informed ered on their own merit. The guidance provided here regulatory applications. This regulatory guide provi-does not preclude other approaches for requesting TS des guidance specifically for risk-informed TS changes changes. Rather, this regulatory guide is intended to consistent with but more detailed than the generally ap-l improve consistency in regulatory decisions related to plicable guidance given in Regulatory Guide 1.174.

TS changes in which the results of risk analyses are used to helpj,ustify the change. As such, this regulatory The information collections contained in this regu-guide, the use of which is voluntary, provides gmdance latorv guide are covered by the requirements of 10 CFR concerning an approach tha t the NRC has determined t Part 50,which were approved by the Office of Manage-be acceptable for analyzing issues associated with pro-ment and Budget, approval number 3150-0011. The posed changes to a plant's TS and for assessing the im-NRC may not conduct or sponsor, and a perse is not pact of such proposed changes on the risk associated required to respond to, a collection of information un-with plant design and operation.

less it displays a currently valid OMB control number.

Scope of this Regulatory Guide B. DISCUSSION This regulatory guide describes an acceptable ap-Risk Informed Philosophy proach for assessing the nature and impact of proposed In its approval of the policy statement on the use of permanent TS changes in AOTs and STIs by consider-PRA methods in nuclear regulatory activities, the ing engineering issues and applying risk insights. As-Commission stated an expectation that "the use of PRA sessments should consider relevant safety margins and technology should be increased in all regulatory mat-defense-in-depth attributes, including considering suc-ters...in a manner that complements the NRC's deter-l cess criteria as well as equipment functionality, reli-ministic approach and supports the NRC's traditional ability, end availability. Acceptance guidelines for defense-in-depth philosophy"(Ref.1). The use of risk evaluating the results of auch evaluations are provided insights in licensee submittals requesting TS changes also.

will assist the staff in the disposition of such licensee This regulatory guide also describes acceptable TS Pmposals.

D monitoring plans that will help ensure that assumptions change implementation strategies and performance The NRC staff has d-fined an acceptable approach to analyzing and evaluating proposed TS changes. This and analyses supporting the change are verified.

approach supports the NRC's desire to base its deci-1.177 - 3

sions on the results of traditional engineering evalua-4.

When proposed changes result in an increase in tions, supported by insights (derived from the use of core damage frequency or risk, the increases should be small and consistent with the intent of PRA methods) about the risk significance of the pro-posed changes. Decisions concerning proposed the Commission's Safety Goal Policy State-changes are expected to be reached in an integrated ment. Regulatory Position 2.3, " Evaluation of fashion, considering traditional engineering and risk Risk Impact," provides guidance for meeting this r

information, and may be based on qualitative factors as principle.

well as quantitative analyses and information.

5. The impact of the proposed change should be

"""II" red using performance measurement in implementing risk-informed decisionmaking, strateg.ies. The three-tiered implementation ap-TS changes are expected to meet a set of key principles.

proach discussed in Regulatory Position 3.1 and Some of these principles are written in terms typically Maintenance Rule control discussed in Regulatory used in traditional engineermg decisions (e.g., defense Position 3.2 provide c.uidance in meeting this prin-in depth). While written in these terms,it should be un-ciple.

derstood that risk analysis techniques can be, and are encouraged to be, used to help ensure and show that Additional information regarding to the staff's ex-these principles are met. These principles are:

pectations with rest ect to implementation of these

1. The proposed change meets the current regula-tions unless it is explicitly related to a requested A Four-Element Approach to Integrated exemption or rule change. Applicable rules and Decisionmaldng for TS Changes regulations that form the regulatory basis for TS are discussed in Regulatory Position 2.1," Compliance Given the principles of risk-informed decision-with Current Regulations."

making discussed above, the staff expects that a certain evaluation approach and tf.e acceptance guidelines that

2. The proposed change is consistent with the de-follow from those principles will be followed by licen-fense in-depth philosophy. The guidance con-sees in implementing these principles, and the staff has tanned in Regulatory Position 2.2,',' Traditional En-identified a four-element approach to evaluating pro-gineering Considerations, apphes the various p sed changes to a plant,s design, operations, and other aspects of maintaining defense in depth to the sub-activities that require NRC approval (illustrated in Fig-ject of changes in TS.

ure 2), as described in Regulatory Guide 1.174 (Ref.

3. The proposed change maintains sufricient safe.

11). Those detailed discussions regarding the evalua-ty margins. The guidance contained in Regulatory tion approach and acceptance guidelines are not re-Position 2.2," Traditional Engineering Consider-peated here; instead, specific application of the ations," applies various aspects of maintaining suf-four-element approach for risk-informed changes to TS ficient safety margin to the subject of changes to TS.

is discussed.

f rEr th w

i m. m-t. -e,.

%ny y ma'rg ex'p$ e ti e t a sted exemptxm o,

\\t ud V

6u integrated Decisionmaking rebreml$

m emera te r;e'"-'-

n ",1:"'.= %

Ount Pohey Sistement O

Figure 1. Principles of Risk Informed Integrated Decisionmaking 1.177 - 4

'iTj w

PRA

\\

/ /

'Q g =*

n Figure 2. Principal Elements of Risk Informed, Plant-Specific Decisionmaking Element 1: Define the Proposed Change The licensee should provide the rationale that sup-The licensee needs to explicitly identify the partic-Ports the acceptability of the proposed changes by inte-ular TS that are affected by the proposed change and grating probabilistic insights with traditional consider-ations to arrive at a final determination of risk. The identify available engineering studies (e.g., topical re-determination should consider continued conformance ports), methods, codes, and PRA studies that are related to the proposed change. The licensee should also deter.

to applicable rules a d regulations, the adequacy of the mine how the affected systems, components, or param-traditional engineeiing evaluation of the proposed eters are modeled in the PRA and should identify all change, and the change in plant risk relative to the ac-elements of the PRA that the change impacts. This in-ceptance guidelines. All these areas should be ade-formation should be used collectively to provide a de-quately addressed before the change is considered ac-scription of the TS change and to outline the method of ceptable. Specificguidan;e for an acceptable approach analysis. The licensee should describe the proposed f r performing engineering evaluations of changes to change and how it meets the ob,iectives of the Commis-TS is found in Regulatory Position 2.

sion's PRA Policy Statement, including enhanced deci-D sionmaking,moreefficientuseofresources,andreduc-Element 3: Define Implementation and tion of unnecessary burden. Regulatory Position 1 Monitoring Program describes element 1 in more detail.

The licensee should consider implementation and Element 2: Perform Engineering Analysis performance monitoring strategies formulated to en-The licensee should examine the proposed TS sure (1) that no adverse safety degradation occurs be-change to verify that it meets existing applicable rules cause of the changes to the TS and (2) that the engineer-and regulations. In addition, the licensee should deter-ing evaluation conducted to examine the impact of the mine how the change impacts defense-in-depth aspects proposed changes continues to reflect the actual reli-of the plant's design and operation and should deter-ability and availability of TS equipment that has been mine the adequacy of safety margins following the pro-evaluated. This will ensure that the conclusions that posed change. The licensee should consider how plant have been drawn from the evaluation remain valid.

and industry operating experience relates to the pro-Specific guidance for Element 3 is provided in Regula-posed change, and whether potential compensatory tory Position 3.

measures could be taken to offset any negative impact from the proposed change.

Element 4: Submit Proposed Change The licensee should also perform risk-informed evaluations of the proposed change to determine the The final element involves documenting the analy-impact on plant risk. The evaluation should explicitly ses and submitting the license amendment request.

l consider the specific plant equipment affected by the NRCwill review the submittal according to NRC Stan-proposed TS changes and the effects of the proposed dard Review Plan (SRP) Chapter 16.1," Risk-Informed change on the functionality, reliability, and availability Decisionmaking: Technical Specifications" (Ref.12),

of the affected equipment. The necessary scope andle-and in accordance with the NRC regulations governing vel of detail of the analysis depends upon the particular license amendmen's (10 CFR 50.90,50.91, and 50.92).

systems and functions that are affected, and it is recog-Guidance on documentation and submittals for risk-in-nized that there will be cases for which a qualitative, formed TS change evaluations is in Regulatory Posi-

[

rather than quantitative, risk analysis is acceptable.

tion 4 of this regulatory guide.

1.177-5 i

i

C. REGULATORY POSITION Plant-specific information with regard to the engineer-ing evaluations described in Regulatory Position 2 1.

ELEMENT 1: DEFINE TIIE PROPOSED must still be provided. However, the group may be able CIIANGES to draw generic conclusions from a compilation of the plant-specific data. In addition, there will be benefits 1.1 Reason for Proposed Change from cross-comparison of the results of the plant-spe-The reasons for requesting the TS change or cific evaluations.

changes should be stated in the submittals, along with 2.

ELEMENT 2: ENGINEERING information that demonstrates that the extent of the EVALUATION l

change is needed. Generally, acceptable reasons for re.

questingTS changes fallinto one or more of the catego-As part of the second element, the licensee should ries below.

evaluate the proposed TS change with regard to the principles that adequate defense in depth is maintained, 1.1.1 Improvement in Operational Safety that sufficient safety margins are maintained, and that The reason for the TS change may be to improve proposed increaser in core damage frequency and risk operational safety; that is, a reduction in the plant risk are small and are consistent with the intent of the Com-or a reduction in occupational exposure of plant person-mission's Safety Goal Policy Statement.

nel in complying with the requirements.

Licensees are expected to provide strong technical bases for anyTS change. The technical oases should be 1.1.2 Consistency of Risk Basis in Regulatory ted in traditional engineering and system analyses.

r Requirements TS change requests based on PRA results alone should The TS changes requested can be supported on not be submitted for review. TS change requests should their risk implications. TS requirements can be give proper attention to the integration of consider-changed to reflect improved design features m a plant ations such as conformance to the STS, generic applica-or to reflect equipment reliability improvements that bility of the requested change ifit is different from the make a previous requirement unnecessarily stringent or STS, operational constraints, manufacturer recomme n-ineffective. TS may be changed to establish consistent-dations, and practical considerations for test and main-ly based requirements across the industry or across an tenance. Standard practices used in setting AOTs and industry group. It must be ensured that the risk result-STis should be followed, e.g., AOTs normally are 8 mg from the change remains acceptable.

hours,12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />,24 hours,72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />,7 days,14 days, etc. STIs normally are 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />,7 days,1 month,3 1.1.3 Reduce Unnecessary Burdens months, etc. Usingyuch standards greatly simplifies The change may be requested to reduce unneces-implementation, scl}(duling, monitoring, and auditing.

sary burdens m complying with current TS require-Logical consistency among the requirements should be ments, based on the operating history of the plant or in-maintained, e.g., AOT requirements for multiple trains dustry in general. For example, m, specific mstances, out of service should not be longer than that for one of the repair time needed may be longer than the AOT de-the constituent trains.

fined in the TS. The required surveillance may lead to plant transients, result in unnecessary equipment wear, 2.1 Compliance with Current Regulations result in excessive radiation exposure to plant person-In evaluating proposed changes to TS, the licensee nel, or place unnecessary admmistrative ourdens on must ensure that the current regulations, orders, and li-plant personnel that are not justified by the safety sig-cense conditions are met, consistent with Principle 1 of mficance of the surveillance requirement. In some risk-informed regulation. The NRC regulations specif-cases, the change may provide operational flexibility; ic to TS are stated in 10 CFR 50.36," Technical Specifi-m those cases, the change might allow an increased cations " Additional information with regard to the allocat on of the plant personnel's time to more NRC's policies on TS is contained in the " Final Policy safety-sigmficant aspects.

Statement on Technical Specification Improvements In some cases, licensees may determine there is a for Nuclear Power Reactors"(58 FR 39132) of July 22, common need for a TS change among severallicensees 1993 (Ref. 9). These documents define the main ele-and that it is bene ficial to request the changes as a group ments of TS and provide criteria for items to be in-rather than individually. Group submittals can be ad-cluded in the TS. The final policy statement and the vantageous when the equipment being consiaered in statement of considerations for 10 CFR 50.36 of July the change is similar across all plants in the group.

19,1995 (Ref.10), also discuss the use of probabilistic 1.177 - 6

i approaches to improve TS. Regulations regarding ap-posed change in a TS has not significantly changed plication for and issuance of license amendments are the balance among these principles of prevention vm found in 10 CFR 50.90,50.91, and 50.92. In addition, and mitigation, to the extent that such balance is

)

the licensee should ensure that any discrepancies be-needed to meet the acceptance criteria of the spe-

,J tween the proposed TS change and licensee commit-cific design basis accidents and tiansients, consis-ments are identified and considered in the evaluation.

tent with 10 CFR 50.36. TS change requests should consider whether the anticipated operational 2.2 Traditional Engineering Considerations changes associated with a TS change could introduce new accidents or transients or could in-2.2.1 Defense in Depth crease the likelihood of an accident or transient (as The engineering evaluation conducted should de-is required by 10 CFR 50.92).

termine whether the impact of the proposed TS change Over-reliance on pmgrammatic activities to com-is consistent with the defense-in-depth philosophy. In pensate for weaknesses in plant design is avoided, this regard, the intent of the principle is to ensure that e.g.,use f high reliability estimates that are pn-the philosophy of defense in depth is maintained, not to marily based on optimistic program assumptions.

prevent changes in the way defense in depth is achieved. The defense-in-depth philosophy has tradi-System redundancy, independence, and diversity tionally been applied in reactor de.cign and operation to are maintained commensurate with the expected provide multiple means to accomplish safety functions frequency and consequences of challenges to the and prevent the release of radioactive material. It has system, e.g., there are no risk outliers. The follow-i been and continues to be an effective way to account for ing items should be considered.

uncertainties in equipment and human performance.

Whether there are appmpriate restrictiors in When a comprehensive nsk analysis can be performed, place to preclude simultaneous equipment out-it can be used to help determine the appropriate extent ages that would erode the principles of redun-of defense in depth (e.g., balance among core damage dancy and diversity, prevention, containment failures, and consequence 9

safety. When a comprehensive risk analysis is not or Whether compensatory actions to be taken mitigation) to ensure protection of public health and when entering the modified AOT for pre-cannot be performed, traditional defense-in-depth con-planned maintenance are identified, siderations should be used or raaintained to account for Whether voluntary re moval of equipment from uncertainties. The evaluation should consider the in-service during plant operation should not be tent of the general design criteria, national standards, scheduled when adverse weather conditions and engineering principles such as the single failure cri-are predicted or at times when the plant may be terion. Further, the evaluation should consider the im-subjected to other abnormal conditions, and pact of the proposed TS change on barriers (both pre-ventive and mitigative) to core damage, containment Whether the impact of the TS change on the failure or bypass, and the balance among defense-in.

safety function should be taken into consider-depth attributes. As stated earlier, the licensee should ation. For example, what is the impact of a select the engineering analysis techniques, whether change in the AOT for the low-pressure safety quantitative or qualitative, traditional or probabilistic, injection system on the overall availability and appropriate to the proposed TS change, reliability of the low-pressure injection func-tion?

The licensee should assess whether the proposed TS change meets the defense-in-depth principle. De-Defenses against potential common cause failures l

fense in depth consists of a number of elements as sum-are maintained and the potential for introduction of new common cause failure mechanisms is as-marized below. These elements can be used as guide-lines for assessing defense in depth. Other equivalent sessed, e.g., TS change requests should consider whether the anticipated operational changes asso-acceptance guidelines may also be used, ciated with a change in an AOT or STI could Consistency with the defense-in-depth philosophy introduce any new common cause failure modes is maintained if:

not previously considered.

m

)

A reasonable balance among prevention of core Independence of physical barriers is not degraded, o

,[^'

damage, prevention of containment failure, and e.g.,TS change requests should address a means of consequence mitigation is preserved, i.e., the pro-ensuring that the independence of barriers has not l

1.177 - 7

been degraded by the TS change (e.g.,when chang-proposed TS AOT changes. Tier 1 is an evaluation of ing TS for containment systems),

the impact on plant risk of the proposed TS change as expressed by the change in core damage frequency Defenses against human errors are maintained, (ACDF), the incremental conditional core damage e.g., TS change requests should consider whether p bability (ICCDP),- and, when appropriate, the the anticipated operation changes associated with a change m large early release frequency (ALERF) and change in an AOT or STI could change the ex-the incremental conditional large early release proba-pected operator response or introduce any new hu-bility (ICLERP).3 Tier 2 is an identification of poten-man errors not previously considered, such as the ti lly high-risk configurations that could exist if equip-change from performing maintenance during shut-ment in addition to that associated with the change were down to performing maintenance at power when to be taken out of service simultaneously, or other risk-different personnel and different activities may be significant operational factors such as concurrent sys-involved.

tem or equipment testing were also involved. The ob-The intent of the General Design Criteria in Appen-jective of this part of the evaluation is to ensure that dix A to 10 CFR Part 50 is maintamed.

appropriate restrictions on dominant risk-significant configurations associated with the change are in place.

2.2.2 Safety Margins Tier 3 is the establishment of an overall configuration The engineering evaluation conducted should as-risk management program to ensure that other poten-sess whether the impact of the proposed TS change is tially lower probability, but nonetheless risk-signifi-consistent with the principle that cufficient safety mar-cant, configurations resulting from maintenance and gins are maintained (Principle 3). An acceptable set of other operational activities are identified and compen-guidelines for making that assessment are summarized sated for. If the Tier 2 assessment demonstrates, with below. Other equivalent decision guidelines are ac-reasonable assurance, that there are no risk-significant

ceptable, configurations involving the subject equipment, the ap-Sufficient safety margins are maintained when:

plication of Tier 3 to the proposed AOT may not be nec-essary. Although defense in depth is protected to some Codes and standards (e.g., American Society of degree by most current TS, application of the three-Mechanical Engineers (ASME), Institute of Elec-tiered approach to risk-informed TS AOT changes dis.

trical and Electronic Engineers (IEEE) or alterna-tives approved for use by the NRC are met, e.g., the cussed below provides additional assurance that de-proposed TS AOT or STI change is not in conflict fense in depth will not be significantly impacted by l

with approved Codes and standards relevant to the such changes to the licensing basis.

subject system.

Tier 1: PRA Capability and Insights Safety analysis acceptance criteria in the Final In Tier 1, the licensee should assess the impact of Safety Analysis Report (FSAR) are met, or pro-the proposed TS change on CDF, ICCDP, and, when ap-posed revisions provide sufficient margin to ac-propriate, LERF and ICLERP. To support this assess-count for analysis and data uncertainties, e.g., the ment, two aspects need to be considered: (1) the valid-proposed TS AOT or STI change does not ad-ity of the PRA and (2) the PRA insights and findings.

versely affect any assumptions or inputs to the The licensee should demonstrate that its PRA is valid safety analysis,or,if such inputs are affected justi-for assessing the proposed TS changes and identify the fication is provided to ensure sufficient safety mar-impact of the TS change on plant risk.

ginwillcontinue toexist. forts AOT changes,an assessment should be made of the effect on the Tier 2: Avoidance of Risk Significant Plant FSAR acceptance criteria assuming the plant is in Configurations the AOT(i.e.,the subject equipment is inoperable)

The licensee should also provide reasonable assur-and there are no additional failures. Such an as-ance that risk-significant plant equipment outage con-4 sessment should result in the identification of all si-figurations will not occur when specific plant equip-tuations in which entry into the proposed AOT ment is out of service consistent with the proposed TS could result in failure to meet an intended safety function.

lCCDP = [(conditional CDF with the subject equipment out of ser.

vice ). (basehne CD F w ith ncminal e xpected equipme nt unavailabili-2.3 Evaluation of RiskImpact ties)J x (duraticn of single AOr under consideration).

The NRC staff has identified a three-tiered aE-hCIIRP = [(conditional LERF wi,th the subject equipment out of service)-(baschne LERF with nominal expected equipment unavai-proach for licensees to evaluate the risk associated with labihties)) x (duration of single AOT under consideration).

1.177 - 8

change. An effective way to perform such an assess-STI, and perform sensitivity and uncertainty evalua-ment is to evaluate equipment according to its tions to address uncertainties associated with the STI contribution to plant risk (or safety) while the equip-evaluations. More detail on risk evaluation for STI

)

ment covered by the proposed AOT change is out of changes is provided in Regulatory Positions 2.3.1 v

service. Evaluation ofsuch combinations ofequipment through 2.3.6 and in Appendix A.

out of service against the Tier 1 ICCDP acceptance guideline could be one appropriate method ofidentify-2.3.1 Quality of the PRA ing risk-significant configurations. Once plant equip.

The quality of the PRA must be compatible with ment is so evaluated, an assessment can be made as to the safety implications of the TS change being re-whether certain enhancements to the TS or procedures quested and the role that the PRA plays in justifying are needed to avoid risk-significant plant configura.

that change. That is, the more the potential change in tions. In addition, compensatory actions that can miti.

risk or the greater the uncertainty in that risk from the gate any corresponding increase in risk (e.g., backup requested TS change, or both, the more rigor that must equipment, increased surveillance frequency, or up.

go into ensuring the quality of the PRA. One approach grading procedures and training) should be identified a licensee could use to ensure quality is to perform a and evaluated. Any changes made to the plant design or peer review of the PRA. In this case, the submittal operating procedures as a result of such a risk evalua.

should document the review process, the qualification tion (e.g., required backup equipment, increased sur.

of the reviewers, a summary of the review findings, and veillance frequency, or upgraded procedures and train.

resolutions to these findings when applicable. Industry ing required before certain plant system configurations PRA certification programs and PRA cross-can be entered) should be incorporated into the analyses comparison studies could also be used to help ensure utilized forts changes as described under Tier l above.

appropriate scope, level of detail, and quality of the PRA. If such a program or studies are to be used, a de-Tier 3: Risk Informed Configuration Risk scription of the program, including the approach and j

Management standard or guidelines to which the PRA is compared; the depth of the review; and the make-up and qualifica-The licensee should develop a program that en-tions of the personnel involved should be provided for

\\

sures that the risk impact of out-of-service equipment is NRC review. Based on the peer review or other certifi-j appropriately evaluated prior to performing any main-cation process and on the findings from this process, the tenance activity. A viable program would be one that is licensee should justify why the PRA is adequate for the able to uncover risk-significant plant equipment outage present TS application in terms of scope and quality. A configuratmns m a timely manner during normal plant peer review, certification, or cross-comparison would operation. This can be accomplished by evaluating the not replace a staff review in its entirety, although the impact on plant risk of, for example, equipment un-more confidence the staff has in the review that has availability, operational activities like testing or load been performed by or for the licensee, the less rigor dispatching, or weather conditions. The need for this should be expected of the staff review. For most TS re-third tier stems from the difficulty of identifying all views, demonstration of PRA quality by means of an possible risk significant configurations under Tier 2 industry certification or cross-comparison process,in that will ever be encountered over extended periods of combination with a focus-scoped staff review, should plant operation.

be sufficient. Cross-comparisons are most appropriate Regulatory Positions 2.3.1 through 2.3.7 and Ap.

when the system designs are similar across the plants pendix A discuss various issues related to the being compared. Some licensees may elect to use the three-tiered approach described above. In general, Reg.

PRA underlying their individual plant examination ulatory Positions 2.3.2 through 2.3.5 and Appendix A (IPE) to analyze the risk impact associated with re-outline issues associated with Tier 1, and Regulatory quested TS changes. It should be noted that the NRC Positions 2.3.6 and 2.3.7 outline issues associated with staff's review of the IPE submittal alone does not suf-Tiers 2 and 3.

fice as an adequate review for TS applications.

The NRC staff has identified several factors that 2.3.2 Scope of the PRA forts Change should be considered in proposals for STI changes that Evaluations m

are discussed below. In summary, the licensee should The scope and the level of PRA necessary to fully

)

identify the STIs to be evaluated, determine the risk support the evaluation of a TS change depend on the contribution associated with the subject STis, deter-type of TS change being sought. The scope and level of v

mine the risk impact from the change to the proposed analysis required is discussed below for a variety of 1.177-9 l

cases. However, in some cases, a PRA of sufficient 2.3.3 PRA Modeling scope may not be available. This will have to be com-2.3.3.1 Detail Needed forts Changes. To evalu-pensated for by qualitative arguments, bounding analy-ate a TS change, the specific systems or components in-ses, or compensatory measures.

volved should be modeled in the PRA. The model should also be able to treat the alignments of compo-As a minimum, for systems used to prevent core damage (i.e., most of the TS systems modeled in a PRA nents during periods when testing and maintenance are other than the containment systems), Level 1 evalua.

being carried out. Typically, limiting conditions for op-tions should be performed. For containment systems, erations (LCOs) and surveillance require me nts relate to Level 2 evaluations are likely to be needed at least to the the system trains or components that are modeled in the point of assessing containment structural performance system fault trees of a PRA. System fault trees should in order to estimate the LERF. When only a Level 1 be sufficiently detailed to specifically include all the PRA is available but additional Level 2 information is components for which surveillance tests and mainte-desirable, one acceptable method for approximating nance are performed and are to be evaluated.

For AOT evaluations, system train-level models the needed information is proposed in NUREG/CR-6595,"An Approach for Estimating the Frequencies of are adequate as long as all components belonging Various Containment Failure Modes and Bypass to the train are clearly identified (i.e., all those Events" (Ref.13).

components that could cause the train to fail).

For changes to TS requirements defined for the For evaluating STIs, individual component-level power operation mode, the scope of analysis should in-models are necessary.

clude internal fires and flooding if appropriate (e.g.,

Since PRAs are typically done at the component-when the subject TS equipment is located in areas iden-level, they are directly used to analyze both AOTs and tified as vulnerable to fires or floods). When changes to STIs.

requirements for systems needed for decay heat remov-Component unavailability models should include al are considered, an appropriate assessment of shut' contributions from random failure, common cause fail-down risk should also be considered. Examples of such ure (CCF), test downtime, and maintenance downtime.

systems are auxiliary feedwater, residual heat removal, emergency diesel generator, and service water. Also, Changes to the component unavailability model f r test downtime and mamtenance downtime when AOTs are being modified to facilitate online maintenance (that is, transfe rring scheduled preve ntive should be based on a realistic estimate of expected maintenance (PM) from shutdown to powe r ope ration),

surveillance and maintenance practices after the the impact on the shutdown modes should also be eval-TS change is approved and implemented, e.g., how often the AOT is expected to be entered for pre-uated. When available,usingboth power operation and planned m mtenance or surveillance.

shutdown models, a comparative evaluation may be presented to decide the appropriate condition for sched-The component unavailability model for test uling maintenance based on risk evaluations. In some downtime and maintenance downtime should be cases, a semi-quantitative analysis of shutdown risk based on plant-specific or industry-wide operating may be adequate (e.g., fault tree analysis or failure experience, or both, as appropriate.

modes and effects analysis).

The component unavailability model should have the flexibility to separate contributions from test When AOTs are being modified in anticipation of and maintenance downtime. For evaluating an the nced for additional time for corrective maintenance, AOT, the contribution from maintenance down-an assessment of transition risk (the risk of transition-time can be equated to zero to delete maintenance ing from power operation to the mode required by the etivities, if desired. For an STI evaluation, the current TS in question) that could be incurred under the contribution from test downtime determines a con-current, shorter AOT ma. be desirable,if the initial cal-tribution to risk from carrying out the test.

culated risk increase is '. ear or somewhat above the ac-ceptanceguidelines. Also,TSchangestorequirements Additional details in terms of separating the failure for a controlled shutdown (i.e., the time allocated to rate contributions into cyclic demand-related and transit through hot standby to hot shutdown to cold standby time-related contributions can be incorpo-shutdown, or to the final state that should be reached) rated, if justifiable, for evaluating surveillance re-l should be evaluated,if possible, using a model for the quirements.

transition risk covering these pe riods, or at least a quali-The CCF contributions should be modeled so that I

tative evaluation of the transition risk.

they can be modified to reflect the condition in which l

l 1.177 - 10

onc or more of the components is unavailable. It should (2) The effect of system failure should not influ-be noted, however, that CCF modeling of components ence any initiating event frequency (or it is not only dependent on the number of remaining should have a minimal or negligible effect),

}

in-service components, but is also dependent on the and Q

reason components were removed from service, i.e.,

(3) The system should not share components with l

whether for preventive or corrective maintenance. For another system.

appropriate configuration risk management and con-trol, preventive and corrective maintenance activities When bounding evaluations are performed assum-need to be considered, and licensees should, therefore, ing any failure in the system as a system failure, the calculated risk impacts for TS changes are ex-have the ability to address the subtle difference that ex-pected to be overestimated. The corresponding ists between maintenance activities (see Section changes that may be acceptable will also be fewer A.1.3.2 of Appendix A to this guide for details).

than those that could have beenjustified using a de-To account for the effects of test placements for re-tailed model. When considering the incorporation dundant components in relation to each other (e.g.,

of non PRA factors, this perspective should be staggered or sequential test strategy), time-dependent kept,while at the same time considering the lack of models and additional evaluations using specialized a detailed model. Here also,the above three condi-codes may be used,if availab!e.

tions discussed for the previous case apply.

In s me cases, since the risk-informed evaluation If the PRA does not model the system for which the TS change is being requested, specialized analyses may will be limited and some mis-estimation of the risk may be necessary when requesting changes to the TS for have been incorporated, non-risk-related engineermg these systems. Examples of these situations are given considerations gain importance in the overall decision.

below:

In such cases, arguments for the change also must be for small increments from current requirements.

When a system is modeled in the event tree, but a 22.3.2 ModelingofInitiating Events. Someini-e detailed fault tree modelis not provided (direct es-tiating events resulting from support system failure timate of system unavailability from expenence (e.g., service water, component cooling water, instru-

)

data or expert judgment is used), the TS evaluation ment air) are modeled explicitly in the logic model,i.e.,

v can proceed in one of two ways:

fault tree models are developed in the PRA. Any TS (1) A separate fault tree can be developed for the change for these systems will affect the corresponding system for TS evaluation and used to comple-initiating event frequency as well as the system un-ment the existing PRA model without directly availability and availability of other supported sys-modifying the PRA (e.g., detailed separate tems. The effect of TS changes on these initiating event fault tree modeling of the reactor protection frequencies should be considered.

system combined with the existing PRA mod-Some test and maintenance activities can contrib-el), or ute to some transients. Initiating-event frequencies (2) A bounding evaluation can be conducted based used in the PRA do not typically separate out this con-on the impact of system failures that are mod-tribution, but such a separation may be needed during j

eled in the PRA event trees, that is, failure of TS change evaluations. For example, the effect of test-any component in the system can be assumed caused transients may be evaluated in deciding an STI.

to cause system failure.

Initiating-event frequencies from conduct of the test (i.e., test-caused transients) could then be modeled sep-When a separate fault tree is developed, specificTS arately to evaluate the risk contribution from test-e requirements within the system can be changed caused transients. Data needs for estimating initiating and changes in the system unavailability can be event frequencies from test-caused transients are dis-measured,which can then be used in the PRA mod-cussed in Section A.2 of the appendix to this guide.

j el to obtain the corresponding Level 1 and Level 2 2.3.3.3 Screening Criteria. The main qualitative and 3 measures, as appropriate. Such evaluations consideration regarding the screening of sequences in i

can b: considered similarly as those evaluations TS change evaluations is the inclusion of sequences di-made directly using PRA models, but should satis-rectly affected by the TS change that would have been

.fy the followmg conditions:

truncated by frequency-based screening alene. For ex-(1) Failures within the system should not affect ample, if the TS change involves accumulators in a any other system or component failure, pressurized-water reactor (PWR), qualitative consider-1.177 - 11 l

ations imply that sequences that contain the accumula-considered foi AOT change evaluations can be summa-tors should be included, even if these sequences do not rized as follows.

meet the frequency criteria. Excluding these sequences 1.

If AOT risk evaluations are performed using only would result in an underestimate of the risk impact of the PRA for power operation (i.e., to calculate the I

the TS chan8es' risk associated with (a) the equipment being un-l 2.3.3.4 Truncation Limits. Truncation levels available during power operation for the duration f the AOT and (b) any change in the AOT), the risk should be used appropriately to ensure that significant ssociated with shutting the plant down because of underestimation, caused by truncation of cutsets, does AOT violations is not bemg considered, la most not occur as discussed below. Additional precautions cases, this risk has not been considered or,if con-relevant to the cutset manipulation method of analysis sidered,is assumed to furtherjustify the requested are needed to avoid truncation errors in calculatmg risk change. For some situations (e.g., for residual heat measmes.

removal systems, service water systems, auxiliary feedwater systems), comparative risk evaluations When failure or outage of a single component is f c ntinued power operation vs. plant shutdown considered, as in the case of an AOT or STI risk evalua-should be considered.

tion, the truncation levels in evaluating R and Roare of i

concern. (R is the increased CDF, with the component

2. When calculating the risk impacts (i.e., a change in i

assumed to be inoperable (or equivalently the compo-CDF or LERF caused by AOT changes), the nent unavailability set to "true"), and Ro is the reduced change in average CDF should be estimated using CDF, with the component assumed to be operable (or the mean outage times (or an appropriate surrogate) equivalently, the component unavailability set to for the current and proposed AOTs. If a licensee

" false")]. If the component in question appears in the chooses to use the zero maintenance state as the cutsets near the truncation limi' (e.g., all appearances base case (case in which no equipment is unavail-t are in cutsets within a factor of 10 of the truncation lim.

able because of maintenance), an explanation stat-it),it may be necessary to reduce the truncation limit. If ing so should be part of the submittal. Usually, data R is marginally larger than the base case value, then f r utagetimescorrespondtothecurrent AOT,but t

one order of additional cutsets should be generated to n t to the proposed AOT. Different assumptions are made to estimate the outage time corresponding ensure that any underestimation did not take place.

to the proposed AOT. Assumptions concerning When risk from plant configurations involving changes in maintenance practices under the ex-multiple components is being considered, a cutset with tended AOT regime should be discussed and their a relatively small frequency can become a significant impact on the results of the analysis characterized.

contributor to the CDF. This is because more than one

3. When the riskimpact of an AOTchange is evaluat-of the affected components may appear in the same ed, the yearly risk impact that is calculated takes minimal cutset, and the unavailability (increased by the into account the outage frequency. An AOTexten-TS change) of more than one of these components sion may imply that the maintenance of the compo-could cause a significant increase in the cutset's fre-nent is improved, which may reduce the compo-quency. For such cases, truncation levels have to be re-nent's failure rate, and consequently, reduce the duced by a larger amount than would be the case for the frequency of outages needed for correcting degra-case of single components. Particular care should be dations or failure. Again, there are no experience taken if the evaluation of R is based on requantifica-data for the extended AOT; therefore, the assump-i l

tion of pre-solved cutsets, as the events related to the tion should be made that both the frequency of out-component of concern may not even appear in the cut.

age for corrective maintenance and the compo-nent's failure rate remain the same. Here, the sets.

beneficial aspect of maintenance is not quantified and this may give a slightly higher estimate of the 2.3.4 Assumptions in AOT and STI Evaluations yearly AOT risk measure for the proposed AOT.

Using PRAs to evaluate TS changes requires con-4.

Often, AOT extensions are requested to facilitate sideration of a number of assumptions made within the on-line (or at-power) preventive maintenance of PRA that can have a significant influence on the ulti-safety-system components. The frequency and mate acceptability of the proposed changes. Such as-duration of the extension may be estimated and the sumptions should be discussed in the submittal re-risk impact from the resulting unavailability of questing the TS changes. Assumptions that should be such equipment can be calculated.

1.177 - 12

5.

When AOTs of multiple safety system trains are an impact on the evaluation of the change being extended, the likelihood of simultaneous outages considered (NUREG/CR-6141,Ref.14).

of multiple components increases (resulting from 4.

Notwithstanding the beneficial aspects of testingto

[

combmations of failures, testing, and mainte-detect failures that occur in a standby period, a nances) because the increased duration increases number of adverse effects may be associated with the probability of the individual events that consti-the test: downtime to conduct the test, errors of res-tute the simultaneous multiple outages; hence, toration after the test, test-caused transients, and overlapping of routinely scheduled activities and test-caused wear of the equipment. Downtime and random failuresbecomes morelikely. Theimpact errors of restoration are usually modeled in a PRA, l

of such occurrences on the average plant risk, e.g.,

unless they are negligible. Test-caused transients CDF,is small,but the conditional risk can be large.

and wear of the equipment are applicable to a few This issue is addressed as part of the implementa-tests, but they are not generally modeled separately tion considerations (see Regulatory Positions 23.7 in a PRA. However, they can be evaluated using and 4.1).

PRA models supplemented with additional data and analysis. Methods are available to quantita-Assumptions that should be considered for STI tively address these aspects [NUREG/CR-5775 evaluations can be summarized as follows.

(Ref.15)]; however, qualitative arguments can also be presented to support the extension of a test inter-

1. Surveillance tests usually are assumed to detect failures that have occurred in the standby period.

". h lf the adverse impact of testing is considered mficant, such cases should be addressed quanti-The component failure rate, A, represents these fail-

jY' ures in the formulation of component unavailabil-ity. The test-limited risk is normally estimated by 23.5 Sensitivity and Uncertainty Analyses assuming that a surveillance test of a component Relating to Assumptions in TS Change detects the failures, and that after the test, the com-Evaluations ponent's unavailability resets to zero or " false"in As in any risk-informed study, risk-informed anal-the Boolean expression. A few component fail-yses of TS changes can be affected by numerous uncer-

'm ures, depending on a component's design and the tainties regarding the assumptions made during the i

test performed, may not be detected by a routine Aj surveillance test. Usually, their contribution to risk PRA model's development and application.

is considered negligible.

Sensitivity analyses may be necessary to address j

the important assumptions in the submittal made with 2.

Regular surveillance testing of a component, as respect to TS change analyses. They may include, as performed for safety system components, is con-appropriate:

sidered to influe nce its performance. Ge nerally, for most components, the increase of a surveillance in.

The impact of variation in repair / maintenance terval beyond a certain value may reduce the com.

policy because of AOT changes (e.g., scheduling a ponent's performance (i.e., increase the failure PM of longer duration at power).

rate). Experience data are not available to assess The impact of variation in assumed mean down-the STI values beyond which the component fail-times or frequencies.

ure rate, A, increases. If,in a risk-informed evalua-tionofsurveillance requirements,the failure rateis The effect of separating the cyclic demand vs.

assumed to remain the same (i.e., unaffected by a standby time-related contribution to the compo-change in the test interval), this assumption implies nent's unavailability in deciding changes to an STI.

The e ffect of details (e.g., equipment failure rate, A, that the STis are not being changed beyond the val-ue at which A may be affected. Care should be taken

) regarding how CCFs are modeled in the PRA.

not to extend the STIs beyond such values using Previous sensitivity analyses performed for risk-risk-infermed analyses only.

informed TS changes have shown that the risk resulting

3. The timing of surveillance tests for redundant com.

from TS AOT changes is relatively insensitive to un-ponents relative to each other(i.e., the test strategy certainties (compared, for example, to the effect on risk used) has an impact on the risk measures calcu-from uncertainties in assumptions regarding plant de-lated. Staggered or sequential test strategies are sign changes, or regarding significant changes to plant

[A) commonly used. The risk impacts of adopting dif-operating procedures). This is because the uncertain-ferent test strategies (e.g.,sequentialvs. staggered) ties associated with AOT changes tend to similarly af-should be evaluated to determine whether there is fect the base case (i.e., before the change) and the 1.177-13

t 1

Adding a test of a redundant train be fore initiating a changed case (i.e., with the change in place). That is, o

the risks result from similar causes in both cases (i.e.,

scheduled maintenance activity as part of an AOT no new initiating transients or subsequent failure extension application.

modes are likely to have been introduced by relatively Limiting simultaneous testing and maintenance of l

minor AOT changes). AOT changes subject the plant redundant or diverse systems as part of an AOT ex-

- l l

to a variation in its exposure to the same type of risk, tension application.

l and the PRA model is able to predict, with relative sure-ty based on data from operating experience, how much Incorporating a staggered test strategy as part of the that risk will change based on that changed exposure.

STI extension application.

Improving test and maintenance procedures to re-f Similar results are expected for STI changes. Licensees l

are expected tojustify any deviations from these expec-duce test-and maintenance-related errors.

tations.

Improving operating procedures and operator The above argument may be more difficult tojusti.

training to reduce the impact of human errors.

fy in cases when the effects of multiple outages may be-Improving system designs, which reduces overall i

come significant during relatively large increases in system unavailability and plant risk.

AOTs or STIs. In those cases, however, the Tier 2 and When compensatory measures are part of the TS l

Tier 3 aspects of TS changes (i.e., configuration moni-change evaluatmn, the nsk impact of these measures toring, risk predictions, and configuration control should be considered and presented, either quantita-l based on the risk predictions) are expected to be robust and will be relied upon to control the resulting potential tively or qualitatively. When a quantitative evaluation is used, the total impact of these measures should be for significant risk increases.

evaluated by comparison to the "small" guideline (Principle 4, as described in the Discussion section of 2.3.6 Use of Compensatory Measures in TS this regulatory guide). This includes:

Change Evaluations (1) Evaluation of the proposed TS changeswithout the Consistent with the fundamental principle that compensatory measures.

changes to TS should result in only small increases in (2) Evaluation of the proposed TS changes with the l

the nsk to the public health and safety (Pnnciple 4, as

• E*"*"

'I * ***"'#8' described in the Discussion section of this regulatory guide), and as part of proposed TS change evaluations, (3) Specific discussion of how each of the compensa-certain compensatory measures (discussed below) that tory measures is credited in the PRA model or dur-balance the calculated risk increase caused by the ing the evaluation process, changes may be considered. This consideration should 2.3.7 Contemporaneous Configuration Control be made in light of the acceptance guidelines given in Regulatory Guide 1.174 (Ref.11). Also, note that these Consistent with the fundamental principle that considerations may be part of Tier 2 or Tier 3 programs.

changes to TS result in small increases in the risk to public health and safety (Principle 4), certain configu-When the licensee wishes to reduce the risk in-ration controls need to be utilized. The need for the crease resulting from a proposed change even though controls discussed below is described at the beginning the individual change is judged by the licensee to meet of Regulatory Position 2.3 in the discussion regarding the acceptance guidelines, the licensee might consider Tier 3.

taking compensatory measures such as those suggested below. If compensatory measures are considered as 2.3.7.1 Configuration Risk Management Pm-part of the analysis of the change, they should be in-gram (CRMP). Licensees should describe their capa-cluded in the overall application for the TS change.

bility to perform a contemporaneous assessment of the However, compensatory measures should not be relied overall impact on safety of proposed plant configura-upon to compensate for weaknesses in plant design.

tions prior to performing and during performance of Compensatory measures included in the submittal for a maintenance activities that remove equipment.from TS change should be measures for which the licensee is service. Licensees should explain how these tools or not already taking credit. Any such compensatory mea-other processes will be used to ensure that risk-signifi-sureswouldbecome partof thelicensingbasisif theTS cant plant configurations will not be entered and that change were approved. Examples of compensatory appropriate actions will be taken when unforeseen measures are:

events put the plant in a risk-significant configuration.

1.177 - 14

=

The TS Administrative Controls section should de-description. The following program should be incorpo-scribe the licensee's program for performing a real-rated and should be described in the TS Administratis e time risk assessment. The bases for T3 for which an ex-Controls section.

tended AOTis granted should reference this program a

MODEL CONFIGURATION RISK MANAGEMENT PROGRAM i

The Configuration Risk Managennt Program (CRMP) provides a proceduralized risk-informed assessment to manage the risk associated with equipment inoperability. The program applies to technical specification structures, systems, or components for which a risk-informed allowed outage time has been granted. The program is to include l

the following.

Provisions for the control and implementation of a Level 1 at-power internal events PRA-informed methodolo-f a.

gy. The assessment is to be capable of evaluating the applicable plant configuration.

b. Provisions for performing an assessment prior to entering the plant configuration described by the Limiting Conditions for Operation (LCO) Action Statement for preplanned activities.

Provisions for performing an assessment after entering the plant configuration described by the LCO Action c.

Statement for unplanned entry into the LCO Action Statement.

d.

Provisions for assessing the need for additional actions after the discovery of additiorni equipment-out-of-service conditions while in the plant configuration described by the LCO Action Statement.

Provisions for considering other applicable risk-significant contributors such as Level 2 issues and external e.

events, qualita tively or quantitatively.

Each submittal for a risk-informed TS AOTextension should contain appropriate changes to the Administrative Control section that incorporates the above program description, unless an approved CRMP program description has already been incorporated into the licensee's TS.

I 2.3.7.2 Key Components of the CRMP. The li-For unplanned entrance into the plant configu-censee should ensure that the CRMP contains the fol-ration described by a TS action statement with lowing key components.

a risk-informed AOT,a similar assessment will be performed in a time frame defined by the Key Component 1: Implen.entation of CRMP plant's Corrective Action Program (Criteria The intent of the CRMP is to implement Section XVI of Appendix B to 10 CFR Part 50).

a(3) of tie Maintenance Rule (10 CFR 50.65) with re-When in the plant configuration described by a spect to on-line maintenance for risk-informed TS, TS action statement with a risk-informed AOT, with the following additions and clarifications:

if additional SSCs become inoperable or non-

1. The scope of structures, systems, and components functional, a risk assessment, including, at a (SSCs) to be included in the CRMP is all SSCs minimum, a search for risk-significant config-modeled in the licensee's plant PRA in addition to urations, will be performed in a time frame de-all SSCs considered high safety significant per Re.

fined by the plant's Corrective Action Program vision 2 of Regulatory Guide 1.160 (Ref.16) that (Criteria XVI of Appendix B to 10 CFR are not modeled in the PRA.

Part 50).

2. The CRMP assessment toolis PRA-informed and

4. Tier 2 commitments apply only for planned main-l may be in the form of a risk matrix, an on-line as.

tenance, but should be evaluated as part of the Tier sessment, or a direct PRA assessment.

3 assessment for unplanned occurrences.

3. The CRMP will be invoked as follows:

Key Component 2: Control and Use of the CRMP Assessment Tool For pre-planned entrance m. to the plant config-1.

Plant modifications and procedure changes will be uration described by a TS action statement with a risk-informed AOT, a risk assessment, m nitored, assessed, and dispositioned.

i including, at a minimum, a search for risk-Evaluation of changes in plant configuration or significant configurations, will be performed PRA model features will be dispositioned by l

prior to entering the acion statement.

implementing PRA model changes or by the 1.177 - 15 l

qualitative assessment of the impact of the risk acceptance guidelines presented herein,in addition changes on the CRMP assessment tool. This to those in Regulatory Guide 1.174. Application of all qualitative assessment recognizes that changes the risk acceptance guidelines to individual proposals to the PRA take time to implement and that for TS changes will be done in a manner consistent with changes can be effectively compensated for the fundamental principle that changes to TS result in without compromising the ability to make smallincreases in the risk to the health and safety of the sound engineering judgments.

public (Principle 4, a described in the Discussion sec-ti n f this regulatory guide).

Limitations of the CRMP assessment tool are

+

identified and understood for each specific TS change evaluations may involve some smallin-AOT extension, crease in risk as quantified by PRA models. Usually,it is argued that such a small increase is offset by the many

2. Procedures exist for the control and application of beneficial effects of the change that are not modeled by CRMP assess ment tools, including a description of the PRA. The role of numerical guidelines is to ensure the process when the plant configuration of con-that the increase in risk is small, and to provide a quanti-cern is outside the scope of the CRMP assessment tative basis for the risk increase based on aspects of the gg TS change that are modeled or quantified.

KGy Component 3: Level 1 Risk Informed The nurverical guidelines used to decide an accept-Assessment able TS change are taken into account along with other The CRMP assessment tool utilizes at least a Level traditional considerations, operating experience, les-1, at-power, internal events PRA model. The CRMP sons learned from previous changes, and practical con-assessment may use any combination of quantitative siderations associated with test and maintenance prac-and qualitative input. CRMP assessments can include tices. The final acceptability of the proposed change reference to a risk matrix, pre-existing calculations, or should be based on all these considerations and not new PRA analyses.

solely on the use of PRA-informed results compared to numerical acceptance guidelines.

1.

Quantitative assessments should be performed whenever necessary for sound decisionmaking.

As discussed previously, the numerical guidelines are used to ensure that any increase in risk is within ac-

2. When quantitative assessments are not necessary ceptable limits; traditional considerations are used to for sound decisionmaking, qualitative assessments ensuie that the change satisfies rules and regulations can be performed. Qualitative assessments should that are in effect; practical considerationsjudge the ac-consider applicable existmg msights from previous ceptability of implementing the change; and lessons quantitative assessments.

learned from past experience ensure that mistakes are Key Component 4: Level 2 Issues and External not repeated.

Events Using the risk measures discussed in this regula-External events and Level 2 issues are trea:ed qual.

tory guide, the change in risk should be calculated for itatively or quantitatively, or both.

the TS changes and compared against the numeric guidelines referenced in Regulatory Guide 1.174, and 2.4 Acceptance Guidelines for TS Changes for AUI' changes, against the numerical guidelines The guidelines discussed in Sections 2.2.4 and presented below. In calculating the risk impact of the 2.2.5 of Regulatory Guide 1.174 (Ref.11) are applica, changed case, additional changes to be implemented as ble to TS AOT and STI change requests. Risk.

part of the change can be credited. For example,in seek-acceptance guidelines are presented in those sections as ing an STI change, if the test strategy is also to be a function of the result of the licensee's risk analysis in changed, the effect of this should also be incorporated in the risk evaluation.

terms of total CDF predicted for the plant and the change in CDF and LERF predicted for the TS changes It should be n6 d that this regulatory guide, as well requested by the licensee. In addition, those sections as Regulatory Guide 1.174, are applicable only to per-discuss cases when the scope of the licensee's PRA manent (as opposed to temporary, or "one time")

does not include a Level 2 (containment performance) changes to TS requirements. TS AOT changes are per-acalysis, and when, according to the guidelincs pre-manent changes, but because AOTs are entered infre-sented in this regulatory guide and in Regulatory Guide quently and are temporary by their very nature, the fol.

1.174, such an analysis is needed. TS submittals for lowing TS acceptance guidelines specific to AOT changes to AOTs should also be evaluated against the changes are provided for evaluating Oe risk associated 1.177 - 16

with the revised AOT,in addition to those acceptance the acceptability (to support regulatory decisionmak-guidelines given in Regulatory Guide 1.174.

ing) of the risk arpment being considered, including r

1. The licensee has demonstrated that the TS AOT the appropriate bleno cf quantitative and qualitative change has only a small quantitative impact on assessments.

A 4

plant risk. An ICCDP ofless than 5.0E-7is con-2.5 Comparison of Risk of Available Alternatives sidered small for a smgle TS AOT change.5 An ICLERP6 of 5.0E-8 or less is also considered In some cases, in support of a TS change, available small. Also, the ICCDP contribution should be alternatives are compared tojustify the TS change. For distributedintimesuchthat anyincreaseinthe as.

changes in TS AOTs, such cases primarily involve sociated conditional risk is small and within the comparing the risk of shutting down with the risk of normal operating background (risk fluctuations) of continuing power operation, given that the plant is not the plant (Tier 1).

meeting one or more TS LCOs. Such comparisons can

2. The licensee has demonstrated that there are ap-be used tojustify that the increase in at-power risk asso-propriate restrictions en dominant risk-significant ci ted with the TS change is offset by the averting of configurations associated with the change (Tier 2).

s me transition or shutdown risk.

3. The licensee has implemented a risk-informed In the case of an STIi.hange, the beneficial and ad-plant configuration control program. The licensee verse impacts can be sindlarly compared. The modi-has implemented procedures to utilize, maintain, fied STI should be chosen so that the benefit of testing and control such a program (Tier 3).

is at least equal to, or greater than, the adverse effects of in the context of the integrated decisionmaking, testing. For example,if the calibration of relays in the the acceptance guidelines should not be interpreted a reactor protection system causgs plant transients, the risk from the test-caused transients is then estimated being overly presc iptive. They are intended to provide an indication,in numerical terms, of what is considered and compared with the test-limited risk of an extended STI.

acceptable. As such, the numerical values above are approximate values that provide an indication of the in using such guidelines, the following consider-q changes that are generally acceptable. Furthermore,the ations apply:

j state of knowledge, or epistemic, uncertainties associ-(1) The uncertainty associated with the two measures ated with PRA calculations preclude a definitive deci-being compared can differ and should be consid-sion with respect to the acceptance of the proposed ered in deciding on an acceptable change.

change based purely on the numerical results. The in-tent in comparing the PRA results with the acceptance (2) When the risk measures associated with all alterna-guidelines is to demonstrate with reasonable assurance tives are unacceptably large, ways to reduce the risk that Principle 4 is being met. This decision must be should be explored instead of only extending the based on a full understanding of the contributors to the TS requirement. That is, a large risk from one of the alternatives should not be the justification for PRA results and the impacts of the uncertainties, both TS relaxation without giving appropriate attention those that are explicitly accounted for in the results and to risk-reduction options. If the risk from test-those that are not.

caused transients is large, attention may then be There may be situations in which a nonquantitative given to exploring changes in test procedures to re-l assessment of risk (either alone or accompanied by duce such risk, rather than only extending the test quantitative assessment) is sufficient to justify TS interval. liowever, a combination of the two also changes. The licensee is expected to use judgment on may be appropriate.

3. ELEMENT 3: DEFINE IMPLEMEN-41CCDP = [(conditional CDF with the subject equipment out of ser.

vice ) - (baseline CD F with nominal expected equipment unavailabi.

TATION AND MONITORING PROGRAM l

lities)] x duration of singic AOT under consideration).

The ICCDP acceptance guideline of 5.OE-7 is based upon the hypo-3.1 Three-Tiered Implementation Approach 5

• stT'$, "j,"hoNIc,c '

As described in Regulatory Position 2.3, the staff h

p u

te e p nt n as sumed baseline CDF or t.OE-4 per reactoryear, to conditionally in-expects the licensee to use a three-tiered approach in fads'aIu$sNat7herna or tyof implementing the proposed TS AOT changes. Ap-i scant adein ou s

/]

less and that the NRC has accepted this levelof risk for existing oper-plication of the three-tiered approach is in keeping with

"'i"8 P' *"

j the fundamental principle that the proposed change is

.v MCLERP = [(conditional LERF with the subject equipment, out of consistent with the defense-in-depth philosophy. Ap-service) - (baseline LERF with nommal expected equipment l

unavailabilities)] X (duration of single AOT under consideration).

plication of the three-tiered approach provides assur-l l

1.177 - 17 1

i l

Changes made to the PRA for use in the TS change ance that defense in depth will not be significantly im-pacted by the proposed change.

evaluation, Review of the applicability and quality of the PRA 3.2 Maintenance Rule Control models for TS evaluations, To ensure that extension of a TS AOT or STI does Discussion of the risk measures used in evaluating not degrade opetational safety over time, the licensee the changes, should ensure, as part ofits Maintenance Rule program Data developed and used in addition to the plant's (10 CFR 50.65), that when equipment does not meet its performance criteria, the evaluation required under the PRA database, Maintenance Rule includes prior related TS changes in Summary of the risk measures calculated including its scope. If the licensee concludes that the perfor-ntermediate results, mance or condition of TS equipment affected by a TS Sensitivity and uncertainty analyses performed, change does not meet established performance criteria, Summary of the risk impacts of the proposed appropriate corrective action should be taken,in accor-dance with the Maintenance Rule. Such corrective ac-changes and any compensating actions proposed, tion could include consideration of another TS change A tabulation of the outage configurations that to shorten the revised AOT or STI, or imposition of a could threaten the integrity of the safety functions more restrictive administrative limit,if the licensee de-of the subject equipment and that are, or will be, termines this ts an important factor in reversing the neg-prohibited by TS or plant procedures (Tier 2).

ative trend.

A description of the capability to perform a con-4.

ELEMENT 4: DOCUMENTATION AND temporaneous assessment of the overallimpact on SUBMITTAL safety of proposed plant configurations, including an explanation of how these tools will be used to The evaluations performed tojustify the proposed ensure that risk-significant plant configurations TS changes should be documented and included in the will n t be entered and that appropriate actions will license amendmeat request submittal. Specifically, be taken when unforeseen events put the plant in a documentation to support risk-informed TS change re-risk-significant configuration (Tier 3).

quests should include:

A m rked up copy of the relevant TS and bases, A description of the TS changes being proposed The level of detail provided in the TS Bases should and the reasons for seeking the changes, melude adequate information to provide the tech-A description of the process used to trrive at the nical basis for the revised AOT or STI.

proposed changes, All other documentation required to be submitted Traditional engirwering evaluations performed, with a license amendment request.

l O

1.177-18

REFERENCES 1.

USNRC, "Use of Probabilistic Risk Assessment 9.

USNRC, " Final Policy Statement on Technical Methods in Nuclear Activities: Final Policy State.

Specifications Improvements for Nuclear Power

((-}

gust 16,1995.1 1993.

ment," Federal Register, Vol. 60, p. 42622, Au-Reactors,"FederalRegister,58 FR 39132, July 22,

2. " Quarterly Status Update for the Probabilistic Risk

10. USNRC,10 CFR 50.36, " Technical Specifica-Assessment Implementation Plan, SECY-97-234, tions," Federal Register, 60 FR 36953, July 19, October 14,1997.1 1995.

3. U S N RC,"S tanda rd Technical Spe cifications, B ab-

11. USNRC, "An Approach for Using Probabilistic cock and Wilcox Plants," NUREG-1430 (latest re-Risk Assessment in Risk-Informed Decisions on vision).2 Plant-Specific Changes to the Licensing Basis,"

Regulatory Guide 1.174, July 1998.3 4.

USNRC, " Standard Technical Specifications, Westinghouse Plants," NUREG-1431 (latest revi-

12. USNRC," Risk-Informed Decisionmaking: Tech-sion).2 nical Specifications," NUREG-0800, SRP Chapter 16.1, August 1998.3 5.

USNRC, " Standard Technical Specifications, Combustion Engineering Plants," NUREG-1432

13. W.T. Pratt et al.,"An Approach for Estimating the (latest revision).2 Frequencies of Various Containment Failure 6.

USNRC, " Standard Technical Specifications, Modes and Bypass Events," Draft NUREG/

CR-6595, December 1997.3 General Electric Plants, BWR/4," NUREG-1433 (latest revision).2

14. P.K. Samanta and I.S.Kim,"IIandbook of Methods 7.

USNRC, " Standard Technical Specifications, f r Risk-Based Analyses of Technical Specifica-tions,' NUREG/CR-6141, USNRC, December j

General Electric Plants, BWR/6," NUREG-1434 1994.

(latest revision).2 8.

USNRC, Statement of Considerations," Technical

15. I.S. Kim et al., " Quantitative Evaluation of Sur-

'rw Specifications for Facility Licensees; Safety Anal-veillance Test Intervals including Test-Caused ys-s Reports," Federal Register, 33 FR 18612, Risks;" NUREG/CR-5775, USNRC, February 1992.-

i D.:cember 17,1968.

16. USN'lC," Monitoring the Effectiveness of Mainte-nance at Nuclear Power Plants," Regulatory Guide 1.160, Revision 2, March 1997.3 l

1 Copies are available for inspection orcopying for a fee from the NRC Public Document Room at 2120 L Street NW., Washington, DC; the l

3 PD R's mailing address is Mail Stop LL-6, Washington, DC 20555; Single copics of regulatory guides, both active and draft, and draft telephone (202)634 3273; fax (202)634 3343.

NUREG documents, may be obtamed free of charge by writing the Reproduction and Distnbution Services Section,0010, USNRC, 2 Copies of NUREG series documents are available at current rates Washington, DC 20555-0001, or by fax to (301 )415-2 a9, or by email from the U.S. Gove rnme nt Printing Office, PO. Box 37082,WasNng, to GRWi@ NRC. GOV. Active guides may also be purchased from ton DC20402-9328(telephone (202)512 2249);orfromtheNation.

the National Technicat informat on Se mce on a standing order basis.

i al Technicallnformation Service by wnting NTIS at 5285 Port Royal Details on this semee may be obtained by wnting NTIS,5285 Port Road, Springfie:d, VA 22161. Copies are available for inspection or RoyalRoad, Springfield,VA22161 Copiesof active anddraftguides copymg for a fee from the NRC Public Document Room at 2120 L are available for inspection or copymg for a fee from the NRC Public Stree t NW., Washington, DC; the PDR's mailing addre ss is M ail Stop Document Room at 2120 L Street NW, Washington, DC;the PDR's LL-6, Washington, DC 20555; telephone (202)634 3273; fax maihng address is M ail Stop lL-6, Washington, DC 20555; tele phone (202m14-1341.

(202)634-3343; fax (202)634 3343.

O

,?

C./

1.177 -19

APPENDIX A CONSIDERATIONS AND DATA NEEDS FOR TECHNICAL SPECIFICATION CHANGE RISK EVALUATIONS Increase in risk [e.g., core damage probability A.1 OTIIER CONSIDERATIONS IN TECIINICAL SPECIFICATION CIIANGE (CDP) (obtained by multiplying the increase in RISK EVALUATIONS CDF by the duration of the configuration for the ecurrene f a giv n c nfiguration)).

A.1.1 Risk Measures for Technical Specification If different measures are used, the licensee should Changes to Allowed Outage Times and Surveillance Test Intervals provide adequate discussions of them in the submittal.

In this section, a list of the risk-informed measures A.1.2 Measures for Multiple Technical used in allowed outage time (AOT) and surveillance Specification Changes test interval (STI) evaluations is presented. A more de-When multiple technical specification (TS) tailed discussion of these measures can be found in changes are being considered, the combined impact of NUREG/CR-6141," Handbook of Methods for Risk-the changes should be considered in addition to the in-Based Analyses of Technical Specifications"(Ref.1).

dividual impacts. The considerations related to the cal-The measures applicable for AOT evaluations are:

culation of totalimpacts are discussed here.

Conditional risk given the limiting condition of A.1.2.1 Measures That Can Ile Combined for operation (LCO)

Multiple TS Changes Incremental conditional core damage probability When considering risk contributions from several e

(ICCDP)

AOTs, the risk measures can be combined according to the following guidelines.

Yearly AOT risk e

The ICCDPs from several AOTs do not generally When comparing the risk ofshutting down with the interact nor do they accumulate to give a total contribu-risk of continuing powe r operation for a given LCO, the tion because the single AOT risks are conditional risks applicable measures are:

per event, and the downtime events for the different Risk of continued power operation for a given AOTs are different events. The only time that ICCDPs downtime, similar to ICCDP should be considered simultaneously is when multiple components can be down at the same time, constituting Risk of shutting down for the same downtime the same event Such a case is referred to as " downed The measures applicable for STI evaluations are:

configuration," or simply a " configuration." The risk c nt@udon assoc eg a cc)n@rahn Wened Test-limited risk to as the configuration risk and is evaluated separately

• Test-caused risk as a multiple component downtime. Conducting main-Similar to the AOT evaluations, the risk contribu-tenance on several components is a principal cause of tions associated with preventive maintenance (PM) are:

potentially high configuration risks.

Single PM risk Yearly AOT risk contributions from several AOTs l

can interact and should be accumulated to give tha total Yearly PM risk yearly contribution from all the AOTs being consid-The risk associated with simultaneous outages of ered. When the AOTs do not interact, that is, when the multiple components, called configuration risk,is cal-downed components are not in the same minimal cut-culated as part of AOT changes. The three-tier ap-set, the yearly AOT risk contribution from several proach discussed in Regulatory Position 2.3 of Regula-AOTs is the sum of the individual yearly AOT risk con-tory Guide 1,177 includes calculations of risks tributions. When the AOTs do interact, that is, when i

associated with multiple components that may be taken two or more of the downed components are in the same l

down together. The applicable measures are similar to minimal cutset, interaction of the AOT risk contribu-the AOT measures stated above.

tions should be considered.

Conditional risk (e.g., increase in core damage fre-When calculating the test-limited risk for changes e

l quency (CDF)) caused by the configuration in multiple STIs, the total test-limited risk should tw l

l 1.177 - 20 l

i

- =.

properly evaluated. Simple addition of individual test-R can be determined by setting the component-down i

limited risks will not provide the combined test-limited unavailability to 1 and deleting larger minimal cutsets risk. In a simple addition, the total test-limited risk con-that contain smaller minimal cutsets (i.e., are absorbed iO tribution is underestimated because the interacting by the smaller minimal cutsets). If there are any mini-terms are neglected.

mal cutsets containing complementary events, they also should be removed if they are inconsistent with the A.I.2.2 TotalImpact of Multiple Changes component being down. The reduced risk level Rocan When multiple changes are requested, the total col.

be determined analogously by setting the down un-lective risk impact from all the changes should be eval.

availability to zero.

uated. For example, for a group of AOT and STI If the component-down event is not contained in changes, this includes the total impact of all the re-the existing minimal cutsets, or if there is a question on quested:

the coverage of the existing minimal cutsets, the mini-AOT changes malcutsetsshould be regenerated. R isdeterminedby t

setting the down-component event in the PRA models STI changes to a true state. The truncation limit of the minimal cut-AOT and STi changes set can be reduced by at least a factor of 10 to give added assurance of sufficient coverage. The minimal cutsets If multiple changes are made, the impact of each that are generated using the reduced truncation limit change is assessed individually; then as a check, the can then be used to determine Ro by setting the down plant probabilistic risk analysis (PRA) should be used unavailability at zero.

to quantify the total impact.

Contributions from common cause failures (CCFs)

A.1.3 Quantification of Risk Measures need special attention when calculating the increased risk level R. If the component is down because of a t

A.1.3.1 Alternative Ways of Calculating TS failure, the common-cause contributions involving the Change Risk Measures component should be divided by the probability of the W

In calculating the measures discussed for evaluat-component being down because of failure since the

)

ing TS changes, two specific risk levels are discussed, component is given to be down. If the component is which should be quantified using a PRA. Focusing on down because it is being brought down for mainte-U the CDFlevel,theyare R,theincreased risklevel(e.g.,

nance, the CCFcontributions involving the component t

CDF) with the component assumed down or cquivalent should be modified to remove the component and to component unavailability set to "true," and Ro, the re-nly include failures of the remaining components duced CDF with the component assumed up; that is, the (also see Regulatory Position 2.3.1 of Regulatory component unavailability is set to " false."

Guide 1.177).

H r e mp nents are reconfigured while the A.1.3.1.1 Using PRA To Obtain AOT, PM, and C mPonent is down, these reconfigurations can be in-Configuration Risk Contributions. R can be calcu-t c rp rated in estimating Rt or AR, using the PRA. If lated by setting the component-down event to a true ther components are tested before repair or if mamte-statein the PRA. Similarly,Rocan be calculated by set-nan e is carried out on the downed components, the ting the component-down event to a false state in the e nduct of these tests and their outcomes also can be PRA. The component-down event in the PRA is the event describing that the component is down for repair m deled. If other components are more frequently tes-or maintenance. If the component-down event is in-ted when the component is down for the AOT, this in-cluded in the existing minimal cutsets, these minimal creased frequency of testm, g also can be incorporated.

cutsetscanbeusedtodetermine R andRoprovidedthe These modeling details are sometimes neglected in the t

minimal cutsets sufficiently cover the contribution of PRA because of their apparently small contribution.

the down event. The existing minimal cutsets are suffi-However, whea isolating the AOT risk contributions cient if those containing the down event are not all near and in justifying modified AOTs, these details can be-l the truncation limit (i.e., are not all within a factor of 10 come sigmficant.

I of the truncationlimit). Alternatively,the minimalcut-A.1.3.1.2 Use of PRA Minimal Cutsets When It p

sets are sufficient if those containing the down event Is Appropriate. As indicated, a PRA computes the

}'

have a non-negligible contribution (i.e., have a con-yearly AOT risk contribution to the yearly CDF. Basi-tribution greater than or equal to 1%). If the existing cally, the yearly AOT risk contribution is the sum of the minimal cutsets are sufficient, the increased risk level minimal cutset contributions containing the compo-1.177 -21

nent-downed unavailability (typically, for mainte-expected to be significantly lower than that for the se-nance) qm, quential test strategy.

qm=fd A.I.3.1.4 Using Minimal Cutsets To Calculate Test Limited Risks. The test-limited risk for a compo-where f is the downtime frequency and d is the nent or a set of components also can be determined by downtime associated with the AOT. The downtime d identifying those minimal cutsets that contain one or usually is estimated as an average downtime associated more of the STI contributions. The sum of the relevant with the AOT. If the mmic.2 cutsets sufficiently cover minimal cutset contributions is then equcl to the test-1 the downed unavailability, those that contain the limited risk. To evaluate changes in the test-limited downed unavailability qm can be summed to give the risks for changes in the STIs, the difference between the yearly AOT risk contribution R.

minimal cutset contributions with and without the STI y

changes will be the difference between the test-limited A.1.3.1.3 Using the PRATo Determine theTest-risks. In using the minimal cutsets, one should ensure Limited Risk Contribution. The PRA can be used to that the STI contributions are all included in the set of calculate the increase in the risk-level AR and to obtain minim I cutsets used. Even though use of the minimal the component unavailability, q, which are the contrib-cutsets gives the same results, the above basic descrip-uting factors in calculating the test-limited risk con-tion of methods for obtaining the test-limited risks is tribution. The considerations involved in calculating useful, since it shows the basic contributing factors to R and Ro to obtain AR are those discussed above and i

the STI risk.

in the next section.

When the effect of change in STI for one or more A.1.3.1.5 Specific Considerations for Evaluat-components is being evaluated, the PRA can be directly ing Multiple Test Limited Risks. When multiple STis are modified or are defined, the total test-limited used to calculate the change in the risk measure (e.g.,in the CDF). The calculation of PRA results, when risk from the multiple STI changes or definitions changed STIs are included, incorporates interactions should be properly evaluated. Instead of using the PRA among the STIs. The differences between the results to evaluate all the changes in a given run, the individual (i.e., CDF when the STIs are changed from the baseline test-limited risks can be evaluated one at a time, pro-CDF) provides the test-limited risk contribution for vided that the updated STIs are used for the other rele-changing the STIs.

vant components. An iterative procedure can then be used in which individual STIs are successively up-i In such a calculation, the contributions of CCFs dated, using the methods described above for individ-should be appropriately modified. The common failure ual component STI risk contributors. These one-at-a-terms modeled as a function of the test interval should time evaluations, or " iterative" evaluations, are useful be modified to reflect the new STI. Typically, CCFs ara if acceptable guidelines on test-limited risks are de-modeled using a -factor or Multiple Greek Letter fined and the STIs are to be selected to satisfy the risk l

model when the CCFof multiple components is a func.

guidelines.

l tion of the STI. When changing STIs, care should be ta-ken to change this term within the common cause con-A.1.3.2 Appropriate Calculation of Conditional tribution. The common cause of failing multiple CDF components resulting from human error following a test is not a function of the STI, but may be affected by A.I.3.2.1 Conditional CDF for Failure of a the test strategy used.

Component. To calculate the conditional CDF when a component is failed (typically represented by R in this i

When different test strategies are being evaluated, document), the component unavailability is changed to

{

the human error term should be evaluated. Specific as-the "true" or "T" state. However, the component un-sumptions that were used in quantifying the human er-availability may be modeled in terms of many contribu-ror common cause term should be identified and tors: random failure, maintenance downtime, test checked if they apply for the test strategy being ana-downtime, and CCF. The CCF term represents the fail-lyzed. For example,if the term was developed assum-ure probability of two or more redundant components ing a sequential test strategy, but a staggered test stra-that include the failed component in question. The trgy is being analyzed, the term should be modified to CCF term is modeled as a product of multiple terms j

reflect this change. The failure probability from a com-(e.g., using the -factormodel for two redundant com-mon cause human error for a staggered test strategy is ponents, the CCF term is times the component un-1.177-22

. = _ -. -.

availability from random failures), but may be repre-successfully been tested. The calculation of AOT and sented by one parameter.

STI risk contributions involve calculating this condi-A Consider a component 0 in Train A of a safety sys-ti n 1CDF(Ro). Forevaluatingthe AOTriskcontribu-tion, Ro signifies that the component is not down for tem, letting OLA, QMA, and QTA represent the com-ponent's unavailability from random failures, mainte-test or maintenance, and this condition is represented nance downtimes, and test downtimes, respectively.

by setting test and maintenance downtime unavailabili-Also,let QC = POL be the term for CCF of the redun-ties to the " false" or "F" state. In this example, QMA dant components in Trains A and B, where QL is nu-and QTA should be changed to the "F" state. For STI evaluations, Ro signifies that the component is up, merically equal to QLA and represents QLA or QLB.

QLB is the unavailability of a component in Train B which is known from the test and is represented by set-from random failure. Usually, the terms QLA, QMA, ting its unavailability to " false."In this example, QLA, QTA, and QC will be part of the PRA input data.

QMA, and QTA should be changed to the "F" state. In many cases, the reduction in CDF from the baseline To calculate the conditional CDF given that the CDF is negligible.

component is failed, the component unavailability A.1.3.2.4 Conditional CDF When Multiple should be represented by the "T" state. This means that Components Are Involved. To calculate conditional QLA, QMA, and QTA should be changed to the "T" CDFs (R and Re) when multiple components are m.-

i state and QC should be divided by QLA since the com-e, m mn ng tems aladng to ead oW ponent is down because of failure. In principle, chang-C mPonents sk 3e changeMe 7,or T state ing one of the three conditions (OLA, QMA, OTA) to the "T" state should suffice. However, in many cases, mp nent, me comsponqng tems gng re c to random failures, CCFs, test downtimes, and mainte-truncated cutsets are used to calculate the conditional nanc downtimes should be converted, as discussed CDF, and changing all three will ensure that the failed above. When all the components modeled by a com-state of the component is represented. For this exam-

• Y".cpangestobeJ ple, QC will be changed to,which represents the con-state for calculating R. Otherwise,it is modeled as dis-i dit.ional failure probability of the redundant compo-cussed above, representing the unavailability of the re-Q nent. When QC represents the failure of more than tw maining components. In many PRA computer codes,

)

components,0C will be converted to the failure proba-the CCF term does not retain the specific component bility of the remaining components, in this case, tw designator (for example, a unique notation identifying c mp nents, the specific component involved may not be part of the A.1.3.2.2 Conditional CDF When a Compo-name of the CCF term), and the relevant term cannot di-nent Is Down (but Not Failed) for PM. To calculate rectly be identified by searching the names of the input the conditional CDF when a component is taken down parameters of the PRA. The description of the CCF for PM (R for PM analyses), the CCF term shW N terms modeled in the PRA may need to be examined to i

treated differently from that described above for the identify the relevant term or the input parameter.

failure of the component.

A.133 Treatment of CCF and Recovery Factors Considering the same example as above, the down The treatment of CCF in estimating the conditional state of the component is represented by changing CDF for AOT and STI evaluations was discussed ear-QLA, QMA, and QTA to "T" and by changing QC t lier. Appropriate considerations in modifying CCF QL, which is numerically the same as OLB or QLA.

terms modeled in the PRA (to include the effect of a The CCF term is changed to represent the unavailabih component being unavailable because of failure, main-sty of the remaining component and not, since the im-tenance, or testing and for implementing a staggered tial component is already down for PM and is not down test strategy) have been discussed. In addition, since l

due to failure. If the redundant component is success-the CCF contributions can be a dominant contributor, l

fully tested before taking the component down for PM, sensitivity analyses with respect to these parameters j

QC can then be equated to zero for a short-duration PM may be appropriate (see Regulatory Position 2.3.5 of (i.e., when the duration of the PM is much less than the RG 1.177). Recovery factors used in the PRA model test interval).

perhaps should be reviewed to learn whether the com-A A.1.3.2.3 Conditional CDF When the Compo.

ponent assumed to be down because of failure is cred-(j nent Is Not Down for Maintenance or Is Tested Op-ited to be recovered. For example, consider that a TS erable. The conditional CDF is reduced when the com-change for an emergency diesel generator (EDG)is be-ponent is not down for maintenance or when it has just ing evaluated, and conditional CDF for the EDG being L177-23 i

down is being calculated. Then,if the cutsets used to sistent with the plant experience. The use of other than calculate the conditional CDF take credit for the same plant-specific data should be justified.

EDO being recovered, such recovery factors should be When a generic analysis is being performed using a modified. In such cases, no credit should be taken.

representative plant model,the use of generie data from similar plants is acceptable. The generic data should A.1.3.4 Calculations of'n ansition Risk bound the specific plants under consideration, not an Transition risk is calculated to compare the risk of average plant.

continuing operation in a given LCO to that of a transi-tion to plant shutdown. Such companions can be used A.2.1 Care in Using Plant-Specific Data to decide which option is preferable and which other al-When plant-specific data are used to update input ternatives may be used. Such evaluations particularly parameters of the PRA during a TS change evaluation apply for systems used to remove decay heat. The fol-(additional to that used during the latest update of the lowing considerations apply in calculating transition PRA), care should be taken that such data are consis-nsk.

tently used both for the base case, where existing TS re-(1) Various stagesof the shutdowncoolingphases and quirements apply, and the change case, where TS the operator's interactions should be modeleJ to as-changes are incorporated. This is done to ensure that sess the impact on the CDF of shutting down the the increase in the risk measure obtained is due to the plant in a LCO.

TS change only and not to the use of plant-specific data

" E " "'

(2) Any initiating event not modeled in the basic PRA, but important during the shutdown phases, should This situation typically arises when recent plant-be modeled. Specific examples are those events specific data are evaluated and reduced values of the pa-that challenge the residual heat removal (RHR) rameters are obtained. Use of the reduced values may system and that can render part of it unavailable.

negate the risk increase from the TS change and may Also, the frequency of initiating events during the give an erroneous impression that the TS change has re-transition to thutdown may have to be reassessed, duced the risk. When the base case is also updated, since it may differ from that during power opera-such difficulties are avoided. Sensitivity and uncer-tion (e.g., more frequent loss of offsite power or tainty analyses should also be performed using the loss of main feedwater during the transition to shut-same set ofinput data, down).

(3) Different recovery paths applicable at various A.2.2 Considerations When Generic Data Are stages of shutdown should be modeled to realisti-Used cally quantify the risk of shutting down, consider-When generic data are used for the TS parameters ing the diminishing levels of decay heat.

in evaluating TS changes, the focus should be on justi-(4) Available time margins for uncovering the reactor fying small changes that do not strongly depend on the core and heating up the suppression pool [in a boil-data parameters. The reasons why generic data are be-ing water reactor (BWR)] or drying out the steam ing used and why generic data apply for plant-specific generator [in a pressurized water reactor (PWR)]

evaluations should be presented. In many cases, be-shoald be modeled to evaluate specific accident se-cause of limited experience, the use of plant-specific quences.

data may result in very optimistic values justifying the use of generic data.

A.2 DATA NEEDS FOR TS CIIANGE EVALUATIONS A.2.3 Specific Data Needs A request for plant-specific TS changes should use Basic data needed for a PRA-informed TS change plant-specific data and not rely solely on generic data or evaluation for risk-informed regulation are those col-data from similar plant designs. Usually, TS changes lected as part of the PRA. Comparative risk calcula-are requested because plant operation indicates that tions for LCO changes require no additional data be-such changes are needed and, accordingly, plant-yond those in the Full-Power Operations Level 1 and specific data are expected to be available. For the com-the Law Power / Shutdown Level 1 PRAs. The addi-ponents or systems for which TS changes are being tional data needs for evaluating changes iu TS require-considered, plant-specific data should be evaluated and ments, such as STIs and AOTs, are discussed in this assurance should be obtained that the data used are con-subsection.

1.177 - 24 i

1 A.2.3.1 Maintenance Downtime Data sumptions can be made if obtaining detailed data or Maintenance downtime data should be partitioned.

related information is costly.

into plant-specific unplanned unavailability for un-Any potential for negative effects of surveillance n

/

\\

scheduled maintenance and planned unavailability for testing (e.g., that may cause the potential for

(

preventive maintenance or testing. For this purpose, introducing plant transients, or that may cause un-data are needed on the frequency of events leading to necessary wear of the equipment) should be taken planned and unplanned maintenance, i.e., the number into account by the analyses. Preliminary evalua.

of occurrences of each type of downtime event during a tions can be used to determine whether a more de-given time period, and the time interval that the compo-tailed analysis should be performed.

nent was out of service for each occurrence. These data The test strategy used for the redundant compo-are also needed forjudgingwhether an adequate AOTis nents in a system (i.e., whether staggered or se-being provided to complete a repair. The distribution of quential testing is performed) should be stated.

downtimes aise can be used to estimate the expected The standard PRA quantification assumes that risk for a given AOT.

components follow no specific schedule and are The distribution of time for unscheduled mainte, randomly placed with regard to one another. By nance may shift when an AOT is being changed. For staggering the test times ofcomponents in different this reason, information about such an influence on the trains, the test-limited risk contribution will be re-distribution is not expected to be available when the duced for the same STis as compared to the PRA AOT change is being evaluated. The average down.

assumption. Conversely,if the tests are carried out time can be assumed to proportionally increase with the sequentially, the test-limited risk will increase increase in the proposed AOT for downtimes associ.

compared to the PRA assumptions.

ated with unscheduled maintenance. For scheduled WA Parameters for Component (preventive) maintenance, the downtime assumed can Unavailability berepresentativeofplantpr ctices(e.g.,one-halfof the AOT).

The component unavailabilities used in a PRA contain a number of parameters that are relevant for O

A.2.3.2 Maintenance Schedules and Frequency evaluating TS changes. These parameters should be These data include the maintenance scheduling delineated, as modeled, to facilitate evaluations to be used by the plant for defining the situations in which conducted and reviewed by the regulatory authority.

multiple equipment or syram trains may be taken The following desirable parameters contributed to the down for PM. These schedules are important to ensure eskad componem unadamp i

that high risks from components being down simulta-Component failure rate neously, implicitly allowed by the TS change, do not Component test interval occur. The maictenance frequency or frequency of downtime for a component may be from 3 to 10 times Maintenance / repair downtime contribution (main-higher than the failure frequency. Since AOTs can be tenance frequency, downtime for scheduled and used for maintenance, the frequency of maintenance unscheduled maintenance)

Test downtime,if applicable should be incorporated in estimating the downtime fre-9"*"'I' Human errors following test or maintenance, if

+

A.2.3.3 Data Relating to Component Testing modeled Separation of cyclic-demand vs. standby time con-The following data related to component testing,in addition to those available as part of the PRA study, tribution,if modeled.

form part of a TS change evaluation relating to surveil-A.2.3.5 Separating Demand and Standby Time lance requirernents.

Contributions to Unavailability A list of the components being tested, any compo-Since the test limited risk (typically defined as Ro) nent realigned from the safety position during a is associated with a failure occurring between tests, the test, duration of the test, and the test frequency rec-failure rate that should be used in calculating the test-ommended by the manufacturer limited risk should be the standby time-related failure (v)

The efficiency of the test (i.e., the failure modes de-rate, which is associated with what can occur while the tected by the test in regard to components, support component is in standby between tests. Test-limited system interfaces, and so forth). Bounding as-risk contributes to increases in risk associated with lon-1.177 - 25

ger test intervals caused by the longer time to detect can be assumed to be time-related to obtain the maxi-standby-stress failures. The time-related failure rate is mum test-limited risk contribution.

expressed in units per time period, such as per hour. For in summary, the data required for measuring a estimating Ro, the data needed are the standby stress change in risk with a change in the surveillance test in-failure rate of the component and the proposed test in-terval are a breakdown of the failure probability of the terval.

component into its time-related and demand-related components, the proposed test interval, and the out-of-The failure probability of a component consists of a service time for surveillance testing for the component.

time-related contribution (the standby time-related failure rate), and a cyclic, demand-related contribution A.23.6 Test-Caused hansients (the demand stress failure probability). The latter is the To evaluate and identify the test-caused transients probability contribution associated with failures that risk (typically defined as Rc), transient events should are caused by demanding, starting, or cycling the com-be analyzed and those caused by a test should be identi-ponent, which include (but are not necessarily limited fied. In most cases, this requires reading through the to) test-caused transients as discussed below m A.23.6.

description of transients that have occurred and noting Since the test-limited risk, Ro,is associated with a fail-those caused by the test. When longer test intervals are i

ure occurring between tests, the failui e rate that should allowed, the resulting reduction in test-caused tran-be used in calculating the test-limited risk is the time-si nts per unit time tends to cause decreases in risk be-i related standby stress failure rate. From the total num-cause there are fewer adverse effects of testing over that her of failures on demand, the number of failures longer test interval (which, however, will be partially or caused by standby stress and the number of failures wholly balanced by increases in Ro that are caused by from demand stresses can be partitioned by either an the longer time period before detection and correction engineering analysis of failure causes or by a graphical of failures)'

method based on the relationship between the observed number of failures and the test interval lengths from The transient events are obtained from the follow-which the failures came, ing plant operating data:

(1) Performance indicator reports: These reports list The test-caused contribution to risk is primarily the number of reactor trips and safety system actua-composed of Rdown, the risk contribution that is due t tions at each plant, the date of the events, and the the unavailability of equipment resulting from aligning numbers of the relevant licensee event reports equipment away from its preferred position / state to (LERs).

conduct a test, when there is no automatic return to the (2) LER system: Reactor trips are described in LERs.

preferred position. The additional data needed for esti-mating this parameter are the surveillance test interval When test-caused transients for a single plant are and the out-of-service time needed for each test.

evaluated, the plant-specific data may be sparse unless the plant's operating experience covers a substantial pe-Dividing the failure probability into a time-related riod. When this is the case, more data may be used from and cyclic demand-related contribution results in a the operating experience of other plants of similar vin-lower test-limited risk because only part of the compo-tage (for example, other BWR/4s) assuming that the nent's failure rate is treated as time-related. However, likelihood of occurrence of test-caused transients is treating only part of the failure rate as being time related similar for all the plants in the data base. (The perfor-when this is not the case underestimates the test-limited mance indicator reports categorize plants according to risk; therefore, such a brcakdown of the failure rate design classes.) Testing, however, tends to be very should bejustified through data analysis or engineering plant-specific, so that cross-plant data applicability

analyses, must be evaluated in detail.

Also, sometimes only the failure probability (i.e.,

A.23.7 Data for Evaluating hansition Risk thc component unavailability q) may be provided with-Data available in a PRA for full-power operation out giving a failure rate. In such a case, the effect of a provide the basic information for evaluating the transi-change in the test interval cannot be evaluated unless tion risks when a plant is being shut down for an LCO.

the component test interval previously used for T is in addition, the PRA for low-power and shutdown op-used to convert the unavailability q in terms of A and T.

erations, if available, will significantly ease the ac-When the breakdown between time-related and cyclic quisition of the data necessary for evaluating the risk of demand-related contribution is unknown, all failures shutdown. The low-power and shutdown PRAs typi-1.177 - 26

cally contain relevant data, such as the durations of (3) Frequency of transients during controlled shut-shutdown phases and the frequencies ofinitiators that down: The LERs for the plant may need to be re-may occur during shutdown operation (e.g., loss of viewed in order to evaluate the likelihood of tran-RilR).

sients during controlled shutdown. The likelihood

.The full-power PRA is available for most operat-of a transient during a shutdown may be different ing plants, but the low-power and shutdown PRAs are from that during power operation (this should be considered).

only available for some plants. IIence, the data needed to evaluate transition risk are discussed here, assuming REFERENCE that only data from a full-power PRA are available.

1.

P.K.Samanta and I.S.Kim, "11andbook of Methods (1) Plant-specific data on shutdown operations: To for Risk-Based Analyses of Technical Specifica-analyze shutdown phases in detail, plant-specific tions," NUREG/CR-6141, USNRC, December information may be needed, such as operating and 1994I abnormal procedures, shift supervisor 's log books, or monthly operating reports. From this informa-tion, data on timing of the plant shutdown and op-erational preferences of equipment during plant shutdown can be extracted.

(2) Plant-specific traditional data: The evaluation of ICopics of NUREG-series documents are available at current rates heatup and recovery seenarios, including estimates frem the U.S. Government Printing Office. P O. Box 37082, Washing.

of heatup time, requires some design data on the t n,DC20402-9328(telephone (202)512 2249);orfromtheNation.

plant, such as the temperature of the ultimate heat al Technicallnformation Serv ce by writing NTIS at 5285 Port Royal Road, Springfield. VA 22161. Copies are available for inspection er sink or the cooling capacity of the RilR system.

copying for a fee from the NRC Public Document Room at 2120 L These data typically are available from the plant's f[**,'$;*n*h"nStogDC h nga

P 555 ep e {202)63 32 ;f final safety analysis report (FSAR).

(202)634-3343.

I Value/ Impact Statement A draft value/ impact statement was published with the draft of this guide, DG-1065, when it was published for public comment in June 1997. No significant changes were necessary from the original draft, so a separate value/ impact statement for the final guide has not been prepared.

A copy of the draft value/ impact statement is available for inspection or copying for a fee in the Commission's Public Document Rcom at 2120 L Street NW, Washington, DC.

,x l

1.177-27

i UNITED STATES FIRST CLASS Mall NUCLEAR REGULATORY COMMISSION POSTAGE D FEES PAID p

WASHINGTON, DC 20555-0001 PERMIT NO. G-67 OFFICIAL BUSINESS PENALTY FOR PRIVATE USE, $300 l

l r

I e

I I

f-L

-