ML20151U513

Reg Guide 1.176, Approach for Plan-Specific,Risk-Informed Decisionmaking:Graded Quality Assurance

ML20151U513
Person / Time
Issue date:	08/31/1998
From:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
To:
References
REGGD-01.176, REGGD-1.176, NUDOCS 9809110030
Download: ML20151U513 (24)

Text

- . _. _ . .. . .

y ga"*gA U.S. NUCLEAR REGULATORY COMMISSION August 1998 m o J (m..) REGULATORY GU DE 1

OFFICE OF NUCLEAR REGULATORY RESEARCH REGULATORY GUIDE 1.176 (Draft was issued as DG 1064)

AN APPROACH FOR PLANT-SPECIFIC, RISK-INFORMED DECISIONMAKING: GRADED QUALITY ASSURANCE A. INTRODUCTION equipment will perfonn satisfactorily in service. The requirements delineated in Appendix B to 10 CFR Part Background 50 recognize that QA program controls should be applied in a manner consistent with the importance to The NRC has established deterministic criteria for s fety of the associated plant equipment. In the past, determining which commercial nuclear power plant . engineering judgment provided the general mecha-equipment is considered safety-related (see Section nism to determine the relative importance to safety of 50.2, " Definitions," of 10 CFR Part 50, " Domestic plant equipment.

Licensing of Production and Utilization Facilities";

Appendix A," Seismic and Geologic Siting Criteria for in recognition of advances made in the state of the Nuclear Power Plants," to 10 CFR Part 100," Reactor art in the probabilistic risk assessment (PRA)

O Site Criteria", Section 50.65, " Requirements for technology area, the NRC has made the decision to V Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," of 10 CFR Part 50; and Section expand the use of PR A in the regulatory process. PRA provides insights that may be utilized by licensees to 50.49, " Environmental Qualification of Electric support the determination of the relative safety Equipment important to Safety for Nuclear Power significance of plant equipment. The probabilistic Plants,"of 10 CFR Part 50). Because of the importance insights help identify low safety-significant structures, of the safety-related equipment to protecting public systems, and components (SSCs) that are candidates health and safety, the NRC has additionally required for reductions in QA treatment. The end result of this that a quality assurance (QA) program (described in process could be that licensees would have plant Appendix B," Quality Assurance Criteria for Nuclear equipment that is categorized as safety-related and Power Plants and Fuel Reprocessing Plants," to 10 high safety-significant; safety-related and low safety-CFR Part 50) be applied to all activities affecting the significant; non-safety-related and high safety-safety-related functions of that equipment. The overall significant; and non-safety-related and low purpose of the QA program is to establish a set of safety-significant. Grading of QA controls would vary systematic and planned actions that are necessary to commensurate with these categorizations. This provide adequate confidence that safety-related plant regulatory guide provides guidance that could be used 7 I L5NRC REGULATOld GUIDt's The gudes are issued n the loitoweg ten broad divisons ,

Regulatory Guides are issued to descree and make avadable to the pu%c such eforma-tion as methods acceptable to the NRC staff for implemenleg specihc parts of the 1. Power Reactors 6 Products 7 Transportaten br9

/1 l- )7 Commesserrs regulatens techniques used by the staff m evaluateg toecthe protnams or 2 Research and Test reactors postulated accidents. and data needed by the NRC staff n its review of apphcatens for 3 Fuels and Materiais Faceist.es 8 Occuparonat Heamh permits and hcenses Regulatory guides are not substitutes for regulahons and compi 4 Environmental and Seteg 9 Antitrust and Fnancial Review ance with them is not required Memods and solutons d.frerent from those set out m the 5 Materels and Plant Protect:an 10 General I

guides we be acceptable it they provde a basis for the fedings requisite to the issuance of contmuance of a permit or hcense by the Commissen Segte cop es of regutatoey guides may be oclamed free of enarge by wnt ng the Reproduc.

This gude was issued a'ter consderaten of comments rece.ved from t*ie pubhc Com- t.on and Disf rtut on Serwces secton. Oil:ce of the Che rInWmat+on 0%cer. U S Nuclear p monts and suggestens for improvements m these guides are encouraged at art timers. and Regulatory Commiss.on. Wasnogton. DC20555 0001,or by fas at (310)415-2281 or by

, go des we b. ,ev,s.d. as aporoonste. to accommodue commenis and io reneci new inio,. e ma,no cRwi NRC cov

', maton or experience

\ issued gwdes may also be purchased from the National Tecntucat Informaton Sennce on Wrvtten Comments may be submatted to the Rules Reven and Directwas Branch AOM. a standing order bas s Details on th s service may be obtaned by werieng NTIS. 5285 Port U S Nucear Regulatory Commesson. Washogton. DC 20555 0001 Royal Road Soreghed. VA 22161 9809110030 980831 -1 i fea ldE GD j {g hg kg\ppub(

1

by licensees both to determine the relative safety within the bounds of the state of the art, to significance of plant equipment and to adjust the reduce unnecessary conservatism associ-application of QA controls accordingly. ated with current regulatory requirements, regulatory guides, license commitments, Requirements related to QA programs for nuclear and staff practices. When appropriate, power plants are set forth in Appendix B to 10 CFR PRA should be used to support the I Part 50. The general requirements contained in proposal of additional regulatory require-Appendix B are supplemented by industry standards ments in accordance with 10 CFR 50.109 and NRC regulatory guides that describe specific (backfit rule). Appropriate procedures for practices that have been found acceptable by the including PR A in the process for changing industry and the NRC staff. Although both Appendix regulatory requirements shou ld be devel-B and the associated industry standards allow a large oped and followed. le is, of course, degree of flexibility, the licens.es and the NRC staff understood that the intent of this policy is have been reluctant to make major changes in that existing rules and regulations will be established QA practices. Recently. however, changes complied with unless these rules and in the nuclear industry have resulted in numerous regulations are revised.

proposals to revise QA practices. These changes include the completion of construction projects,

• PRA evaluations in support of regulatory establishment of programs related to plant operations decisions should be as realistic as and maintenance, maturation oflicensee programs and practicable, and appropriate supporting personnel, and increased pressures to control plant data should be publicly available for operating costs. review.

The infonnation collections contained in this

• The Commission's safety goals for nuclear regulatory guide are covered by the requirements of 10 power plants and subsidiary numerical CFR Part 50, which were approved by the Office of objectives are to be used with appropriate Management and Budget, approval number 3150- consideration of uncertainties in making 0011. The NRC may not conduct or sponsor, and a regulatory judgments on the need for person is not required to respond to, a collection of proposing and backfitting new generic information unless it displays a currently valid OMB requirements on nuclear power plant control number. licensees.

B DISCUSSION The staff s review of 10 CFR Part 50 indicates that the option of applying QA measures in a manner During the last several years, both the NRC and the commensurate with safety significance is clearly available to licensees. That is, no exemptions from nuclear industry have recognized that PRA has evolved to the point that it may be used as a tool in current regulations are expected to be needed to regulatory decisionmaking so that the regulations can implement a graded qualitt assurance (GQA) be implemented more effectively, in 1995, the NRC program. The implementing mdustry QA standards issued a final policy statement on the use of PRA (which licensees have committed to implement to methods in nuclear regulatory activities (Ref.1). In its fulfill the requirements of Appendix B) also contain approval of the policy statement, the Commission general provisions for applying QA using a graded articulated its expectation that: approach. However, when implementing such changes, licensees may need to submit a revised

• The use of PRA technology should be QA program to the staff pursuant to 10 CFR 50.5-1(a).

increased in all regulatory matters to the extent supported by the state of the art in Purpose and Scope PRA methods and data and in a manner that complements the NRC's deterministic in this guide the staff descr>es an acceptable approach and supports the NRC's tradi- approach for identifying the safety significance of tional defense-in-depth philosophy. SSCs and assigning QA controls accordingly to ensure that QA requirements are being graded commensurate a PRA and associated analyses (e.g., with safety. This regulatory guide contains guidance bounding analyses, uncertainty analyses, on modifying current QA program controls based on and importance measures) should be used the safety categorization of the SSCs. This regu'aory in regulatory matters, where practical guide also describes acceptable approaches for 1.176-2 l

monitoring the effectiveness of the GQA program Energy Institute (NEI) in a letter dated June 15,1994 implementation and for determining when it may be (Ref.4). Irrespective of a licensee's specific approach, y necessary to make adjustments in QA practices and the NRC stated a graded QA program should have four

safety-significance categorizations to ensure that SSCs essential elements

Q remain capable of performing their intended functions.

The guide also delineates the principles for risk- (1) A process that determines the safety significance informed decisionraaking, or guiding features, of a of SSCs in a reasonable and consistent manner, GQA program that need to be dealt with by a licensee. including the use of both traditional engineering In some cases, rather than articulating a prescriptive and probabilistic evaluations i method that must be implemented by a licensee to fulfill these principles (or their subsidiary issues) for (2) The implementation of appropriate QA controls GQA, the staff has chosen to identify those issues that for SSCs, or groups of SSCs, according to safety must be evaluated, and documented, by licensees when function and safety significance to maintain formulating their particultr approach to GQA. Thus, reasonable confidence in equipment performance the burden would fall on the licensee to be able to and to support the GQA corrective action feedback inform the staff how the issues were addressed within process the site-specific program. This guide has been specifically written for situations when the !!censee's (3) An effective root-cause analysis and corrective I GQA program will result in changes to the QA action program program that do reduce commitments in the p*ogram description pmviously accepted by the NRC. (4) A means for reassessing SSC safety significance and QA controls when new information becomes Graded quality assurance (GQA) is intended to available through operating experience, or based I provide a safety benefit by allowing licensees and the. on changes in plant design.

NRC to preferentially allocate resources based on the safety significance of the item. The Commission har Organization and Content articulated its expectation that implementation of the policy to expand the use of PRA will improve the Limited data are available to define the impact of

"]J regulatory process in three areas: foremost through safety decisionmaking enhanced by the use of PRA QA programs on SSC performance. Consequently, this regulatory guide emphasizes the classification of insights, through more efficient use of agency equipment into safety-significance categories as resources, and through a reduction in unnecessary discussed in Section 2.2 and Appendix A of burdens on licensees. Background information about Regulatory Guide 1.174 (Ref. 3). Regulatory Guide initial efforts to implement GQA is in SECY-95-059, 1.174 describes a general four-element process that is

" Development of Graded Quality Assurance Method- elaborated upon in the context of GQA in the ology"(March 10,1995) (Ref. 2). Discussion section of this regulatory guide. The Regulatory Positions in this regulatory guide discuss Relationship to Other Guidance Dacument Element I, a definition of proposed changes to QA Applications applications; Element 2, which addresses engineering evaluations applicable to GQA programs; Element 3, Regulatory Guide 1.174 (Ref. 3) describes a which provides specific guidance for an acceptable general approach to risk informed, rer ulatory decision- approach for implementing GQA controls and for making and includes a discussion of specific topics developing performance monite .g strategies; and coramon to alt regulatory applications. This regulatory Element 4, documentation and submittal aspects guide provide- guidance specifically for GQA related to the change.

programs, consistent with but more detailed than the generally applicable guidance given in Regulatory PROCESS OVERVIEW Guide 1.174. Licensees may choose to use risk-informed decisionmaking in application areas other As the nuclear industry incorporates risk insights than GQA. It is anticipated that certain efficiencies into its QA programs, it is anticipated that the industry could be realized in that situation. will build upon its existing risk-informed activities, including the individual plant examination program.

Licensees developing GQA programs will adjust To provide the industry with the NRC's expectations their QA programs to accommodate their individual for risk-informed decisionmaking, Regulatory Guide

'9 needs. The NRC conveyed its goals and expectations for an acceptable graded QA program to Nuclear 1.174 (Ref. 3) was developeu. This guide establishes five safety principles and describes a four-element 1.176-3

P process for evaluating risk-informed regulatory SSCs. The following is an overview, with greater changes consistent with those principles, as illustrated detail provided in the Regulatory Positions. The in Figure 1. Regulatory Guide 1.174 provides elements are (1) define the proposed change, additional quantitative acceptance guidelines, discus- (2) perform engineering analysis, (3) define imple-sion of defense in depth, and safety margins. The mentation and monitoring program, and (4) submit principles are: proposed change.

1. The proposed change meets the current regulations Element 1: Define the Proposed Change unless it is explicitly related to a requested exemption or rule change. The process for developing the initial proposal for the changes is left to the licensee, but it should derive

2. The proposed change is consistent with the from an examination of both traditional engineering defense-in-depth philosophy. and probabilistic information, and it should result in categorization of the plant's SSCs based on their safety

3. The proposed change maintains sufficient safety significance so that an appropriate level of quality margins. controls can be applied. The licensee identifies the candidate SSCs and associated activities for a risk-

4. When the p-oposed changes result in an increase in informed application of QA requirements. A risk-core damage frequency or risk, the increases informed GQA submittal includes the QA program should be small and consistent with the intent of change required by 10 CFR 50.54(aM3)(ii), accompa-the Commission's Safety Goal Policy Statement. nied by the supplemental information described in Regulatory Position 4.1.2 of this guide, which will be

5. The impact of the proposed change should be mon- used by the staff to determine the acceptability of the itored using perfonnance measurement strategies. program. A licensee may elect to categorize a limited number of plant systems and apply GQA controls to The individual elements of this process are these selected plant systems. The SSCs included in the described in Regulatory Guide 1.174. Those generally bounding analysis discussed in Regulatory Position af plicable discussions are not repeated here. Instead, 2.2 determine which SSCs are candidates for this guide describes a method acceptable to the NRC categorization. If all SSCs in the PRA are included in staff for categorizing SSCs at nuclear power plants in a the bounding analysis, all SSCs may be candidates for manner commensurate with their safety significance categorization.

(using an integration of insights from traditional engineering analyses, applicable qualitative consider- The licensee identifies the sy stems to Se categorized ations, and probabilistic analyses) and for . pplying in the supplemental infonnation. The licensee can appropriate QA programs to each category of SSCs. choose when to categorize each system and may choose not to categorize all the systems identified in the The process begins with a set of actions related to submittal. If categorization of systems not included in proposed changes in the QA categorization of certain the supplemental infonnation proves desirable, the Traditional e PRA Analysis

,s ,a' q ,

s s s' ,' ,-

,' f, #

3. Define 4. Submit i' peg;" 2. Perform .

-> Engineering 4-> Impy entauon/ --> Procosed Ch "8# Momtonng Change Analysis Program

~

O Figure 1. Principle Elements of Risk-Informed, Plant-Specific Decisionmaking 1.176-4

licensee prepares additional supplemental information Element 3: Define Implementation Monitoring for NRC approval prior to implementation. SSCs that Program

~

\ should be considered as potential candidates include:

/ The third element involves developing GQA v .

Systems and components that are subject to control implementation and monitoring plans. These current QA requirements in Appendix B to 10 CFR plans should be formulated to ensure that appropriate Part 50, system and component performance are maintained.

For the safety-related SSCs in the high safety-SSCs modeled in the PR A for the plan:, significant category, no changes in QA controls are expected to be proposed. For the non-safety-related

+

Non-safety-related SSCs that are within the scope SSCs that are found to be high safety-significant. an of the Maintenance Rule (10 CFR 50.65), and evaluation would be performed to determine what augmentation of existing QA controls is appropriate.

+

Non-safety-related equipment that has previously For low safety-significant SSCs that are safety-related, received augmented quality treatment (e.g., reductions in QA controls are anticipated. For non-anticipated transient without scram, station safety-related SSCs that are low safety significant, blackout, fire protection). licensees would continue to define their quality controls. Means should be specified for monitoring the The licensee should ensure that the QA program performance of systems und components and of commitments and other QA-related information quality-related activities and processes and for germane to the contemplated changes in QA practices applying corrective actions. Cpecific guidance for are clearly understood and adhered to, unless modified Element 3 is provided in Regulatary Position 3.

or amended through the appropriate licensing or regulatory actions. The suitability of the plant-specific Element 4: Submit Proposed Change PRA should be assessed relative to its use in supporting the GQA decisionmaking process. In addition, The final element involves documenting the available industry and plant-specific operational analyses for NRC staff or independent review or experience information relative to GQA should inspection, and submitting the request to change D be assessed.

Further, the licensee should identify the overall implementation of QA commitments, as required by 10 CFR 50.54(a)if the change involves a reduction in the licensee's QA commitments (for example, a objective and approach of the proposed changes to the deviation from an NRC regulatory guide or American QA program for the candidate SSCs. More details are National Standards Institute ( ANSI) standard). If the provided in Regulatory Positior i of this document. proposed change does not involve a reduction in the licensee's QA commitments, prior NRC staff review Element 2: Perform Engineering Analysis and approval is not required and the change to the QA program is submitted in accordance with 10 CFR In Element 2, the proposed changes in the 50.71(e). The changes associated with the adoption of application of QA controls for SSCs as a function of GQA proposed by the licensee will be descibed in the categorization commensurate with safety are exam. QA Program. In addition,important assumptions that ined and assessed with respect to the relevant risk. play a key role in supporting the acceptability i f the informed decisionmaking safety principles. An QA program change should be identified by the essential element of the evaluation is the categoriza- licensee in the QA program. Documentation necessary l tion of SSCs into high and low safety-significant to support the GQA effort is listed in Regulatory categories. The impact of the QA program changes Position 4 of this regulatory guide.

i on defense in depth would be determined through the use of both traditional engineering evaluations and C. REGULATORY POSITION

! PRA techniques. In addition, an assessment would l ensure that no more than insignificant risk increases 1. ELEMENT 1: DEFINE Tile PROPOSED are introduced by the proposed changes, as described CilANGE in Regulatory Position 2. The engineering evaluation i helps to establish the salety significarce of systems The first element in the process of evaluating a m and components and determines that the effects of the change to QA programs involves providing a full j changes in QA controls has a small impact on plant definition of the proposed change. The first step is te j risk. More details concerning Element 2 are ,:ontained identify the overall scope of the GQ A program in terms l h:3ulatory Position 2. of the SSCs that are covered. Additionally, the 1.176-5

licensee's PRA would be evaluated with respect to its program commitments should be identified and adequacy so support the GQ A decisionmaking process. the manner in which they are being changed To accomplish this the licensee should: should be documented, reviewed, and approved by the NRC as necessary in accordance with the

1. Identify, and consider during the GQA process, the applicable regulato.y requirements (such as 10 set of regulatory requirements and commitments CFR 50.54(a)).

that are directly related to the proposed QA implementation changes as well as those that may 4. Evaluate risk studies to detennine the extent to be impacted. This information is used to which quantitative and qualitative risk insights demonstrate that the proposed QA changes do not may be utilized. The quality, level of review, and violate existing regulatory requirements. The accuracy of plant representation of the risk studies major regulatory requirements applicable to GQA should also be taken into account when programs are set forth in Appendices A and B to 10 determining the level of support the studies can CFR Part 50,10 CFR 50.54(a), and 10 CFR 50.34. provide to the development and implementation of Changes to technical requirements are controlled the GQA program. The licensee should also under existing processes such as 10 CFR 50.59, consider how it may use risk-study models, license amendments, relief requests, and exemp- computer programs, and personnel to support the tion requests, which are outside of the scope of this long-term performance monitoring program document. Relevant quality commitments that are required as part of GQA implementation.

to be considered reside in a variety of licensing documents such as the QA program description, 5. The licensee should not make any changes in the the Final Safety Analysis Report (FSAR), application of QA controls and processes prior to responses to generic communications, and the evaluation of the associated system or responses to enforcement actions. component to determine its safety significance as discussed in Regulatory Position 2 an.1 before

2. Identify the structures, systems, and components receiving approval of the proposed QA cnanges by (SSCs) and associated activities that are candi- the NRC, if required.

dates for assessment within the risk-informed application of GQA. The SSCs selected for the The definition of the change should be completed risk-informed application of GQA need not by categorizing the SSCs identified above according to include all systems within the scope of this whether they are high or low wfety significant. For regulatory guide. A licensee may elect to only those safety-related SSCs that are categorized as high categorize and apply GQA controls to a limited safety significant, current QA practices would apply, number of SSCs. For those safety-related SSCs For those non-safety-related SSCs that are high safety not categorized, the licensee's full Appendix B significant, some increase in QA controls may be QA program controls will continue to apply. warranted and should be implemented as appropriate.

For those safety-related SSCs that are low safety

3. Identify the expected revisions to existing significant, relaxation in QA controls should be implementing guidance of QA requirements that considered. For non-safety-related SSCs that are low will result from the GQA program. Although the safety significant, licensees would continue to define NRC staff would consider an application for their quality controls without NRC approval, changes to many areas of a licensee's QA program to support the GQA methodology, such an 2, ELEMENT 2: ENGINEERING application is not necessary. A licensee may EVALUATION initially choose to apply GQA controls only to selected portions of its QA programs, such as in the In Regulatory Guide 1.174 (Ref. 3), Element 2 is to area of procurement. No exemptiens from current perform the engineering evaluation to support regulations are expected to be needed to decisions to change a plant's licensing basis. Chan3es implement a GQA program. However, the in the application of QA controls do not lend commitments of each licensee regarding QA are themselves to a quantitative assessment because the addressed in a number of documents, including the relationship between QA programs and equipment FSAR, a QA topical report (if applicable), and performance (and, hence, risk contribution) has not other docketed correspondence (e.g., responses to been explicitly established. Furtbeimore, only a small generic communications, inspection reports). fraction of components that are candidates for Licensees ue expected to maintain control of their application of GQA controls are modeled in PRAs.

licensing bases. Accordingly, changes in QA This small percentage arises from PRA's emphasis on 1.176-6

l l l l l the control and mitigation of severe accidents; the The categorization process must also be capable of l

exclusion of equipment, such as recombiners, useful systematically tracking and documenting system ,

only for control of design basis accidents; the functional boundaries, defined as the point (compo- I j exclusion of most instrumentation and reactor nent) at which a system operating in a particular mode l 9 protection system equipment from the models; the functionally interfaces with a connected system. The l exclusion of emergency preparedness and plant categorization of the safety significance of support monitoring equipment from the models; the combining functions is generally determined by the categorization of SSCs with identical failure consequences into of the function being supported, augmented by a grouped basic events; and not including some highly quantitative or qualitative evaluation of the support reliable SSCs when other less reliable SSCs (of similar system's aggregate safety significance. Interfacing impact) or operator actions are modeled. function categorization should be well documented, traceable, and internal' sonsistent. Licensees who Categorization of the safety significance of SSCs chose to implement GQA programs one system at a for utilization in GQA uses quantitative PRA results, time must ensure that support system interfaces are supplemented by qualitative engineering evaluations sufficiently well defined and documented that the to include SSCs not modeled in the PR A, to develop an safety significance of interfacing systems will always initial categorization referred to in this regulatory be explicitly considered as each system is evaluated, guide as candidate high or low safety significance.

These initial categories should be evaluated, modified The scope, level of detail, and quality required of as appropriate, and approved during a final traditional the PRA are commensurate with the application for engineering decisionmaking process. Sech a which it is used and commensurate with the role the combined, integrated approach is necessary to utilize PRA results play in the integrated decision process.

the strengths and avoid inherent limitations in both PRAs used to support a GQA application should I probabilistic and traditional engineering analysis realistically reflect the actual design, construction, l methodologies. operational practices, and operational experience of l the plant and its operator. Furthermore, all calculations 2,1 Safety-Significance Categorization using the PRA model should be performed correctly and in a manner that is consistent with accepted A minimum of two levels of categorization should practices. The licensee must demonstrate that the PRA v

) be utilized, preferably labeled high and low safety and the calculations are of sufficient quality to support significant. At the prerogative of the licensee,a greater a decision on the acceptability of the proposed change.

number of safety-significance levels can be defined, such as three levels composed of high, medium, and A well organized and documented safety- I low safety significance. From a regulatory point of significance categorization process, sensitivity and view, it is essential that high safe.y-significant items bounding studies performed with the PRA, and are not inappropriately categorized as less than high, implementation of a robust monitoring and feedback I since these might then be inappropriate candidates for program can provide reasonable assurance that reduced QA requirements. Therefore, for regulatory implementation of GQA should result in an purposes, high safety significance may be assumed or insignificant change in risk. Consequently, NRC staff assigned. Only assignments oflow and medium safety evaluation of the quality of the PRA may be directed significance must be justified. toward a finding that the quality is sufficient for assigning SSCs into broad safety-significant catego-Systems have a variety of operating modes and ries for consideration in an integrated decisionmaking I

perform a variety of functions, with each function a process, well-defined task requiring the proper operation of some subset of system equipment. Although certain All operational modes and internal and external QA controls are applied at the component or even events should be included in the evaluation of the i

piece-part level, safety-significance categorization is safety significance of systems, functions, and most appropriately defined at the system function components. PRA models and results for coa damage l level. Therefore, the guidance in this regulatory guide and large early release frequency for interna! nitiating I is based on determining the safety-significance of events at full power should be used to support the system functions, identifying the components and categorization process. Licensees may use qualitative component operational modes required to sepport high studies of other initiating events and operational modes Q i safety-significant functions, and determining the categorization of the components based on this ll.at identify and characterize scenarios that are believed to be important, but without expending ,

information. significant resources in quantifying the frequencies of 1.176-7

3 the scenarios. Seismic margin analysis and fire- functions can be categorized as low or medium safety induced vulnerability evaluations (FIVE) done to significant. To provide confidence that eventual support the individual plant examination of extemal determination of less than high system safety events (IPEEE) analyses and shutdown risk configura- significance is made with full recognition of each tion control evaluations are examples of qualitative system's contribution to risk, system-level importance studies that have been developed. Evaluations based should be determined from importance measures on quantitative external and shutdown studies may also developed from the PRA. If the system is not modeled be used. If importance measures from quantitative in the PRA, the licensee should determine why the studies are combined with measures generated from system was not modeled and, guided by this internal event analyses, the licensee should ensure that determination, investigate through a traditional the greater uncertainties inherent in the analysis of engineering review whether any system functional external events and the modeling of shutdown events failure will degrade the performance of any human are fully considered during the final categorization. actions or any other systems' high safety-significant functions. A system-level safety significance may be 2.1.1 Identification of System Functions assigned based on the documented results of the review.

l Definition of the proposed change includes identification of all the functions a system must 2.1.2.1 Quantitative Safety Categorization perform. Although many system func'tions may Insights. Quantitative importance measures from risk eventually be categorized as low safety significant, studies provide valuable insights about the relative characterization of the proposed change begins with a ranking of the safety significance of PRA model description of all functions a system must fulfill. elements such as basic events, components, human System functions should include functions used during actions, functions, trains, or systems. At least two normal operation as well as all functions related to the quantitative measures of importance are needed, one prevention or mitigation of core damage, protection of (such as Fussell-Vesely (FV) or risk reduction worth containment integrity, or reduction in the release (RRW)) illustrates the fraction of current risk probability or consequence to the public from involving the failure of the model element; the other l

j accidents and transients both within and beyond the (such as risk achievement worth (RAW) or Birnbaum) design basis (e.g., risk analysis). illustrates the margin of safety contributed by the model element's proper operation. Other measures 2.1.2 System Function Safety-Signincance may be used, but at least two measures reflecting i Categorization current contribution and margin contribution are needed to balance the risk insights.

Determination of the safety significance of sptem functions is inherently a " top down" process, starting importance measures represent the risk sensitivity with the front-line systems and system functions of an individual model element. lmportance measures directly involved in plant-level safety functions (such should be compared to some quantitative guideline as reactivity control, reactor pressure control, and values. The specific values chosen as guidelines decay heat removal). The delivery of high pressure should be justified by the licensee and should reDect primary coolant from the reactor water storage tank to the estimated risk levels at the plant. All model the core may be categorized as a high safety-significant elements characterized by importance measures function. The pumps, valves, and other SSCs whose greater than (or less than, as appropriate) the guidelines proper operation is required to fulfill this function are identified as potentially high safety significant.

derive their initial categorization from the significance Once one element is varied, the importance measures of the function. Therefore, any determination of an for the other elements will change. Consequently, SSC's safety significance requires determination of while large or small importance measure values the safety significance of all functions the SSC identify candidate high or hw safety-significant model supports. Similarly, determin uion of the safety elements, final categorization is determined by an significance of support systeni functions (which expert panel during the integrated decisionmaking.

should be later pursued in the support system's evaluation)is best performed by determining the safety To ensure that the integrated decisionmaking is significance of the function being supported. made with adequate understanding of the sensitivity of the importance results to major PRA modeling Licensees may limit their evaluation to the system assumptions, techniques, and data, the licensee should level and assign all components to the same safety- address the technical issues associated with the use of significance category as the system. This will only risk importance measures to categorize SSCs reduce the burden on licensces if all the system discussed in Regulatory Guide 1.174. For GQA 1.176-h

l applications, a minimum of two sensitivity calcula- RAW and FV importar.ce measures will always be at tions are expected; one in which recovery' actions are least as large as the RAW and FV for basic events l p removed (that is, recovery probabilities set to 0.0) and '

whose failure will fail the function. If other importance D) r one in which all common cause failures (CCFs) are removed (that is, failure probabilities set to 0.0). The studies should be performed by modifying and measures are used with this technique, this property should be validated for the measures used.

l quantifying the original PRA logic model to minimize When basic events are used to charactedze the j truncation effects. These sensitivity studies are importance of system functions, the relationship  !

desirable since human actions and CCF probabilities between the failure of the basic events and the system l are derived from models requiring extensive functions they support becomes a critical consider- 1 interpretation and manipulation of observable data. ation. For example, the R AW of a CCF basic event that When an SSC moves into the high safety-significant fails a set of nominally identical pumps provides a category as the result of a sensitivity study, the expert reasonable estimate of the margin of safety the proper ,

panel should consider the reasonableness of the operation of the pumps is contributing. If the pumps recovery action or CCF event that caused the low fu' fill only one system function, the RAW of the CCF safety significance in the original results and consider provides a reasonable estimate of that function's l assigning the SSC into a higher safety-significant contribution to margin of safety. Any system function l category. If the sensitivity studies are not performed, modeled in the PRA that is supported by one or more additional peer and NRC staff review of the human basic events that have importance measures above the l l error a CCF probability development may be guideline values should be initially categorized as a l

necet , develop confidence that the quantitative candidate high safety-significant system function.

results } vided to the expert panel are sufficiently Since it is possible that the system f..nction's RAW and robust to support the categorization process. FV measures are much higher than those of any l . individual basic event, system functions not catego-

[ When each SSC is categorized, the safety rized as candidate high should, as a minimum, be significance of all the functions that SSC supports must further evaluated as discussed below, and the licensee be known. Therefore, the PRA model element most should describe technically how each issue was applicable to the SSC grading process described in this addressed.

O regulatory guide is a system function failure. System

(/ function importance provides the expert panel clear a The redundancy and reliability of trains within and documented information referencing individual systems that are available to fulfill a critically component functions to plant safety functions. important system function can have the result that Developing system functional importance will assist in each individual basic event within the system has both the risk categorization process and the NRC staff very low importance measure values or is even review. If basic event (such as component failure) truncated out of the results. A system based

, importance measures, rather than system function evaluation should be perfomled to determine the

! importance measures, are used to directly categorize impact of the failure of systems that are modeled in SSCs at the component level, the categorization the PRA but that have no single failure event (for process becomes more dependent on PRA characteris- example, no CCF) and no basic event importance tics such as system success criteria, system modeling measure above the guideline values. Discrepan-detail, and component modeling guidance. cies in the form of high failure consequence for l

j some systems (automatic depressurization system, l System functions generally require the proper for example) but low or no basic event importance l

operation of a group of SSCs and are represented in the measures should be identified and the relevant l PRA models as a set of logically linked basic events. high safety-significant functions defined and l Some PRA codes are not well suited to the properly categorized as high safety significant.

l development and quantification of system level l importance measures. One altemative technique uses

• Initiating events are often not modeled as basic

! basic event importance measures (readily calculated events or, if they are, are modeled as single by most PRA codes) to identify a set of system moduluized events. Some examples of such functions that are clearly high safety significant. This initiating events are the loss of instrument air, the technique is based on recognition that system function loss of main feedwater, the loss of offsite power

__ (through local switchyard faults), the loss of i(3 ' Recovery actions include human actions perforrned to return a failed alternating current (AC) or d.irect current (DC) ll j system or component to operability. Recovery actions may also include buses. If components whose failure contributes to

\ / using systems in relatively unusual ways. The procedures for recovery actions usually give only general guidance instead of step-by-step these initiating events are modeled .m other procedures and are not part of the standard traming rouime. initiating events (e.g., loss of an air compressor 1.176-9

leading to loss of pneumatic valves following a modeled. Thus, the importance of some systems, loss of component cooling), the importance of the functions, and structures will not show up in the basic events will not include the contribution of the PRA results since the functional failure is screened failure to the initiating event frequency. Thus, the out. (For example, screening out certain importance of functions whose failure would containment penetrations because of the number cause both an initiating event and the partial loss of of isolation valves involved obscures the mitigating function can be severely underesti- importance of the containment isolation function mated by surrogate basic event importance of the system.)

measures.

- Risk insights from nonquantitative external event PRA's integrated models provide an excellent and shutdown risk studies should also be used. All framework to characterize system and system function the system functions credited in these studies importance. One area relevant to GQA that PRA should initially be categorized as "high safety-modeling does not usually address is cross-system significant" candidate s. Final categorization into a dependencies arising from nominally identical lower safety-significance category should include components used in different applications throughout consideration of the initiating event's frequency or the plant. This occurs because cross-system magnitude and the ability of the SSC to respond to dependencies are typically not modeled (between the event.

nominally identical MOVs in different systems, for example) and because the resolution of the ~ RA + Risk insights from the evaluation of the models may not be sufficiently detailed (the PRA Mamtenance Rule (10 CFR 50.65) should be analyst may not be able to determine whether the incorporated to ensure the identification of I circuit breakers in two different systems are identical functions that are (1) relied upon to mitigate i models, for example). Cross-system dependencies are accidents; (2) used in emergency operating not modeled in PRAs yet can have a significant impact procedures;(3) those whose failure could prevent on risk. Consequently, licensees must develop a a safety-related SSC from performing its safety- .

I monitoring program capable of timely identification of related function; and (4) those whose failure could repetitive failures of nominally identical equipment for cause a reactor scram or actuation of a safety-further investigation. related system.

2.1.2.2 Qualitative Safety Categorization + PRA importance measures do not fully address the insights. PRA results are to be used in conjunction significance of SSCs that support operator actions with traditional engineering, and the ,cinciples for emergency and severe accident management.

associated with defense in depth and safety margins Such systems can include environmental controls, must also be factored into the safety-significance lighting, alarms, communications, and annuncia-determination. Consequently, the following qualita- tors. Determir.ation of the categorization of such tive factors should be applied to the quantitative PRA systems should include consideration of whether insights developed in the previous section. The the loss of such systems could cause short-term or licensee is to be able to describe technically how each long-term problems, whether a system failure issue was evaluated and resolved.

coincident with an accident is likely, and whether personnel could reasonably compensate for the

- The diversity of systems that are able to fulfill loss of these support systems.

critical high level functions (e.g., reactivity controi, decay heat removal) can have the result 2.1.3 Identification of Components that that each individual system could meet all Support Functions quantitative guidelines to be categorized in the low safety-significance group. It would be prudent, QA controls are applied at the component level and the licensee is expected, to designate at least while PRA basic events often represent groups of one system associated with critical high-level components. For example, a diesel failure basic event functions as high safety significant. in the PRA can represent a large number of plant equipment parts, including such items as the diesel

+ Screening analyses are used to dismiss some motor, oil pump, oil cooling fan, motor generator.

functional failures as insignificant. In many cases, Other components are not included in PRA basic credit for the redundancy or reliability of plant events because their reliability is assumed to be high systems or structures is taken to bolster the enough that their failure probability would have a arguments that the functional failure need not be negligible impact on the CDF and LERF. Therefere, 1

I 1.176-10

once the high safety-significant functions in a system furictions requiring support from other ystems.

for which GQA is being implemented have been Eventually, the categorization of all support functions o identified, the plant equipment required to support the slaould be consistent, e.g., the safety significance of the

/,

high safety-significant functions must be identified functions requiring support in the upper-tiered system independently of the PRA basic event definitions. corresponds to the relevant function in the support system.

An efficient format to identify this component versus system function is a matrix that lists and cross- 2.1.4 Safety-Significance Categorization references the high safety-significant systern functions of Components to all the components needed to support each function at the level of equipment specificity at which changes The final categorization of system functions and in the application of QA controls will be pursued. the components that support the high saf ety-significant Although a matrix is not necessary, well-organized system function is selected by an integrated assessment information to support the final deliberations and to of quantitative and qualitative risk insights as provide a traceable record for future licensee described in Regulatory Position 23.

evaluations and for NRC inspections should cover all high safety-significant system functions, all system The safi.ty-significance categorization assigned to components that support the high safety-significant components (and to support system functions that can be functions, and all external system support functions treated as component functions for initial categoriza-required by any component. The licensee is to be able tion)is based on the safety significance of the function to describe technically how each issue was addressed the component supports. Components that support only and resolved. Here are some examples that illustrate low safety-significant functions should be classified low areas of potential concern regarding the accuracy and safety significant. The safety significance of completeness of this information. components supporting high safety-significant func-tions need not always be high, but each such

• One component can directly support another categorization as low safety significant should be system's function. For example, some contain- explicitly evaluated and documented and in conform-ment smnp recirculation valves are nominally ance with licensee-defined guidelines. Justification for f3 ass %d to the low-pressure injection system but categorizing a component's safety significance as low Q dietly mpport containment spray by providing the recne Nticn f'ow path.

based on high reliability alone will not be acceptable, because the high reliability may be the result of the QA controls applied. If it is not the quality controls that are

• Some instrumentation can belong to one system the cause of the high reliability, thejustification should but provide signals used in other systems, or be describe the source of the high reliability.

used by the operators as a basis for proceduralized or unproceduralized actions. Instrumentation used 2.2 Demonstration of Conformance with to actuate and control system and plant functions Safety Principles needs careful attention if grading of instrumenta-tion b contemplated. Once the full set of low safety-significance candidates has been identified, it is necessary to a Component failures could lead to an initiating demonstrate that the proposed changes to the QA event such as loss of feedwater or loss of requirements for these candidates do not violate the component cooling water. Components whose safety principles. Guidelines for making that failure could cause an initiating event should be demonstration with due consideraticn for the scope of identified in the matrix as being necessary to the GQA program are summarized below. Other support the normal operation function (e.g., air- equivalent guidelines are acceptable.

operated feedwater control valves are required to support feedwater at power). GQA programs need to reflect the multiplicity of current regulations and programs to which some SSCs Well organized and detailed information is also are subject. For example, some SSCs may need to be needed to systematically propagate safety categoriza- excluded from certain reduced QA control categories if '

tion through successive tiers of support systems not those SSCs are also governed by more stringent modeled in the PRA. If systems are not graded in a top- American Society of Mechanical Engineers (ASME) s down sequence, it is particularly important that the Code provisions to meet the requirements of 10 CFR evaluation should include a traceable record of the 50.55a. In such instances, the ASME Code

-(%

previously assumed categorization of upper-tiered requirements must be met.

1.l W il

l l 2.2.1 Engineering Evaluation Guidelines

• The GQA process will not result in changes to the plant configuration. Therefore, no existing phant The engineering evaluation should assess whether barriers will be removed. Addinonally, existing the impact of the proposed change is consistens with system redundancy, diverQy, and independence the defense-in-depth philosophy. An acceptable st

• of will be maintained.

guidelines for making that assessment is summarizel l below. Other equivalent decision guidelines are +

The GQA process will not result in changes to the technical requirements (e.g., design bases or acceptable, operational parameters) associated with SSCs.

• A reasonable balance among prevention of core damage, prevention of containment failure, and +

The resulting QA provisions will provide the consequence mitigation is preserved. necessary level of assurance that low safety-cignificant, safety-related and high safety-

• O,'er-reliance on programmatic activities to spificant, nou-safety-related SSCs remain capr ble compensate for weaknesses in plant design is of p0 forming their safety function.

avoided.

The core damage frequency (CDF) and large early l

• System redundancy, independence, and diversity release frequency (LERF) figures of merit do not fully are preserved commensurate with the expected cover long-term containment overpressure protection.

frequency and consequences of challenges to the Functions credited in the PRA for long-term system and uncertainties (e.g., no risk outliers). overpressure protection, but which do not contain any SSCs with CDF or LERF based importance measures

• Defenses against potenthi common cause failures above the guideline values, should be identified and are preserved and the potential for introduction of the safety significance explicitly assigned. For new common cause failure mechanisms is example, the containment spray systems for PWRs assessed. may not contribute to the prevention or mitigation of core damage or large early release.

• Independence of barriers is not degraded.

An important factor to ensure that defense-in-Defenses against human errors are preserved. depth and safety margin considerations are not degraded during the implementation of GQA is control

• The intent of the General Design Criteria in of potential common mode failures, As discussed in Appendix A to 10 CFR 50 is maintained. Regulatory Position 2.1.2.1, groups of nominally l identical SSCs. utilized in multiple systems throughout

! The engineering evaluation should also assess the plant, can as an aggregate hau high safety l whether the impact of the proposed change is significance.

l consistent with tb principle that sufficient safety margins are raaintained. An acceptable set cf Principle 4 in Regulatory Guide 1.174 (Ref. 3) l guidehnes for making that assessment is summarized states that any proposed increase in CDF and risk are l below. Other equivalent decision guidelines are small and are consistent with the intent of the l

acceptable. Commission's Policy Statement (Ref.1). Although the risk impact of GQA changes on individual components Codes and standards or alternatives approved for is expected to be minimal, reduced QA oversight may be use by the NRC are met. applied to a large number of SSCs. It is raognized that limited data are available to define the impact of QA Safety analysis acceptance criteria in the licensing programs on SSC reliability Accordingly, the licensee basis (e.g., Final Safety Analysis Report (FS AR) should perform a bounding analysis in which the failure and stqporting analyses) are net, or proposed rates or probabilities for basic events representing SSCs revisions provide sufficient mirgin to account for that may be subjected to reduced QA controls are set at analysis and data uncertainty some increased level (chosen and justified by the licensee). Alternatively, the licensee may choose to 2.2.2 Guidelines for Defensi. in Depth and Safety address the bounding analyses by modifying the Margins uncertainty distributions in some manner (also chosen and justified by the licensee).

Defense in depth and safety margins are expected to be addressed generally by considering the The bounding analysis should include all SSCs following GQA program aspects. modeled in the PRA on which QA controls may be 1.1 W 12

l reduced in all systems that the licensee defines as being probabilistic, and qualitative information available I within the scope of the GQA program. SSCs not- regarding the systems and system functions within the l modeled in the PRA must be reviewed to verify that defined scope of the GQA program changes. The I

, ' their failure will not impact any functions modeled in evaluation should include either resolving or

\ the PRA. Any potentialimpact on systems modeled in approving the resolution of the quantitative and the PRA must be qualitatively addressed. qualitative issues addressed in Regulatory Positions

2. i .2. I and 2.1.2.2.

It is recogninJ that the categorization of SSCs for the bounding m.nalysis will necessarily be an initia! Safety significance may be determined using ,

categorization, most likely based on an evaluation of guidelines related to prevention and mitigation of core basic event importance measures augmented by a limited damage, as well as containment integrity and LERF.

deterministic review. The purpose of such a study is not Factors such as potential common mode failures, to estimate a new plant CDF and LERF, but to understand human errors, defense in depth, the importance of plant the potential or bounding impact of the proposed change equipment used for emergency preparedness and plant and to assess the risk impact through bound 6g momtonng functions, and the maintenance of safety evaluations. The results should be compared to the margins should also be fully considered.

acceptance guidelines in Regulatory Guide 1.174 and 4 contrasted with aspects of the GQA program 3. ELEh1ENT3: DEVELOPlalPLEhlENTATION I implementation that are expected to provide an AND hlONITORING unquantifiable safety benefit. If, during the categori. STRATEGIES zation process, it becomes apparent that the initial '

categorization is modified to such an extent that the This section addresses the f.irst, second, third and bounding results may be non-conservative (that is, SSCs fifth principles for nsk-informed decisionmaking. The that were high during the bounding analysis are being objective or the GQA effort is to implement a GQA placed in lower categories), a new bounding calculation pr gr m that provides a reasonable level ofconfidence should be performed. If the original results are exceeded,  ! hat plant SSCs will be capable of performing the,ir the licensee should adjust the category of selected SSCs intended functions. The extent of QA controls w,ll i be categorized or adjust the categorization criteria. determined by the relative safety sigmficance and ,

safety functions performed by the equipment to which i 2.3 Integrated Assessment those controls are applied. The licensee's revised GQA program should specifically identify how the Generally, the performance of, and integration of, criterion in Appendix B to 10 CFR Part 50 will be the above described evaluations should be perfonned satisfied. The beensee may adjust the elements of the by a number of technically knowledgeable personnel. QA Program as deemed necessary to provide a r One acceptabb approach to accomplish this function is re s n ble level of confidence that the SSCs will be to utilize a multi-disciplinary review group of cap ble of performing their intended function. The technically proficient plant personnel, referred to here b""l, .' will demtonstrate achieve that the proposed progra as an expert panel. in tota is sufficient this objective,

. . . 3.1 Grading of Quality Activities If the integrated assessment function is performed by an expert panel, the expert panel determines safety The first step of the evaluation process is for the significance and considers QA program adjustments licensee to identify specific elements of the Q A program for SSCs accordingly. The panel would normally controls that will be adjusted for the set of plant include experienced representatives from various equipment that is defined to be low safety significant.

disciplines such as operations, mamtenance, engmeer- For example, a licensee may propose a change to its ing, safety analysis and licensing, and PRA. The verification practices and perform verifications by compesition of the expert panel should be augmented, sampling. Additionally, the licensee should identify the if necessary, to support the purpose of the safety- approach for evaluating the adequacy of QA controls for

, significance ranking and the grading of QA controls. non-safety-related SSCs determined to be high safety i For example, because of the emphasis on QA significant. Augmented quality controls will likely be i

considerations in the GC 3. process, QA and warranted for these items.

! procurement engineering personnel may be assigned to the panel. 3.1.1 Regulations and Commitments

]

The expert panel is responsible for determining the In accordance with the first principle, no M safety significance of the system functions and SSCs. exemptions from current regulations are expected to be The panel should evaluate traditional engineering, needed to implement a GQA program.

l 1.176-13 f

l _ _

The licensee's QA program description should be " Technical Specifications," remain in effect and may revised to address GQA activities applicable to safety- not be changed by means of the GQA program related SSCs of low safety significance, including a description.

discussion of how the applicable requirements of Licensee commitments regarding QA are ad-Appendix B to 10 CFR Part 50 will be satisfied for that dressed in a number of documents, including the part of the program in accordance with 10 CFR 50.34(b)(6)(ii). This may be accomplished by a FSAR, the QA Topical Report, and other docketed discussion that identifies exceptions to applicable correspondence (e.g., responses to generic communi-NRC regulatory guides and associated endcrsed cations, inspection reports). Licensecs are expected to industry standards or by including additional text that maintain control of theirlicensing bases. Accordingly, describes how Appendix B will be satisfied (merely re- changes from current commitments to QA regulatory stating the Appendix B provisions will not be guides that will be revised as part of the GQA program acceptable). The submittal should adequately describe should be identified, and the manner in which they are the safety-significance determination process and the being changed should be documented, reviewed, and adjustments made to the QA provisions associated approved as necessary by the NRC in accordance with with the 18 criteria of Appendix B to 10 CFR Part 50 to 10 CFR 50.54(a), as appropriate.

describe how the requirements will be satisfied in a graded manner. While considerable flexibility may be 3.1.2 Grading of Quality Elements exerciaed, the GQA program should be based on standards of performance that are clear, definite, and After categorizing the system functions and enforceable. subsequently the SSCs into two or more safety-significance categories as described throughout this

~

Grading of QA activities will likely result in regulatory guide, the licensee should apply appropriate changes that reduce QA program commitments QA controls for the various categories. This is a relating to SSCs of low safety significance. In that critical factor in achieving the goals of the GQA event, the NRC would expect the licensee to submit a initiative and is performed by an integrated QA program change to the NRC in accordance with assessment, for example, by an expert panel, as 10 CFR 50.54(a), as discussed further in this section discussed in Regulatory Position 2.3.

and in Regulatory Position 4.

For safety-related SSCs determined to be high However, plant SSCs cannot be reclassified as safety significant, or for safety-related SSCs that have non-safety-related solely on risk considerations. not yet been evaluated in accordance with the GQA Regulatory requirements in Section VI(a)(1) of process, the current QA practices contained in the Appendix A to 10 CFR Part 100,10 CFR 50.2, NRC-approved QA program should be retained.

10 CFR 50.49(b)(1), and 10 CFR 50.65(b)(1) pre-scribe the criteria for determining which SSCs are Licensees have the flexibility to define the '

safety-related and are subject to the provisions of processes used to achieve reasonable confidence in l Appendix B to 10 CFR Part 50. However, GQA does SSC performance commensurate with their safety l allow for differences in Q A controls for safety-related significance. Therefore, the licensee may develop i i

SSCs based upon their safety significance. reduced, or graded, quality assurance controls for those safety-related SSCs assigned to the low safety-GQA programs should not result in either intended significant category. Examples of areas in which this or effective changes in the design, configuration, or may be possible are listed in Regulatory Position 3.2 of technical requirements of plant systems. Such design this regulatory guide. In proposing to reduce controls, or configuration changes would occur, for example, if two basic objectives sisould be kept in mind. These are QA program reductions result in a loss of confidence of that the GQA program should be sufficient to ensure ,

the SSC's ability to perform its safety function. The the SSC's design integrity and ability to successfully 1 licensee should ensure that changes to technical perform its safety function and that the GQA program l requirements are only made in accordance with should include processes and documentation that I applicable regulations. support an effective conective action program as I discussed in Regulatory Position 3.3.2. Accordingly, l Other regulations, such as the requirements of 10 in reducing or enhancing the QA program for any SSC, CFR Part 21," Reporting of Defects and Noncompli- the licensee must describe how the proposed changes ance," including provisions related to basic compo- will achieve the objectives. Also, consideration should '

nents and commercial grade item dedication; 10 CFR be given to issues such as CCF, as discussed in 50.55(a)," Codes and Standards"; and 10 CFR 50.36. Regulatory Position 2.2.

1.176-14

_ . _ _ _ _ .m . _ _.___ _ _ . _ _ __ __ _ __. _ __

i It should be emphasized that a certain number of 3.2 Potential Areas for Implementing GQA SSCs currently categorized as non safety-related Program Controls .

(i.e., that have not previously been subjected to an )

Appendix B QA program) may fall into the high Low safety-significant SSCs that are safety-safety-significant catagory based on application of related, to which the QA program controls in Appendix the methods described in this regulatory guide. B to 10 CFR Part 50 have previously been applied, are These non-safety SSCs become important because candidates for grading subject to the guidance the categorization of safety-related SSCs as either discussed earlier. In addition, for high safety-t high safety significant or low safety significant is significant SSCs that are non-safety-related, licensee l derived either directly or indirectly from the evaluation should be performed to identify proposed l licensee's PRA or from qualitative methods that augmented quality controls.

consider the results of PRA when available. In j particular, PRA takes credit systemajcally for non-Some areas that may be appropriate for applying l safety-related SSCs as (1) providing support to, (2)

GQA program contro!s for safety-related SSCs of low alternatives to, and (3) back-ups for safety-related safety significance are discussed below. The SSCs. Thus, the categorization of safety-related functional areas discussed below are not all-inclusive i SSCs as low safety significant depends upon the and licensees may propose graded controls in other l l_ proper operation and reliability attributed to non-areas, provided it can be shown that the objectives safety-related SSCs as part of the safety-sigmficance discussed in Regulatory Position 3.1.2 are met. The determination process. '

i goal is to allow licensees flexibility to define l

acceptable QA controls that provide reasonable Licensees should evaluate whether augmented confidence that the SSCs will perform their intended QA , practices are warranted for "high safety- functions. As discussed in Regulatory Position 3.3.2, sigmficant, non-safety-related" SSCs. The applica-the assignment of QA controls is dynamic in nature.

l tion of augmented controls provides reasonable i As part of the GQA process, it is necessary to consider I contidence that the reliability assumed m the risk analysis, or the associated qualitati ve decisionmaking feedback information from the monitoring and corrective action elements that may lead to a need to

process, remains valid. Licensees may voluntarily reinstate controls that had been relaxed. Further details select certain Appendix If QA program controls as of specific GQA prectices that the staff has found augmented quality provisions. However, a heensee may determme that the amount of QA controls acceptable for low safety-significant items l

currently being applied to these high safety- are described in SECY-97-229, " Graded Quality sigmficant, non-safety-related SSCs are appropriate.

Assurance /Probabilistic Risk Assessment If there is reasonable assurance that the SSC will Implementation Plan for the South Texas Project Electric Generating Station" (Ref. 5), the associated j perform its mtended function, there may be no need t I

apply augmented QA controls. The licensee should licensee QA program change, and other documents be able to provide a documented basis concerning the referenced in the staff safety evaluation attached to SECY-97-229*

adequacy of the QA controls applied to these high i safety-significant, non-safety-related SSCs. The When considering the application of GQa, discussion that QA controls will be applied to high safety-significant, non-safety-related SSCs, and the controls, the licensee should consider the essential delineation of the augmented quality controls that elements of the process (such as the safety-sigmficance j will be applied to those SSCs must be documented by determination, identification of GQA controls, the licensee in the QA program. In the above manner, associated corrective action methods, and performance risk insights will be used in an integrated manner to monitoring) to be high safety-significant activities that identify areas in which improvements should be are not subject to grading.

implemented.

3.2.1 Procurement if the PRA analysis assumed that certain non-safety-related SSCs would perform particular func. Licensees may establish less stringent QA tions under postulated design basis conditions (for requirements for the procurement of low safety-i example, seismic, harsh environment, or fire), and significant components than for high safety-these SSCs are categorized as high safety-significant, significant components. In making these changes, s

then GQA controls that address the equipment licensees must consider requirements in 10 CFR Part characteristics that support the credited function 21 and Appendix B to 10 CFR Part 50 and must should be considered. consider any still-current commitments based on the

, 1.176-15 1

i . __ _

use of withdrawn regulatory guides.2 Within this process concerning the functions of SSCs, as they may area, the technical requirements for commercial provide useful insights for identifying critical grade item (CGI) dedication in accordance with 10 characteristics to be used during the dedication process CFR Part 21 (critical characteristics of an hem for an application) are not subject to grading. However, for 3.2.2 Inspections safety-related items of low safety significance, the verification of critical characteristics may be graded The licensee may chose to reduce inspection (e.g, by reduced sampling plans or alternative testing activities related to low safety-significant SSCs and techniques). Other procurement-related activities choose to perform monitoring or surveillance such as auditing, qualifying suppliers, and receipt oversight to ensure that components can perform their inspection may also be graded. Licensees should intended functions. Verifications by peer personnel consider the role its procmement practices play in may be implemented for safety-related low safety-ensuring the prevention of cross-system common significant SSCs provided that the licensee uses cause failures and implement the procurement individuals who are qualified to do inspections and activities accordingly. who are independent from the actual performance of the work activity as discussed above. However, these A licensee may choose to reduce current changes cannot conflict with ASME Code-required commitments regarding certificates of conformance inspections and examinations or other inspections and that are based upon regulatory guides that have been examinations specified in NRC regulations (e.g., use withdrawn.2 The licensee would instead follow the of the Authorized Nuclear Inspector services).

I guidance in sections 4.2.a 10.2.a through f, and 10.3.2 in ANSI N45.2.13 (Ref. 6). The licensee may choose to reduce commitments to section 5.2.7 of ANS 3.2/ ANSI N18.7 (Ref.10) to A licensee may choose to reduce commitments to perform post-work inspections for maintenance and l ANSI N45.2.13 (Ref. 6) regarding source verifications modification activities depending upon the complexity and procurement program audits described in Sections of the work. Post-work inspections would then be 7.2.1. 7.3.1,10.3.1, and l2. The change of practices in performed for relatively complex maintenance and this area for low safety-significant items would be modifications. Other verifications such as applicable appropriate. However, licensee practices for receipt surveillance testing, receiving inspections, and inspections, post-installation testing, and a compo- inservice inspections would continue to be performed nent-level monitoring program will provide feedback for the low safety-significant item.

to identify any necessary corrective actions.

Licensees may propose to reduce their require-A licensee may reduce commitments associated ments regarding personnel who perform inspections with Regulatory Guide 1.38 (Ref. 7) and other on low safety-significant items. Those inspection (previously withdrawn) guides 2 and with ANSI personnel will need to be experienced, task-qualified N45.2.12 and N45.2.2 (Refs. 8 and 9) regarding the journeymen, or supervisors who did not perform or conduct of extemal supplier audits and supplier directly supervise the activity being inspected. These evaluations. For low safety-significant items, the personnel will need to receive training in the quality external supplier audits could be done as deemed organization's inspection procedures, processes, and necessary on an unschedulc_ sis. The associated methods in accordance with a training program supplier evaluations could be done on a biennial basis. approved by the quality organization. The quality Overviews of suppliers will be based on performance organization will need to provide periodic oversight of monitoring and trending of feedback from receipt these inspectors. This provision would also not be inspections, pou-installation tests and inspections, and applicable for staff who perfonn nondestructive plant operational results. examinations.

Licensees should also consider the results of the evaluations generated during the categorization 3.2.3 Records and Documentation 2 several QA-related regulatory guides were withdraw n in 1991 because the Documentation, such as procedures and design ANsl standards that they endorsed were incorporated into ANst/AsME packages, for low safety-signiricant SSCs may be less WQA.1-1983 "Quahty Assurance Pro;;: ram Requirements for Nuclear . .

detailed than for high safety-sigmficant items. In pagai,, The withdrawal of a regulatory guide does not alter any prior or exisung heensee comnntments based on the use of the withdrawn assessing the level of detail specified in procedures or regulatory guides. At their discretion, hcensees with pnor or exisung actual packages related to iow sarety-significant items, commitments to withdraw n regulatory guides or standards may contmue to implement those pronsions, or revise their comtrutments to adopt the there should be enouE h evidentiarydetail to maintain ANSUAsME NQA. I.1983 standard plant design and configuration control. Further, 1.176-16

l l

l l sufficient records need to be maintained to evaluate 3.3 Integrated Performance Monitoring Process l l

failures, to perform root cause analyses, and to  !

f; determine appropriate corrective actions. The implementation of an integrated performance l monitoring process is necessary to ensure that the l

\ 3.2.4 Audits observed reliability and availability of SSCs following implementation of GQA remains consistent with the l Processes and work associated with low safety- engineering evaluation developed to support the i significant SSCs may be audited less deeply and less categorization process. The elements of an effective l

frequently than high safety-significant activities. performance monitoring process are generally discussed Surveillance, performance monitoring, self-assess- in Section 2.5 of Regulatory Guide 1.174 (Ref. 3).

ments, trend data, or other activities may in some cases replace formal audits in low safety-significant areas. As discussed in this regulatory guide, GQA programs do not follow in detail all the steps inherent in 3.2.5 Staff Training and Qualification other risk-informed regulatory decisionmaking appli-Requirements cations as outlined in Regulatory Guide 1.174, because many of the SSCs ofinterest in GQA programs are not The licensees may establish different training and modeled in the PRAs, and it may not be possible to I qualification requirements for personnel performing quantify the effects of changed QA programs on the I tasks only on safety-related low safety-significant modeled SSCs' performance. For these reasons, a l SSCs however, those personnel would need to remain larger portion of the decisionmaking is left to the  !

sufficiently technically proficient in their assigned discretion and judgment of licensee personnel who area of responsibility to provide reasonable confidence perform the integrated assessment function (typically that their tasks were adequately performed to ensure an expert panel).

l that affected SSCs would be capable of performing their intended functions. The licensee must meet the In the GQA program, the " operational feedback" l requirements of the applicable regulations and and " corrective action" portions of the program technical specification requirements pertaining to assume considerable importance, and their accept-

training programs and staff qualifications. ability must be pivotal in the determination of the

1. s) y/ 3.2.6 Corrective Action overall program's acceptability and effectiveness.

The licensee should develop criteria for monitoring

! the reliability and availability of (1) safety-related, The GQA effort will identify a population of low low safety-significant and (2) non-safety-related, safety-signi6 cant, safety-related items. In accordance high safety-significant SSCs based upon risk insights with Criterion XVI," Corrective Action,"of Appendix developed during the safety-significance categoriza-B to 10 CFR Part 50, the timeliness of corrective tion process. The level of monitoring (e.g., SSC, actions for these items can be prioritized commensu- train, system) should provide the capability to rately with their safety significance. determine whether and when the reliability and availability of safety-related, low safety-significant l 3.2.7 Design and non-safety-related, high safety-significant SSCs deteriorates to unacceptably low levels and should Tne licensee may choose to change selected include trending aspects intended to identify '

i commitments to previously withdrawn regulatory deteriorating performance. As QA programs address

- guides2 or ANSI Standard N45.2.ll (Ref.11) for low a broad spectrum of plant activities, the monitoring safety significant items. These changes could relate to process should address monitoring of both plant (1) the need to consider all design input aspects as hardware (SSCs) and the effectiveness of the process stated in Section 3.2 of ANSI N45.2.11, instead and the organization.

replacing this need with the need to prepare a documented checklist for only these items deemed 3.3.1 Operational Feedback Process necessary; (2) the need to censider, and document i

wbn deemed necessary, the 19 design review items The GQA program should include a feedback delineated in Section 6.3.1 of ANSI N45.2.11; and (3) process (which is generally performed by licensees i the adoption of independent design verification irrespective of GQA) to evaluate plant and industry provisions contained in section 6.1 of ANSI N45.2.11 operational experience and the potential need to revise fT in lieu of the more restrictive position in previously SSC safety-significance categorizations or QA i nj l\

withdrawn regulatory guides.2 This would not obviate the need for inter-disciplinary design reviews.

controls. Sources ofinformation that should be used to provide input to this feedback process include:

l 1.176-17 1

• Oper: ting Experience: Sources of operating A program assessment, which could be accom-experience data include licensee perfonnance plished in conjunction with similar Maintenance Rule indicators, NRC generic communications, Insti- provisions, should be performed to ensure that the tute of Nuclear Power Operations (INPO) and overall GQA process (activities associated with safety-Electric Power Research Institute (EPRI) design significance determination, grading of QA controls, reliability data, Systematic Assessment of Lic- implementatic.' of performance monitoring, and ensee Perfonnance (S ALP) reports, licensee event application of orrective actions) is being effectively reports (LERs), NRC inspection reports, equip- implemented and provides insights into whether the GQA program needs improvements. As part of the

(

ment maintenance histories, plant performance reviews, reliability and unavailability data, assessment, (1) plant deficiencies should be evaluated, equipment perfonnance or condition trending and (2) the bases for (a) the safety-significance da.a, and quahty assurance assessments. The categorizations (e.g., the PRA model and assumptions) industry-wide data should be evaluated for and (b) the assignment of Q A controls to each eategory consistency with PRA assumptions, system should be evaluated to determine whether they unavailabilities, and other plant-specific data. continue to reflect plant design and operating practices. This assessment should not be performed in

• Plant Modifications and SSC Replacements: a graded manner and should be considered to be a Plant modifications, as well as SSC replacements h:gh safety-significant activity as it serves to confirm and parts thereof, might affect the safety- the integrity of the GQA process implementation.

significance determination or selection of QA controls for low safety-significant SSCs. Accord- 3.3.2 Corrective Actions ingly, the GQ A program should include provisions to periodically review plant modifications with The licensee's GQA program should include respect to their potential impact on safety- comprehensive and effective corrective action and root significance determinations. Alternatively, the cause analysis processes. Failures of safety-related, design change process may include provisions to low safety-significant SSCs and non-safety-related, verify that changes do not affect SSC safety high safety-significant SSCs should be identified significance or associated QA controls. through operational feedback or trending processes so that the licensee can ascertain whether the SSC's

• Reliability and Availability Monitoring: The unacceptable performance may be attributed to licensee should develop a living PRA or define deficient QA controls or practices. Licensee corrective performance thresholds based on ensuring, to the action or trending programs should identify and extent possible, that the equipment performance determine the apparent cause of failures of SSCs to ,

assumptions used in the PR A and upon which most determine whether licensee-established performance of the safety categorization is based remain valid. criteria or quality elements need to be changed. If the The staff expects that licensees will integrate, or at failure is determined to apply generically to other least coordinate, their monitoring for risk- SSCs, or the failure represents a potential common informed changes with existing programs for cause concern for similar equipment installed in monitoring equipment performance and other multiple systems, or if an excessive number of failures operating experience on their site and throughout occurs that exceed licensee-established thresholds, the industry. In particular, monitoring that is then further licensee evaluations are warranted. An performed as part of the Maintenance Rule apparent cause determination is warranted to screen implementation can be used when the monitoring the failures in order to ascertain the necessity to performed under the Mamtenance Rule is perform more in-depth evaluations.

sufficient for the SSCs affected by GQA. As GQA requires monitoring of SSCs not included in the The SSC risk-categorization methodology could Maintenance Rule, or requires a greater resolution be affected by the SSC reliability ad unavailab;lity of monitoring than the Maintenance Rule assumptions. These assumptions o could affect (component vs. train- or plant-level monitoring),it final categorization decisions to the extent that may be advantageous for a licensee to adjust the reliability and unavailability were used as a licensee Maintenance Rule monitoring program rather than criterion for determining the safety significance of an to develop additional monitoring programs for SSC that fails or exhibits a declining performance GQA purposes. Section 2.3," Element 3: Define trend. Both the probabilistic and non-probabilistic Implementation and Monitoring Program," of methods previously used should be re-evaluated when Regulatory Guide 1.174 provides amplifying there is significant disparity between the analysis guidance in this area. assumptions and the observed data. The GQA 1

l 1.176-18 s

l program controls should be evaluated to determine section. The guidance is intended to help ensure the l whether they need to be strengthened as a result of the completeness of the information provided and to aid in l p failures. Based upon positive performance monitoring shortening the time needed for the review process.

results, the licensee may further evaluate both safety- Additional guidance on style, composition, and significance categorization and assignment of QA specifications of safety analysis reports is provided in controls to identify situations in which they may be the Introduction of Revision 3 of Regulatory Guide further relaxed. Such changes would be evaluated and 1.70," Standard Format and Content of Safety Analysis reviewed by the staff as necessary, as discussed in Reports for Nuclear Power Plants (LWR Edition)"

other sections of this guide. (Ref.12).

When a safety-related SSC has been categorized as 4.1 Licensee Submittal Documentation low safety significant and, because of events such as plant modifications, reanalysis, or human errors, it is To support the staff's conclusion that the proposed

determined that the SSC should now be categorized as change is consistent with the key principles of risk-high safety significant, the licensee should take informed regulation and NRC staff expectations, the appropriate corrective action and evaluate the following information is expected to be submitted to acceptability of the GQA controls applied to the SSC the NRC.

while categorized as low safety significant. This l evaluation should be documented and should address 4.1.1 GQA Program Change the impact, if any, on the SSC as a result of applying GQA controls and should identify any GQA controls The licensee's existing QA program description that need to be adjusted in order to provide assurance contained in, or referenced by, the FSAR should be that the SSC will perform its safety functions. The revised to describe the GQA program provisions. The licensee should maintain documented justification submittal containing the proposed GQA provisions concerning the adequacy of the GQA controls applied to should contain the following. l the SSC that is now categorized a; high risk significant.

(1) A discussion of the essential implementation l n 3.4 Change Control for Implementing elements of the GQA program, the scope of Procedures potential SSCs that may be in the GQA program, and the basis for concluding that the overall GQA The licensee QA program for GQA will provide a program provides reasonable confidence that high-level characterization of the GQA program SSCs remain capable of performing their imended elements as further discussed in Regulatory Position function ~

4.1. As part of the implementation process for GQA, a number of procedures will be developed by the licensee for activities associated with elements of the (2) An overview discussion of the process and GQA program. This would include procedures for guidelines developed by the licensee to determine aspects of the GQA program such as safety. the safety-significance categorization of all SSCs significance determination, monitoring, working within the GQA program scope as defined in this g aup, and expert panel functions, as appropriate. As regulatory guide.

these procedures will be considering important aspects of the GQA program that the staff will review, it is (3) A statement uf the role of the staff who perform the necessary that the procedures have an appropriate integrated assessment function (expert panel).

change control applied to them so the stafiis informed j of significant changes. Any procedure change that (4) The process for determining the QA controls being impacts on the QA program description must be applied to each safety-significance category of l assessed with respect to 10 CFR 50.54(a) (see SSCs' l Regulatory Positions 1 and 3.1.1 of this guide). The

! FSAR must incorporate by reference the GQA

! implementing procedures so that procedure changes (5) A description of the adjustments proposed as part

{ will be controlled in accordance with 10 CFR 50.59. of the GQA program and how the requirements of l

each of the criterion of Appendix B to 10 CFR Part 1

4. ELEMENT 4: DOCUMENTATION 50 will be satisfied in a graded manner. The D description should identify any exceptions to The recommended contents of a plant-specific, existing QA program commitments (such as risk-informed GQA submittal are presented in this regulatory guides). l 1.176-19 J

(6) A discussion of how augmented QA controls for (5) Applicable documentation discussed in Section non-safety-related SSCs categorized as high safety 3.3. "Cu iulative Risk," of Regulatory Guide significant will be determined. 1.174 (Ref. 3).

(6) A description of how the proposed change impacts (7) A discussion of the operational feedback and enhanced corrective action mechanisms and any licensee commitments.

processes to adjust both safety-sigrificance categorization of SSCs and the asiociated QA 4.2 Plant Data and Engineering Evaluation controls.

Licensees may submit the following information (8) A discussion of the performance monitoring as a separate document to support the proposed GQA process, along with the SSC functional perfor- submittal. This information should be available for mance and availability attributes that form the staff review at the licensee's offices.

basis of the proposed change.

4.2.1 Systems Pertinent to GQA 4.1.2 Supplemental Information Summarize design and operating features of in addition to the submittal of the QA program systems in which changes to the QA program are change, the licensee should submit documentation planned, as well as systems supported by the systems in that, although not incorporated into the QA program which changes to the QA program are planned. For itself, will be needed by the staff to help detennine the each system, include a table summarizing the key acceptabihty of the program. These documents should design and operating data. Values that are used in the include: analysis should be identified and justified. Refer to appendices or other documents (e.g., specific sections (1) A full set of the records and analyses related to the of the FS AR or design basis documents) as necessary categorization of one system. This documenta- for more details. Systems to be considered should tion should include all supporting information include the pertinent portions of all systems modeled in developed and used during the process, all the plant-specific probabilistic analysis. '

documented deliberations and justifications developed by the relevant panels, and the results 4.2.2 Status of SSCs of the categorization for all SSCs in the system.

The submitted information should only include All SSCs whose QA program control is proposed documentation that the licensee intends to to be changed should be listed and should include (at e maintain in support of future program changes minimum) the plant's SSC label, the current QA and NRC inspections. categorization (by default all safety-related SSCs will initially han a "high" QA categorization), the (2) Plant procedures and instructions that provide the proposed QA categorization, associated correlation programmatic guidance to the utility staff on the with system functions, and a brief explanation of the SSC categorization, monitonng, and feedback that justification for the proposed change.

will be implemented in support of the GQA program. 4.2.3 Plant Operating Experience

! (3) The methodology, PRA change summary, and Summarize any major events involving failures if

! results of the bounding analysis, augmented by a the occurrence was attributable to inadequate or discussion of the nonquantified aspects of the improperly applied QA controls at this plant. Include i

GQA program that are expected to provide a safety in this summary any lessons learned from these events

( benefit. The scope, in terms of systems included in and indicate actions taken to prevent or minimize l the bounding analysis, should be discussed. If the recurrence of the events.

bounding analysis was perfe-med on a limited number of systems, the systems should be clearly 4.2.4 Engineering Evaluation identified.

l The categorization process is considered an I

(4) A description of the licensee process to ensure engineering analysis, and as such, the completed PRA quality, a discussion as to why the PRA is of analysis should be considered a quality record. In sufficient quality to support the categorization addition to the submittal documentation discussed process, and the results of all peer or industry in Regulatory Position 4.1, Regulatory Guide 1.174 reviews of the PRA. (Ref. 3) provides guidance on documentation that may I.176-20 1

__..____._m ._ _.._ _ _ __._..________ _. . . . . . . _ _ . _ _ _ .~

1

. be required to support a risk informed application. tory Position 4.1.2) for all systenu that have i ' The licensee should review the guidance in Regulatory been categorized.

1 Guide 1,174 and either develop the documentation or .

ensure that sufficient material is available that the A desen.ption of how the importance measures

,( documentation can be developed if requested. were calculated and used (including the guidelines i Additional documentation that should be available if t c teg rize if applicable). This information requested includes: should be augmented by technical description on how the limitations associated with the use of j

• importance measures were communicated to the Documentation descr.bing i the methods and .

l expert panel and resolved.

techniques used for developing quantitative and j qualitative risk insights used to support the safety-

• Important assumptions, including SSC functional

significance categorization of SSCs. capabilities and performance attributes, that play a j key role in supporting the acceptability of the QA i

!

• Documentation corresponding to the sample program change and that are used in the l

! document submitted (described in (1) in Regula. monitoring and feedback program. i t

L 1

a i

i '

. 1

.* l m l l

1 l

l 1

0 1 1.176-21 l

_ - , , _ _ _ - _ _ _ . _ __ , - , , ~ . _ _ _ _ _ . _ _ _

REFERENCES

1. USNRC, "Use of Probabilistic Risk Assessment 6. American National Standards Institute (ANSI),

Methods in Nuclear Activities: Final Policy " Quality Assurance Requirements for Control of Statement," Federal Register, Vol. 60, p. 42622 Procurement of Items and Services for Nuclear Power Plants," N45.2.13, published by the (60 FR 42622), August 16,1995.

American Society of Mechanical Engineers,1976.

2. " Development of Graded Quality Assurance Methodology," SECY-95-059, March 10,1995.' 7. USNRC, " Quality Assurance Requirements for Packaging, Shipping, Receiving, Storage, and

3. USNRC, "An Approach for Using Probabilistic Handling of Items for Water-Cooled Nuclear Power Plants," Regulatory Guide 1.38, Revision 2, Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," May 1977.'

Regulatory Guide 1.!74, July 1998.2

8. ANSI, " Requirements for Auditing of Quality Assurance Programs for Nuclear Power Plants,"

4. Letter from James L.Milhoan (NRC) to William Rasin (Nuclear Energy Institute), June 15,1994.' ANSI N45.2.12,1977, i

5. " Graded Quality Assurance /Probabilistic Risk 9. ANSI, " Packaging, Shipping, Receiving, Storage Assessment Implementation Plan for the South and Handling of Items for Nuclear Power Plants Texas Project Electric Generating Station," (During the Construction Phase)," ANSI N45.2.2, SECY-97-229, October 6,1997.' 1972.

10. American Nuclear Society (ANS), "Administra-

' Copies are avadable for inspection or copying for a fee from the NRC Pubhc Document Room at 2120 L Street NW.. Washington. DC; the tive Controls and Quality Assurance for the PDR's mailmg address is Mail Stop LL-6, Washington. DC 20555; Operational Phase of Nuclear Power Plants," ANS telephone (202)643273; fax (202)634-3343. 3.2/ ANSI 18.7, American Nuclear Society,1976.

2 Single copies of regulatory guides, both active and draft. and draft NUREG documents may be obtained free of charge by wnting the I1. MS " Quality Assurance Re9uirements for the Reproduction and Distnbution Services Section, OCf0. USNRC.

Washmgton. DC 20555-0001. or by fax to (301)415-2289. or by email to Design of Nuclear Power Plants," ANSI N45.2.11, GRWi @NRC. GOV. Active guides may also be purchased from the 1974, National Technical information Seriice on a standing order basis. Details on this service may be obtained by wnting NTIS,5285 Port Royal Road.

12. USNRC," Standard Format and Content of Safety Springfield V A 22161. Copics of active and draft guides are available for inspection or copying for a fee from the NRC Pubhc Document Room at Analysis Reports for Nuclear Power Plants (LWR 2120 L Street NW, Washmgton. DC; the PDR's mailing address is Mail Ed. .ition),,, Regulatory Guide 1.70, Rev. .ision9 ,

stop LL-6, Washmgton, DC 20555, telephone (202)6%3273; fax (20236 4 3343.

November 1978.2 O

l 1.176-22

l REGULATORY ANALYSIS Iq 4 A draft regulatory analysis was published with the draft of this guide, DG 1064, when it was issued for public comment in June 1997. No significant changes were

'V necessary from the original draft, so a separate value/ impact statement for this final i Regulatory Guide 1.176 has not been prepared. A copy of the draft regulatory I analysis is available for inspection or copying for a fee in the Commission's Public l Document Room at 2120 L Street NW, Washington, DC, under Task DG-1064.

s 4

4 4

i b[

e A

1 L#

Printed on recycled paper tO Q1 Federal Recycling Program 1.17(r23

\

k i-

• Q t,

UNITED STATES FIRST CLASS MAIL N POSTAGE AND FEES PAID USNRC

, T 205 PERMIT NO. G47 OFFCIAL BUSINESS nmTY FOR PRNATE USE,5300 i

1 sn 10 an b

o G

E O

O 1.

u M O MX (L 0 44 O

M EW ~

CO O

W WJ RO E

CH U

Z MOZo WHOUW2

• Ow wo ookk 3W C8 4 %e=to IOU (D E 14.JCL 2 EE3w (O%CDZ.T C

h.Ou. u)

NM Z O 3 acr.

MDwoa3

.