ML20151Z196
| ML20151Z196 | |
| Person / Time | |
|---|---|
| Issue date: | 08/31/1998 |
| From: | NRC (Affiliation Not Assigned) |
| To: | |
| References | |
| NUREG-0800, NUREG-0800-03.9.7-R0, NUREG-800, NUREG-800-3.9.7-R, SRP-03.09.07, SRP-3.09.07, NUDOCS 9809210193 | |
| Download: ML20151Z196 (44) | |
Text
__
77 NUREG 0800
\ ) ...
- %, UNITED STATES NUCLEAR REGULATORY COMMISSION
( *...+
)STANDARDREVIEWPLAN OFFICE OF NUCLEAR REACTOR REGULATION l 1
l 1
3.9.7 RISK-INFORMED INSERVICE TESTING l REVIEW RESPONSIBILITIES j i
Primary - Mechanical Engineering Branch (EMEB)
Secondary - Probabilistic Safety Assessment Branch (SPSB)
INTRODUCTION i
The NRC's policy statement'on probabilistic risk analysis (PRA)(Ref. 1) encourages greater use of this analysis technique to improve safety decisionmaking and improve regulatory efficiency. One activity under way in (V) response to the policy statement is the use of PRA in support of decisions to modify an individual plant's inscr ice testing (IST) program. Licensee-initiated IST Program changes which are consistent with currently approved staff positiont [e.g., regulatory guides, standard review plans, branch i technical positions] are normally evaluated by the staff using traditional, engineering analyses. In such cases, a licensee would not be expected to submit risk information in support of the proposed change. Licensee-initiated IST program change requests that go beyond current staff positions may be evaluated by the staff using traditional engineering analyses as well as the risk-informed approach set forth in Regulatory Guide 1.175, "An Approach for Plant-Specific Risk-Informed Decisionmaking: Inservice Testing." (Ref. 3). A USNRC STANDARD REVIEW PLAN Standard review piens are prepared for the guidance of the Office of Nuclear Reactor Regulation staff resgonsible for the o missio s polfcy to in rm nuc rYn tr an he enera p b o u afo y pro edures en policies.
is nJ' 37e'3*#'"!t;n J,d fe",?!?'" late'c;fo'n"a'fe'U"%ise* stand F"d% 4'd'n'd MTt?'nts s*3**'na'ssTs* ***
Report or Nuclear Power Plants. Not all sections of the andard Format have a corresponding review p an.
bi h d a n ard rev lans will be revised periodically, as appropriate, to accommodMe comments and to reflect new d d M*fs"s'Fo*"af#cW70fe'?'4*/c'0*4"e;"uia%n'%JudYo*n. t"a.'as"s's '*"" ** "*' "" "*"""
O g
l/
cj f
'- 3.9.7-1 Rev. 0 - August 1998 9809210193 980831 4 PDR NUREO 0800 R PDR i
licensee may be requested to submit supplemental risk information if such information is not provided in the proposed risk-informed inservice testing (RI-IST) program submittal by the licensee. If risk information on the proposed RI-IST program is not provided to the staff, the staff will review the information provided by the licensee to determine whether the application can be approved based upon the information provided using traditional methods and will either approve or reject the application based upon the review. For those licensee-initiated RI-IST Program changes which a licensee chooses to support (or is requested by the staff to support) with risk information.
Regulatory Guide 1.175 describes an acceptable method for assessing the nature and impact of proposed RI-IST Program changes by considering engineering issues and applying risk insights. Licensees submitting risk information should address each of the principles of risk-informed regulation discussed in Regulatory Guide 1.175. Licensees should identify how chosen approaches and methods (whether they are quantitative or qualitative. and traditional or probabilistic). data, and criteria for considering risk are appropriate for the decision to be made.
In this Standard Review Plan (SRP) section. the NRC staff describes procedures and acceptance guidelines (referred to as Regulatory Positions in Regulatory Guide 1.175) for its reviews of proposed plant-specific, risk-informed changes to a licensee's inservice testing (IST) program. The review procedures herein are consistent with acceptable methods for implementing a risk-informed IST (RI-IST) program consistent with Regulatory Guide 1.174 and Regulatory Guide 1.175 (Ref. 2 and Ref. 3).
The licensee's RI-IST submittal should define the proposed changes to the IST program. The licensee should have identified changes to the design, operation, and other activities at the plant that would be changed by the proposed RI-IST program. The principal focus should be on the use of PRA findings and risk insights in support of those proposed changes to a plant's design, operation, and other activities that require NRC approval. Such changes include (but are not limited to) license amendments under 10 CFR 50.90 requests for use of alternatives under 10 CFR 50.55a. and exemptions under 10 CFR 12. However, the reviewer should note that there are certain docketed commitments that are not related to regulatory requirements that may be changed by licensees via processes other than as described in NRC regulations (e.g. consistent with reference 9). The reviewer will need to evaluate the acceptability of proposed changes to docketed commitments identified by the licensee (e.g. , any changes to commitments made by the licensee in response to NRC Generic Letter 89-10 or 96-05). The licensee should have identified the particular components that would be affected by the proposed changes to the IST program. This should include all of the 3.9.7-2 Rev. 0 - August 1998
1 Iq components currently in the licensee's IST program as well as any other (j components that the licensee's integrated decisionmaking process categorized as being highly safety significant (HSSC). The method used by the licensee to categorize components should be described. There should also be a detailed description of how the proposed RI-IST program affects the design, operation, and other activities at the plant and why these proposed changes are acceptable. If exemptions from specific regulations, technical specification amendments, or relief requests are required to implement the licensee's proposed RI-IST program, the appropriate requests should accompany the licensee's submittal. Revisions to testing schedules and methods should be described. The implementation and monitoring approach should be included.
Details of the RI-IST implementation plans and schedules should be available onsite for inspection.
The licensee should also have described the proposed IST program change in terms of how it conforms to the objectives of the Commission's PRA Policy Statement, concerning enhanced decisionmaking, more efficient use of resources, and reduction of unnecessary burden. The description may consider such benefits from the change as reduced fiscal and personnel resources and reduced radiation e::posure, as well as increased reactor safety.
The reviewer should become familiar with the licensee's entire submittal n)
( before beginning the detailed review described in the sections that follow.
In short, the reviewer should develop an understanding of the proposed change in terms of:
the particular components that would be affected by proposed changes to the IST program the plant systems involved with the proposed changes a
the change in testing strategy (i.e., test frequency and methods) proposed for each component or group of components a
the affect of proposed changes on plant design, operation, and other activities
=
the affect of proposed changes on the defense in depth philosophy and safety margins i
l
=
the effect of the changed testing strategy on overall plant risk ln -
the proposed implementation and monitoring strategies q i b' 3.9.7-3 Rev. 0 - August 1998 i
i I
In Regulatory Position 4 of Regulatory Guice 1.175 the staff describes in more detail the documentation that the licensee should have submitted in conjunction with its proposed RI-IST program.
I. AREAS OF REVIEW
.A. ENGINEERING EVALUATION
- 1. Evaluation of Proposed Changes For all components affected by the proposed RI-IST program change, the licensee should have determined the acceptability of the proposed RI-IST program changes in light of the plant's design, operation, and other activities.
pumps or valves) in the current code-prescribed program, any other components categorized HSSC that were identified as such as part of the PRA or licensee's integrated decision-making process (e.g., expert panel).
- 3. Changes To Component Test Requirements This section discusses test strategy changes (i.e. changes to component test frequency, methods, or both) that licensees should make as part of a RI-IST program.
- 4. Relief Requests and Technical Specification Amendments Although implementation of the licensee's RI-IST program (i.e. in lieu of implementing an IST program that is totally consistent with the ASME Code as endorsed in 10 CFR 50.55a) may be authorized by exemption from the regulations or via NRC authorizing an alternative pursuant to 10 CFR 50.55(a)(3), specific details of the licensee's RI-IST program may require exemptions from other regulations, technical specification changes, or require relief from provisions of NRC approved Codes. The licensee should have included in the RI-IST program submittal the necessary exemption requests.. technical specification amendment requests, and relief requests necessary to implement their RI-IST program.
3.9.7-4 Rev. 0 - August 1998
I I
lp 5. Scope Level of Detail, and Quality of the PRA for IST Application i
'V The quality of a PRA required for RI-IST is commensurate with the role the PRA plays in the determination of test strategies. The licensee's submittal should document how this quality is assured. In addition, the submittal should document why the PRA quality, level of detail, and scope are appropriate for the analysis, and how the integrated decision process compensates for potential limitations in this quality, level of detail or scope.
- 6. Categorization of Components The identification of components as potential candidates for changes in IST intervals or test methods should be done using PRA importance measures to classify components into high and low risk contributors. The results from l this importance analysis should be one of the inputs to the licensee's integrated decision-making process to help determine the safety significance of the IST components.
In addition to the determination of risk importance contribution for input to the licensee's integrated decision-making process, the determination of Cs potential risk contribution from components by PRA importance determination is h useful for the following reasons:
=
When performed with a series of sensitivity evaluations, the PRA importance determination can identify potential risk outliers by identif., 7 components which could dominate risk for various plant configurations and operational modes, PRA model assumptions, and data and model uncertainties.
Importance categorization can provide a useful means to identify improvements to current IST practices during the risk-informed application process by identifying components that are high risk contributors which may benefit from more frequent tests or enhanced testing methods.
- 7. Evaluating the Effect of Proposed Changes on Overall Plant Risk One element in the approval of RI-IST changes is that proposed increases in core damage frequency (CDF) and large early release frequency (LERF) are small and consistent with the intent of the Commission's Safety Goal Policy Statement. In calculating this change in risk, the licensee should have (O)
'v 3.9.7-5 Rev. 0 - August 1998
accounted for changes in component reliability / availability as a function of test intervals and test methods. In addition, the affects of program changes on initiating event frequency and common cause failures should have been considered. The use of appropriate data (including generic and plant-specific component failure rates, and human error probabilities and recovery probabilities) should have been justified as part of the calculation of the risk change.
- 8. Integrated Decisionmaking Justification of changes to the IST program should be based on results from both traditional and probabilistic engineering analyses. These analyses should reflect the current plant design and operating experience. Uncertainties in analysis models should be addressed by a step-wise implementau on plan, and a performance monitoring and corrective action plan. The proposed change will be acceptable when all these elements are combined in a complementary fashion to show that an acceptable level of quality and safety is provided.
B. IMPLEMENTATION, PERFORMANCE MONITORING, AND CORRECTIVE ACTION
- 1. Program Implementation The licensee should have an implementation plan and schedule established for testing all high and low safety significant components identified in its RI-IST program. The staff should verify that the plan con' ains test strategies (i.e. . frequencies and methods) for high and low safety significant components that are within the scope of the licensee's RI-IST program, including those components identified as HSSCs that are not currently in the IST program. The licensee's RI-IST program should not allow the immediate increase of the test interval of all low safety significant components (LSSCs) to their maximum.
Instead, a step-wise approach should be employed.
One step-wise method to extend the test interval for LSSCs is to group similar components based on component type, size. manufacturer, model, and service condition and staggering the testing of the components in a group over an extended interval. Initially, it would be desirable to test at least one component in each group every refueling outage. For component groups which are insufficient in size to test one component every refueling outage. the implementation of the interval extension should be accomplished in a step-wise manner. Components whose test interval is to be extended via staggering should o' e identi Tied along with their staggered frequency over the test inta val . Components should also be identified that are to have their test l 3.9.7-6 Rev. 0 - August 1998 O
' r'N
'() frequency extended using some other step-wise approach. The final test interval of these components should also be noted in the submittal.
- 2. Performance Monitoring of IST Component 1
Performance monitoring in RI-IST programs refers to the monitoring of l inservice test data for components within the scope of the RI-IST program !
including both HSSC and LSSC. The purpose of performance monitoring in a RI-IST program is twofold. First, the performance monitoring should help confirm {
that no unexpected failure mechanisms that are related to the revised test strategy become important enough to alter the failure rates assumed in the justification of proposed changes. Second performance monitoring should, to the extent practicable, ensure that adequate component capability margin exists, above that required during design-basis conditions. so that component operating characteristics over time do not result in reaching a point of l insufficient margin before the next scheduled test activity. Regulatory Guide 1.175 provides guidance on performance monitoring when testing under design-basis conditions is impracticable. In most cases, component-level monitoring will be expected.
Two important aspects of performance monitoring are whether the test frequency 73 is sufficient to provide meaningful dat3 and whether the testing methods.
/ procedures and analysis are adequately developed to ensure that performance degradation is detected. Component failure rates should not be allowed to rise to unacceptable levels (e.g., significantly higher than the failure rates used to support the change) before they are detected and corrected.
i
- 3. Feedback and Corrective Action Program A performance-based corrective action program should be a part of the licensee's proposed implementation and monitoring plan.
- 4. Periodic Reassessment The reviewer should examine the licensee's RI-IST program to ensure that it ,
contains provisions whereby the overall program is periodically evaluated and component performance data gets fed back into both the component categorization and component test strategy determination (i .e. . test frequency l
and methods) process. These assessments should also take into consideration corrective actions that have been taken on past IST program components. [This periodic reassessment should not be confused with the 120-month program updates required by 10 CFR 50.55a(f)(5)(i). whereby the licensee's IST program
^ -) 3.9.7-7 Rev. 0 - August 1998 ,
i l
l l
must comply with later versions of the ASME Code that have been endorsed by the NRC.]
e
- 5. RI IST Program Changes After Initial Approval The reviewer should examine the licensee's proposed RI-IST program to determine whether it appropriately describes the types of changes that the licensee can make without prior NRC approval and the types of changes that require NRC approval before implementation.
II. ACCEPTANCE GUIDELINES A. ENGINEERING EVALUATION
- 1. Evaluation of Proposed Changes The licensee should have reviewed applicable doct'ments to identify proposed changes to the IST program that would affect thei tesign, operation, or other activities of the plant. On a component-specific bcis, the licensee should have (1) identified instances in which the proposed RI-iST program change would affect the design operation, and other activities of the plant. (2) identified the source and nature of the requirement (or commitment), and (3) documenteu the basis for the acceptability of the proposed requirement changes l
by addressing the key principles.
1 The licensee must comply with 10 CFR 50.59. 50.90. and 50.109 as applicable.
The reviewer should recognize that there are certain docketed commitments that I are not related to regulatory requirements that can be changed by licensees via processes other than as described in NRC regulations (e.g., consistent with Reference 9).
! code-prescribed IST program. In addition, the scope srould include those non-code components that the licensee's integrated decision-making process categorized as HSSC.
The staff's basis for reaching a conclusion that the licensee's proposed RI-IST program "provides an acceptable level of quality and safety" will be predicated in part, on the licensee's use of PRA to identify the appropriate components that should be included in an RI-IST program. In addition. PRA 3.9.7-8 Rev. 0 - August 1998 t
insights should be used to evaluate test requirements (i.e., test methods and
( ,i frequency). This will ensure that assumptions used to justify relaxations in l" testing requirements for components within the scope of the current ASME Code-required IST program remain valid.
- 3. Changes To Component Test Requirements A RI-IST program should identify components that are candidates for an improved test strategy (i.e., frequency, methods or both) as well as components for which the test strategy might be relaxed. It should also, in some cases, identify components categorized HSSC that may not be included in the present IST program. The information contained in, and derived from, the PRA should be used to help construct the testing strategy for components. To the extent practicable, components with high safety significance should be tested in ways that are effective at detecting their risk-important failure modes and causes (e.g., ability to detect failure, to detect conditions that are precursors to failure, and predict end of service life). [ Note: The test described in the current ASME Code may not be particularly effective in detecting the risk-important failure modes and causes of a component or group of componerits. A more effective test strategy for HSSC components may be to conduct an enhanced test at an extended test interval.] Components p( f categorized as LSSC may be tested less rigorously than components categorized as HSSC (e.g. . less frequent or informative tests).
In some situations, an acceptable test strategy for components categorized HSSC may be to conduct the existing approved code IST test at the code-prescribed frequency. In some situations, an acceptable test strategy for components categorized LSSC may be to conduct the existing approved Code IST test at an extended interval.
l An acceptable strategy for testing components categorized HSSC and LSSC should be defined in NRC-approved ASME risk-informed Code Cases. Licensees who choose to pursue RI-IST programs should have considered adopting of test strategies developed by ASME and endorsed by the NRC. Deviations from endorsed Code Cases must be reviewed and approved by the NRC staff as part of the RI-IST program review.
In establishing the test strategy for components, the licensee should consider l component design. service condition, and performance, as well as risk insights. The proposed test strategy should be supported by data that are appropriate for the component. The omission of either generic or plant-specific data should be justified. The proposed test interval should be significantly less than the expected time to failure of the component as O 3.9.7-9 Rev. 0 - August 1998
assumed in the PRA (e.g. an order of magnitude less)2 In addition. the licensee should demonstrate that adequate component capability margin exists, above that required during design-basis conditions, such that component operating characteristics over time do not result in reaching a point of insufficient margin before the next scheduled test activity.
The IST interval should generally not be extended beyond once every 6 years or 3 refueling outages (whichever is longer) without specific compelling documented justification available onsite for review. Extensions beyond 6 years or 3 refueling outages (whichever is longer) will be considered as component performance data at extended intervals is acquired. The documented justification for interval extensions beyond 6 years or 3 refueling outages should be available onsite for review. This is not meant to restrict a licensee from fully implementing NRC-approved component Code Cases.
Components categorized HSSC that are not in the licensee's current IST program should (where practical) be tested in accordance with the NRC-approved ASME risk-informed Code Cases, including compliance with all administrative requirements. When ASME Section XI or 0&M Code testing is not practical, alternative test methods should be developed by the licensee to ensure operational readiness and to detect component degradation (i.e., degradation associated with failure modes identified as being important in the licensee's PRA). As a minimum, a summary of components and proposed testing should be included in the RI-IST program.
For components categorized as HSSC that were the subject of a previous NRC-approved relief request (or an NRC-authorized alternative test) the licensee should discuss the appropriateness of the relief in light of the safra <
significance of the component in their RI-IST program submittal.
If practical. IST components (with the exception of certain check valves and relief valves) should, as a minimum, be exercised or operated at least once every refueling cycle. More frequent exercising should be considered for components in any of the following categories, if practical
. Components with high risk significance.
. Components in adverse or harsh environmental conditions, or
. Components with any abnormal characteristics (operational, design.
1 For example, the MOV exercise requirement (which is comparable to the current stroke time test) should be performed at intervals considerably smaller than the expected time to failure.
3 9.7-10 Rev. 0 - August 1998
l l
l l or maintenance conditions). ,
The testing strategy for each component (or group of components) in the ,
- licensee's RI-IST program should be described in the RI-IST program "
description. The RI-IST program description should summarize all testing to '
l be performed on a group'of components (e.g., motor-operated valve (MOV) i testing in response to NRC Generic Letter 96-05 (Ref.7)). The specific j testing to be done on each component-(or group of components) should be ;
! delineated in the licensee's IST program plan and is subject to NRC i
! inspection. t
- 4. Relief Requests and Technical Specification Amendments ;
The following are to be approved by the NRC before implementing the RI-IST program:
f A relief request for any component or group of components, that is not !
tested in accordance with the licensee's ASME Code of record or NRC- !
approved ASME Code Case. :
A technical. specification amendment request for any compenent, or group I of components, if there are changes from technical specification O requirements.
- To be acceptable for application to RI-IST PRA models must reflect the as-built as-operated plant, and they must have been performed in a manner !
- that is consistent with accepted practices. The quality of the PRA has to be _ .
shown.to be adequate commensurate with the role the PRA results play in t
justifying changes to the test intervals or strategies. l l
While a full-scope PRA. covering all modes of operation and initiating events ,
is preferred.-a lesser scope PRA can be used to provide risk information, but I it must be supplemented by additional considerations during the integrated i decisionmaking process. ;
l l
Regulatory positions for the required PRA quality and scope are further l defined in Regulatory Guide 1.174. j The PRA model should be developed to the component level for the systems important to safety. <
i
'O 3.9.7-11 Rev. 0 - August 1998 l
l
- --'- "- --
- ve *7+-
7
- 6. Categorization of Components When using risk importance measures to identify components that are low risk contributors the potential limitations of these measures have to be addressed. Therefore, information to be provided to the licensee's integrated decisionmaking process should include evaluations that demonstrate the sensitivity of the risk importance results to the important PRA modeling techniques assumptions, and data. Issues that the licensee should consider and address when determining low risk contributors include truncation limit used. different risk metrics (i.e. . CDF and LERF). different component failure modes, different maintenance states and plant configurations, multiple component considerations. defense in depth, and analysis of uncertainties (including sensitivity studies to component data uncertainties, common-cause failures, and recovery actions).
While the categorization process can be used to identify areas in which testing strategy can be improved and areas in which sufficient safety margins exist to the point that testing strategy can be relaxed, it is the determination of the change in risk from the overall changes in the IST program that will help determine acceptability of the RI-IST program.
Therefore, there are no generically applicable acceptance guidelines for the threshold values of importance measures used to categorize components as HSSC or LSSC. Instead, the licensee should demonstrate that the overall impact of the change on plant risk is small as discussed in the next section.
Therefore, when categorizing components that are not modeled in the PRA.
licensees must take into account the reasons why these components were omitted in the first place. Although PRAs model many of the SS(s involved in performance of plant safety functions, some SSCs are not modeled for various reasons. However, this should not imply that unmodeled components are not important in terms of contributions to plant risk. For example, some components are not modeled because certain initiating events may not be modeled (e.g., low power and shutdown events, or some external events); in other cases, components may not be directly modeled because they are grouped together with events that are modeled (e.g., initiating events, operator recovery events. or within other system or function boundaries): and in some cases, components are screened out from the analysis because of assumed inherent reliability, or failures modes are screened out because of their insignificant contribution to risk (e.g. spurious closure of a valve). The licensee should either provide qualitative arguments that the proposed changc to the unmodeled components do not. result in an increase on risk. or demonstrate that the components significant to risk are maintained as HSSC.
In classifying components not modeled in the PRA as LSSC. the licensee's 3.9.7-12 Rev. 0 - August 1998 i !
l l
l
i (~'s integrated decision making process should have determined that:
l C
The component does not perform a safety function, or does not perform a '
support function to a safety function. or does not complement a safety function.
The component dces not support operator actions credited in the PRA for either procedurai or recovery actions.
The failure of the component will not result in the eventual occurrence of a PRA initiating event.
The component is not a part of a system that acts as a barrier to fission product release during severe accidents.
The failure of the component will not result in unintentional releases of radioactive material even in the absence of severe accident conditions.
- 7. Evaluating the Effect of Proposed Changes on Overall Plant Risk f's. The change in risk from proposed changes to the IST program should be Q consistent with the guidelines provided in Section 2.2.2 of Regulatory Guide 1.174. In comparing the calculated risk to the guidelines. the licensee should address the model and completeness uncertainty as discussed in Regulatory Guide 1.174. In addition, the licensee should address parameter uncertainty either by propagating the uncertainty during sequence quantification or by demonstrating that the " state-of-knowledge correlation" effect (Ref. 8) is not significant especially in cutsets where the RI-IST changes affect multiple components which are similar.
In evaluating the change in overall plant risk from proposed changes in the IST program, the licensee should perform the following:
Evaluate the risk significance of extending the test interval on affected components. This requires that the licensee address the change in component availability as a function of test interval. The analysis i should include either a quantitative consideration of the degradation of the component failure rate as a function of time, supported by appropriate data and analysis, or arguments which support the conclusion that no significant degradation will occur.
! I j ,q .
Consider the effects of enhanced testing to the extent needed to f) i* 3.9.7-13 Rev. 0 - August 1998 i
substantiate the change.
Other issues that should be addressed in the quantification of the change in risk include the following:
. The impact of the IST change on the frequency of event initiators (those already included in the PRA and those screened outbecause of low frequency) should be determined. For applications in RI-IST.
potentially significant initiators include valve failure that could lead to interfacing system loss-of-coolant accidents (LOCAs) or to other sequences that fail the cont 31nment isolation function.
. The effect of common cause failures should be addressed either by the use of sensitivity studies or by the use of qualitative assessments that shows that CCF contribution would not become significant under the proposed IST requirements (e.g.. use of phased implementation. staggered testing, and monitoring for common cause effects).
. Justification of IST relaxations should not be based on credit for post-accident recovery of failed components (repair or ad hoc manual actions, such as manually forcing stuck valves to open). However. credit may be taken for proceduralized imp hmentation of alternative success strategies. For each human action that compensates for a basic event probability increasing as a result of IST relaxation. there should be a licensee commitment to ensure performance of the function at the level credited in the quantification. Excessively low human failure probabilities should be adequately justified and there should be adequate training programs, personnel practices, plant policies, etc. to ensure contiaued licensee performance at that level.
. The failure rates and probabilities used for components affected by the proposed change in IST should appropriately consider both plant-specific and generic data. The licensee should determine whether individual components affected by the change are performing more poorly than the average associated with their class; the licensee should avoid relaxing IST for those components to the point that the unavailability of the poor performers would be appreciably worse than that assumed in the risk analysis. In addition components that have experienced repeated failures should be reviewed to see whether the testing scheme (interval and methods) would be considered adequate to support the performance credited to them in the risk analysis.
. The evaluation should be performed so that the truncation of LSSCs is 3 9.7-14 Rev. 0 - August 1998 O
l l
considered. It is preferred that solutions be obtained form a re-f']
'(j solution of the model. rather than a requantification of CDF and LERF cutsets.
The cumulative impact of all RI-IST program changes (initial approval plus later changes) should comply with the guidance in Regulatory Position 2.3.3 of Regulatory Guide 1.175 and Section 2.2.4 of Regulatory Guide 1.174.
- 8. Integrated Decisionmaking The licensee's RI-IST program submittal should meet the acceptance guidelines contained in Sections II. A.1 through 7 (above) or should justify why an alternate approach is acceptable.
Proposed changes to IST strategies should be evaluated in an integrated fashion which takes into account traditional and probabilistic engineering information. supplemented by a step-wise implementation plan and a performance monitoring and corrective action plan. General acceptance guidelines for this integrated decision process are provided in Regulatory Guide 1.174, and they consist of the following key principles:
/~\
/ 1) The proposed change meets the current regulations unless it is explicitly related to the requested exemption or rule change.
- 2) The proposed change is consistent with the defense in depth philosophy.
- 3) The proposed change maintains sufficient safety margins.
- 4) When proposed changes result in an increase in core damage frequency and/or risk. the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement.
- 5) The impact of the proposed change should be monitored using performance measurement strategies.
In demonstrating adherence to the above principles. reviewers should ensure that licensees address the following issues as part of their RI-IST submittals:
- All safety impacts of the proposed change are evaluated in an integrated manner as part of an overall risk management approach in which the Lf m licensee is using risk analysis to improve operational and engineering L'"} 3.9.7-15 Rev. 0 - August 1998
decisions broadly by ideritifying and taking advantage of opportunities for reducing risk, and not just to eliminate requirements the licensee sees as undesirable. For those cases when risk increases are proposed, the benefits should be described and should be commensurate with the proposed risk increases. The approach used to identify changes in requirements was used to identify areas where requirements should be increased as well as where they could be reduced.
. The scope and quality of the engineering analyses (including traditional and probabilistic analyses) conducted to justify the proposed licensing basis change are appropriate for the nature and scope of the change and are based on the as-built and as-operated and maintained plant, including reflecting operating experience at the plant.
. The plant-specific PRA that is used to support licensee proposals has been subjected to quality controls such as an independent peer review or certification.
. Appropriate consideration of uncertainty is given in analyses and interpretation of findings, including usirig a program of monitoring.
feedback and corrective action to address significant uncertainties.
. The use of CDF and LERF as bases for probabilistic risk assessment guidelines is an acceptable approach to addressing Principle 4. Use of the Commission's Safety Goal qualitative health objectives (OH0s) in
- lieu of LERF is accept 6ble in principle and licensees may propose their
! use. However, in practice, implementing such an approach would require an extension to a Level 3 PRA. in which case the methods and assumptions used in the Level 3 analysis. and associated uncertainties, would require additional attention.
. Increases in estimated CDF and LERF resulting from proposed changes are limited to small increments. The cumulative effect of such changes should be tracked and considered in the decision process.
. The acceptability of the proposed changes is evaluated in an integrated fashion that ensures that all principles are met.
. Data. methods. and assessment criteria used to support regulatory decisionmaking are clearly documented and available for review.
3.9.7-16 Rev. 0 - August 1998
[] B. IMPLEMENTATION PERFORMANCE MONITORING, AND CORRECTIVE ACTION V
- 1. Program Implementation The following implementation activities are acceptable:
For components that will be tested in accordance with the test frequency and methods required by the ASME Code, no specific implementation schedule is required. The test frequency and method should be documented in the licensee's RI-IST Program Plan.
. For components that will be tested in accordance with NRC-endorsed ASME Code Cases. implementation of the revised test strategies should be documented in the licensee's RI-IST Program Plan.
. Alternate test strategies proposed by the licensee (i.e. for components within the scope of the current ASME Code). should be specifically approved by the NRC.
The licensee should increase the test interval for components in a step-wise mannar (i.e.. equal or successively smaller steps. not to exceed one refueling
(~] cycle per step). If no significant time-dependent failures occur, then the Gl interval can be gradually extended until the component is tested at the maximum proposed extended test interval. An acceptable approach is to group similar components and test them on a staggered basis. Initially. it would be desirable to test at least one component in each group every refueling outage.
Guidance on grouping components is contained in NRC Generic Letter 89-04 Position 2 for check valves (Ref. 5): Supplement 6 to NRC Generic Letter 89-10 for motor-operated valves (Ref. 6): or other documents endorsed by the NRC.
- 2. Performance Monitoring of IST Component Monitoring programs should be proposed that are capable of adequately tracking the performance of components that, when degraded, could alter the conclusions that were key to supporting the acceptance of the RI-IST program. Monitoring programs should be structured such that components are monitored commensurate with their safety significance. This allows for a reduced level of monitoring of components categorized as having low safety significance (LSSC) provided the guidance below is still met.
The acceptance guidelines for this item consist of evaluating the licensee's j proposed performance monitoring process to ensure that it has the following A]
S
[ 3.9.7-17 Rev. 0 - August 1998
attributes:
. Enough tests are included to provide meaningful data.
. The test is devised such that incipient degradation can reasonably be expected to be detected and
. The licensee trends appropriate parameters as required by the ASME Code or ASME Code Case and as necessary to provide reasonable assurance that the component will remain operable over the test interval. ,
Assurance must be established that degradation is not significant for components that are placed on an extended test interval and that failure rates assumed for these components are not compromised. It must be clearly established that those test procedures and evaluation methods are implemented that reasonably ensure that degradation will be detected and corrective action will be taken.
- 3. Feedback and Corrective Action Program l 1
The licensee's corrective action program for this application is acceptable if it contains a performance-based feedback mechanism to ensure that if a particular component's test strategy is adjusted in a way that is ineffective in detecting component degradation and failure. particularly potential common cause failure mechanisms, the RI-IST program weakness is promptly detected and corrected. Performance monitoring should be provided for systems. structures, and components with feedback to the RI-IST program for appropriate adjustments when needed.
The licensee's corrective action program should evaluate RI-IST components that either fail to meet the test acceptance criteria or are otherwise determined to be in a nonconforming condition (e.g.. a failure or degraded condition discovered during normal plant operation).
The licensee's corrective action prccedures should:
. Comply with 10 CFR Part 50. Appendix B. Criterion XVI. " Corrective Action."
. Determine the impact of the failure or nonconforming condition on system / train operability and follow the appropriate Technical Specification when component capability cannot be demonstrated.
. Determirie and correct the apparent or reot cause of the failure or nonconforming condition (e.g.. improve testing practices, repair or replace the component). The root cause of failure should be determined for all components categorized as having high safety significance, as 3.9.7-18 Rev. 0 - August 1998
i-l O .
.well as for components categorized LSSC when the apparent cause of failure may contribute to common cause failures.
Assess the applicability of the failure or nonconforming condition to other components in the IST program (including any test sample expansion that may be required for grouped components such as relief valves). !
Correct other susceptible similar IST components as necessary.
i Consider the effectiveness of the component's test strategy in detecting l l the failure or nonconforming condition. Adjust the test frequency or ;
L methods or both. as appropriate, when the component (or group of components) experiences repeated or age-related failures or nonconforming conditions.
l The corrective action evaluations should periodically be given to the licensee's PRA group so that any necessary model changes and regrouping are done as might be appropriate. The effect of the failures on overall plant risk should be evaluated and the fact that the corrective actions taken will restore the plant risk to an. acceptable level should be confirmed.
The_RI-IST program documents should be periodically revised to record any RI-IST program changes resulting from corrective actions taken.
]
A_/
- 4. Periodic Reassessment j The test strategy for IST components should be periodically assessed to reflect changes in plant configuration, component performance, test results, and industry experience.
l
- 5. RI IST Program Changes After Initial Approval I Licensees can change their RI-IST programs consistent with the process (i.e..
L as defined in the RI-IST Program Description) and results that were reviewed j and approved by the NRC staff. As discussed in Section V below, the overall '
RI-IST program, including changes thereto, are enforceable under 10 CFR 50.55a. Examples of changes to RI-IST programs that would not require review and approval may include, but are not limited to, the following:
- Changes to component groupings, test intervals, and test methods that do I
.not involve a change to the overall RI-IST approach which was reviewed and approved by the NRC.
Component test method changes that involve the implementation of an NRC l endorsed ASME Code or an NRC-endorsed Code Case.
G V 3.9.7-19 Rev. 0 - kJgust 1998 l
- Re-categorizatdon of components due to experience. PRA insights, or design changes but not programmatic changes where the process used to recategorize the components is consistent with the RI-IST process and l results that were reviewed and approved by the NRC. l Changes to RI-IST programs that would require review and approval may include. !
but are not limited to, the following
- Changes to the RI-IST program that involve programmatic changes (e.g.. l changes in the acceptance guidelines used for the licensee's integrated decision making process). l
. Test method changes that involve deviation from the NRC-endorsed Code requirements. NRC-endorsed Code Case, or published NRC guidance.
The cumulative impact of all RI-IST program changes (initial approval plus later changes) should comply with the guidance in Regulatory Position 2.3.3 of Regulatory Guide 1.175 and Section 2.2.4 of Regulatory Guide 1.174.
Changes to a licensee's RI-IST program should also be evaluated using change mechanisms described in the regulations (e.g., 10 CFR Part 50.55a. 10 CFR Part 50.59), as appropriate, to determine whether prior NRC staff review and approval is required before implementation.
III. REVIEW PROCEDURES A. REVIEW 0F THE LICENSEE'S ENGINEERING EVALUATION i
- 1. Evaluation of Proposed Changes The reviewer should verify that the licensee reviewed the applicable
- licensing-basis documents to identify proposed changes to the IST program that would affect the design. operation and other activities of the plant. On a component specific basis, the licerisee should have (1) identified instances in which G e proposed IST program change would affect the design, operation, and other activities of the plant. (2) identified the source and nature of the requirement (or commitment), and (3) documented the basis for the acceptability of the proposed requirement changes by addressing the key principles.
The reviewer should consider other licensing-basis documents (e.g. Technical Specifications. FSAR. responses to NRC generic letters) in addition to the IST 3.9.7-20 Rev. 0 - August 1998 O
I t
[ program documentation to identify and evaluate changes to the design.
\
operation. and other activities of the plant. The principal focus should be ,
on the use of PRA findings and risk insights in support of those proposed !
changes to a plant's design, operation, and other activities that require NRC approval. Such changes include (but are not limited to) license amendments under 10 CFR 50.90. requests for use of alternatives under 10 CFR 50.55a. and l exemptions'under 10 CFR 12. However, the reviewer should note that there are l certain docketed commitments, that are not related to regulatory requirements !
L that may be changed by licensees via processes other than as described in NRC :
regulations (e.g., consistent with Reference 9). The licensee should have j l identified any docketed commitments that would be affected by their proposed l
RI-IST program. The reviewer should-evaluate the acceptability of any changes to docketed commitments associated with the proposed RI-IST program (e.g.,
changes to commitments made by the licensee in response to NRC Generic Letter .
89-10 or 96-05). If the reviewer concludes that there is an " unacceptable" impact upon other commitments, then the reviewer must prepare a safety !
evaluation addressing why the commitment is necessary from a safety l standpoint 2 l On a component-specific basis, the reviewer should evaluate the acceptability of each proposed change that affects plant design, operation, or other ,
A activities. A determination of acceptability should consider the original i V acceptance conditions, criteria, and limits, as well as the key principles identified in Section I. A.8 above.
l i
l following:
L
. For selected systems, components that perform a safety-related ]
! function (s) are in the proposed RI-IST program.
l L
- All components categorized by the licensee's integrated decision-making process as HSSC are included in the RI-IST program, regardless of their l
2 Unless the technical adequacy of the licensee's proposal is dependent l upon the affected commitment determined to be unacceptable, the Staff reviewer :
should prepare either: (1) a backfit analysis showing that imposition of the commitment will constitute a cost-justified substantial increase in protection -
to public health and safety, or (ii) a " documented evaluation" demonstrating p that one or more of the exceptions in Section 50.109(a)(4) have been met.
- V 3.9.7-21 Rev. 0 - August 1998 i
status in the licensee's current IST program.
- 3. Changes To Component Test Requirements By axamining the licensee's material for a representative sample of '
components. the reviewer should verify that the licensee considered component design, service condition, and performance, as well as risk insights, in establishing the technical basis for each component's (or group of components) test strategy. The licensee's rationale for the proposed change in test interval and its relationship to expected time to failure should be reviewed.
The reviewer should verify that the proposed test strategies are supported by ;
l applicable generic or plant-specific failure rate data. The reviewer should verify that proposed test intervals are less than the expected time to failure of the components in question. In addition. the reviewer should spot check the licensee's calculations or basis for concluding that adequate component capability exists above that required during design basis conditions, so that l component operating characteristics over time do not lead to a point of insuf ficient margin before the next scheduled test activity. The reviewer should verify that the IST intervals are not extended beyond once every 6 years or beyond three refueling outages (whichever is longer) without specific compelling documented justification. Extensions beyond 6 years or beyond three refueling outages should be considered as component performance data at extended test intervals is acquired.
The reviewer should verify that the licensee made a commitment to adopt enhanced test strategies as described in the risk-informed IST Code Cases developed by ASME. as endorsed by the NRC. If the licensee chooses not to adopt one or more of these Code Cases (or if such a Code Case is unavailable, the reviewer should examine the licensee's written technical justification outlining why it is impractical to implement the risk-informed Code Case s'.rategy and should assess the adequacy of the licensee's proposed alternative test strategy.
The reviewer should verify that the licensee's RI-IST program identifies and tests components categorized HSSC that are not in the licensee's current IST program commensurate with their safety significance or that the licensee has demonstrated that a suitable search for such components was conducted. These components should be tested in accordance with the ASME Code where practical, including compliance with all administrative requirements. When ASME Section XI or OM Code testing is not practical, the licensee should have proposed alternate test methods to ensure operational readiness and to detect component degradation (i.e.. degradation associated with failure modes identified as being important in the licensee's PRA). NRC should review and approve these 3.9.7-22 Rev. 0 - August 1998
I l
l l
[] alternate test strategies before implementation of the RI-IST program at the plant.
lU/
l The reviewer should verify that the licensee assessed the appropriateness of relief for components categorized as HSSC that were the subject of a previous NRC-approved relief request (or an NRC-authorized alternative test) in light i of the safety significance of the component. l l .
l 1 The reviewer should verify that the licensee has made a commitment to exercise l or operate IST components (except for certain check valves and relief valves) at least once every refueling cycle if practical.
- 4. Relief Requests and Technical Specification Amendments For components categorized as HSSC or LSSC not tested in accordance with the i code test method requirements or NRC-endorsed Code Case, specific relief would -
be required from the applicable code requirements. Relief would also be i
required from the code test frequency requirements for components of high !
safety significance not tested at the code-required frequency. Relief is not l required to adjust the test interval of individual LSSC provided it conforms l l with the process reviewed and approved by the NRC staff or conforms with the FT I process described in an NRC-endorsed ASME Code Case.
O
. The reviewer should verify that requests for relief or proposed alternate testing have been submitted to the NRC for approval. The reviewer should verify that the licensee has submitted technical l l specification amendment requests for proposed changes that affect the technical specifications. l
. The reviewer should examine the basis for requests for relief and alternatives and should assess the adequacy of the implementation of the alternative testing. ;
i
l Review guidelines for PRA scope. level of detail, and quality are presented in !
Section III.2.2 and Appendix A of SRP Chapter 19 (Ref.4) and are summarized below.
l PRA Scope: Reviewers should ensure that they understand the scope of the PRA,
! and in particular, what initiating events and operating modes are not represented in the PRA model. It will be necessary to ensure that these missing contributions to risk are treated appropriately in the integrated 3.9.7-23 Rev. 0 - August 1998 t
decisionmaking process.
Level of Detail: In RI-IST. the PRA would normally be used for two purposes:
to provide input to the categorization of components and to evaluate the change in risk. Typically, a PRA model will include both safety-related and non-safety-related components. The reviewer should determine that all the components in the LSSC category are either modeled in the PRA and have been treated appropriately, or there are qualitative arguments why they do not contribute to risk. When evaluating the impact of the change on risk, the PRA model has to be sufficiently detailed that the impact of the change on individual components can be accommodated, either because there are events in the model that are in direct correspondence with the affected components, or there is a mapping of the impact onto events in the model. Components for which there is no mapping must be addressed with supplementary arguments.
Quality: The licensee must show that the PRA has been performed correctly and in a manner that is consistent with accepted practices, and commensurate with the scope and level of detail discussed above. If the approach to ensuring quality includes, in part, a peer review (e.g.. an independent peer review, an industry PRA certification, or an industry PRA cross comparison), the staff reviewer should determine that the peer review process has been performed by qualified individuals with knowledge of PRA techniques and practices.
Reviewers should use SRP Chapter 19. Appendix A as a guide to perform their own limited review of the PRA.
l
( 6. Categorization of Components
(
When risk importance measures are used to group components as low risk l
significant, additional evaluations, sensitivity studies and other considerations have to be taken into account. Review procedures for component risk categorization are provided in Appendix C of SRP Chapter 19.
l One of the considerations discussed in Appendix C of SRP Chapter 19 is the l issue that importance measures cannot address the integrated impact of the l change. This aspect is best addressed during the quantification of the impact l of the change (item 7 below). i I
l Typically, the PRA derived categorization will only address a subset of the contributions to risk. That is, if the PRA only models internal event initiators at full power operations, results from risk importance calculations will only be applicable for these events. If the PRA results are adopted for other contributors, the reviewer should determine whether the same assumptions that apply for the PRA model are likely to apply under the conditions being 3.9.7-24 Rev. 0 - August 1998
1 l [V] addressed. For example, a component categorized as LSSC based on results from a full-power PRA may not be a low risk contributor at shutdown conditions even if the component function and operating state is the same for both full-power and shutdown conditions. In this case, reduced redundancy in certain l configurations may make a difference in the determination of risk importance.
- 7. Evaluating the Effect of Proposed Changes on Overall Plant Risk i
\
I There are two major areas of review: the modeling of the impact of the change on individual components, and the propagation of these impacts through the PRA model for the calculation of plant risk.
Modeling of the Effects of IST on PRA Basic Events The review procedure for the modeling of the effects of IST changes on individual components involves the following steps:
Identify the assumptions underlying, and the characteristics of the model used to evaluate the risk significance of extending selected component test intervals.
Establish whether the validity of the model depends on the efficacy of
( ,- the tests to be performed as part of the IST program, l l
If the model does not address degradation, review the arguments why l degradation is not a significant effect.
If the model requires the estimation of an exposure time, the reviewers should l establisn that the fault exposure time credited in the PRA is reasonable in light of the IST interval and other activities. In general, the mean fault exposure time will be taken to be one half of the test interval. Some I analyses may apply a fault exposure time other than this: a different fault l exposure time for a given component might be claimed as a result of credit !
taken for non-IST validation of the performance of the component, perhaps by l virtue of system challenges, or an IST test on a different component that '
implicitly requires functioning of the subject component and would therefore reveal a failed state of the subject component. The reviewer should establish that the licensee has identified a basis for fault exposure times modeled, and that commitments are in place wherever a fault exposure time is determined by a programmatic activity. Where a fault exposure time is the result of tests l on other components, the reviewer should verify that there is assurance that i these other tests will be performed and that the behavior of the subject component will be surveilled in the course of these tests. Where a fault A) 3.9.7-25 Rev. 0 - August 1998 l
1 exposure time is the result of system challenges, the reviewer should verify that this challenge frequency is consistent with system challenge frequencies modeled elsewhere in the PRA.
Evaluation of Change in Risk The comparison of the quantitative results of the PRA with the regulatory positions contained in acceptance guidelines of Regulatory Guide 1.174 provides input to the demonstration that, if increases in risk are proposed, these increases are small and consistent with the intent of the Commission's Safety Goal Policy Statement. General guidance on the evaluation of the change in risk is given in Section III.2.2 and Appendix A of SRP Chapter 19.
Some issues specific to the IST evaluation are given below.
. Initiating Events: The reviewer is not expected to independently verify the licensee's evaluation of the effect of IST program changes on initiating event frequency. Rather, the reviewer is expected to look for evidence that the licensee has considered the effects of IST changes on initiating events that were analyzed in the PRA and those that were previously screened out from the analysis to determine whether these events can become more important as a result of the IST change.
However, if a licensee argues for a relaxation in testing frequency and/or method based on the adverse risk effects of testing. the reviewer should review the calculational basis, especially if other plants of the same type have not drawn similar conclusions.
- Common Cause Failures (CCFs): The reviewer should check to confirm that the impact of the IST change on potential CCFs has been considered in the PRA. It is important that the selection of common component groups was performed correctly to ensure that important common cause failure groups were not omitted. As a minimum. the CCF groups should include:
redundant standby pumps: redundant MOVs and air-operated valves (A0Vs) that change state: redundant check valves: and any other components that change state in order to support IST component operability. Changes to CCF probabilities could result from increases in the individual component failure probabilities, or could occur as a result of an increase in the CCF model parameters (e.g. beta factors. multiple Greek letter factors. etc.) If credit is taken for improved testing or staggered testing, reviewers should check that licensees have established that performance monitoring is capable of detecting CCF before multiple failures are allowed to occur subsequent to an actual system challenge.
3.9.7-26 Rev. 0 - August 1998
O
\
Human Reliability Analysis (HRA): The IST-speci fic aspects of HRA include errors related to testing, and quantification of compensating human actions. Errors related to testina are those that leave equipment unavailable until the condition is discovered during a subsequent test or until the equipment is demanded (i.e., a restoration error).
Reviewers should verify that the assumptions, models, and data used to quantify this error are consistent with the revised test strategies. -
The quantification of compensating human actions refers to the credit taken for actions for purposes of deciding on IST changes. Reviewers
, should confirm that credit for compensating human actions is limited to proceduralized actions taken to actuate systems and that repair of failed equipment is not considered. The intent of this review is to ensure that licensees do not relax IST on the basis of relatively uncertain quantification of recovery probabilities.
- Component Failure Rates: The reviewer should establish that failure rates for components that are important in the justification of the IST change are consistent with plant-specific data. Failure rates that are appreciably less than generic data (e.g., those that are more than a factor of 3 lower than generic data) should be justified. To use the lower plant-specific failure rate it must be demonstrated that the e plant-specific failure rate data came from a population statistically different from the generic population and an engineering rationale should be provided. The reviewer should ascertain whether the failure I rate takes account of special environmental stresses or aging. If not, I this should figure in the evaluation of the performance monitoring and I feedback activity.
Quantification of Risk Impact: Reviewers should ensure that the evaluation of the change has not been performed non-conservatively by, for example, using a pre-determined cutset solution and requantifying the basic event probabilities, rather than resolving the equations with the higher values. In addition, because of the simultaneous increase in basic event probabilities associated with like components, it is important to consider the impact of parameter uncertainties and the
> state-of-knowledge correlation. This can be done by either propagating uncertainties or showing that the contributing cutsets will not be affected by this correlation.
- 8. Integrated Decisionmaking If the licensee's submittal regarding changes to component test strategies meets the acceptance guidelines as specified in Section II, the submittal )
to\ ,
3.9.7-27 Rev. 0 - August 1998
could be deemed to have used an integrated decisionmaking process which ensures that the principles and expectations of risk-informed regulation are met. This section provides procedures for the overall review of the different elements of the integrated decisionmaking, and how these elements can complement or compensate for others.
The licensee's records should clearly identify all factors considered in the decision process and the basis for the proposed changes to the IST program.
On a sampling basis, the reviewer should conduct an independent evaluation to determine whether the licensee's conclusion is technically sound. The reviewer's determination that the proposed alternative will provide "an acceptable level of quality and safety" [Ref. 10 CFR 50.55a (a)(3)(i)] should be based on this independent assessment.
The review of the proposed IST program change is discussed in Section III.A.1 and the requirements for an exemption or a relief request associated with are discussed in Section III.A.4. In evaluating the process for defining the overall change, reviewers should determine whether the licensee has used an approach where risk insights were also used to improve test strategies, and not just to relax testing requirements. This is discussed more in Sections III.A.2 and III.A.3 under the review of program scope and strategy.
In evaluating the impact from changes to the IST program, reviewers should determine that the change is consistent with the defense in depth philosophy.
Accounting for defense in depth is an effective way to compensate for uncertainties in equipment and human performance. In some cases, risk analysis can help quantify the range of uncertainty: however, there will remain areas of relatively large uncertainty or areas not covered by the risk analysis. Therefore, where a comprehensive risk quantification is not, or cannot be done, traditional defense in depth considerations should be used or maintained to account for uncertainties. Review guidelines for defense in depth considerations is provided in SRP Chapter 19. For IST changes, defense in depth is preserved if. for example:
. The risk analysis shows that a reasonable balance is maintained between prevention of core damage, prevention of containment failure and <
consequence mitigation.
. System redundancy, independence, and diversity are maintained commensurate with the expected frequency and consequences of challenges to the system. The effects on system redundancy, independence, and diversity from potential common cause failures that could result from IST changes are addressed as , art of the risk quantification and/or as 3.9.7-28 Rev. 0 - August 1998 V /7
l 1
~
.O part of the implementation and monitoring strategies associated with the
!( IST change.
l - Credit taken for operator actions to compensate for relaxations in IST are justified and these-actions are backed up by licensee commitment l (e.g.. training. plant procedures, etc.). Credit is not taken for non- ;
proceduralized actions (e.g. for the recovery of failed components). l
.This ensures that the change preserves defenses against human errors. !
l l
l- Another element of the integrated decisionmaking is the assurance that !
- sufficient safety margins are maintained. In applications that seek
- relaxations in the IST strategy, safety margins could be decreased. The-level
(~ of justification required for such changes in margin should depend on how much
- uncertainty is associated with the performance parameter in question (e.g.,
l component failure rate as a function of time for applications that seek to l
extend test intervals). the availability of alternatives to compensate for )
L adverse performance, and the consequences of functional failure of the affected components. For example safety margin is maintained if:
- ASME Codes or alternatives approved for use by the NRC are met. ;
)
p . Safety analysis acceptance criteria (e.g.. USAR. supporting analyses) l
' are met.
. In applications that propose to extend test intervals, component degradation is accounted for either by quantitative methods (analysis
! and data) or by qualitative arguments.which show that significant i degradation will not occur. Component degradation can also be addressed by the use of enhanced testing methods and the trending'of the required performance parameter to determine an acceptable test interval.
I l . The component categorization process is robust. and the components
- identified for relaxation in IST because of their low safety l significance based on this categorization will only have a small effect on plant risk. In addition, test intervals are based on a margin to L failure (by trending of performance characteristics) that is commensurate with the risk significance of the component, l
l The categorization of components will be based in part on results from importance/ risk rankings from a PRA. Since importance measures are only applicable to components taken one at a time. these measures are not an j adequate measure of the change in total risk for changes that involve more than one component. Therefore, reviewers should confirm that the overall f 4
[ 3.9.7-29 Rev, 0 - August 1998
1 impact from an IST change is calculated, and that if risk increases are proposed, these increases are small and consistent with the intent of the Commission's Safety Goal Policy Statement.Section III.2.2 of SRP Chapter 19 contains guidance on the review of the overall risk impact.
Although the categorization process and the assessment of risk impact requires that all plant operating modes ard initiating events be addressed. it is not necessary in RI-IST that licensees submit PRAs that treat all plant operating modes and all initiating events. Instead, when full-sccpe PRAs are not available, reviewers should ensure that the submitted findings are supportable on the basis of available risk insights, traditional engineering analyses or other plant operational information addressing modes and initiators not analyzed in the base PRA.Section III.2.2 of SRP Chapter 19 provides review guidance on this topic.
When relaxations in IST strategy are offset by alternative measures (e.g..
additional monitoring, different tests, procedures, training, etc.) the licensee should identify and quantify to the extent practicable, the effects of these alternative measures. Similarly. if there are benefits associated with proposed relaxations (e.g., reduction in initiating event frequency, reduction in system misalignment, reduction ja radiation exposure), the licensee should identify, and quantify to the extent practicable. the effects of these benefits. As a general rule, the alternative measures and benefits should be directly linked to the systems or components associated with proposed relaxations. However, on a case by case basis, tne staff may also assess the licensee's proposed improvements made to the test strategy for a group of components against proposed relaxations in test requirements for another group of components in assessing the overall acceptability of a proposed RI-IST program. For example, the risk increase associated with relaxation of requirements for a group of low safety significant components may be deemed acceptable in light of improvements made to a group of more high safety significant components on the basis of quantitative or qualitative arguments on the overall change in risk. The factors considered by the licensee's integrated decisionmaking process, as well as the basis for the licensee's integrated decisionmaking process conclusion, should be clearly documented. The reviewer should evaluate this documentation to see whether there is adequate technical justification for the licensee's decisions.
Finally, review of the integrated decisionmaking process should include an l evaluation of the licensee's proposed implementation. monitoring and j corrective action program, and how this program is used to complement the risk i analysis (monitoring for unexpected failure mechanisms). the defense in depth analysis (in terms of prevention of common cause failures), and the analysis .
1 3.9.7-30 Rev. 0 - August 1998
P j of safety margins (trending of component performance relative to the marg' ins 5
to failure). Guidance for this review is provided in Sections III.B.1 through III.B.3. -
Additional review guidance for the licensee's integrated decisionmaking ;
process is presented in Appendix B and in Section C.2 of Appendix C of SRP- l Chapter 19.
B. REVIEW 0F IMPLEMENTATION, PERFORMANCE MONITORING, AND CORRECTIVE ACTION
- 1. Program Implementation The reviewer should check the adequacy of the justification for extending the l
- test interval for a sample of low safety significant components to verify that I the extension'is appropriate. The test intervals for LSSC may be implemented I at the discretion of the licensee after the NRC approves the RI-IST program.
The reviewer should verify that the liccnsee is increasing the' test interval for low safety significant components in a step-wise manner. Component corrective action procedures should be in place for LSSC being tested on a step-wise basis before any test intervals are extended.
7 HSSC and LSSC that will continue to be tested in accordance with the ASME Code
\ requirements for the licensee's code of record, or ASME Code Cases that have been endorsed by the NRC, require no further review by the reviewer and are subject to site-specific inspections, The reviewer should verify that the licensee has developed plant corrective l action and feedback procedures to ensure that testing failures are reevaluated for possible adjustment to the component's grouping and test strategy.
- 2. Performance Monitoring of IST Component The review procedures consist of the following steps:
The performance monitoring program is identified in the licensees proposal for RI-IST.
\
. .The program.is reviewed to determine whether it contains a test program that will provide sufficient data to detect component degradation in a timely manner, as described in Section II.B.2.
L The reviewer should determine whether the licensee's monitoring process for I
Rev. 0 - August 1998 3.9.7-31
RI-IST is coordinated with existing programs for monitoring components performance and other operating experience on their site and, when appropriate, throughout the industry. In particular, monitoring that is performed as part of the Maintenance Rule (10 CFR Part 50.65) implementation can be used in the RI-IST program when the monitoring performed under the Maintenance Rule is sufficient for the components in the RI-IST program. As stated in Section 2.3 of Regulatory Guide 1,174. if an application requires monitoring of structures, systems, and components (SSCs) not included in the Maintenance Rule, or SSCs that need a greater resolution of monitoring than the Maintenance Rule (component- vs. train- or plant-level monitoring). it may i be advantageous for a licensee to adjust the Maintenance Rule monitoring program rather than to develop additional monitoring programs for RI-IST purposes. Therefore. the licensee may have adjusted the Maintenance Rule performarice criteria to meet the guidance in Regulatory Position 3.3 of Regulatory Guide 1.175 (i.e. the same guidance provided in Section II.B.2 l above).
- 3. Feedback and Corrective Action Program The reviewer should examine the licensee's corrective action program to verify that it is initiated by component failures that are detected by the IST l program as well as by other mechanisms (e.g. normal plant operation.
l inspections).
The reviewer should verify that the licensee's corrective action procedures meets the acceptance guidelines specified in Section II.B.3.
The reviewer should verify that corrective action evaluations are given to the licensee's PRA group so that any necessary model changes and regrouping can be periodically done by the PRA group, if appropriate.
The reviewer should verify that procedures are in place to ensure that corrective actions affecting the IST program get documented. as appropriate, in the licensee's RI-IST program.
- 4. Periodic Reassessment ,
l The reviewer should assess the licensee's procedures for conducting the periodic risk-informed IST program review to ensure that it l
. prompts the licensee to conduct overall program assessments periodically to reflect changes in plant configuration, component performance, test results, and industry experience 3.9.7-32 Rev. 0 - August 1998
l
!.] .
prompts the licensee to review and revise as necessary the models and data used to categorize components to determine whether component groupings have changed prompts the licensee to reevaluate equipment performance (based on both plant-specific and generic information) to determine whether the IST program should be adjusted The reviewer should verify that the licensee has incorporated the results of its corrective action program for IST program components into its periodic IST program reassessment.
The reviewer should verify that the licensee has procedures in place to identify the need for more emergent RI-IST program updates (e.g.. following a major plant modification or following a significant equipment performance problem).
The periodic RI-IST program review conducted by the licensee may be done in conjunction with the plant's periodic PRA updates, industry operating experience programs, the Maintenance Rule program, and other risk-informed program initiatives.
9 5. RI-IST Program Changes After Initial Approval The reviewer should verify that the licensee has a process or procedures in place te assure that changes that meet the acceptance guidelines in Section II.B.5 (above) are reviewed and approved by the NRC staff prior to implementation.
IV. EVALUATION FINDINGS The reviewer should write an introduction to the safety evaluation that describes the proposed change in terms of the particular components that would be affected by the proposed changes in IST program the plant systems involved with the proposed changes a
the change in testing strategy (i.e. test frequency and methods) proposed for each component or group of components mi 3.9.7-33 Rev. 0 - August 1998
a the affect of proposed RI-IST program on the design, operation, and other activities of the plant
= the affect of the proposed changes on the defense in depth philosophy and safety margins
!
- the overall affect of the changed testing strategy on plant risk
. the proposed implementation and monitoring strategies A. ENGINEERING EVALUATION h- 1. Evaluation of Proposed Changes The reviewer should verify that sufficient information is provided in accordance with the requirements herein and that the evaluation supports conclusions of the following type, to be included in the staff's safety evdluation report:
On a component-specific basis, the NRC staff has reviewed each IST program change as it affects the design, operation, and other activities of the plant. In conducting its review, the staff considered the original acceptance conditions, criteria, and limits, as well as the key principles identified in Section 2 of Regulatory Guide 1.174. Due consideration was given to diversity, redundancy, defense in depth, safety margins, and other aspects of the General Design Criteria.
Having conducted this review, the staff finds that the RI-IST program changes proposed by the licensee are acceptable.
- 2. IST Program Scope The reviewer should verify that sufficient information is provided tri
, accordance with the requirements herein and that the evaluation supports conclusions of the following type to be includcJ in the staff's safety evaluation report: ,
. The staff concludes that the scope of the licensee's RI-IST program is
' acceptable because it ir:ludes, in addition to components (e.g., pumps or valves) in the current code-prescribed program, any other components categorized HSSC that were identified as such as part of the PRA or licensee's integrated decision-making process (e.g. expert panel).
3.9.7-34 Rev. 0 - August 1998 m
l
, ,7
, ) 3. Changes To Component Test Requirements The reviewer should verify that sufficient information is provided in accordance with the guidelines herein and that the evaluation supports conclusions of the following type, to be included in the staff's safety i evaluation report:
. The licensee considered component design, service condition, and performance as well as risk insights, in establishing the test strategy for components. The proposed test intervals for components were 1]ss than the expected time to failu e of the components. In addition, the licensee ensured that adequate component capability existed. above that required during design basis conditions. such that component operating characteristics over time will not result in reaching a point of insufficient margin before the next scheduled test activity. The RI-IST intervals for components were generally not extended beyond once every 6 years or once every three refueling outages (whichever is longer). In every instance where the interval was extended beyond 6 years or beyond three refueling outages (whichever is longer), the licensee submitted a specific, compelling, documented justification that the staff found acceptable. [Each instance should be explicitly addressed in the safety c) a evaluation report.]
. The licensee also made a commitment to either adopt enhanced test strategies as described in RI-IST Code Cases developed by ASME as endorsed by the NRC, or to request authorization from the NRC to perform an alternate test strategy.
. The licensee provided the staff with a description of the testing to be conducted on components of high safety significance that were not in the licensee's current IST program.
. The licensee assessed the appropriateness of relief for components categorized as HSSC that were the subject of a previously approved relief request (or an NRC-authorized alternative test) in light of the I
safety significance of the component. The staff finds hat relief for I these components is still appropriate. [Each instance should be explicitly addressed in the safety evaluation report.]
. The licensee has made a commitment to exercise or operate IST components
~
(except for certain check valves and relief valves) at ieast once every
, refueling cycle where practical.
I v' 3.9.7-35 Rev. 0 - August 1998
I
- 4. Relief Requests and Technical Specification Amendments The reviewer should verify that sufficient information is provided in accordance with the requirements herein and that the evaluation supports conclusions of the following type to be included the staff's safety evaluation report:
. The licensee's RI-IST program is testing components of high safety :
significance in accordance with the code test frequency and method l requirements or has a relief request approved or submitted for approval.
In addition, the licensee is testing LSSC in accordance with the code test method requirements (although at an extended interval) or has a relief request approved or submitted for approval. The licensee has approved technical specification amendments for all proposed RI-IST program changes that affected its technical specifications.
- 5. Scope, Level of Detail, and Quality of the PRA for IST Application The reviewer should verify that sufficient information is provided in accordance with the requirements herein and that the evaluation supports conclusions of the following type, to be included in the staff's safety evaluation report:
. There is reasonable assurance of PRA adequacy, as shown by the licensee's process to ensure quality. and by a focussei-scope review by the staff which shows that the components affect by the RI-IST process and those that are important to the decisionmaking are appropriately modeled. In addition. results are shown to be robust in terms of uncertainties and sensitivities to the key modeling parameters.
. The level of detail of the PRA is such that the IST components (and relevant failure modes) that contribute most significantly to the plant's estimate risk are included. and that the system and operator dependencies important to the plant risk are included.
. The PRA scope is adequate to provide insights on the plant risk and to provide input to the component categorization process, and limitations in the scope is address in the integrated decisionmaking process.
The reviewer should also verify that the information provided supports the following conclusions:
s
+
-36 Rev. 0 - August 1998
-- x -
a model for unavailability in terms of fault exposure time exists and J was used in the PRA for evaluating the risk significance of extending the selected component test intervals.
the arguments that support the conclusion that no significant degradation will occur are justified or the licensee has considered enhanced testing to the extent needed to substantiate the change.
- 6. Categorization of Components The reviewer verifies that sufficient information is provided in accordance l with the requirements of this SRP section and that the evaluation supports I conclusions of the following type, to be included in the staff's safety evaluation report:
The licensee's process on the determination of risk importance of components in the RI-IST program is robust in terms of the important PRA modeling techniques, assumptions, and data. In addition, the factors as described in the section on integrated decisionmaking (e.g. , risk increases are small, defense in depth philosophy is maintained, and safety margins are maintained) are taken into account when categorizing a component as low safety significant.
- 7. Evaluating the Effect of Proposed Changes on Overall Plant Risk The reviewer verifies that sufficient information is provided to make the following findings:
The application is either risk neutral or decreases plant risk, or if an application results in an increase in risk, the increase is within the acceptance guidelines specified in Section 2.2.4 of Regulatory Guide 1.174
- In calcalating the risk impact:
. Fault exposure time for IST components is modeled appropriately and is linked to programmatic activities.
. The effects of aging and environmental stresses (time dependent degradation of the failure rates) has beeri addressed. either explicitly in the PRA models or as part of the licensee's integrated decisionmaking process.
3.9.7-37 Rev. 0 - August 19'8
. The effects of the IST program change on initiating event frequency have been considered.
. Common cause failure has been suitably addressed. The licensee has systematically identified all component groups sharing attributes that correlate with CCF potential and that affect IST.
either in that they comprise IST components or compensating SSCs.
The licensee's performance monitoring program addresses staggered test w of IST components in CCF groups.
. Credit for human actions that compensate for relaxation of IST is modeled in a defensible way.
. Appropriate failure rates have been used for IST components.
Justification has been provided for the failure rates and monitoring will provide ongoing justification. The licensee has reviewed the modeling of compensating SSCs. and concluded that it is appropriate and that the significance of IST events is not distorted by modeling of compensating SSCs, l
- 8. Integrated Decisionmaking l
If the licensee's proposed alternative is acceptable in light of the safety significance of the component. and if the licensee's risk-informed IST program i
meets the detailed acceptance guidelines specified herein. the staff should be I
able to reach the following general conclusion:
i . The licensee's proposed RI-IST program is authorized as an alternative i
to the ASME Code-required IST program (e.g. including test frequency.
test methods, and program scope requirements) pursuant to S50.55a(a)(3)(i). based on the alternative providing an acceptable level of quality and safety.
B. IMPLEMENTATION, PERFORMANCE MONITORING. AND CORRECTIVE ACTION
- 1. Program Implementation <
l The reviewer should verify that the licensee provided sufficient information l is provided in accordance with the guidance herein and that the evaluation l supports conclusions of the following type, to be included in the staff's l safety evaluation report:
I l
l 3.9.7-38 Rev. 0 - August 1998 O 1
' r]
=
For components in the high safety-significance category, the licensee
()
will either continue to test these components in accordance with the current ASME Code of record for the facility (i.e., test frequency and i method requirements) or has proposed an alternate test strategy that is acceptable to the staff (via either an NRC-endorsed ASME Code Case or a plant-specific relief request). Testing strategies are adequately described in the licensee's RI-IST Program Plan and were found to be acceptable.
l
. For components in the low safety-significance category, the licensee ,
will either continue to test these components in accordance with the current ASME Code of record for the facility or has proposed an alternate test strategy that is acceptable to the staff.
l
. LSSC that will be tested less often than required by the current code I may be tested at an extended interval, in a step-wise manner, only if the interval can be justified on the basis of previous component performance. An acceptable approach is to group similar components and test them on a staggered basis. Corrective action procedures will ensure that the licensee evaluates and corrects failures or l nonconforming conditions that may apply to other components in the es group. The staff found that component grouping was consistent with the
, 'j guidance provided in NRC Generic Letter 89-04. Position 2 for check l valves: Supplement 6 to NRC Generic Letter 89-10 for motor-operated valves; or other documents endorsed by the NRC.
. The licensee has developed plant corrective action and feedback procedures to ensure that testing failures are reevaluated for possible adjustment to the component's grouping and test strategy.
- 2. Performance Monitoring of IST Component The reviewer should verify that sufficient information is provided in accordance with the requirements herein and that the evaluation supports conclusions of the following type, to be included in the staff's safety evaluation report:
l l
. A performance monitoring program exists that covers all components in I the RI-IST program.
l
. The program responds to the attributes specified in Section II.B.2. l q . The licensee is committed to maintain the program as part of its RI-IST l 3.9.7-39 Rev. 0 - August 1998
initiative.
- 3. Feedback and Corrective Action Program The reviewer should verify that the licensee provided sufficient information in accordance with the guidance herein and that the evaluation supports conclusions of the following type, to be included in the staff's safety evaluation report:
. The staff concludes that the licensee's corrective action program is acceptable for implementation with the RI-IST program because it contains a performance-based feedback mechanism to ensure that if a particular component's test strategy is adjusted in a way that is ineffective in detecting component degradation and failure, the IST program weakness will be promptly detected and corrected.
- 4. Periodic Reassessment The reviewer should verify that the licensee has provided sufficient information in accordance with the guidance herein and that the evaluation supports conclusions of the following type, to be included in the staff's safety evaluation report:
The staff concludes that the licensee's procedures for periodic reassessment of its risk-informed IST program are acceptable because the licensee's procedures for periodic reassessment ensure that the licensee's test strategies are periodically assessed to incorporate results of IST and new industry findings.
- 5. RI-IST Program Changes After Initial Approval The reviewer should verify that the licensee has provided sufficient information in accordance with the guidance herein and that the evaluation supports conclusions of the following type, to be included in the staff's safety evaluation report:
. The staff concludes that the licensee has an adequate process or l procedures in place to ensure that RI-IST program changes that could i adversely affect the RI-IST program or results that were previously I reviewed and approved by the NRC staff get evaluated and approved by the NRC before implementation. l 3.9.7-40 Rev. 0 - August 1998 l
I i
G s
V. . RISK-INFORMED IST PROGRAM DOCUMENTATION J
The reviewer should examine the licensee's submittal to assure that it c.ontained the documentation _ necessary to conduct the review described herein (i.e., the documentation described in Regulatory Position 4 of Regulatory l Guide 1.175). The detailed RI-IST program and its updates should be !
, maintained on site and should be available for NRC inspection consistent with ;
i the requirements of 10 CFR Part 50. Appendix B. i
( The reviewer should also ensure that the cover letter that transmits to the licensee the staff's safety evaluation approving the proposed RI-IST program (i.e.. alternate IST program to that prescribed by the ASME Code) contains a statement to the effect that " Failure to comply with the RI-IST p maram as l
reviewed and approved by the NRC staff and authorized pursuant to 10 CFR ;
50.55a(a)(3) (e.g., including' scope, test strategy documentation, and other l
programmatic requirements) constitutes noncompliance with 10 CFR 50.55a and is [
enforceable."
i VI.- IMPLEMENTATION The preceding material is intended to provide guidance to licensees regarding !
') the NRC staff's plans for using SRP Section 3.9.7. Except in tho'e s cases in v which the applicant proposes an acceptable alternate method for complying with l specified portions of Regulatory Guide 1.175. the method describ d herein will -
be used by the staff in its evaluation of risk-informed, performance-based 1 changes to the design, operation, and other activities of the licensee's l plant.
VII. REFERENCES
- 1. U.S. Nuclear Regulatory Commission. "Use of Probabilistic Risk Assessment Methods in Nuclear Activities: Final Policy Statement " ,
Federal Register, Vol. 60, p. 42622. August 16, 1995.
- 2. U.S. Nuclear Regulatory Commission. Regulatory Guide 1.174. "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on l Plant-Specific Changes to the Licensing Basis." July 1998.
l
- 3. U.S. Nuclear Regulatory Commission. Regulatory Guide 1.175. "An Approach
- for Plant-Specific Risk-Informed. Decisionmaking: Inservice Testing."
August 1998. !
3.9.7-41 Rev. 0 - August 1998
- - - - ,, , , -,-l
- 4. U.S. Nuclear Regulatory Commission. Standard Review Plan Chapter 19.
"Use of PRA in Regulatory Activities." July 1998.
- 5. U.S. Nuclear Regulatory Commission. Generic Letter 89-04. " Guidance on Developing Acceptable Inservice Testing Programs." April 3.1989.
l 6. U.S. Nuclear Regulatory Commission. Generic Letter 89-10. Supplement 6.
"Information on Schedule and Grouping, and Staff Responses to Additional l
Public Questions." March 8. 1994.
- 7. U.S. Nuclear Regulatory Commission. Generic Letter 96-05. " Periodic Verification of Design-Basis Capability of Safety-Related Motor-Operated Valves." September 18. 1996.
- 8. Apostolakis. G. A. and Kaplan. S. , " Pitfalls in Risk Calculations."
Reliability Engineering. Vol. 2. pages 135 - 145, 1981.
- 9. Nuclear Energy Institute. " Guidelines for Managing NRC Commitments."
Revision 2. December 19. 1995.
9
(
l 3.9.7-42 Rev. 0 - August 1998
O 4
O Printed on recycled paper Federal Recycling Program
l 0
! ~
- UNITED STATES FIRST CLASS MAIL POSTAGE AND FEES PAID l NUCLEAR REGI)LATCR.Y COMMISSION USNRC l WASHINGTON, DC 20555-0001 PERMIT NO. G-67 f OFFICIAL BUSINESS i PENALTY FOR PR!VATE 'JSE, $300
(
l
?
+
'. 2
?
~ .+
' t i
\ . . - ,,,,. . .:-.
^'
. - . , , ..n... . ~ , . . - - --- ~ . L *