ML20206R919

NRC Nuclear Power Reactor Baseline Inspection Program

ML20206R919
Person / Time
Issue date:	12/31/1998
From:	Berhard R, Mallett B, Stein S NRC (Affiliation Not Assigned), NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II)
To:
Shared Package
ML20206R761	List: ML20206R756 ML20206R919
References
PROC-981231, NUDOCS 9901210265
Download: ML20206R919 (180)

Text

.. _ - - - .__ . -. _- -- - - -. - . . . - - - - __

~

t l l l

l .

l l

l I

NRC i

NUCLEAR POWER REACTOR BASELINE INSPECTION l

PROGRAM l December 1998 Developed by:

Bruce S. Mallett, Region 11, Team Leader Steven R. Stein, NRR, Assistant Team Leader Rudolph H. Bernhard, Region 11 Jin Chung, NRR Thomas Dexter, Region IV John Flack, RES Ronald Lloyd, AEOD Sam Malur, NRR Peter Prescott, AEOD Larry Scholl, Region i Nick Shah, Region lli Mel Shannon, Region ll Randolph L Sullivan, NRR Barry Westreich, OE Attachment 3 i

9901210265 981216 PDR REVGP ERGNUMRC PDR

. l Table of Contents Pace Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii 1 Program Part 1: Inspectable Areas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.1 Inspectable Areas Required in the Baseline Program . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2 Ba sis Docum en ts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1.3 Inspection Planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.4 Eve n t Follow Up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.5 Plant Status Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .... . . . .4 . . . . . . . .

2 Program Part 2: Process for Verifying Performance Indicators . . . . . . . . . . . . . . . . . . 6 3 Program Part 3: Process for Evaluating Problem Identification and Resolution . . . . . 7 4 inspection Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 5

Interf ace with Other NRC Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

5.1 All e g a tion s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .... . . . 9. . . . . . . . . 9 5.2 Performance Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 5.3 E nf o rce m e nt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

5.4 T ra i n i n g . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ........... . . . . . . . . . 9. . . . . . . 9 6

Risk Inf ormation Matrices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 7 l D efinition s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 8 Projected Re sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 9 Program Feedback and Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 List of Tables Table 1: Inspectable Areas by Comerstone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Table 2: Concept for Baseline inspection Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Table 3: Projected Resource Estimates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Appendices Appendix 1: Basis Documents for inspectable Areas Appendix 11: Comerstone Charts Appendix 111: Risk Information Matrices li

EXECUTIVE

SUMMARY

l As a part of the NRC's response to issues raised by stakeholders, intemal and extemal to the NRC, the Commission directed the staff to develop a new regulatory oversight process. The objective was to develop a more risk-informed, efficient, and effective baseline inspection program and plant performance assessment process. To accomplish this objective, the work was divided into three projects: (1) technical framework, (2) baseline inspection program, and (3) assessment process. The technical framework task group developed the concept of cornerstones of safety, which are areas of reactor functions or reactor licensee activities that I

must be performed to a certain set of objectives in order to ensure that the NRC's mission is I met. The inspection task group used this comerstone framework as a guide during the development of the NRC power reactor baseline inspection program.

l The inspection task gcoup was comprised of 14 individuals from multiple NRC offices, including l each region and the ofees of Nuclear Reactor Regulation, Nuclear Regulatory Research, l Analysis and Evaluation cf Operational Data, and Enforcement. Group expertise included i managers and staff with experience in designing and conducting inspections of nuclear power l reactor facilities.

This document is the product of the inspection task group and it describes the key concepts and process for a risk-informed baseline inspection program. The methodology used by the task group and the key concepts of the program are summarized below:

Devetooment Methodoloav The baseline inspection program was developed using a risk informed approach to determine a '

comprehensive list of areas to inspect (inspectable areas) within each comerstone. These are listed in Table 1 in Section 1.1. Risk-informed means that the areas were selected based on their significance from a risk perspective (i.e., must be needed to meet a cornerstone objective as derived from a combination of probabilistic risk analyses insights, operationa! experience, deterministic analyses insights, and requirements in regulations).

Basis documents were created to describe the scope of each inspectable area and the justification for inspection based on risk information. The basis documents also were used to indicate whether the inspection is designed to be complementary or supplementary to a performance indicator (Part 1 of the program) or designed only for verification of a performance indicator (Part 2 of the program). Risk information matrices were developed, with input from the Office of Research, to serve as guides in planning and conducting inspections as described in Section 1.3.

The team benchmarked the concepts for the baseline inspection program with selected Federal agencies (i.e., Environmental Protection Agency and the Federal Aviation Administration). The purpose was to glean insights into how these agencies incorporated risk into their inspection programs.

Throughout the project, the inspection task force elicited issues to address and comments on proposed program concepts from licensees, the Nuclear Energy Institute, and internal NRC stakeholders. The baseline inspection program document addresses these issues and incorporates the comments.

iii

. _ . _ _ _ _ __ . _ _ _.___ ._ = . . . _ . . _ .

Eroaram Overview The power reactor baseline inspection program defines the planned activities to evaluate licensee performance at a minimum level of NRC effort over a 12-month period. The overall objective of the program is to monitor all power reactor licensees at a defined level of effort to assure licensees' performance meets the objectives in each comerstone of safety. These cornerstones support the agency's performance goals in the NRC's Strategic Plan.

A key concept in the pro' gram is that all areas where there is a need to inspect a licensee's performance are defined as "inspectable areas". These areas are then categorized into three types of inspections to reduce inspection effort where licensee performance to meet a

comerstone objective is adequately gauged by performance indicators. The first type

! inspection is termed complimentary, and it is used for comerstone areas where a performance 4

indicator has not been established. The second type of inspection is termed supplementary, j and is used for cornerstone areas where the performance indicators provide only limited indication of performance. The third type inspection is termed verification, and is used for cornerstone areas where the performance indicator sufficiently measures performance of the i

cornerstone objective. In the verification type, the inspection need only verify that the

performance indicator is providing the intended data. The inspectable areas, along with the ,

type inspection proposed for each, are listed in Section 1.1. '

l Another important concept in the baseline program is that each inspectable area will have a basis document, which describes the scope of the inspectable area and the reasons why the i

area is included in the baseline program. Reasons may include (1) the linkage to the NRC's  ;

mission, (2) the linkage to the key attribute of a cornerstone of safety that the inspectable area  !

i is measuring, and (3) the risk information that was used to explain wny there is a need to j include the inspectable area in the baseline program.

i A third concept in the program is that the regional managers and inspectors will plan the type and number of activities to inspect each year for each reactor site, based on the guidance l contained in the risk information matrices (RIMS) in Section 6 and Appendix ill.

l Risk has been factored into the baseline inspection program four ways: (1) inspectable areas i are based on their risk importance in measuring a cornerstone objective, which supports the NRC mission, (2) the frequency, how many activities, and how much time to inspect activities in

each inspectable area are based on risk information in a RIM, (3) selection of activities to

] inspect in each inspectable area is based on the use of a RIM, modified by plant specific j information, and (4) inspectors are trained in the use of risk information.

4 I

The baseline inspection program will be implemented by a combination of resident and regional

mspectors. The actual inspection of inspectable areas will be performed by these two

inspection groups using the eight procedures specified in Section 4.

I Future Development Work e

The baseline inspection program introduces concepts that are new to the agency's power

reactor inspection program and that were developed over a relatively short time. The inspection task group recognizes that additional effort is needed before the program is complete enough for a pilot effort. The following tasks were identified by the task group as

{ necessary to complete the development of the proposed risk-informed baseline inspection program:

, h'

Write and test the inspection procedures for the baseline inspection program.

Train resident and regionalinspectors in applying risk through the baseline inspection program, how to implement the new program, and how to use the new inspection procedures.

Instruct regional managers in the new concepts for the baseline program and new methods for plaryning baseline inspections.

More completely benchmark the baseline inspection program against past plant performance, e Additionally review the inspectable areas after fully verifying the Pls to make adjustments in inspection scope and level of effort.

Review the inspectable areas against regulations to identify any areas that are not currently addressed in the regulations.

e Continue to review stakeholders' comments and concems with the proposed baseline inspection program.

Establish a process for modifying the baseline inspection program as changes are made to the performance indicators.

e Further develop the process for continually evaluating the baseline inspection program and feeding back lessons leamed, e

Determine the type of inspection (resident, regional specialist, team) to be used in each part of the program and for the inspectable areas.

t V

1 1 PROGRAM PART 1: INSPECTABLE AREAS 1.1 inspectable Areas Required in the Baseline Program The baseline inspection program requires the inspectable areas in Table 1, below, be reviewed at each nuclear power plant each year. The inspectable areas verify aspects of key attributes for each of the associated cornerstones, and their link to the attributes they are measuring is depicted in the cornerstone charts in Appendix 11. The inspectable areas are characterized as one of three basic types of inspection of cornerstones: complementary inspection, supplementary inspection, or verification inspection. Complementary inspections verify performance in areas that are not measured by a performance indicator, supplementary inspections augment the information provided by performance indicators that do not sufficiently measure performance in a comerstone area; angt verification inspections verify the accuracy and completeness of the data used as the basis for performance indicators used to fully measure performance of a cornerstone area. Therefore, the amount of inspection effort within each inspectable area is affected by the applicability of a performance indicator to the cornerstone area. Table 1 identifies the characterization of each inspectable area in the seven comerstones.

Table 1: Inspectable Areas by Comerstone e

initiatino Events Comerston_e Adverse weather preparations (complementary)

Equipment alignment (supplementary)

Emergent work (complementary)

Fire protection (complementary)

Flood protection measures (complementary)

Heat sink performance (complementary)

Identification and resolution of problems and issues (complementary) i inservice inspection activities (complementary)

Maintenance rule implementation (supplementary)

Maintenance work prioritization and control (supplementary)

Nonroutine plant evolutions (supplementary)

Piping system erosion and corrosion (complementary)

Refueling and outage activities (complementary) e Miticatino Systems Comerstone i

Adverse weather preparations (complementary)

Changes to license conditions and safety analysis report (complementary)

Emergent work (complementary)

Equipment alignment (supplementary)

Fire protection (complementary)

Flood protection measures (complementary) i Heat sink performance (complementary)

Identification and resolution of problems and issues (complementary)

Inservice testing of pumps and valves - ASME Section XI (complementary) i

' Licensed operator requalification (human performance) (complementary)

Maintenance rule implementation (supplementary)

Maintenance work prioritization and control (supplementary) 1 1

[

Table 1: Inspectable Areas by Comerstone (continued)

Nonroutine plant evolutions (supplementary)

Operability evaluations (complementary)

Operator work arounds (complementary)

Permanent plant modifications (complementary) l Post maintenance testing (supplementary)

Refueling and outage activities (complementary)

Safety system design and performance capability (complementary)

Surveillance testing (supplementary)

Temporary plant modifications (complementary) l e Barrier Intearity Comerstone l

Changes to license conditions and safety analysis report (complementary)

Equipment alignment (supplementary)

Fuel barrier performance (verification) i identification and resolution of problems and issues (complementary)

Inservice inspection activities (complementary)

Large containment isolation valve leak rate and status verification (verification)

Licensed operator requalification (complementary)

Maintenance rule implementation (supplementary) l Maintenance work prioritization control (supplementary)

! Nonroutine plant evolutions (supplementary) l Permanent plant modifications (complementary) l Refueling and outage activities (complementary) l Surveillance testing (supplementary)

Temporary ' plant modifications (complementary) 1 l

• Emeraency Preparedness Cornerstone l

l Alert and notification system testing (verification)

Drill and exercise inspection (verification) l Emergency action level changes (complementary) l Emergency response organization augmentation testing (complementary)

! EP training program (verification) l Identification and resolution of problems and issues (complementary)

• Occupational Exoosure Cornerstone l Access control to radiologically significant areas (supplementary)

ALARA planning and controls (complementary)

( Identification and resolution of problems and issues (complementary)

Radiation monitoring instrumentation (complementary) l Radiation worker performance (complementary) l *

• Public Exoosure Cornerstone l

I Gaseous and liquid effluent treatment systems (supplementary)

Identification and resolution of problems and issues (complementary)

Radioactive material processing and shipping (complementary) 2

Radiological environmental monitoring program (complementary) e Physical Security Comerstone Access authorization (human performance, program / process)

Access control (equipment, human performance, program / process)

Changes to license conditions and safety analysis report (program / process)

Identification and resolution of problems and issues Physical protection system (equipment, human performance)

' Response to contingency events (equipment, human performance, program / process) 1.2 Basis Documents Each inspectable area is described in a basis document (see Appendix I). The documents discuss the scope of inspections within the areas and the basis for why each area needs to be inspected in the baseline program. The basis includes risk insights from generic risk analyses and studies, analyses of significant precurser events, End the judgement of an expert panel of inspectors and risk analysts.

The basis document for each inspectable area also identifies if a performance indicator is applicable to the area and how the indicator effects the inspections within the area. Inspections are either complementary, supplementary, or verification. (See Section 1.1, above.)

Inspectors will use the basis documents to focus their baseline inspections into the more risk-significant aspects of the inspectable areas that directly support the desired results and important attributes of the comerstones of safety.

1.3 Inspection Planning The planning and tracking of hours for the baseline inspection program will be based on the total hours allocated for each cornerstone, which are summarized in Table 3 in Section 8.

l Those hours were derived from a risk information matrix (RIM) that was developed to assist in l risk informing the planning and conducting of baseline inspections. (See Section 6, below and l Appendix 111.) RIM 1, from which the total hours were derived, establishes a baseline level of l effort for each inspectable area. However, planning for monitoring of the baseline inspection l program will be based on the comerstones and not the individualinspectable areas.

Each year, inspections at each nuclear power reactor site will be planned using a process much  !

f like the current Plant Performance Review process. The primary steps in the planning process  !

! will be:  !

l l

1. In each comerstone, determine the inspectable areas applicable for the specific plant for ,

the upcoming period from Table 1 in Section 1.1 of this document. The only reason an l inspectable area may be excluded is that the area may not be expected to occur at the site during the next 12 months (e.g., the refueling and outage activities).

2. For each inspectable area, select the systems or activities to be inspected during the i

next 12 months. Guidelines for selection of the type system or activity can be obtained j on a generic basis from RIM No. 2. Modifications to this generic basis should be made I

3

to accomodate site specific information. Guidelines for the number of systems or activities can be obtained using RIM No.1.

3. Schedule inspection of the systems and activities selected in steps 1 and 2 above over the next 12 months.

The total hours for inspecting the systems and activities for all inspectable areas within a comerstone are fixed for the 12-month period and must not exceed those hours specified in Section 8 of this document. The planned hours for inspecting each inspectable area in a comerstone, however, are nqt fixed and do not need to be tracked or match those shown in RIM No.1.

1.4 Event Follow Up NRC's norrnal follow up of events fall into three general categories: (1) events of low significance that need only minimal follow up, (2) events of much greater significance that need a special team to follow up, and (3) events whose significance require follow up somewhere between 1 and 2. The baseline program is designed to encompass an initial screening of all licensee event reports and following up only some of the more routine, noncomplex events.

The program includes a procedure for event follow up to be used in conjunction with inspections in the various inspectable areas. Following up other events with regional discretionary resources would be based on the significance of the event and whether the plant is receiving only baseline inspections.

The follow up of more extensive, nonroutine events is outside of the scope of the baseline inspection program and would be performed with reactive inspection resources. The decision to follow up such events would be made on a case-by-case basis by NRC regional management and as directed by senior NRC management in accordance with NRC Management Directive 8.3,"NRC incident investigation Procedures."

1.5 Plant Status Review The baseline inspection program includes a procedure that is used in conjunction with other inspectable areas for routine control room and plant walkdowns of all safety significant plant areas. For example, plant areas that contain equipment included within the scope of the maintenance rule, areas with significant radiological hazards, and areas with important physical security equipment would be included in this inspection. Inspection activities would also include a review of control room logs, observations of operator shift turnovers, and review or observation of the facility's plan of day meeting and management's review of plant deficiencies.

The primary objective of these inspection activities would be to ensure that the inspectors are aware of current plant and equipment problems and have an appropriate level of understanding of the risk significance of the proposed or ongoing operations, maintenance, and testing activities. The inspection activities would focus on identification and understanding of emergent plant issues, potential adverse trends, current equipment problems, and ongoing activities and l their overallimpact on plant risk. This activity also allows for an independent assessment of the effectiveness of the licensee in entering system and component deficiencies into the corrective action program.

s l

l 4

These aspects of the inspection effort are important because they will be used to aid in the risk informed selection process described in Section 1.3 to modify the scope and depth of inspections in other inspectable areas that support assessment of all comerstone areas.

There are no performance indicators that have been established that can provide results re!ated to safety significance of emerging plant issues or ongoing activities. In addition, performance indicator data would be a lagging indicator and would not include current status of equipment.

Therefore, the baseline inspection program includes this activity. The procedure to use in performing this inspection is referred to in Section 4 of this document.

Hours have not been allotted specifically for plant walkdowns. The effort has been factored into the allotted times for each affected inspectable area.

l 5

I i

_ - . ._ - _~_ __- _ __ - _ _.

l 2 PROGRAM PART 2: PROC 23S FOR VERIFYING l

PERFORMANCE INDICATORS l The NRC and industry have established a set of performance indicator (Pis), which relate to the seven cornerstones of safety. The NRC will evaluate licensee performance within the

comerstones using a combination of Pls and inspection information. Therefore, it is important that the NRC verify the accuracy of the data being reported with the indicators.

As part of the baseline inspection program, the NRC staff will periodically review the Pi data to

determine its accuracy and completeness and to compare the Pi indication of performance to l performance indicated by inspections. The NRC staff will collect and review licensee plant

specific Pls as well as selectively reviewing the objective raw data that formed the basis of the  ;

Pls. '

L l

' As part of the 12-month planned inspections, Pl data will be reviewed by the inspectors. The I baseline inspection program includes a separate inspection procedure for verifying Pls. The ,

procedure will work in conjunction with the inspectable areas that include verifying specific Pls. l The sampling of Pi data will verify that (1) operating experience was entered into the licensee's '

Pl database, (2) the data was appropriately characterized, (3) reporting thresholds were in accordance with agreed upon definitions and reporting criteria, and (4) any models used to prescribe action levels based on a Pl produce acceptable results. The inspector will review any changes that licensees make to their Pl databases or the models for determining action levels  !

, that may alter Pi results. As part of the PI verification, the inspector will determine whether Pl l

l action thresholds were appropriately set and not modified without adequate technical review.  !

1 1

i I

6

3 PROGRAM PART 3: PROCESS FOR EVALUATING PROBLEM IDENTIFICATION AND RESOLUTION l

An effective problem identification and resolution program is the primary means of reducing risk by effectively correcting deficiencies involving human performance, equipment, and programs and procedures.

In general, licensees identify problems (conditions adverse to quality) by three processes:

1) problem reports or condition reports that are initiated by plant personnel when they observe problems; 2) licensee self assessments of individual departments (such as engineering, operations, and radiation control); and,3) quality assurance audits. Problems identified by any of these processes are assessed by the licensee, root causes are determined, and corrective actions are implemented under a plant-wide corrective action program. At some plants, each department may have its own problem identification and corrective action program.

The process for evaluating problem identification and resolution will consist of reviewing the licensees' deficiency reporting process, self-assessments, quality assurance audits, root cause analyses of events, corrective actions, and follow up to corrective actions to validate effective implementation. The NRC will review the licensee's activities in this area to verify that: 1) the l scope of licensees' identification and resolution programs bounds the key attributes in the l cornerstones; 2) root causes of problems and issues have been properly determined and l corrective actions are timely and effective; and,3) generic implications or extent of condition have been considered. If the NRC's review indicates that for any of the key attributes the licensee has not been identifying and correcting problems, additional inspections in that area l may be proposed.

The NRC program to review activities in this area is composed of two parts. The first part is a l review of the associated inspectable area within each cornerstone, along with the other I

applicable inspection areas. The procedures for this part will be included in the inspection procedure for each cornerstone. The second part is a biannual review of the overall problem j identification and resolution programs across all cornerstones. The biannual review should not duplicate the inspections within the cornerstones. A separate inspection procedure will be 4

.oped for this part of the program.

NRC inspectors will use licensee's self-assessments to help direct these baseline inspections into worthwhile areas. However, licensee self assessments will not be used to reduce or replace baseline inspections.

l 4

7

e 4 INSPECTION PROCEDURES Baseline inspections will be performed using the procedures listed below. There are certain procedures for each portion of the baseline inspection program. The table below lists the procedures, along with the correlation to the applicable portions of the program:

Table 2: Concept for Baseline inspection Procedures PROGRAM PART PROCEDURE APPUCABLE AREAS Reviewing inspectable areas in the initiating Reactor Safety events, mitigation systems, and barrier comerstones Emergency Reviewing inspectable areas in the Preparedness emergency preparedness comerstone Reviewing inspectable areas in the inspectable Area Radiation Safety occupational dose and public dose Review cornerstones l

Security Reviewing inspectable areas in the physical security cornerstone Event Follow Up Reviewing emergent events Plant Status Reviews Walking down plant activities and systems in conjunct, ion with reviewing inspectable areas identification and Identification and Reviewing the identification and resolution of

! Resolution of Resolution of problems across cornerstones l Problems Problems l

l Verification of \/eritying the accuracy and completeness of Verifying Performance t Performance !nf rmation used in the performance Indicators indicators indicators within the comerstones l

i i

1 8

5 INTERFACE WITH OTHER NRC ACTIVITIES 5.1 Allegations The baseline inspection program does not include resources for follow up on allegations received by the NRC. The process for review of incoming allegations will continue to follow that described in NRC Management Directive 8.8," Management of Allegations." However, the baseline inspection program is designed to allow for follow up in conjunction with the planned reviews of the inspectable areas. Following up on allegations that require immediate response or extensive inspection effort is outside of the baseline program and is budgeted in the reactive inspection program.

5.2 Performance Assessment inspection findings will be used, in conjunction with performance indicators, in assessing licensees

• performance within the newly developed assessment process. The inspection findings from the baseline program (and other inspection findings for plants that receive more than the baseline program) will be recorded in inspection reports and collected in a document such as the Plant issues Matrix. A level of risk significance, based on a risk scale, will be determined and documented for the findings. Some risk significance of findings can be inferred through the risk informed nature of the program. That is, the program has established those risk significant areas that wi'l be inspected, and it directs the inspector into the more risk-significant systems and activities.

5.3 Enforcement Violations identified during the conduct of the baseline inspection program will continue to be processed in accordance with the NRC Enforcement Policy, NUREG 1600. Violations will be followed up during the inspection of the licensee's process for identification and resolution of problems and issues. Inspection in this area will become increasingly more important as the enforcement policy is modified to expand the use of noncited violations (NCVs) and require fewer licensee responses to Severity Level IV violations.

5.4 Training The proposed baseline inspection program will require the development of new inspection

~

procedures, which will use the concept of risk insights from the inspectable area basis documents. The program will also have procedures based on comerstones of safety rather than based on SALP functional areas. Because of these significant changes, additional training is considered necessary for the inspection staff to successfully implement this program.

Training specific to the baseline inspection program would incude:

Training on the organization and implementation of the baseline program (e.g., use of performance indicators, inspectable areas, planning);

Training on the definition and use of risk insights in the Emergency Preparedness, Security and Radiation Protection inspection programs, and the use of generic and site specific PRA insights for all other inspectors; and 9

I .

i l Guidance on inspecting selected portions of emergency planning, radiation protection

! and secunty for resident inspectors.

1 This training would be in addition to those requirements already stated in IMC 1245," inspector Qualification Program For the Office of Nuclear Reactor Regulation inspection Program." l Resources for training are budgeted separately from the baseline inspection program. j a

a l

l I

4 1

! 10 l

l i

6 RISK INFORMATION MATRICES The risk information matrices (RIMS) are tools to be used in determining which activities, systems, or components are to be inspected in the baseline inspection program. The matrices are to be used, along with other generic and site specific information, in planning the baseline program at the beginning of each planning cycle to schedule inspections within each inspection

' area, and during inspections to help guide the inspector in selecting the more risk-significant inspection samples.

The first table (RIM 1 in Appendix lil) includes the frequency, number of activities or components to inspect, and total hours expected in the baseline program for each inspectable area. This RIM also describes the basis for these items. The data in RIM 1 was derived from risk analysis in IPE and IPEEE, inspection experience, and history of problems at plants for the cornerstones in the reactor safety strategic performance area. Parallel efforts to develop resource estimates were made by NRC risk analysts, and independently by two NRC contractors. The results of the efforts were compared and merged to create a risk informed estimate of level of effort.

A different approach was taken for incorporating the comerstones from the radiation safety and safeguards areas into RIM 1. For these cornerstones, a relative risk methodology was used that was based on relative frequency of occurrence and consequence of the events of interest.

Level of effort was determined by ranking the frequency and consequence as either high or low.

Areas with high frequency of occurrence and high consequence (high relative risk) were l assigned the highest levels of oversight. Areas with low frequency of occurrence and low consequence (Iow relative risk) were assigned little or no oversight. Areas of low frequency of occurrence and high consequence were assigned a moderate level of oversight. i 1

A second table, a generic risk insights table (RIM 2 in Appendix 111), was developed based on reviews of IPE/IPEEE databases, summary NUREGs on the IPE results, and contractor reports i dealing with risk insights. This table is to be used for generic insights for inspection planning until site specific tables are developed.

5 11

~

l 7 DEFINITIONS 7.1 Baseline Inspection Program The set of risk-informed inspectable areas that, coincident with performance indicators, provide sufficient information to assess licensee performance within comerstones and to detect trends in performance. It is the minimum inspection performed at all operating nuclear power plants.

7.2 Complementaryinspection inspection within a comerstone area for which a performance indicator has not been identified.

7.3 Cornerstone The fundamental building block for the regulatory overs ght process.

Acceptable licensee performance in each comerstone prov des reasonable assurance that the NRC's overall mission of adequate Motection of public health and safety is met.

7.4 Deterministic Approach Considering a set of challenges to sa,ety and determining how those challenges should be mitigated. ,

7.5 Inspectable Area Those aspects of the physical plant or the licensee's programs or processes that need to be verified to assure a desired attribute of a comerstone is achieved or maintained to assure safe operation.  ;

l 7.6 KeyAttribute A characteristic of a cornerstone that needs to be achieved or maintained to assure public health and safety.

7.7 Performance Indicator A set of data monitored over a period of time to provide a measure of licensee performance of a key attribute within a comerstone.

7.8 RiskInformation Matrix A table that lists for each inspectable area important activities from a risk perspective, a relative risk ranking for the area, a suggested frequency for inspecting the activities, and a methodology for selecting risk-informed inspection samples.

7.9 Risked-InformedApproach A philosophy whereby risk insights are considered together with other factors (e.g., engineering analysis and judgement, and performance history) to establish requirements that better focus attention on issues commensurate with their importance to health and safety.

7.10 Supplementaryinspection inspection within a comerstone area for which the performance indicator is not sufficiently comprehensive to fully measure licensee performance.

12

7.11 Validation (ofpedormance Indicators)

The process of determining the degree to which a performance indicator measures performance.

7.12 Verification (of performance indicators)

The process of confirming the accuracy and completeness of data used as the basis for a performance indicator.

7.13 Verificationinspection inspection necessary to verify the accuracy and completeness of reported performance indicator data within a comerstone area for which the performance indicator is sufficiently comprehensive to fully measure licensee performance.

l l

i i

l I

l i

k i

13

~ . -

d 8 PROJECTED RESOURCES I Direct resource effort in the form of hours of inspection per year has been projected for each l part of the baseline inspection program. These are provided in the table below, which will be j used for planning the inspections at each site over a 12 month period.

The hours are for a 12-month period for the entire site. Exceptions must be allocated for sites where each reactor unit is a different type. At these sites there will be additional baseline inspection hours. .

Table 3: Projected Resource Estimates (2-unit reactor site) lNSPECTION CORNERSTONE PER R (2 UNrr SITE *)

l Initiating Events 182 Mitigating Systems 1151 Barrier Integrity 183 Emergency Preparedness 59 Occupational Exposure 123 Public Exposure 40 Physical Security 104 Total 1842

• The total level of effort for single-unit sites has not yet been fully determined. The effort will be the same as shown in the table for the Emergency Preparedness, Occupational Exposure, Public Exposure, and Physical Security comerstones. Level of effort needs to be determined for the initiating Events, Mitigating Systems, and Barrier integrity comerstones.

l

! 14

1

9 PROGRAM FEEDBACK AND ASSESSMENT l

l The baseline program was developed using an approach to select areas to inspect that is .

different from the existing core inspection program. For example, the new program provides l inspectable areas based on a risk informed and performance based comerstone framework. In l

contrast, the current program provides inspectable areas based on a SALP functional area '

framework.

Because this is a new program and some of the data for hours to inspect and frequency in the new program rely on an estimate, there should be a feedback process to modify the inspectable

' areas, the frequency of inspection, and the hours to expend. The effectiveness of the baseline program will be evaluated on a trial basis for a 12-month period. After the completion of the trial period, the baseline program will be evaluated by an expert panel comprised of NRR and regional personnel. Feedback received from the participants in the trial programs would be used by the panel to improve the baseline inspection program, it may be determined that some Pls may not correlate well with plant performance or risk associated with plant activities. This discovery will result in a modification to the inspection program to provide an adequate level of inspection effort necessary for assessing performance.

If a Piis determined to no longer provide an indication of performance within an area, the P1 would no longer be used to reduce inspection effort. In these instances, the NRC will revert to inspection to assess performance in that area. As new Pls are developed, adjustments will be made in the inspection effort within the affected area and the PI will also be verified through this same inspection process.

p i

l I

15 9

APPENDIX l BASIS DOCUMENTS FOR INSPECTABLE AREAS December 1998 MrAuuwT?

l _ _ _ _ _ _ _

b l

l The following is an alphabeticallisting of each inspectable area under the baseline inspection program. Following the list are the basis documents for each area.

Inspectable Area Paae Access Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Acce ss Cont rol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ........

. . . . ..... . . . 1-3

! Access Control to Radiologically Significant Areas . . . . . . . . . . . . . . . . . . . . . . . . . 1-4

[ Adverse Weather Preparations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ... . . . . 1 5 ALARA Planning and C;ontrols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-6 ..

Alert and Notification System Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . l 7 Changes to License Conditions and Safety Analysis Report . . . . . . . . . . . . . . . . . . . . . . . . 1-8 Drill and Exercise inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 l Emergency Action Level Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-11 l

Emergency Response Organization Augmentation Testing . . . . . . . . . . . . . . . . . . . . . . 1-12 l Emergent Work . . . . . . . . . . . . ......... ..........................

1- 13 l E P Training Prog ram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. .. .. .. .. .. .. .. 1 14 l Equipment Alignment . . . . . . . . . . ........................................1-15 l

Fire Protection . . . . . . . . . . . . . . . . . . . ... .................... ....... 1-16 i Flood Protection Measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ....... . . . . 1-17 Fuel Barrier Performance ............ . ...

.......................... 1-18 Gaseous and Liquid Effluent Treatment Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-19 i Heat Sink Performance . . . . . . . . . .. . . . ........................ 1-21 Identification and Resolution of Problems / issues . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-22 Inservice inspection Activities . . . . . . . .. . ......................... . 1-24

inservice Testing of Pumps and Valves-ASME Section XI . . . . . . . . . . . . . . . . . . . . 1-25 l Large Containment Isolation Valve Leak Rate and Status Verification . . . . . . . . . . . . 1-26 Licensed Operator Requalification .... ... ............................. . 1-27 Maintenance Rule implementation .... ................................. 1-28 Maintenance Work Prioritization and Control . .. ........................... 1-29 Non Routine Plant Evolutions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-30 Operability Evaluations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-31 Operator Work-Arounds . . . . . . . . . . . . .. .. ........................... ...

1-32 Permanent Plant Modifications . . . . . . . . . . . . . ........................... ... 1-33 Physical Protection System . . . . . . . . . . . . ................................ 1-34 Piping System Erosion / Corrosion .....

.................................1-35 Post Maintenance Testing . . . . . . . . . . . . . . . ............................... 1-36 Radiation Monitoring instrumentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-37 Radiation Worker Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-38 Radioactive Material Processing and Shipping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 Radiological Environmental Monitoring Program (REMP) . . . . . . . . . . . . . . . . . . . . . . . . . 1-40 Refueling and Outage Related Activities . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . 1-41 Response to Contingency Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-42 Safety System Design and Performance Capability . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-43 S urveillan ce Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-44 Temporary Plant Modifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-4 5 t

1 1-iii l

l t

l

. --e a 4a. - 4 m.--3.a - - A-. .4.-- -

4 aB'" .a -- ,, -,- - -,m--,

4 9

8 e

I*lV

INSPECTABLE AREA Access Authorization (Personnel Screening, Fitness-for-duty and Behavior Observation)

Scope This area will verify that the licensee is properly implementing their personnel screening and fitness for-duty programs, including granting, denying, and revoking unescorted access authorization into the protected area, as appropriate.

Basis inspection of these areas supports the Physical Security comerstone.

This is a risk significant area because the personnel screening and fitness-for-duty processes are used to verify personnel reliability and trustworthiness prior to granting unescorted access to the site protected and vital areas and to assure continued reliability and trustworthiness after that. The establishment of reliability and trustworthiness for persons granted unescorted access to the protected area is a major component of protection against the insider threat as defined in 10 CFR 73.1 of radiological sabotage. The behavioral observation process is used to monitor the continuation of trustworthiness for persons authorized unescorted access and for escorted visitors.

An individual with malevolent intent or an individual under the influence of drugs could be granted unescorted access due to human or program failure. The frequency of this type of event has been low but the safety significance of this type event can be medium to high. The probability of a single individual causing a radiological release is low although the consequences of an individual causing a radiological release can be high depending on the individual's knowledge of plant systems.

Historically, licensees have effectively implemented the personnel screening and fitness-for-duty programs.

The licensee is required by 10 CFR 73.56 to maintain an access authorization program, which includes background investigations and psychological assessments, for granting individuals unescorted access to protected and vital areas with the objective of providing high assurance that the individuals are trustworthy and reliable and do not constitute an unreasonable risk to public health and safety including the potential to commit radiological sabotage. The licensee is also required by 10 CFR 26.10 to maintain a fitness-for-duty program that provides reasonable assurance that the workforce will perform tasks in a reliable and trustworthy manner and that they are not under the influence or impaired from any cause. Both rules require behavioral observation to detect indications of behavioral problems that could constitute a threat to public health and safety.

Performance Indicators This area will be assessed by a performance indicator after an initial verification and validation inspection is done to confirm implementation of the program is acceptable and that reporting thresholds for a significant event meets regulatory expectations. The initial verification and validation inspection will serve to ensure valid data is used for the performance indicator. There will be a two-part PI for this area, one for access control and one for FFD. The performance indicator for this area will be based on the number and nature of reportable events. The Pl cata 1-1 l

L -

.- - - - - - - - - _ . _ - - . - - - ~ . - - . - - . .

will be analyzed to determine trends. The Pl provides some data regarding this inspectable area. The data provided is currently available and there are regulatory requirements to report significant events in the areas of Personnel Screening and Fitness-For-Duty. Performance i indicators are established on the number of events reported to the NRC Operations Center.

Reportable events per calendar year are established at 0-2 events - no inspections; 3-5 events

- a baseline inspection and 6 or more events - a reactive inspection. However, the j

performance indicator is limited in the behavior observation area and only covers reporting l issues inv0!ving supervisors and operators, who are reported for drug / alcohol problems under the fitness for duty program. Identificatbn of these supervisors / operators may or may not have been through behavior observation identification. There are no other indicators to identify how effectively the program is being carried out in areas such as after duty hours call-outs, escort training, and manager / supervisor training. Consequently, a minimum baseline inspection should be conducted of the behavior observation program process and human performance attributes. This area should be reviewed after a 2-year period to evaluate the threshold's validity and to make adjustments as necessary.

l 1

l l

1 1-2

1 INSPECTABLE AREA: Access Control (Search of Personnel, Packages, and Vehicles; identification and Authorization)

Scope This area will verify that the licensee has effective access controls and equipment in place designed to detect and prevent the introduction of contraband (firearms, explosives, incendiary devices)into the protected area that could be used to commit radiological sabotage and to assure that only authorized personnel are permitted unescorted access to the site protected area and vital areas. The identification and Authorization process is to assure that, once personnel have been screened to verify their trustworthiness, those persons have a need for access and to confirm that only those persons who have been screened and have a need are granted access to the plant including vital areas. Some of the equipment involved are metal detectors, explosive detectors, x-ray machines, biometric sensors, computers, key-cards, hard keys, and card-readers.

Basis inspection in this area supports the Physical Security comerstone.

The areas to measure are the effectiveness of the search function (personnel, packages and vehicles) and the identification and authorization. The search function is to prevent the introduction of contraband (firearms, explosives, incendiary devices) that could be used to commit radiological sabotage. The search function for detection of firearms, explosives and incendiary devices on individuals, in packages, or vehicles, is accomplished by equipment listed above or a hands-on search. The identification and authorization functions are accomplished during issuing of badges or through the use of biometrics or card-readers. The licensee must also positively control all points of personnel and vehicle access into vital areas.

The frequencies of an unauthorized individual being granted unescorted access or the introduction of contraband, described above, into the protected or vital areas are low but the consequence of risk to radiological sabotage is considered moderate.

Performance Indicators At this time there is no performance indicator for this inspectable area that measures both equipment and human performance at the same time. The combination of both is what is used to detect and vital to the prevention of contraband entering the protected area. Meaningful tracking data on the pedormance of access control was not practical since much of the performance is dependent on the quality of the implementation of the tasks. The areas of search and identification and authorization will be inspected as part of the baseline inspection program. The inspection will consist of procedure reviews, self assessment reviews, observations of personnel processing, security officer performance and observation of routine testing of equipment. The same level of inspection effort would be applicable if a PI was in place. These are areas where the effectiveness of doing the task determines the effectiveness of the processes and areas where many personnel in the security organization do the tasks.

1-3

INSPECTABLE AREA

• Access Control to Radiologically Significant Areas Scope This area will verify that the licensee has implemented effective Radiation Protection (RP)

Barrier integrity to prevent an uncontrolled access to an airbome, high (HRA) or very high (VHRA) radiation area that could potentially result in an exposure in excess of regulatory limits.

An RP Barrier integrity includes: identification and control of the hazard, administrative controls (RWPs, planning, procedures), physical Barrier integrity or engineered controls (e.g., Barner integrity ropes, locked doors, shielding, or ventilation systems), radiological surveys and monitoring (e.g., RP technician coverage, personnel alarming dosimeter, or remote monitoring or surveillance), and radiation worker training.

Basis inspection in this area supports the plant facilities attribute of the Occupational Exposure cornerstone.

This inspection will review the licensee's performance in instituting the physical and administrative controls defined in Subparts G, H, I, and J of 10 CFR Part 20, applicable technical specifications (TS), and licensee procedures for airbome areas, HRAs and VHRAs and worker adherence to these controls.

Radiological risk (i.e., exposure) to a worker must be within the occupational exposure limits defined in 10 CFR Part 20 and ALARA to minimize the potential for health effects. Collectively, the access controls provide a defense-in-depth" against a significant exposure. Industry experience has identified frequent occurrences where the failure of multiple Barrier integrity resulted in an uncontrolled entry and, in some cases, a significant exposure.

Performance Indicators The established performance indicator (PI) does not address airborne areas or HRAs with dose rates <1000 mrem /hr or highly contaminated areas having the potential for an exposure in excess of regulatorylimits. Therefore these areas will be included in the baseline inspection.

Incidents that would be tracked under this Pi include:

A single nonconformance of TS controls or comparable 10 CFR Part 20 requirements applied to all high-radiation areas (HRAs) having dose rates 2 1000 mrem /hr.

A single nonconformance with 10 CFR Part 20 and/or licensee procedural requirements regarding radiation protection controls associated with VHRAs.

A single occurrence of an uncontrolled exposure in excess of 10 percent (%) of the non-stochastic or 2% of the stochastic dose limits specified in 10 CFR Part 20.

1-4

INSPECTABLE AREA: Adverse Weather Preparations Scope inspection activities in this area would focus on the effectiveness of the licensee's program for protecting mitigating systems and components from cold weather and other adverse weather related conditions. The inspection focus would be to ensure that risk significant systems and components will perform within the design assumptions for adverse weather.

Basis inspection of this item supports the initiating Events and Mitigating Systems comerstones by ensuring that the licensee takes steps to reduce the effects of weather-related initiating events and the impact of adverse weather on key portions of mitigating systems.

The inspection activities are intended to verify that the licensee has taken the necessary steps to demonstrate that the reliability, availability and functional capability of SSCs and associated components are maintained during adverse weather conditions. For example, operating experience indicates that cold weather conditions continue to cause intake structure icing, process and instrument line freezing, emergency diesel generator oil viscosity problems, essential chiller problems, and electrical problems such as grounds.

Frozen equipment can lead to a common cause/ mode loss of multiple trains and loss of equipment in redundant systems without any indication of a problem until called upon to function, which would have a significant impact on plant risk. In addition, high temperature conditions can place plant equipment and systems in an unanalyzed condition, which could also have a significant impact on risk.

Performance Indicators The e are no performance indicators that have been established that can provide results related to the adequacy of the licensee's program for freeze protection or for the adequacy of the licensee's preparations for other adverse weather conditions.

1-5

- = _ - - . _- -. - _ _ . . . - . . _- . _ - - - - - - - -_ . _ _

i INSPECTABLE AREA: ALARA Planning and Controls  :

Scope 3

This area will verify that the licensee maintains occupational exposure ALARA by properly l planning and controlling radiologically significant work activities. Controls, as stated here, refer 1 to those physical (e.g., locked doors, Barrier Integrity ropes, shielding, engineering controls) and administrative (e.g., surveys, planning, procedures, training, monitoring) Barrier integrity '

that, in the aggregate, serve to mitigate exposure.

l The focus is whether reasonable goals were established for radiologically significant work which I l consider previous licensee performance and industry experience, and whether the licensee's's l subsequent performance met those goals. Emphasis should be placed on those jobs having a high individual and/or collective dose, being performed in an area of higher radiological risk or are of concern because of industry or licensee experience (such as spent fuel pool diving).

This may include observing selected activities to verify the assumptions underlaying these goals and that the appropriate controls were implemented. The inspection should also review licensee assessments of the ALARA program to determine whether adequate administrative controls, management oversight, and exposure controls (including source term reduction) were taken.

i Specific attention should be given to Planned Special Exposures and exposures to Declared Pregnant Workers, because of the inherent risk and public interest.

Basis inspectit n in this area supports the program / process attribute of the Occupational Exposure cornerstone.

This inspection will review whether the licensee meets the requirements of Subpart B to 10 CFR Part 20, which requires that a Radiation Protection program, including procedures and engineering controls, be instituted to maintain occupational dose ALARA.

Radiological risk (i.e., exposure) to a worker be within the occupational exposure limits defined in 10 CFR Part 20 and ALARA and to minimize the potential for health effects. Effective ALARA planning will ensure that adequate physical and administrative controls are in place to mitigate exposure during radiologically significant work. Industry's experience includes frequent events where problems in this area have resulted in unanticipated exposure or a loss of control of the work activity. Specific attention should be given to Planned Special Exposures, exposures to Declared Pregnant Workers, and to activities that challenge the maintenance of occupational exposure control and ALARA, such as outage and refueling planning and preparation, emergent work activities, and radiological events.

Performance Indicators There is no performance indicator established that covers this area. Assessment of the ALARA program effectiveness is site-specific and highly dependent upon operational history, work scope, and worker experience.

I l-6

1 INSPECTABLE AREA: Nert and Notification System Testing Scope l

Inspection in this area includes a review of testing activities for the Alert and Notification System (ANS) in order to assess licensee performance.

Basis:

This inspection area supports the Emergency Preparedness (EP) comerstone and the Facilities and Equipment key attribute.

The ANS is a risk significant system for notifying the public of the need to take protective actions. The licensee generally maintains the ANS and the local governmental authorities operate the ANS when necessary. Assurance that the system has a high rate of availability increases the assurance that the licensee can protect public health and safety during an emergency. 'If an EP program consistently ensures that the ANS is in a high state of readiness it indicates that the program is operating at or above the threshold of licensee safety performance above which the NRC can allow licensees to address weaknesses with NRC l oversight through a risk informed inspection program.

Performance indicators A Pl, ANSA, addresses performance in this area. However, for the statistics of the PI to be valid, the testing program must be conducted in accordance with NRC guidance. The inspection verifies testing program compliance. Every site would be inspected once during the implementation of the NRC Assessment Program and thereafterif there are changes in the methodology.

Areas that would require inspection if the PI were not available include:

l Review of surveillance tests for completeness l Review the disposition of a corrective actions Review disposition of repeat items I-7

INSPECTABLE AREA: Changes to License Conditions and Safety Analysis Report (10 CFR 50.54 and 10 CFR 50.59)

Scope Inspection activities in this area focus on those changes to the facility and licensee programs performed under the requirements of 10 CFR 50.54 and those changes to the facility, procedures, tests or the Final Safety Analysis Report (FSAR) performed under the requirements of 10 CFR 50.59. The inspection activities include a review of the licensee's required submittals as specified by 10 CFR 50.54 and 50.59. A more detailed review would be performed on those changes that have the potential to be and/or appear to be intent changes.

Examples of inspection areas would include safety evaluations performed by the licensee for permanent and temporary facility modifications, procedure changes, FSAR changes, emergency and security plan changes.

Basis inspection of this area supports the Mitigating Systems, Barrier Integrity, and Physical Security comerstones.

Inspection of this item provides monitoring of the effectiveness of the licensee's programs for implementing changes to facility SSCs, risk significant normal and emergency operating procedures, test programs, FSAR and security plans and ensures that the changes were in accordance with the requirements of 10 CFR 50.54 and 10 CFR 50.59. This would provide assurance that the facility changes have not reduced the safety margins of the SSCs or reduced the effectiveness of the facility security plans.

Performance Indicators No performance indicators have been established that can provide results related to the adequacy of the licensee's program for making changes to the facility.

I-8

i INSPECTABLE AREA: Drill and Exercise inspection Scope This inspection area is an evaluation of licensee self assessment of performance during the conduct of drills, exercises, appropriate training evolutions and actual events. This will verify that the statistics gathered for the DEP Pl represent the actual success rate of performance end provide oversight to ensure the efficacy and veracity of the licensee problem identification and resolution program as related to EP.

Basis:

This inspection area supports the EP comerstone and the ERO Readiness, Facilities and Equipment, Procedure Quality and ERO Performance key attributes.

The implementation of the Emergency Plan is dependant on the performance of the ERO in their EP assignments. There are many areas important to Plan implementation, but the most risk significant areas of ERO performance are:

Timelv and accurate classification of events: including the recognition of events as potentially exceeding emergency action levels (EALs) and any assessment actions necessary to support the classification.

Timelv and accurate notification of offsite aovemmental authorities; including adequate performance of notifications as specified in the Plan.

Timelv and accurate development and communication of protective action recommendations to offsite authorities; including providing protective action recommendations (PARS) to governmental authorities, the decision making process to develop the PARS and any accident assessment necessary to support PAR development.

If the ERO consistently performs these activities in a timely and accurate manner, it indicates that the EP program is operating at or above the threshold of licensee safety performance above which the NRC can allow licensees to address weaknesses with NRC oversight through

a risk informed inspection program.

Performance Indicators The DEP PI has been developed to indicate performance in this area.

However, the data used to develop the DEP Piis based on licensee assessment. This inspection area verifies licensee assessment activities that generate this data.

Simulated emergency events that are identified in advance of performance as opportunities for the DEP PI would be observed. Inspection of drills and training evolutions could be i

unannounced, but inspection of the biennial exercise could not. The inspector would observe l licensee assessment of risk significant activities and verify the determination of successes and failures. The inspector would also verify that the reported PI statistics conform to the observation.

l-9

In addition, during the biennial exercise, the licensee's ability to identify and resolve EP related problems would be inspected, including the following areas:

ERO proficiency in general, ERO ability to diagnose plant accident conditions, formulate mitigating actions and implement them under accident conditions, readiness and quality of EP equipment and facilities, a

direct interface with offsite authorities during exercises and drills, e.g., in the area of PAR communication and technical support, adequacy of communication channel testing and timely correction of communication channel deficiencies, a

adequacy of worker protection during exercises and drills, implementation of severe accident management guides, and ANS deficiency correction.

The licensee should identify ERO performance problems that detract from the ability to protect the public health and safety. The identification of repeat items and trends and the disposition of corrective actions would be inspected. The ability to identify and resolve problems is integral to the efficacy of an EP program. This area is meant to include any licensee efforts that assess the EP program or the performance of the ERO such as:

self assessment reports including reports of actual events or missed classification of actual events, a

biennial exercise and drill critiques, audits conducted under 10 CFR 50.54(t), and a

assessments performed by the Quality Assurance organization.

If the DEP and ERO PI's are not available, the biennial exerce would have to be inspected in a broader manner. This effort would include elements in the current inspection program such as, inspection of ERO performance in the CR, TSC, OSC, EOF, damage control teams, field monitoring teams, etc. The inspection areas would include:

Timely activation a

Facility and management control Analysis of plant conditions Classification Notification PAR development Dose projection Accident assessment Accident mitigation planning Engineering support Damage control Habitability assessment Sitc and facility personnel accountability Protective actions for workers Security activities Offsite monitoring teams PASS teams 1-10

INSPECTABLE AREA: Emergency Action Level Changes Scope Inspection activities in this area includes a review and assessment of changes to the Emergency Action Levels (EALs).

Basis:

This inspection area supports the Emergency Preparedness (EP) comerstone and the Procedure Quality key attribute.

Recognition and subsequent classification of events is a risk significant activity because classification leads to activation of the Emergency Response Organization and notification of govemmental authorities. However, if the EAL scheme is not in compliance with the approved configuration or with regulations, it will not result in the expected emergency classification.

Appendix E to 10 CFR Part 50, states that NRC will approve EALs. " Emergency Preparedness Position (EPPOS) on Emergency Plan and implementing Procedure Changes," EPPOS No. 4, provides additional guidance. EAL changes are expected to be submitted for NRC review and approval prior to implementation. This inspection area addresses the need to perform this review. All changes would be reviewed.

Performance Indicators No PI's were established that cover this area.

1-11

. . _ ~_ _= ~ . _ __ . .. . - - . . - . _ . _ . - - -

l l*

INSPECTABLE AREA: Emergency Response Organization Augmentation Testing Scope Inspection in this area involve reviews of licensee self assessments of Emergency Response Organization (ERO) augmentation including the design of augmentation tests to ensure they l provide assurance that emergency response facilities could have been staffed in a timely manner if it had been necessary, the self assessment of test conduct and an analysis of test results. The inspector will also review the ability of self assessments to identify trends in results i and implement the associated corrective actions.

Basis:

l This inspection area supports the Emergency Preparedness (EP) comerstone and the ERO Readiness key attribute.

The licensee system to augment the on shift staff with ERO members is a risk significant process because the ERO is critical to implementing the Plan in a timely manner. This system involves a notification system for individual ERO members, training of ERO members in its use, and testing to ensure facility activation goals can be met. The test design would be performed for every site initially and there after:

Changes to test desi0n Self assessment of the response Identification of trends A sampling of findings and the implementation of corrective actions Disposition of repeat findings Performance Indicators None of the established Pts cover this area.

l l

l l

l12

INSPECTABLE AREk Emergent Work Scope The inspection activities in this area would focus on the effectiveness of the licensee's configuration controls during repair of emergent equipment failures. These inspection activities would include a review of related troubleshooting, work planning, establishment of plant conditions, tagging, conformance with Technical Specifications and restoration of equipment to service, with an emphasis on verification of plant configuration The inspection activities would be limited to risk significant emergent activities that could cause an initiating event to occur or affect the functional capability of mitigating systems.

Basis inspection of this item supports the Initiating Events and Mitigating Systems comerstones.

Inspection activities are intended to verify that the licensee has taken the necessary steps to demoastrate that emergent activities are adequately planned and controlled to avoid initiating events and to ensure the continued reliability, availab;iity and functional capability of SSCs.

This would include proper control of troubleshooting, maintenance activities, and appropriate post maintenance testing. This will in addition, emergent failure of equipment can result in risk significant configurations if redundant equipment was already unavailable because of planned maintenance or testing.

~

Industry experience has shown that inadequate control of repair activities to equipment during power operation have resulted in plant transients, inoperable safety systems, and/or loss of redundancy. In addition, when the plant is at full power operation, thorough post-maintenance testing by the licensee can become more difficult and may warrant additional NRC attention to verify equipment reliability is not jeopardized due to inadequate or inappropriate testing.

In addition, the inspection activities should ensure that the licensee has appropriately considered the prioritization and timing of repairs and that the repair activities are factored in with other previously planned maintenance or surveillance activities such that overall plant risk is minimized.

Performance Indicators There are no Pls for configuration control that provide a leading indicator of potential events or failures that could result from a failure to properly plan and control emergent work.

113

l INSPECTABLE AREA: EP Training Program Scope

~

Inspect training program for adequacy, changes and the knowledge level and qualifications of ERO members.

Basis:

This inspection supports the Emergency Preparedness (EP) comerstone and the ERO Readiness and ERO Performance key attributes.

Emergency Preparedness is the final barrier in the " defense in depth" NRC regulations provide for ensuring the public health and safety. The training program must ensure that ERO members are adequately prepared to perform their assigned EP duties. The ERO members must be qualified to perform their assigned duties. The following areas would be inspected:

Review all training program modules over a six year period to ensure adequacy.

Review all changes to training program modules since the last inspection.

Review training records of a significant portion of ERO members with risk significant duties, classification, notification and PAR development, including shift management Interview a significant portion of the above identified ERO members to verify their knowledge level Select a sampling of other ERO positions and interview the assigned individuals for knowledge level as applicable to duties.

Review the qualifications of a significant portion of ERO members, including shift management, with duties in the risk significant areas of classification, notification and PAR development.

Review the qualifications of a sampling of other ERO members.

Review the qualifications of new members (changes) to the ERO.

Performance Indicators Two PI's, DEP and ERO, address this area and therefore a baseline inspection is not required.

1-14

INSPECTABLE AREA: Equipment Alignment Scope inspection activities in this area focus on the effectiveness of the licensee's program for changing the alignment of risk significant plant equipment . This includes changes made for operational needs and for removing equipment to/from service for activities such as maintenance, modification or testing. The inspection focus would include a review of the effectiveness of the licensee's programs for independent verification, locked valve verification, switching and tagging clearances and system lineups. The inspection activities would be more limited during power operations with increased emphasis during shutdown evolutions.

Basis inspection of this area supports the initiating Events, Mitigating Systems and Barrier integrity comerstones.

The inspection activities are intended to verify that the licensee has an effective process for maintaining system configuration control, which ensures that the functional capability of the plant system is maintained. Systems and components that are not properly configured may not be capable of performing their intended functions, which results in a loss of availability and functional capability.

Systems or components that are not properly aligned can lead to the initiation of events, can result in personnel injuries, and can significantly impact the availability and functional capability of plant equipment, which could significantly increase the overall risk to the plant. It is understood that inspection activities will have minimalimpact on reducing the frequency of initiating events. However, a review and documentation of those events does provide valuable assessment information. Inspection activities would normally be performed following emergent work activities, following risk significant system realignments, or during outage related activities.

Performance Indicators A performance indicator for the unavailability of four systems has been identified. Due to the monitoring of a limited number of systems, this inspection supplements that Pl. Also, there is no similar PI for equipment lineup during shutdown conditions, requiring this baseline inspection.

i 115

. .-_ . - . - _ . . _ . _ . - _ _ - _ - _ _ . .__ - . - - - . _ = _ . _-

INSPECTABLE AREA: Fire Protection Scope The inspection includes a review of ignition sources, control of combustibb materials, and fire protection systems and equipment. Fire brigade staffing, training and pr lormance as well as equipment necessary for plant shutdown following a fire such as emerpancy lighting, Appendix R diesel generators (when applicable) and remote shutdown equipment would also be included as part of the inspection activities.

Basis inspection of this item supports the Initiating Events and Mitigating Systems comerstones.

The inspection would review licensee controls designed to minimize the probability of a fire and would also review the availability and reliability of equipment necessary to mitigate the effects of a fire.

Proper implementation of the fire protection program is important to provide defense-in-depth against fires by maximizing prevention, detection, suppression, and mitigation capabilities for fires. An effective program reduces the risk of a fire being an initiating event. Also, in the event of a fire, reliable detection, suppression and mitigation capabilities ensure the plant can be safely shut down. Plant specific evaluations have shown internal fires to be high contributors to risk at some plants due to the potential for damaging redundant systems and multiple control l circuits and due to the adverse effect on operator mitigation strategies.

Performance Indicators 1

There are no performance indicators that assess performance in the area of fire protection.

116

INSPECTABLE AREA: Flood Protection Measures Scope Inspection activities in this area focus on licensee's program to protect the plant from potential flooding. These inspection activities would include verification that compensatory measures are documented, equipment is available and staged, and equipment is routinely tested and remains fully capable to perform the intended functions. These activities would be performed at specific facilities that have the potential for extemal flooding and would also include those facilities with internal flooding concems.

Basis This activity would be an input to the Initiating Events and Mitigating Systems comerstones.

Verification of the licensee's implementation of the flood control program would be performed to insure that the facility is capable of withstanding potentialintemal and external flooding.

Flooding would have a significant adverse affect on the functional capability of safety and risk related equipment needed to maintain the plant in a safe shutdown condition.

Flooding has been shown to be a significant contributor to risk at some facilities, in addition, flooding has the potential to make multiple trains of equipment and support equipment inoperable which would result in a significant increase in risk to the plant. Flooding also has a significant consequence of preventing or limiting operator mitigation and recovery actions.

Performance Indicators There are no performance indicators that have been established that can provide results related to the adequacy of the licensee's program for mitigating the consequences for flooding. Due to the rare but possibly risk significant nature of flooding events, no performance indicator was judged to be suitable for monitoring licensee performance in this area.

1-17

INSPECTABLE AREA: Fuel Barrier Performance Scope inspection includes verification of operation of the licensee's capability and performance of in-plant radio-chemical analyses of the reactor coolant system (RCS).

Basis Inspection of this item supports the cladding performance attribute of the Barrier Integrity comerstone.

1 Inspection of fuel cladding radio-chemistry analysis performance will provide assurance that the first Barrier Integrity against release of radioactivity to the environment is maintained. Failure of i fuel cladding would increase the radiation dose to workers and potentially to members of the public.

The fuel cladding integrity is maintained by controlling reactor operation within the established operationallimits. Routine sampling and radio-chemical analysis of reactor coolant will detect

)

any fuel cladding failures. Appropriate plant procedures and measures for protecting plant workers from increased dose due to fuel failures and to prevent release of radioactivity to the environment should be implemented.

Performance Indicators A performance indicator is provided for RCS activity. This inspectable area could be deleted, if the performance indicator for this area is acceptable and the indicator is verified.

i i

l-18

INSPECTABLE AREA Gaseous and Liquid Effluent Treatment Systems Scope This area will verify that gaseous and liquid radioactive effluent treatment systems are maintained such that radiological releases are properly mitigated, monitored and assessed.

The focus is to ensure that releases are reasonably controlled, that system modifications are properly performed, and that effluent and meteorological monitors are accurate and reliable.

Other aspects of system operation (including administrative controls) will be assessed by reviewing licensee assessments, the Annual Environmental Monitoring Report and the Annual Effluent Release Report.

The baseline program should consist of performing in-office reviews of the Radiological Effluent Release Report to verify that the program was implemented as described in the ODCM.

Additional areas of review include calibrations of the effluent and meteorological release monitors and modifications to the gaseous or liquid radwaste systems. However, the inspection should not review the original as-built liquid and gaseous system, maintenance records or administrative controls as it is expected that deficiencies in this area will be addressed through the licensee's assessment process and in the Annual Radiological Effluent Release Report.

However, the baseline inspection can include walking down the liquid and gaseous release systems to observe ongoing activities (such as radwaste transfers) and to independently verify that licensee identified deficiencies were being corrected.

Basis inspection in this area supports the plant facilities / equipment and instrumentation and program / process attributes of the Public Exposure comerstone.

This inspection will verify that gaseous and liquid effluent processing systems are maintained as required by General Design Criteria 60,63 and 64 of Appendix A to 10 CFR Part 50, Radiological Effluent Technical Specifications (RETS) and the Offsite Dose Calculation Manual (ODCM).

Radiological risk (i.e., exposure) to the public below the 10 CFR Part 20 and 40 CFR Part 190 limits and ALARA to minimize the potential for health effects. Doses below the design objectives of Appendix I to 10 CFR Part 50 are considered ALARA by the NRC. Proper operation of the effluent treatment system and monitors will ensure an adequate " defense-in-depth" against an unmonitored, unanticipated release of radioactivity to the environment.

Overall industry performance has improved, but concerns still exist with abnormal releases, system modifications, and monitor operability.

Performance Indicators The performance indicator (PI) for this item adequately addresses most aspects of the program / process and human performance attributes of this area. However, it does not address abnormal releases, system modifications, and meteorological and effluent monitor operability. The Pl does address meteorological and effluent monitor calibration and setpoint verification, but a selective inspection of calibration and setpoint records is necessary to verify the integrity of the Pl. Because most licensee's calibrate these monitors at a greater than annual frequency it was deemed appropriate to perform this review as part of this inspectable area rather than through the annual verification of Pls. Incidents that will be tracked as a Pl 1-19 -

include any effluent release not in accordance with 10 CFR Part 20, Appendix 1 to 10 CFR Part

! 50, ODCM, and RETS.

l l

i a

1 20

INSPECTABLE AREA: Heat Sink Performance Scope This inspection includes a review of the cerformance of normal and ultimate heat sinks. The inspection activities would focus on potential common cause failures of heat removal capabilities such as clogging of intake screens, strainers, piping and heat exchangers.

Basis ,

inspection in this area supports the initiating Events and Mitigating Systems comerstones by ensuring initiating events are not caused by a loss of heat sink and that mitigating systems heat removal capabilities are not degraded.

The inspection would focus on events that could result in the simultaneous loss of both the normal and ultimate heat sinks due to events such as ice buildup, grass intrusion or blockage of pipes and co'mponents by other foreign materials.

Also, industry experience has shown that many plants have experienced significant problems with repeated loss of heat sink and degraded performance of heat exchangers due to problems that include corrosion, silting and fouling. Since the subject heat exchangers do not normally operate at design heat loads, it is important for the licensee to routinely monitor the performance of the heat exchangers to ensure that the heat exchangers are capable of meeting I their design requirements.

Performance Indicators None of the established Pls cover this area.

l 4

l-21

INSPECTABLE AREA: Identification and Resolution of Problems / Issues Scope This item will verify that the licensee has an effective problem identification and resolution program. Problem identification and resolution refers to: (1) the deficiency reporting process; (2) licensee self-assessments; and (3) Quality Assurance audits. Additionally, in some plants each department may have its own problem identification and resolution program. The focus of the inspection is on the licensee's effectiveness in identifying, resolving and preventing risk significant problems.

Basis inspection in this area supports all seven of the comerstones.

The objective of this inspection is to ensure that the licensee effectively assesses performance to identify and correct situations that could impact the cornerstone objectives .

An effective problem identification and resolution program is the primary means of reducing risk by correcting deficiencies involving people (i.e., training, knowledge and sk;ils), processes (i.e.,

procedures and programs), and equipment (i.e., design and maintenance) before they manifest in a significant event affecting the health and safety of workers or the public. Industry experience indicates that licensees having an effective program for identifying and resolving problems also have a reduced frequency of events.

The inspector shall select a set of outputs from a selected program for review. For each cornerstone of interest, a sample set comprising licensee assessments and deficiency reports will be selected for review. The selection will be made using information contained in the Risk information Matrix (RIM) and insights gained from site-specific PRA results, industry experience and NRC inspection findings. Where site specific toxic hazards and grid stability problems have been identified, the resolution of thema types of issues should be included in a review of corrective actions.

For selected programs, additional issues may be identified by periodic observations of specific activities such as operator simulator training, or emergency preparedness, security and fire protection drills and exercises. Some issues may also be identified by reviewing operating experience information, engineering and maintenance work request data bases, operator work around lists and the non-conformance report data base. Collectively, these issues shall also be reviewed for inclusion in the sample set.

When reviewing the sample set, consider whether individuals involved in the problem identification and resolution process effectively identify, resolve and correct risk-significant problems. Additionally determine if risk insights were used to allocate licensee resources for investigating and correcting identified deficiencies.

The inspection should verify that: (1) the assessments were of sufficient scope to address the key attributes of the cornerstone: (2) the risk significance of the findings was properly assessed; (3) root cause analyses and corrective actions were timely and adequate to prevent i recurrence; (4) industry and NRC generic issues were considered; (5) required reports to the l Commission or input to a PI were made; and (6) the performance trend indicated by the

sample set was consistent with the applicable Pls.

l-22

l .

l Periodically during the inspection, discuss with the residents (or other inspection team members if applicable) to identify common issues that cross other cornerstones. For example, procedural adherence problems in the Occupational Exposure, initiating Events and Barrier Integrity l Cornerstones. Review the common finding as stated above and determine if the licensee was

! aware of the common issues.

Additional sampling of the licensee's performance assessment feedback loop is required if: (1) recurrent issues or highly risk significant findings were identified; (2) adequate corrective actions were not taken in response to a declining trend or performance above a Pl threshold; or (3) the NRC or licensee assessment results indicate risk significant findings that should have been manifested in a negative Pi trend.

An observed discrepance between Pl data and NRC or licensee findings is indication that additional review of PRA assumptions, re-verification of applicable Pls and an assessment of changing risk may be required.

Performance Indicators None of the established Pls cover this area. However, some insight may be obtained from the Pls developed for each comerstone, which may reduce the overall inspection effort in this area.

i l

l l

1 l

l I

l I 23 f

INSPECTABLE AREA: Inservice inspection Activities Scope Inspection activities in the area would focus on the effectiveness of the licensee's program for inservice inspection, repair, and replacement of reactor coolant system (RCS) pressure retaining components. Inspection activities would include a review of the results of the steam generator tube inspections, a selected review of risk significant non-code repairs, and a review or observation of the reactor vessel ISI examinations.

Basis inspection activities in this area primarily support the Barrier integrity comerstone. Activities I also support the Initiating Events comerstone because ISI activities can detect precursors to RCS boundary failures.

The inspection activities are intended to ensure that the licensee has an effective program for monitoring degradation of reactor coolant system boundary, including steam generator tubes, control of non code repairs to ASME components, and performing the required periodic ISI examinations.

Degradation of the reactor coolant system, steam generator tubes, or safety related support systems would result in a significant increase in risk. Degraded piping or tubes would increase the risk impact due to initiation of events. In addition, it would result in mitigating systems not being capable of performing their intended design functions. Based on these considerations, inspection activities are necessary to ensure that the licensee has an effective ISI program to ensure that risk significant degradation of the RCS boundary is identified and is promptly and appropriately corrected.

Performance Indicators There are no performance indicators that have been established that can provide results related to the adequacy of the licensee's program for ensuring system integrity in accordance with ASME requirements l

?

l 24

[

INSPECTABLE AREA: Inservice Testing of Pumps and Valves-ASME Section XI Scope inspection activities in this area would be focused on the effectiveness of the licensee's program for testing of pumps and valves as required by ASME Section XI. Inspection activities in this area would include a review of test procedure adequacy, testing methodology, equipment trend results and observations of selected pump performance testing, valve stroke time testing, relief valve setpoint testing, and check valve testing.

Inspection Basis inspection activities in this area would provide input to the Mitigating Systems comerstone.

Inspection of this area would be performed to verify that the required testing is being performed as required and that plant equipment is functioning as designed, with an emphasis on ensuring test procedures are adequate to confirm design bases requirements are being met.Section XI testing program was specifically designed to demonstrate the reliability of components and to identify degrading components prior to actual failure. The trending of the Section XI test data is necessary to identify degradation of components so that the licensee can initiate corrective actions before the degradation causes a loss of functional capability. This ensures that equipment will be available and have adequate functional capability if called upon to mitigate the consequences of an accident.

Degraded equipment, even on less significant systems can collectively have a significant impact on overall plant risk.

Performance Indicators There are no performance indicators that have been established that can provide results related to the adequacy of the inservice test procedures and methods.

l 25

INSPECTABLE AREA: Large Containment isolation Valve Leak Rate and Status Verification l Scope j inspection activities in this area would be focused on the adequacy of the licensee's testing l program for large containment isolation valves that provide a direct flow path from the l containment atmosphere to outside containment. At most facilities the inspection scope would l be limited to the containment purge and ventilation valves and personnel access hatches. ,

inspection activities related to leak rate testing for most of the containment isolation valves l and/or containment Integrity issues would be captured by the corrective action program inspection activities.

Basis i

i inspection in this area supports the Barrier Integrity comerstone.

l The inspection activities are intended to verify that the licensee has an acceptable process for l

l insuring that major containment isolation valves will function as designed in preventing the I

release of contamination following a design basis accident.

l The normal containment ventilation isolation valves tend to be very large valves with soft rubber

, seats. Industry experience has shown that the seats tend to dry out over long periods and fail I

to maintain their leakage Integrity. Pressurized water reactor containment purge valves are routinely opened during plant operation to purge the containment or to allow reductions in containment pressure. The constant cycling results in degradation of the valve seats. In both cases inspection efforts would be focused on insuring that the valves continue to meet the design leakage requirements and that the maintenance and testing efforts are appropriate.

Performance Indicators There is a performance indicator for total leakage from all containment penetrations. However; the limited inspection activities detailed in this inspectable area will be used to verify the accuracy of the Pl.

1-26

l

. 1 INSPECTABLE AREA: Licensed Operator Requalification Scope inspection activities in this area would focus on the effectiveness of the licensee's program for conducting operator requalification training. Inspection activities would include a review of requalification examinations, administration of requalification examinations, the training feedback system and the remedial training program. In addition, inspection activities would verify that the facility's operating history has been factored into the requalification program and would verify conformance with operator license conditions.

Basis inspection of this area supports the Mitigating Systems, Barrier Integrity and Emergency Preparedness cornerstones because it can assess operator performance adequacy in responding to events.

This inspection evaluates operator performance in mitigating the consequences of events.

Poor operator performance results in increased risk due to its impact on the human factors terms, assumed operator recovery rates and personnel induced common cause error rates assumed in the facility IPEs. Human performance errors and failure to recover from accident events are the most risk important events at a facility.

Performance indicators There are no performance indicators that have been established that can provide results related to the adequacy of the licensee's licensed operator requalification program.

1 27

INSPECTABLE AREA- Maintenance Rule implementation Scope The inspection includes a review of goal setting, performance monitoring, repetitive failure determinations, and evaluations of functional failures and maintenance preventable functional failures. The scope of the inspection activities would include those systems covered under the maintenance rule which would also include a review of the licensee's implementation of the maintenance rule requirements for those systems.

Basis inspection of this item supports the Initiating Events, Mitigating Systems and Barrier integrity comerstones by assessing the effectiveness of the licensee program in ensuring availability and reliability of plant equipment.

Proper implementation of the maintenance rule is important to ensure reliable operation of plant equipment within the scope of the rule. The program should ensure that there is a proper balance that optimizes availability and reliability when removing equipment from service for preventive maintenance. High avails bility and reliability result in a high probability that accident mitigation systems will perform suecassfully when needed and that Barrier Integrity will remain effective in preventing the release of radioactivity.

Performance Indicators This inspection area supplements the safety system performance indicator (system unavailability). In addition, inspection activities in this area would provide an assessment of equipment reliability where a performance indicator does not exist.

1-28

I INSPECTABLE AREA

• Maintenance Work Prioritization and Control Scope inspection activities in this area would focus on the effectiveness of the licensee's programs for l work prioritization and control during shutdown and power operations. Licensee work l

prioritization methodologies, level of maintenance support, and assessments of integrated risk of the work backlog would be reviewed by the inspector.

Basis This inspection item supports the Mitigating Systems, initiating Events and Barrier integrity comerstones.

Maintenance is the primary means of mitigating and managing the effects of component degradation and failures. Operating experience shows that the lack of maintenance (component deficiencies not corrected) or improperly performed maintenance (maintenance l

activities not well controlled) can greatly contribute to the risk for event initiation, and may cause SSCs to not function properly if called upon to mitigate the consequence of an event.

Operating experience also shows that for risk significant events identifit d through the Accident Sequence Precursor (ASP) program, work control and failure to maintain equipment represent the majority of causes. Appropriate identification, prioritization, planning, scheduling, and completion of risk significant work is essential to safe operation.

l One specific area that should be included in inspection of this area is the control of risk significant work in the switchyard. A large percentage of loss-of-offsite power events. occurred when either some major electrical power source was out of service prior to the event and/or some major electrical power source failed during the event. It is important that work occurring in the switchyard be well controlled to prevent an unplanned loss of a power source due to 1 maintenance errors. Also, the simultaneous removal of multiple electrical power sources from service should be avoided, particularly during shutdown conditions.

l Performance Indicators There are several performance indicators (Pis) that indirectly infer the quality of work j prioritization and control to reduce inspection effort in this area. However, events that have reached the ASP threshold (E-06) tended to be random and were not predicted through existing Pls. This inspection supplements these Pis.

l 1

1-29

= _. _- - . _ . - - _. . - . _ .

INSPECTABLE AREA: Non Routine Plant Evolutions Scope The inspection activities will be used to evaluate operator and equiprnent performance for other than norrnal/ routine operations. This inspection activity will provide a vital tie between operator performance observed under simulated conditions and those observed during non routine plant operations. This activity will also provide a snapshot of plant and equipment performance during transient conditions.

Basis This inspection primarily supports the Mitigating Systems and Barrier Integrity comerstones by providing assessment of operator performance during transient and off-normal operations.

Poor operator performance could also affect the initiating Events cornerstone. in addition to providing observations of non routine plant operations, inspections in this area provide increased opportunities to observe more significant plant transients and to evaluate operator and equipment performance during those non-simulated transient conditions.

Operator performance provides a vitallink in mitigating the consequences of improper or unforseen equipment performance. Degrading operator performance results in increased risk due to it!, impact on human factors terms, assumed operator recovery rates, and personnel induced common cause errors. Probabilistic risk assessments have shown that human errors can be very significant contributors to risk, in particular during recovery from accident events.

Performance Indicators Operator performance under abnormal plant operating conditions cannot be sufficiently covered by a performance indicator because the Pls of transients and trips do not include near-miss events 1-30

INSPECTABLE AREA: Operability Evaluations Scope Inspection activities in this area would focus on the effectiveness of the licensee's program for the evaluation of degraded and non-conforming conditions affecting plant systems, structures and components (SSCs). Inspection activities would be limited to a review of those potentially risk significant degraded and non-conforming conditions affecting SSCs that are considered to be operable and fully ca'pable of performing their design functions based on written operability evaluations. Initial reviews of the operability evaluations should be performed following formal completion of the evaluations by the licensee.

Basis inspection of this item primarily supports the Mitigating Systems by ensuring risk-significant SSCs are fully functional to perform their design function.

The inspection activities are intended to verify that the licensee has taken the necessary steps to demonstrate that the reliability, availability and functional capability of the SSCs and associated components are maintained although the SSCs are degraded and/or non-conforming in some way.

As a result of the size and complexity of a nuclear power plant, degraded and non-conforming conditions are frequently identified at all plants. Risk-significant SSCs are often affected and the degraded or non-conforming condition cannot always be corrected immediately. An improperly evaluated degraded and/or non-conforming condition may result in continued operation with a SSC that is not capable of performing its design function which would result in operation of the plant outside of its design and license bases. The potential effects on safe operation could include the loss of redundancy within a safety system, the loss of safety function or a reduction in the safety margin assumed in the plant design and analyses.

The inspection would ensure that the evaluations include an adequate technical justification to support the operability evaluation and would verify the implementation of any compensatory measures.

Performance indicators There are no performance indicators that provide effective assessment of the quality of operability evaluations.

1-31

1' INSPECTABLE AREA: Operato Work Arounds Scope inspection activities in this area would focus on plant and control room deficiencies that have the potential to affect performance in conducting routine and non-routine evolutions. Detailed inspection activities would be limited to those risk significant deficiencies that could compromise equipment and personnel mitigation strategies. The inspection would focus on those de.ficiencies that are not. included in the temporary modification process and would require operator actions that are in addition to those assumed in the initial design.

Basis inspection of this area supports the Mitigating Systems comerstone.

1 Operator work arounds can have an adverse effect on the functional capability of a system in I that the system may not be capable of performing its design function without operator intervention. An excessive number of operator work-arounds or those requiring complex operator actions reduce the effectiveness of the operations staff in responding to transient conditions and willincrease the chance of operator errors. PRAs have identified human errors as significant contributors to risk.

Performance Indicators There are no performance indicators that have been established that can provide results related to the adequacy of the licensee's process for controlling operator work arounds. Performance j indicators can not assess the significance of operator work-around items. '

l l-32

INSPECTABLE AREA: Permanent Plant Modifications Scope inspection activities in this area include the review of design, installation, configuration control, and post-modification testing for the potentially risk significant permanent modifications of the SSCs covered by the maintenar>ce rule. Inspection activities would also include an in-depth review of changes to the initiallicensed design, design basis documents, test procedures and normal and emergency operating procedures.

Inspection Basis inspection of this area supports the Mitigating Systems and Barrier Integrity cornerstones.

Inspection of permanent plant modifications provides monitoring of the licensee's performance to ensure that the design bases for risk-significant systems, structures, and components (SSCs) have been maintained and that the changes have not adversely affected the licensing and design bases and safety functions of the SSCs. Plant modifications may introduce changes to the assumptions and models used in the plant specific PRA. Modifications to one system may affect the design bases and functioning of other interfacing systems. Also, similar modifications to several systems could introduce potential for common cause failures that affect plant risk.

Industry experience has shown that modifications to risk-significant SSCs can adversely affect their availability, reliability or functional capability. The baseline Inspection of permanent modifications should focus on: (1) compliance with regulations, (2) consistency with defense-in-depth philosophy, (3) maintaining sufficient safety margins, and (4) acceptability of the effects on risk.

Verification of post-modification testing to confirm that the objectives of the modification are met and verification that the system is restored to the required configuration after completion of the modification are important. Design requirements that cannot be verified by testing of the modification, such as seismic or environmental qualifications should also be reviewed.

Performance indicators No performance indicators have been established that can provide results related to the adequacy of permanent modifications.

1-33

(

I INSPECTABLE AREA: Physical Protection System (Barriers, Intrusion Detection System, and Alarm Assessment)

Scope Verify that the licensee has an effective physical protection system in place capable of providing high assurance that the facility is protected against the extemal threat of radiological sabotage.

The system includes protected and vital area barriers, associated intrusion detection systems, and alarm assessment capabilities.

Basis 1

inspection of this area supports the Physical Security comerstone. l This is a risk significant system that is necessary for protection against the extemal threat of radiological sabotage. Operability of the protected area intrusion detection system and of the vital area intrusion detection system is necessary to idenMy and initiate response to security events. The system is the first line of defense in the " defense in depth" concept of protection against radiological sabotage. The risk significance is based on an exploitable vulnerability by a person (s) with the intent and capability of committing radiological sabotage. The frequency of '

occurrence of this type event has been low. However, the consequences of such an event would be moderate to high.

Performance indicators l This area will be assessed by a performance indicator after the initial verification and validation i inspection is done to confirm implementation is acceptable and that reporting thresholds for j significant event meet regulatory expectations. The initial verification and validation will serve to ensure valid data is used for the Pls.

The performance indicator for this area measures that each of these systems can perform their  !

intended function 95% of the time. For examplo if compensatory posting hours for the perimeter intrusion detection system exceeds approximately 438 hours0.00507 days <br />0.122 hours <br />7.242063e-4 weeks <br />1.66659e-4 months <br /> in 12 months, a l

l supplementalinspection may be performed to address this specific area. If the protected area l or the vital area system falls below the 95% indicator, a supplemental inspection will be I performed for the entire system. The percent of time equipment is available and capable of performing its intended function will provide data on the effectiveness of the maintenance process and provides a method of monitoring equipment degradation because of ageing that could adversely impact on reliability. The reporting of equipment percent availability will be accompanied by the reporting of compensatory hour for equipment out of service due to extreme environmental conditions (severe storms, heavy fog, heavy snowfall, sun glare that renders the assessment system temporarily inoperative, etc.,) and for planned maintenance and modifications. The extreme environmental and planned maintenance and modifications compensatory hours will not be considered as equipment unavailability as part of the PI but are part of the total compensatory hours and will provide information on events that are contributing to equipment unavailability. The data in this area will be reported as two Pis, one as percent availability for the protected area system and one for the vital area system. This indicator is considered adequate to assess performance and no additionalinspection of this area is necessary.

1-34

INSPECTABLE AREA: Piping System Erosion / Corrosion Scope The inspection activities in this area would focus on the effectiveness of the licensee's erosion and corrosion program. Inspection activities would include reviews of the licensee's monitoring, detection and correction of piping and component degradation caused by erosion and/or corrosion. Inspection activities would ensure that SSCs were being adequately monitored and that appropriate corrective actions were implemented. inspection activities would be limited to the site specific risk significant SSCs and would include reviews of system test results and reviews of corrective actions for identified deficiencies.

Basis inspection of this item supports the initiating Events comerstone.

The inspection activities are intended to verify that the licensee has adequately implemented the erosion / corrosion program so that the SSCs remain reliable and fully functional.

Effective implementation of an erosion / corrosion program is important to minimize the potential for high energy fluid system failures that can result in plant transients, damage to plant equipment and/or injury of personnel. The industry has experienced failures of steam system piping as a result of the effects of erosion / corrosion which underscore the importance of monitoring licensee performance in this area. Effective implementation of the erosion / corrosion j

program is also important to minimize the potential for internal flooding or a loss of system "

function.

Performance Indicators There are no performance indicators established that can provide results related to the adequacy of the erosion / corrosion program before an SSC degrades or fails.

1-35

INSPECTABLE AREA: Post Maintenance Testing Scope inspection activities would focus on verification that the post maintenance test procedures and test activities were adequate to verify system operability and functional capability for the maintenance that was performed. The inspection would focus on significant maintenance involving high risk significant systems or components, in areas that have the potential to cause common mode /cause failures, where repetitive failures indicate programmatic problems, or on maintenance activities that have the potential to significantly impact risk.

Basis inspection of this item primarily supports the Mitigating Systems cornerstone This is the only process available to verify that a system or component is reliable and fully functional following maintenance.

Post maintenance testing provides the final check that a system and /or component has been retumed to its required design configuration and will perform its design function (s) following completion of maintenance activities. Inadequate maintenance activities that are not detected prior to returning the equipment to service can result in a significant increase in unidentified risk for the subject system and in common mode /cause failures and potential for loss of function on redundant trains and identical components in other systems.

Performance indicators This inspection activity will supplement Pls and maintenance rule implementation inspectable area. The Pls do not measure the adequacy of the post-maintenance test procedures.

1-36 l..... .

l INSPECTABLE AREAS: Radiation Monitoring Instrumentation Scope inspection of this area should ensure that criticality, area radiation monitors (ARMS), continuous i

air (CAMS) and applicable Radiation Monitoring System (RMS) monitors are reliable and l accurate in areas where activities could result in transient HRAs, VHRAs or airbome areas.

This inspection will also include the containment dome monitors, because of their importance in accident analysis and classification, and portable instrumentation used to assess radiologically significant areas or activities (such as underwater meters used during diving). However, the inspection will not include those monitors that a licensee has included under their Maintenance Rule program.

Basis inspection in this area supports the plant facilities / equipment and instrumentation attribute of the Occupational Exposure cornerstone This inspection will verify that these monitors are calibrated and maintained (including verifying alarm setpoints) as required by 10 CFR Part 20 or a licensee's technical specifications and l

procedures l

Radiological risk (i.e., exposure) to a worker should be maintained within the occupational  !

exposure limits defined in 10 CFR Part 20 and ALARA and to minimize the potential for health effects. These monitors identify changing radiological conditions to workers such that actions i to prevent an overexposure can be taken. Industry has experienced several events where these monitors were the primary indication that radiological conditions had significantly changed as a result of planned or unplanned activities.

Performance Indicators None of the established Pts cover this area. Monitor locations are site specific and assessments of their reliability and accuracy will require baseline inspection.

i l

1 37 1

l INSPECTABLE AREA: Radiation Worker Performance Scope inspection activities in this area consists of observing radiation worker (including Radiation Protection and Chemistry (RP&C) technicians) performance to verify that they aware of and use appropriate radiological controls (such as properly controlling radioactive material) when performing work in radiological areas.

The focus is on whether licensee identified radiation worker performance events were appropriately corrected, were not recurrent and were being trended to identify underlying performance issues (such as poor training). This includes observations of work during plant walk downs, performed as part of other inspectable areas (such as ALARA Planning and Controls and Radioactive Material Processing and Shipping), to verify that workers (including technicians) understand and use appropriate controls to maintain exposures within regulatory limits and ALARA, and to prevent an unauthorized release of radioactive material to the environment.

Basis inspection in this area supports the Occupational and Public Exposure cornerstones.

The objective of this area is to verify that workers understand the radiological hazards associated with nuclear plant operation, effectively identify and control these hazards, identify and resolve adverse trends or deficiencies, and maintain proper oversight of work.

Tne associated risk is the potential for a significant, unplanned exposure resulting either directly or in part by the failure of a worker to perform a required task owing to poor knowledge or training. Recurrent problems in this area have been identified by the industry as a root or contributing cause in many exposure events and in some events involving the unplanned release of radioactive material to the environment. This is of special concern during outages, when radiologically significant work is often performed by contract staff having varying levels of experience.

Performance Indicators None of the established Pls cover this area.

1-38

- - - ._ .- . - . . . . - - - . _ _ - - - ~- . __ _

l i

l l INSPECTABLE AREA: Radioactive Material Processing and Shipping l

Scope inspection of this area should verify that appropriate controls are instituted for the processing l l and shipping of radioactive material to a burial site or other licensed recipient. The inspection l

focus is to review the administrative and physical controls for radiologically significant activities (Type A, Type B, and higher risk material shipments) that prevent an inadvertent exposure to workers and the public. This includes observing selected shipping activities having some risk-

significance (such as Type B or irradiated fuel shipments), including reviewing associated '

I shipping records, to provide independent validation of the shipping program. Particular l

emphasis should be given to the 10 CFR Part 61 waste characterization and stability l

requirements (Ill.A.3 and Ill.C.5 of Subpart G to 10 CFR Part 20) as industry experience has shown this area has not been well addressed in licensee assessments. However, the inspection should use licensee assessments to review minor shipping activities, administrative controls, worker training and qualifications and to verify that significant changes to the DOT or .

NRC transportation requirements were addressed. All transportation events reported to the l Commission or to the licensee should also be reviewed.

Basis This inspection supports the program / process attribute of the Public Exposure cornerstone.

This inspection will verify that the radioactive material processing and shipping program <

l complies with the requirements of 10 CFR Parts 20 and 71 and DOT regulations 49 CFR Parts l 170-189. Radioactive material intended for burial must also comply with 10 CFR 61.55 - 61.57 waste classification and stability requirements. l The regulations state specific physical and administrative controls that provide for a layered defense against unplanned radiation exposure during radioactive material processing and transport or from an accidental breech of the shipping container. Although there is a low frequency of industry events, the actual or potential consequence (i.e., significant exposures or release of radioactive material) is typically high. Additionally, the NRC has determined that an independent assessment of performance in this area is necessary to ensure that adequate j protection of public health and safety is maintained.

Performance indicators There is no established Performance Indicator for this area given the low frequency of events.

l l

t 1

l-39 l

INSPECTABLE AREA: Radiological Environmental Monitoring Program (REMP)

Scope inspection of this area will ensure that the REMP reasonably measures the effects of radioactive releases to the environment and sufficiently validates the Integrity of the gaseous  ;

and liquid effluent release program. The focus is on adverse trends or recurrent problems l identified through licensee assessments or the Annual Environmental Monitoring Report and periodic observations of worker and equipment performance. The inspection should not focus on the quality of procedures or minor administrative processes as these will be addressed in the licensee assessments.

The baseline inspection should consist of an in-office review of the Radiological Environmental Monitoring Report and routine licensee assessment results to verify that the REMP was implemented as required by the Technical Specifications and the ODCM. Specific emphasis should be placed on verifying that environmental sampling is representative of the release pathways and that missed samples and/or inoperable sampling / analyses equipment are being properly addressed. A subsequent on-site walkdown to observe sampler stations, environmental sampling and analyses techniques, and to review the calibration and maintenance of the counting room instrumentation should also be performed. The inspection should not focus on the quality of procedures, trar,kina of samples or other minor administrative processes as deficiencies in this area would reorrial'y be identified through the licensee assessments.

Basis inspection in this area supports the plant facilities / equipment and instrumentation, and program / process attributes of the Public Exposure comerstone.

This inspection will verify that the REMP is implemented consistent with the licensee's technical specifications to validate that the effluent release program meets the ALARA principle of Section IV.B of Appendix I to 10 CFR Part 50.

The REMP supplements the effluent monitoring program by verifying that the measurable concentrations of radioactive materials and levels of radiation are as predicted by the effluent measurements and modeling of effluent pathways. As such, it serves as the final Barrier Integrity in assuring that the associated dose from radioactive releases is within regulatory limits. Industry experience has shown that the REMP is often the primary method of assessing the potential risk from unplanned or unmonitored radioactive releases. Because REMP results have served to allay public concems regarding the actual health effects due to radioactive releases associated with power plant operation, the NRC has determined that an independent assessment of performance in this area is necessary to ensure that adequate protection of the public health and safety is maintained.

Performance Indicators None of the established Pls cover this area.

1-40

INSPECTABLE AREA: Refueling and Outage Related Activities Scope Inspection activities in this area would focus on the licensee's shutdown risk management program and those outage related activities that have the potential to impact the risk to the plant. These areas include plant cool down, transfer to shutdown cooling, solid operations, drain down evolutions, fuel handling (core off-load / reload), mid-loop / reduced inventory operations, containmentintegrity, plant heat up, reactor startup and physics testing. In addition, the inspection activities would include support systems necessary to mitigate the consequences of shutdown accidents, which includes control of switch yard activities, emergency diesel generator availability and vital power availability. Inspection activities in this area would include activities during forced or planned outages and would not be limited to only refueling outages.

Basis inspection of this item supports the initiating Events, Mitigating Systems and Barrier integrity cornerstones.

The inspection activities are intended to verify that the licensee has taken the necessary steps to minimize potential events, maintain defense in depth, ensure the appropriate SSCs are maintained available to mitigate and contain postulated accidents.

Due to changing plant configuration, combinations of equipment outages can place the plant in a condition where single failures can quickly lead M significant adverse conditions such as core boiling. In addition, operations and maintenance personnel are performing non-routine tasks which have greater risk impact due to the extensive amount of equipment that is usually out of service. These items, along with the fact that the barriers to prevent a radiological release are also degraded, result in a significant increase in risk if not appropriately controlled by the licensee.

Performance Indicators There are currently no performance indicators that have been established that can provide results related to the licensee's performance during refueling outages. A shutdown performance indicator is under development.

1-41

INSPECTABLE AREA: Response to Contingency Events (Protective Strategy and implementation of Protective Strategy)

Scope Verify that the licensee has the capability to protect its vital area target sets against the design basis threat. The implementation of the protective strategy includes demonstrating that the strategy works, and that security force can successfully protect against the design basis threat through drills and exercises.

Basis inspection in this area supports the Physical Security comerstone.

This is a high risk-significant system necessary to protect against the design basis threat of radiological sabotage. The licensee should be able to demonstrate the ability to respond with sufficient force, properly armed, appropriately trained and within the appropriate time frame to protected positions in order to interdict and defeat the design-basis adversary force in order to protect vital equipment necessary for the safe shutdown of the plant.

The ability of the security 'arce to effectively respond to the design basis threat is contingent upon the number of armed responders committed to in the physical security plan; the intrusion detection system being able to detect; the alarm status being communicated to the alarm stations; the assessment functions (closed-circuit television and lighting) and the training of CAS and SAS operators, communications on and off site, the response officers and response team leaders, including handling and qualification with assigned weapons, and the use of proper tactics. Each of these items will be reviewed to determine if they can perform their intended function in support of the design basis threat and as verification of the PI identified in the Physical Protection System inspectable area.

The consequence to radiological sabotage if an attack did occur is high.

Performance Indicators None of the established Pls cover this area.

1-42

4 INSPECTABLE AREA: Safety System Design and Performance Capability Scope

} inspection includes review of design bases, final safety analysis report (FSAR), supporting calculations, as-built conditions, modifications, testing, and normal and emergency operations of risk-significant systems and interfaces with support systems. This would be an in-depth review of a selected risk significant system and suppo:I systems with an emphasis on changes i

to the design bases and normal and emergency plant procedures. ,

Basis inspection of this area supports the Mitigating Systems comerstone.

l Inspection of safety system design and performance verifies the initial design and subsequent modifications and provides monitoring of the capability of the selected system to perform its design basis functions. The inspection should focus on the design and functional capability of components that are not validated by in-plant testing. Also, seismic and environmental qualifications of the SSCs should be verified. The PRA assumptions and models are based on the ability of the as-built safety system to perform its intended safety function successfully. If the design bases of the system had not been correctly implemented in the installed system, the operation and test procedures, and the supporting analyses and calculations, the system j

cannot be relied upon to meet its design bases and performance requirements. The design  !

interfaces with support systems, such as cooling systems, ventilation systems, and instrument air system, should also be reviewed, l i

The baseline inspection should focus on: (1) maintaining oesign bases (2) consistency with  !

defense-in-depth philosophy, and (3) maintaining sufficient safety margins.

I Performance Indicators There are no periormance indicators that have been established that can provide results related to correct implementation of the design bases in the as-built system and the associated plant documents.

1-43

• l l

l l lNSPECTABLE AREA: Surveillance Testing Scope inspection activities in this area would be focused on ensuring test procedures are adequate to confirm SSCs will perform in accordance with their design. The inspector would review test results for adequacy in meeting the requirements, observe ongoing testing to evaluate human performance, and ensure that appropriate test acceptance criteria is in agreement with design requirements.

Basis inspection of this area ensures that safety systems are capable of performing their safety function and would support the Mitigating Systems and Barrier Integrity cornerstones.

Surveillance activities are required to verify that systems and components are reliable and functionally capable of performing their design function. Surveillance testing is the minimum required testing specified in the facility license and ensures that a conservative safety margin exists for system capability. Operating experience has shown that test procedure deficiencies

, may invalidate previously acceptable test results.

1 Performance indicators The Pls indirectly verify the adequacy of required surveillance test activities. The inspection is performed to supplement the Pls.

l l

l l

l l-44

INSPECTABLE AREA: Temporary Plant Modifications Scope ~

fnspection activities in this area includes a review of design, installation, configuration control, and post-modification testing for potentially risk significant temporary modifications of the SSCs covered by the maintenance rule.

Basis inspection of this area supports the design and design control attributes of the Mitigating Systems and Barrier Integrity comerstones.

Inspection of temporary plant modifications provides monitoring of the licensee's performance in ensuring that the design bases for risk-significant systems, structures, and components (SSCs) have been maintained and that the changes have not adversely affected the safety functions of the SSCs. Temporary modifications may introduce change to the assumptions and models used in the plant specific PRA. A temporary change to one system may affect the design bases and safety functions of other interfacing safety systems. . An increase in the likelihood of the occurrence of an initiating event could result from a temporary change. Also, similar temporary modifications to several systems could introduce the potential for common cause failures that affect plant risk.

Industry experience has shown that temporary modifications to risk-significant SSCs can adversely affect their availability, reliability or functional capability. Verification that all safety functions of the system are restored after completion of the temporary modification is important.

Performance Indicators No performance indicators have been established that can provide results related to the adequacy of temporary modifications.

1-45

l l

l l

APPENDIX 11 CORNERSTONE CHARTS 1

December 1998 l l

l l

l l

I l

[ M"44 '"WT' 3

S = Scrams T = Transients

'"$','[ SD = Shutdown Margin (Future)

R!I = RisR Informed inspections Key: un e Maintenance Rute V = VeriflCation and Validation 1& RP = identillCation & Resolution of Problems ISI = InservlCe inspection i

l Protection Against Human Procedure Equipment E nternet Performance Design Configuration Ous tif y Performance Factors Control seeetoe Integetty Fteed H; reed Homse Error Avemebmty Ftre SoTR Sheldene Los3 el Heat sink opeceMag Etwipment pree, tal#et Design I **"8 L '" # peep Tm Mitted ReNebElty ISLOCA s g ,,,,dere Adegency

, g ,g, e,,yy senchroed Aetow Neo 0,td stebnpy usineenance LOCA(S.M.L) Medmessene Rotwelen08 vet M =5.T.90 head #ng 0488 9

, M=8.Y.80 PI = 8. T. SD. MW neRv Me 3, go, y M *90.AN L Res est3PECT19tE AnE As:

INSPECTABLE ARE AS:

• D fMSPECT AetE ARE AS- Weeny Pt t4 RP VW P' y,,g pg yyuypg INSPECT ABLE ARE AS- lB RP INSPECTABLE ARE A: INSPECTABLE ARE A. ISRP $ E gwsp. Atigament Adveese Weeks hop Egoi, Astgnment Moneewtees Eve 8vtient SAR tmplementapon

• AC M NW ""

Fare Peeeecteen Piping System Ereston/Cerret&ea Meant. Weet Peteettigetten E*e'9 M WWh geeng,'weg py.or.'tesaften Hest Slah Porfoemence Reevoteng AcIlve ties 843ent. Wort Peteettirettee Deesmber 80.8999 idMet S CR Il-1

V

- - i e

1&RP = identificat' ion & Resolution of Probtems udgaung SSPI = Safety System Performance Indicator Systems nit = Initial Operator Exam Requal = Operator Requal Key: So = Shutdown uafgin (Future)

RIl a Risk Informed inspections MR = Maintenance Rule V = VeriflCation and Validation SSF = Safety System Failures I I I l l Protection I Against Design Configuration Control Equipment Performance Enternal Procedure Ouality Events Human Performance

/ eed

/ \

M- .Me-,

ePs Pee.e.e.ee weemee greet-e,enn P'*c'8u*ee oesgn enmet Dee+ge feets Hereed E qWement tP'# #M)

Medeseg e,sene pg, f eelgMment Line p

(%

,e,e tey AvelleeWy toes of heet sent IN8**"I tot powel AOP Hu"** E"ee ** '"#

8eismet SOP (P**'-e**a'8 ) ******I

- E OP "4

= .Ia.o.e RR M MRa,ttM  ;,',,P,  :,';,$$m att omt.ne..it ,,e,,,,

Re, R. .e,ee,, e, e ..Pt. R,t I

1 MSPECTAstE AREAS.

WeeWy PI fSRP INSPECTAett AREAS: ,,,, pg P' **"** M'88# weeny Pt j Advoese'weether Prop. '88 ISRP INSPECTAstE ARE A: weew, pt INSPECTAett ARE AS: I Flee Protect 6en Egustwnent Aegame nt INSPECTAett ARE ASI Meet Stat Peefonnence gq %g ISRP Meine weet Peteettersteen Poemenent ment Mode. Tempeesey ment Nede' MM h'""8 Noneetstene Eeeluttene TempereefNew Mees. Emeeeem weet '"'seevece Teenn, MR empmmentetsen MSPECTAett ARE AS:

ISRP Opeestee weet Aeeende poemenent p,ent Mees. MSPECTABLE AREAS: INSPECTAetE ARE AS- MSPECTAett ARE AS- 1 Changes to SARISO $9) INSPECTAStE ARE AS 5 SS oenign a Poet. Cepebsm, tanP tanP ISRP Tempoesy Plent Mode Equepmerit Aegnmeng Equapment Angnenent tic,n,e ope,, no,,eg eg np Meant weet Peseeinretten MR 'mpie*eateHea Changes to SAR ISO $9) Liceased Opee. Regese Ret iseerig Aege,stee, Opeestmy Evelsesteen 8eeareenae Evesteweas Tempeeeey Poeng Mege Seve4 Nance Testing Emeegene weet gene 3e cet oecemete it,1999 Il-2

/ M< -

I i

+

?

f i

I Mainteln Mainteln Functionately of i

Barrier integrity Functionality of ,

Conte 6nment 'RCS  !

i I

1 Key:

1 Melnteln >

Functionefity of ISRP = identification & Resolution of Problems  :

Nucteer Fuel Clodding RCSA = Reactor Coolant Sy. tem Activity RII = Riek Informed inspectione t CAP = Corrective Action Program 4

i Ctedding Human Procedure Desien Configuration Performance Performance Quenty Control Control

, . P_

/ \

P. .

/

.E P._

/ \

c ~.. . ..

/ \

c;;;;;,

ac,s.,,

(

re- t- P=

c- c ..

-- . P .. T . .,,,,,,,,,,,,,,, w.,, e ., _,,

c , ,, ,

. c, .t ,  ::::~,',, . c..

.. ,ocense.e

.. oe .,, L , . t  : c. ,;y P . c- , it.

.P.

. v....A. .. T ,

, ,,,, ca,,, ,,,_ .-

. Ch.ne.W,

, Re M. nap, a - ac' A

• • ' n . .c A Pt..c.A CAP n . .c A CAP

- ac' A c"a' m ..c.A aa a .- ac. A cA "J"*** .

I I I v wy Pt v.ewy Pt MSPEcTAets ARE A: mSPECTAett ARE A: v.,ee, P, msPEcTAM AMA: ,

la RP 58RP 'O NP pr3PECTiett ARE AS:

mSP CTAetE ARE AS: MSPEcTaetE ARE A; seSPECTAett AREA: v .iypi f C.me P.ef.

stRP ISRP

' MSPECTAett Ang A:

R.I leng Ac#wNI., Et RP esi.46 ca 0.c nb.e eo. t e 11- 3

,__ _ . _ _ _ . . _ _ _ _ _ _ _ _ _ . _ - _ _ - _ _ - . _ _ . _ __ m _ __ -. ____ _- ___ _ _ _ _ _ _ - _____

- ~. - . _ . _ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - .- - - - - - - - - - - - - -

{

t Weinteln Mainteln "

Functionefity of Berr6er Integ'ily Functionetely of Nuclear Fuel Clodding Contelament I Key:  !

l&RP = identification & Resolution of Problems .

Maintoin RCS LMG = Reactor Coolant System Leakage (identified, unidentitled) !

Functionality of LOR = leak OCCurence Rate (future)

RCS {

Ril = RISK Informed Inspections  ;

ISI = inservlCe inspection (future)  ;

CAP = Corrective Action Program '

1 RCS Equip Human Procedure Design Configuration E O*"I"'

Performance Queltty Contret Control Performance

/ I L /

RCS teenese ISt ReseRe g o,, ,,,

Componente Post Aceident Reloted off M Reenne e' Escal A of b.eendeep Me esene IT8Ie* A*S**o*t c,. sos. teen, OPS,M A., Po- -o-. Norme.t P.ee e.ee PT,8*e',s?!SeeenderF C ,e. e, Ps.seemewe in eeed by E OPS Pt e RCS LEG. Pt.tgittetwee)

'I geny cap RR W Re gg Rft CAP I

IMSPECT ABLE ARE AS' MSPECT Aett ARE A. MSPECT ABLE ARE AS:

mSPECT ABLE ARE A: ta RP mSPECT ABLE ARE A:

I IA RP Permane,nt MR topse.enseWen Changee le S art 59 59) te.,. p e.tPlent useeMede sa RP Cheneesto SAR(Seto)

Werey Pt MSPECTABLE ARE AS: MSPECTA9tt ARE AS: MSPECTAett ARE AS:

MSP CTABLE ARE AS:

MSPECT AetE AREA:

IS RP 'EN" ggpo 80 RP KRP 88: Aeterstles "8" E.e ,'."'t Am' '.e.Connet Changes to sAR(Se 59) 'I P 4 Ny [

IE M ' " "Ee*

==eenae "'a'e-. t idneSb em ootember t t. t999 ,

i Il-4

L Melnteln Maintain Functionality of Barrier Integrity Functionality of RCS Pressure Boundary Nuclear Fuel Cladding Key:

CONT = Containment Leakage V = VeriflCation / Validation Maintain RH = Risk informed Inspections Functionality of Containment MR = Maintenance Rule f&RP =

identiflCation & Resolution of Problems CAP m Corrective AClion Program I

SSC&

• ' ' Human Procedure Design Performance Performance Ouality Control Configuration Control

/ \

m e. m entstame C.SC Re...c,eA.e

.mP f goessme.n P t

. f.

gr n .~t pyg,. ,

M.co .

=,_

Storet

.P t .ures e

y C

-e e.

e e.me ,

SFstems Fenenen tops. Mame. Cepe% P. ,

Serv)

,,,eme,e, Co ree by RCs one

,Q "' Pe .Cosit Rm C8P Rn P'*C 0"T* "# CAP G84V RN CAP RA RW I I I

versy Pi l INSPECT A9tt ARE AS: gNSPECT A8tt ARE A:

INSPECT A8LE ARE A:

LG Cons. teel. States ggnp ggny We'NFPI MR tmplementafien O'"'"'*C't'8""O ag Rp MSMCTAstE ARE AS-INSPECTABLE ARE AS.

' t&RP t&RP Noneovnae Ev* pons 54RP Permaneel Pleat Mods Maant Work Peteeny Comeo, Lkeased opee-nEOuAL Changes to SAR(50 59) Temp P' ear Moes Rohrenag Actevetee s Changen se SAR(50 59) LG Coat. f$ot. States December te. l998 lenots est 11- 5

e Key:

Emergency Preparedness DEP = Drift / exercise Performance ERO = ERO readiness ANSA = ANS Availability SA = Self Assessment R&RP = identification & Resolution of Problems RIl = Risk informed inspections CAP = Corrective Action Program

(

l ERO Procedure ERO Offsite Feenities & Equipment Ouelity Re m ss Performance EP seNAmeeeemeN Orm & Ewe ANS Testing FEMA ERO Augmentatten Teettag ERO Dem & EAL Changee "**

A,eiset,einty et ANs g,, ,, g Eve %eMon ayg p,Q*. recomes & sAwo D'"'*E***"*** C'******

E,es,.eni SAuo emommemetwa sur mence htmes#en Achset Event Reepeceo PAR's  !

Ret. CAP.SA M=ERo.UEP Pt. ANSA IHI. S A Rn. CAP... M.ERo.oEP  !

L t

i I

l Versy Pt l l versy M l l vers, Pt l l vers, Pt l

INSPECTAetE ARE AS: INSPECTAetE AREAS:

~

INSPECTAetF

• 4AS: INSPECTAetE AREAS:

EF.P ISRP e4RP IARP ERO Avgmentetten Testing Ames & Noemeenen Svetem Testing E AL Chedges LW OP*' #*e'd l EP Testneng Pesgram DeMemon WWm OrWEsoretse taspecuen DeWEseedse bepectlen i e- m .e,w to, tese brad ea [

t 11- 6 '

t a

e Occupationar E sposure Key:

HPT = Health Physics Technician ORO = Occupational Radiological Occurence i Uncontrotted dose Occupational Worker Dose Il TS HRA nonconformence til VHRA nonconformance II) < 10CFR2O Limits Ril = Risk Informed Inspections (2) Maintain AL AR A 1&RP =

identification & Resolution of Problems l

I Ptant Factfitles /

Equipment & Program / Process Human instrumentation Performance

/ \

l Pte Ise P ee ee P,eee., tee ee AtARa Pie l c.Pene..

et e , C.o.iem e

e In_: I HPT 1 TeWee i RedleWen Peelectem T. e--.

9 gensteeteg e IAge.t ocele 3 (Ru caos& n Meweatace W Red Weekee N RP Ce=Ne8e E M,e weeg . I Coateoctor HPT ooe's Ame8tet#4 Peg. eene 5 Red Wessee Trem.eng 998 ALARA a Presacioact le Secree Teem Ceake8 pt e oRo. Rig agg PS e oRo, RH Pleono. RW Rtt Pt e omo. Att i I Wormy Pt stesPECTasta ARE AS: INSPECTAett AREAS: We*#v PI IARP INSPECTABLE AREAS:

vyny Pt INsPECTA9tt AREAS: y,,, pg ta RP INSPECTABLE ARE A:

Access centree to Red. A'* . INSPECTAett ARE As:

Rr,4 Kenneeing emett. Acces. Ceakes to Reg. Areas t&RP t&RP Red Menneving teste. ISRP ISRP AtARA Pionning & Centrees AtARA Plehalat & Ceakete p g g,,6m Perlermance

. Decesaber10.9999 geneet ce Il-7

P.

Key Euposure REMP = Redlological Environmental Monitoring Program OOCM = Offsite Dese Calculation Mancet l- PERO = Process Effluent Radiological OcCurences I Rif = Rtsk Informed Inspections ISRP = identification & Resolution of Problems Dose to members of the Pubile from effluents, material releets and transportation activities (t) < 10CFR Part 20 & 50 APP i (2) Melnteln ALARA -

Plant Facifftles /

Equipment & Program t Process Human instrumentation Performance

/ \

l Pteroev.es P'"e&M Empeewe a med Metoetaa 8 e.Pr..e. Red Mwees (WS)

Me ncese us,mereng a contes D. Cambreesses g p,,,gn # Mees e Peocess NS AMEMP y,8"8"O 8- 4 E"'e Mene OC I Peelected offene sone 1 T.h Ovale

d. Avenet'*4 A Egv.pnie.e Cole # -

I 5 Chem Tech Portemenee 3 ftEMP Equ.pmeent s Atmervisel reasonee M Teenspetopen Peg. M Tronepe.teHo.Pegnt  ;

W Mo'sessepy h*sewnente se Counung ise M M8e'*e, Re.sene te Teenopetenen Paceeging a Me'eereleg.cel P'gm.

- Pt . .. . ei oe- Es,.-sMe Pt.PEno, m

, , , , , vs.no n v.w, n pfSPECTABLE ARE As: fNSPECTAett AnE AS:

MPECTRE AREW #fSPECTAett AREAS: ,

ERP n o._u u,, e t T.e.- s,s e

ets

,== =,o,,e.,, t,a,s.P M e , tan.P

n. e = R-

.e..ee En.e P..,.e n M P.. Ms.oe e.Me

. En.eoe e. ,,e.ees M . s, me e ,

..e e . . ,,,,,,,

11- 8

l v

e n

o E ,

if s. f

$ ,s < gu.

o a ~

a.

e,

/

s.

• 5

= 5; la. 5

. ig .

}E 8 o

e cpc as; fa}r .= *. y- i

.=

o . w c.2-

~sS .

lu;a  :

c E3

-o Si ti gagu a .

j o

. "a. *. s a

. n

-um.e

• .go e ce m

A ys t

! jov.*c 25 i E ,,

. }f

-.E - .- i.

I .I . 8c= 3. > 3 $LE u

f.g.

zg

u. < . e

• • . 0u =c. M*

2 -C .

1. ..Io 38

.y a><sm2 1 l

5 e aae a,, u X e. <

s a

. =

m 3 a .

m / .

= l" s

-* G u. .

a E =  : e a a 8 s

i

<<<*Es"'

s><w "

• N 11::0 Et

}.

. r

• u 3 s a

< .E s . .

YI

= !s Gv.

w :s ki:j

. Etiu e

i

. a p

• I. .

e o  :* , .

is

'* j ? m*

a. i e =

t E 2 E

• i i

O  %

o '

2 c ".

.* m E .uE s s .t, I.~ . c r 3

• Et0 e a s

. gj s

.I sg

]

[ a  : E.

. g.u.

E

=

t. .i a

g. * .t o

< .8 .= . ,.

2 .

s

.- s e.  :

< G

r. !!

EGi! i.

l

.f I:

a

.I

u.

a:

. r

• i

, ts ss

sc :

! Er.r s 4.<

• E5u; s

E

. !f.u E.<

s. .a ..m: .

iI,f

/

• i s g 1"s s

E;u z=

-U. Ew s. L o

~ =-

g.as..

• *Efl0 y \ e I

> . rg e 1*

.j -la II.o  :*

• 7 e

). .i er *

"" *E I E jj i 2 ti a i 1-a ss Zu 3; g

5 EEsl* =

by:su:

-E

a - __L. ._-i- Jm.e _

,* e. m a % a.-

.a - w

)

1 I

a  !

i l

l 1

i l

l I

l

.O 0

C l

l l

l r

i i

J

'h

.i 4

4 l

e 4

l I

1 4

l 1

l l APPENDIX lli l

l RISK INFORMATION MATRICES l

i December 1998 l

l l

l l

l

[

l k

i

. _ _ _ . - __m.. ..._ _. _ ._ _ _ .. . . _ . _ - . _ . . _ _ _ _ _ . . . _ . _ _ _ . _ _ _ . _ _ . .. . . _..

' Contents Table 1, Risk Information Matrix No.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . lll.1 Table 2, Risk information Matrix No. 2: PWRs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 14 Table 2, Risk Information Matrix No. 2: BWRs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ll127 1

.-m - - --- - -- ,- .-- - - -- - - - - , -

L e . i 4 i

- Tchle 1, Risk Information Matrix No.1 i i

C0fesEftSfoNE IMsPECTMILE AftEA Fasouevecy 2 tper S Pen Ltvst or Estofer BASIS .

I EMERGENCY PREPAREDNESS ('M CORNERSTONE I EP Alert and NoGReason System Alert and Blennlet 4 hrs t 2 yrs Review at system eruf program changes.

Avesebuey Moselcanon , Polonnel pubec evposure could be System Empert ludgement basis for hours estimellon. After Inglel Impacted by degradation in the ANS f Avesabeny program verWicetion (8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />). Idenulicagon and ResoluMon of during on L._,. ~,.

1 ProblemsAssues rev6ew, and review systern and program >

changes every 2 years. Totalinspecuan hour 1Mguired were reduced by 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> / 2 years because of the eveNobalty of a Pl. I I

I i EP Dets and Eueretse Inspection Dr41 and Esercise Beennial 64 hrs 12 yrs Observe the Osennial Exercise Adequatem' ..-.~. between the [

Performance for spectenst Nconsee and the entemet egencies Expert judgement bests for hours estimeport Piin this eres l lhet respond to emergencies is enminates the need for addHlonelinspectors to monitor the l i necessary to limit poten6el public [

14 hrs 1yr for exercise (about 96 addptonal hours). Hours include observeNon esposure Quarterly Resident or OL of Dienneet eserctse by EP Speclenst (32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br /> every 2 years for j

inspector observetton, and 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br /> for identificeflon and ResoluMon of ProblemsAssues).

Resident inspectors peelodic observation of evolueWon of .

Operator ,-.L.. ~e with respect to Emergency Plan during [

j strnulator observation (8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 1 yeer; one 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> observenon per -

quarter ). In addition. Resident should observe eedt annual

}

exercise (6 hrs 1yr).

EP Emergency Action Level None As required by 16 hrs 12 yrs Review at program changes Timing of offsNe response to Changes program

..._.. .~a, can be lmpacted by changes Empert judgement bests for hours estimenon. Assumes modest ,, ,.._ eat cheneas. and this i EAL program change every 2 yrs. Estenstre plan changes may could impact potenrel public require higherlevel of effort. esposure .

EP Emergency Plan Training DrNI and Esercise Bienneet None This inspoenon eroe is adequately covered by the Pls. This inspection eroe is adequatedy 3 Podormance, covered by the Pts.

ERO  ;

Participedon inadequate training could result in en increased posensel for pubac  !

esposure in the event of en [

eccident. [

t EP Emergersey Response None Blenntat 6 hrs 12 yrs Review alllicensee performed self assessments. Inadequate staffing during en l OrgenereNon Augmentellon

• .~. ~y couldimpactlicensee -

impert judgement basis for hours. IdenMilceWon and ResoluMon response, and could impact of ProblemsAssues review based on licensee self essessments, potential pubec exposure.

EP Identificetton and Resolution incorporated in of ProblemeAssues each appuceble j Inspectable area i

111-1 i

Table 1, Risk Information Matrix No.1 (continued)

ConNEn$YONE hSrtCTAtte AntA Fntru Ncv 2 S rt Ptn Ltytt or Erront BASIS YrAn OCCUPATIONAL EXPOSURE (OE) CORNERSTONE OE Access Control to High Radiation Annual 13 hrs I yr Walkdown all HRAs < 1000 mrenVhr and select aress that are The poterstial for tWgh occupattonat Radiolog6cally Slgnificant Area (for >1000 subject to transient dose sales, ll those conditions ertst Assure doses are higher in HRAs and in Areas mR/hr only) that proper controls have been estabRshed, and that workers areas where transient HRA could Events Very understand access controis for these areas. Review those HRA eutst. Radiological risk (i e.,

High Radiation eccess control events docurnented irt the Pts and/or in the exposure) to a worker must be Events, licensee's corrective action system over the last 6-12 months within the occupational exposure Significant lit-ilts defined in 10 CFR Part 20 and Exposure Events The hours are based on the current core progenm as rnodified by At ARA to minimize the potent!al for inspection experience. The total hours include 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> at health effects. Conective ry, the identificatton and Resolution of ProblemsMssues for the Region access controts provide a " defense-Based and the Resident inspectors to review incidents involving in-depth" agaMst a signthcant the loss of one or more barriers to en HRA, VHRA or abbome exposure. Industry experience has area; Four hours of walkdown are included to observe identified frequent occurrences redlologically significant work not addressed by the Pt and to where the failure of rnuffiple barrters verify that HRAs 1 0001 mrem /hr are controsed as required by resulted in en uncontrolled entry the applicabie TS. Total W.pection hours required were reduced and,in some cases, a significant because of the evaltability of a Pl. exposure OE ALAAA Pfanning and None Annual 60 hrs / yr The Inspectors shot review, at a minimum, the top five Radiological rfsk (i e exposure) to Controts rad 60 logically significant jobs. Select lobs having a high a worker be witNn the occupational Individual or cof'ectre dose or located in an HRA. VHRA, or exposure limus defined in 10 CFR airbome area by attending licensee planning and RP briefings Part 20 and ALARA and to minimfre and reviewir g RP&C logbook entries and past outage Nstories, the potentist for heefth effects.

Compare current licensee performance to established exposure Effective ALARA planning wit!

goals and previous performance, assess whether these goals ensure that adequate physical and were aggressive and reasonable, identify what erposure administrative controls are in place controls worn implemented, and determine if the licensee's to mittgale evposure during subsequent performance met these goals Observe selected radiologicaffy significant work.

lobs to determine if the work is being performed as planned. Industry's expertence includes frequent events where probMms trt The hours a e based on the current core program as moditled by tNs area have resulted in inspect!on empertence. The total hours include 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> of unenficipated exposure or a loss of kfentification and Resolution of ProblemsAssues to review controlof the work activity. Specific ficenses assessments of the AlARA program and app'ocable attention should be given to events; 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> to review the planning for selected Planned Special Exposures and radiologically significant jobs; and 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> to observe those exposures to Declared Pregnant activities selected. It is expected that this inspection will be Workers owing to the higher risk performed prior to (i e., observe planning) and during (I e Involved.

observe implementation) en outage. However,if no outage is scheduled for that site for the yeer, then tNs effort should only require about 40 total hours (1 e.,20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> for job review and 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> for welkdown).

OE Identification and Resolution incorpora'ed in of Problems / Issues each applicable inspectable area 111- 2

Table 1, Risk Information Matrix No.1 (continued) i Coseseviewy8E b80PECTMLE AREA Fewouescv 24 pet

• PER LEvet or Erront Bases [

YEAR OE Redlemon Montoring None Annuet 30 twstyr hopect en those monilors located in areas subject to signillcent, Ameirdagsref risk (i.e., esposure) to hstrurneneanor-transeent radiologieel condmons enduding inadvertent crocomM a worker be woun sw ocapesonal during work actMiles, and Wiet portable inserumentellon used to exposure limRe defhed h 10 CFR 3 assess radiologicaey signWicent orees or work. Part 20 and ALARA and to frenhoze the posenne for hosen e# sects. i The hours are based on the currord are program es enodmed by These monnors idenmychanghe hopecton emportance. These hours Include 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> d redlelogicalcondsons to workers  :

Identmceeon and Resolueton et ProblemsAssues to review such that oceans to pneverd on uconsee identified events; 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of walkdown and 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> to overeuposure con be takert - '

revlow monlior coibrellon, alarm selpoint and rneintenance Industry has expertenced several records -

events where these monnors were the primaryindication that i redlodogicalcondsons had '

signmceney charged as a resun of planned or unplanned actMlles, t

OE Radiation Worker None Annual 20 hrst yr The inspector shot rewtow. et a minimum. et ewwes that The assocsated risk is the pocenitet i Performance occurred over 15e Inst 6 12 months, including specmc events for a signmcent, unplanned identifled by the resident inspectors, for adverse trends lhet enposure resulling either direcily or offect the Occupanonet or PutAle Oose mmerstones. In port by the foNure of a worker to -

perform o required task owing to The hours are based on the current core program os modWied by poor knowledge or training.

Inspection emportence. These hours include 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> of Recunent problems in this ares  !

Identecation and Resolution of Problems 4ssues to determine have been identmed by the Industry l that the Econsee effectvey idonulles and addresses adverse es a root or contribuung causein j redworker performance Irends and that overet perfonnance is enony exposure events and h some  ;

consistent weih NRC inspecWon or PI findings. This eroe does events invoMng the unplanned '

not include weihdowns or events invoMng access conwel to receese of radioecove meterlet to the  !

HRAs11000 mromeir, VHRAs or sirbome areas as they are .J._..  ;. This is of special eddressed in otherinepection eroes concemduring outages, when  !

r"*"fsemmy segnmcent work is i onen performed by contreet stest i

having varying invees of empertence >

i l

I I

i l

i i

111- 3 t

~ -

Tabla 1, Risk information Matrix No.1 (cos;tinued)

PE N HOURSFOR Com6 STONE be9PECTABLE AREA FREcuf4cv 2 9.Mn Snt PER g LEVEt.or EFFORT BASIS YEAR PUBLIC EXPOSURE (PE) CORNERSTONE PE Gaseous and Liquid Effluent Reportable Dienniat 30 hr / 2 yr The inspector shall revtew the caubration and me!ntenance Radiological risk (t e.. exposure) to Treatment Systems Release Events records for each etnuent monitor [xtusng the backup monnors) the pubnc be below the 10 CFR Part and each meteorologicat Instrument. Each system enodfication 20 and 40 CFR Part 190 Emits and should also be reviewed excepting those having a rninimal ALARA to minimize the potential for impact on system operation. Every e .ent reported via the PI hee!!h effects. Ooses below the shst also be reviewed. des 6gnobjectPresof Appendix 1to 9

10 CFR Part 50 are considered g Totalinspection hours required were reduced because of the ALARA by the NRC Proper p

avaitabihty of a Pt The hours are based on the current core - operetton of the effluent treatment progeam as modified byinspection exper8ence. The totalhours cystem and enonitors will ensure an include 10 bours of Identification and Resolution of adequate " defense 4n-depth" Problems /tssues to review the licensee assessments, events against an unmonitored, and annual effluent and environmental reports; 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to unanticipated release of walkdown the gaseous and liquid systems (including monRors) to radioactivity to the a.W .e..;.

observe the equipment matertal condtton and ongoing activRtes; Overat industry performance has and 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> to rev'ew effluent and meteorological monitor improved, but concems stts entst callbrations. morWtor alarm setpoints, maintenance records and with abnormal releases, system system mo@ftations. rnodifications, and mon 8 tor operabeity.

PE Identification and Resolution incorporated in of Problems /tssues each applicable inspectable area PE Radioactive Matertal None Annual 40 hrst 2 yrs At a minimum, the inspectors should review 4-5 radiologicetty Processing and Shipping The regulations state specific significant shipment packages, observe the surveying, physical and administrative controls placarding etc for at least 1 shipment, and observe at least t that provide for a layered defense radioactive material processing activity (f.e., resin dewelering, against unplanned radiation weste sorting. waste packaging, etc). exposure during radioactive materiet processing and transport or The hours are based nn the current core program as modified by from an accidentat breech of the inspection expertence. These hours include 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> of shipping container. Although there Identification and Resolution of Problems. issues to review is a low frequency of Industry licenses assessments and events; 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to observe events, the actualor potential radiologicaRy significant processing and shipping activNies (such consequence (I e., significant as RWCU resin dewatering. Type A or o shtprnents), and exposures or release of radoscthre radioactrve materlat worti and storage areas; and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to material)is typicatly high review associated records including 10 CFR Part 61 sample conection and anstysis resuRs. Credt shall be taken for any of these activities observed / reviewed whRe performing another inspectable area.

111- 4

-. - ._.._. . -..-_-..- _ .-. - -. _ . . _ .. . . . =..

l 3l{

tp I ]'

" l l ,1: i nlf 5 I du i i i

!!Olie lli 1

}

! l. 1

'i i

i ,

i a

s 0 t b

\ s" r

9

t Table 1, Risk information Matrix No.1 (continued)

CoRnensioser pseFectants AREA FREOuEVECY 24Nert S PER LEVEL OF EFFORT BASIS I v.a.,

REACTOR SAFETY CORNERSTONES (l=tnmoung Events; EMulgoung Systems; B-Berskr, X or a number truncelos the inspectable Aree is mapped to lhet Comeestone; When a number is present in a column, a represents the approutmale percentage of the totalhours of inspection to be perfonned for that Comerstone) f M 8 Adverse Weather None As condulons 12 to 18 hrsI Seesct t non-tenure tolerant SSCs, supplemented by 1 slie-20 Properemone Conslionsleading to Loss of Onsae 80 require year speclNe high risk SSCs. The non-lellure toleront SSCs (i.e, Power,freering torryeresures,Ngh .p highly renable RWST), whose feauros may contribute e smas winds Gooding dominose risk.

emount to the toest CDF, but create a large CCDP, could resu4 kt Condtons conlead to common feNures of other SSCs due to lnstrument une freereng or oIher cause failure of rnitigedon t CCF teAures. equipment and toinillellegng evenes.

Use plant fWstory,IPE,IPEEE to determine G , D and -

l*

essign finst hours. Beseene Inspecuon to be performed prior 16 seasonet suscepubumes, Hours include 6 hrs for IdenWRcogon and Resoluuon of ProblemsAssues.

I I M 9 Changes to Uconee None Annuel 32 hr / yr Review Ilconsee evaluenons made per 10CFRSO.5g Changes con be made without pefor i 80 20 Condmone and Selety %J.,...~.as. N the initial screening indicates that the issues NRC approval ordy N they do not Anotysis Report potenlielty increase risk, select the issue for review. Select e increase risk. Adequate 5cencee minimum of 5 skynlHcant evea u eNons for Indopth review. Includes performance whee evaluaang 8 hrs of ident#Heation and Resolunon of ProblemsAssues impact of changes prevents changes that increase risk from

' being mode. Success creerte for PRA could change W Rcense bests ,

changes I M 8 Eme gent work None Bimonthly 60 hrs t yr Selection of risk signlNcent actMues should be made using Troubles %onng while trying to 40 60 ticensee's conHguracon specNic risk assessment or from a determine cause of emergent ranking of systern importance. RIM 2 should be used N plant equipment problems con lead to speelhe Informenon has not yet been developed. Sele:t 2 Inodvertent resk signlRcent inulating r actMues per monIh. events.

Hours estimese assumes 3 hre Imonth of observocon and 2 hr/ In addman, high risk _ .6 month of klenunceton and Resoluuon of ProblemsAssues. with mumple out-of-service SSCs mer occur during veiling m meineenance due to ;c... .; work.

j lll-6

0 l t! 'i-jL-i !I,jlll1  !!!jliil !

lyld11!!

d!i ikllilli! i,ih!!!! !

!!)!! !ib I' i

i

, vline'l$!{I'lI lii 14o a l pi d,.it v!1 il >,,

i l l gl tr n ajjI

}d Ij!!$1s ill3

. m 1 nli illllI  !!dlI da Il;!I Ilill,pliilld InI! !:3,I ll,!!i

. ii IIfl a <

l lifl  ! 1 II

{ i

# 1 i i li 1

3 1

[1

.  !. 3  !.

.e . . .-

4 g g g . . .s =

g _a _e _e _

Tcble 1, Risk inform:, tion Matrix No.1 (continued)

% Houns FOR CORNER $70NC INSPECTAaLE AnEA FREcuENCY 2-UNIT StrE PER LEVEL OF ErroRT BASIS YEAR I M D Heat Sink Portormance None Annual 6 hrs / yr Once a year, for heat exchangers and heat sinks in rtsk Heat exchangers and heet sinks are 20 80 Resident important systems. observe periodic performance testing with a required to remove decay heat, and focus on the potentialimpact of common cause failures.. provide cooling water support for Enchanger setection should be made focusing on high rish operating equipment. Degradetion functions on euchangers that have low margin to their design In performance can result in failure point, or have potennal for high fouling. One activity per yr for 5 to meet system success crtlerta, hours. One hr of Identification and Resolution of and lead to ine eased risk primartly Problems / Issues- dt t b common cause failures.

Dionnial 24 hrs / 2 years Regional Specialist Blennlat inspection on heat sink pedormance conducted by regional specialist. Includes 12 hrs / 2 yrs of Identification and Resolution of Problems / tssues.

I M D IdentlHeation and ResoluHon AH Reactor Diemist 120 hrs / yr Region based inspection every two years using 240 hrs. SRA 70 20 Uncorrected root causes to 10 of Problems / Issues Sar ey (240 / 2 yr) should brief team on site specmc risk study and provide heights problems could lead to increasing Performance by Regional to aid in selection of flems lo inspect h the review. Select one or comnion cause and humor, went bdicators Spectafists two syskms depending on scope of inapection, and complently rates, and to breakdowns in multiple of selection. Comerstone areas. Manyof the Additional hours issues wlO cross multipa, Da#y incorporated in Comerstones.

each appucable For the review by inspectors, selection should not necessarWy be inspectable area based on Individual system importance, but should look at the potentialImpad of the root Cause on the piant as a whole.

t M D inservice Inspection RCSleak Rate Annual 24 hrs / yr Totalinspection hours required were reduced because of the ASME Oass 1,2, & 3 components 50 50 Activmes availabilityof a Pt. Regional based spedalist to perform. have relatively high rellatWity Activity may be performed on a re'ueling cycle basis to observe components. However,theyare activmes. Review or inspection of steam generator tube non- non-fanure tolerant SSCs and their destructtve enaminations would be performed fonowing each falli res could result in a high refueling outage. For Weiding ISI select a minimum of 3 welds Conditional Core Damage for review. Includes 4 hrs / yr of Identification and ResoIClon of ProbabiNty and consequences. t Problems / tssues.

Review or Inspect 60n of reactor vesset non<festructive examinanons would be performed at the appropetate 10 year Interval. I Inspection activities related to noni: ode repairs would be specified when non-code repairs are performed. SRA wel provide input to select repairs to inspect.

L lil-8 '

i

Tabla 1, Risk information Matrix No.1 (continued)

CORNERSTONE INSPECTABLE AREA FREQUENCY 2OST PER LEVEL OF Erront BASIS YEAR t M B inservko TesNng None B4montNy 64 hrs / yr Select 2 tests per month. RIM 2 should be used for component inservice testing provides Indication X

selection if plant spedftc informat60n has not yet been developed. of equipment avaRabPtty and Select 6on wtR also be based on the Nstory of previous Scensee retab#ity. Improper testing could implementatlon problems in ins area, any adverse trends resuit in undisclosed problems that identitled witNn the Section XI pump or vatve trending program, last until the next required tasting, and/or following significant rnalntenance or modification activities unless discovered through failure on specific components. For vane testing, select samples from wh8e in service earner, creating long different valve groups to increase the inspection's sensttivity to periods of unknown equipmert common cause failures. Inoperabatty.

Hours assumes observation of 24 tests on high rtsk components wtth associated Identification and Resolution of hoblems/ Issues time.

I M tl large Containment Isolation Containment Status. 8 hrs / yr At PWRs, monthly verify hours purge valves were open, k)ok for Large containment vetves that are X Valve Leak Rate and Status Penetration monthly increasing trends. cyded open durtng plant operation Verttication Leakage increase the like8thood of failure of Leakage- Al refueting Intervals observe one LLRT for high impact vatve the containment barrier. Frequent refueling with large fierce seat area operat6cn and aging of seals in the valves can iend lo ercessive Tota; containment Isakage inspection hours required were leakage rates.

reduced because of the avaRabi!Ity of a PL Indudes 2 hrs / yr of Identification and Resolution of Problems /tssues and configuration control on large containment valves that are frequently cyded.

I M 0 Licensed Operator None Annual 96 hrs / year by Assumes 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br /> ons!fe by a regional based spedalist.

25 Requalification Human errors and fature to recover 75 Regionat Regionat activities based on the required program. n'esure from acddent events increase the Spectatst licensee includes training on high risk ope stor actions based on significance of important events:

SRA Input or RtM2. Does not include in office review of tests Examples include failure to performed by the regional spedalists. manuelty depressurtre and faHure to recover offsite power for BWRs, and fature to switch from RWST to Resident review should focus on the high risk operator actions containrnent sump for PWRs.

Quarterty 8 hrs / yr by from the site spedflc risk study. Assumes 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of simulator Resident staff activttles sampled once per quarter by the Resident inspectors.

I M B Maintenance Rule None Annual 40 hrs / yr for Selection for annual review shouh! be made with Iraput from SRA. Tracking and documenting system 10 80 10 Implementation Regional includes a 40 hr annust review by a region based specialist,16 evenahmty and retiabety for the Spedalist hrs / month of resident inspector activities, and 2 hrs / month of plants risk important systems is identification and Resolution of Problems / Issues. performed under the Maintenance Rule. These estimates impact the inspectors should focus on categortration of fattures used in plant risk rnodet,in addition to actual tracking condition of important systems, and goal setting and get plant risk.

Monthly 216 hrs / yr for wet program for risk significant A1 Systems. Residents sample Resident Staff 2 systems per month.

lil-9

Table 1 Risk Inform: tion Matrix No.1 (continued) '

PEnr m HOunsFon COrodEnsTONE blePECTAeLE AREA l'nEQuFNCY 24pe? SITE PEft Leva CF EFFonf BAS!S YEMt l '

i M a unintenance Work None Monthly 34 hrslyr Select one semple per enonth for Mmes when mumple to 80 10 Cortof of plant dsk and PdodureNon and Conhol component outages were planned sirnumeneously,or for those coneguramons through appropdele i times when planning decisions were made lor expedung planning and controlof molnlonence eqtApment return to service because of component tellures, activilles minirreroe lhe plant's especially on the backshNt when normal planning was aggregole dek. Work priorlWrellon (

unevetable. Use alle spedRc risk tools, N evetable. Prior to end reek evolusilon pdor to oulages 7 planned ouleges, review the culege plan, and Rs reek evahm rninimeres risk signNicant includes 4 tws 1 year of Idenlmconon and Hamahman of Problemet m ~. n ,andmoulmeres ,

issues. berriors lo radiological reisese.  !

\

i M 9 Nonroulho Evolutione None As Required 102 hrs t yr As enelor evolupons should be conaldered for revleer endfor X X X Human Errors,perucutedy recovery j (Hour egocellon observadon. The Items to be selected should be beood en the ecleons from event inluellons, are between complently of the ac9vily and the polonnel elsk elyillicence of Wie mejor contribulors to plant risk. I Cornersiones we possible operator eners endsor equipment problems. Indudes Perlonnance during non-rouune be based on i 40 hrs / year of Idenillicecon and ResoluMon of Problemet lesues. operellons con be used as en actualevents; iniscolorof plantpersonnel assume even performance durmg omergencles i estribunon for Hours based on sfu occurrences per year of risk signecent off Ihan their performance during planning ,

normal opero#on, one post-scram review, and 10 risk signmesnt normaloperanons. In addman, plant purposes) LER reviews per year. upset events are more Whely during j non-rouMne operoNons.

I M B Operabaly Evoluellone None Monthly 60 hrs / yr  !

Review at operebety evaluelions to idenufy those involving hoperebuty of components can X l systems or components with the greelest impact on plant risk. result In high risk configurellons '

Perform a more h depth review of 38 elsk signihcent evolustions because the tools being used to RIM 2 should be used for selecnon N plant specific Informetton evskale risk in de#y planning wm .

hos not yet been developed includes 12 hrs t year of have involld equipment evenebatty.

IdenNNcellon and Resolution of Probleens/lasues. [

j l

7 Hours based on 2 octMues per month of 2 hrs each. t i

t M i B Operolor Work-Aroundo None MonIhly 30 hrs Iyr Review operator workerounds monthly, and select two lo Operator workarounds canimpact I X

evoluelo. Select those floms which con impact operefor human performance during event response during evente, response, due to heressing  ;

compleullyof tesksandmore >

Besed on 2 actMuss per month of 1 hr each. Includes 6 hrs / nmlung time lo perlorm required year of IdensliceWon and Resoluuan of Problems / lesues.

i acuans. .

I i

f Ill-10 l

Table 1, Risk Information Matrix No.1 (continued)

HOURS FOR PERFORMANCE CoRNFRsTONE INSPfCTAPAE AREA FREQUENCY 24sNrf SITE PCR TOR LEVEt or Erront BASTS YEAR I M 0 Permanent Plant None Annua!!y 80 hrs / yr Review plant specific configuration risk for pre and post. Plant modifications wfillmpact plant 80 20 Modit6 cations regional mod

• cation, and potential unreviewed safety questions. Select etsk, by either increesing or speciaast 3 to 5. dependmg on compleulty. of those modifications with the decreasing the baseline rtsk atier greatest impact on risk Reg 60nalinspectors should use the SRA the modification. The elsk changes to input into the selection of modifications to be reviewed. Hours are espected to be small, however are based on 5 rnodificanons at 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> of revenw per the concem is an increase in risk modification by a Reg 6onal specialist. Includes review of post andfor consequence during the modit6 cation lesting includes 8 hrs / year et kjentification and modification,Il per rormed on line.

Resolution of Prob!sms/ Issues.

At time of Resident inspectors will select an actkity based on its uccurrence, if 24 hrs / yr importance to risk, and complexity. Use the RIM 2 W plant high risk and Resident Slatt specific information has not yet been developed.

performed on Itne On site inspection by either the residerd or regional based inspector for configuration and post mod test review of ongoing modifications will require an additionaf 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />.

I M O Piping System None Refueling 16 hrs / yr 16 hrs / refuenng review / observation; 8 hrs / refuenng High energy and high risk system X ErosiorVCorrosion kfentification and Resolution of ProblemsMssues. Performed by piping breaks are relativety low risk regional spectatist. Select sample from both the erosion and the but an actuallaMure may result in a corrosion program. significant event, or high Conditional Core Damage ProbabiNttes.

1 M 0 Post Maintenance Testing None Monthry 72 brs / yr Selection should tocus on high risk components. RfM2 should inadequate PMT could result in X

be used if plant spectftc Information has not yet been developed unreallied inoperabilliy of Select an average of two per month. Hours based on review of 2 equipment for extended periods of ,

risk significant actktties / month, and 3 hrs / actkity. time, and could impact any risk based planning tools ability to model plant risk. TNs could result in high inspector should determine if scope of testing adequately risk situations when other covered the work pe formed, and final equ%wnent configuration. equipment is taken out of service.

I M O Refueting and Outage None Refusting 80 hrs / yr includes rev6ew of med loop ops for PWRs. Licensee's outage Shutdown risk wirl be high if vital 20 70 10 Related Activities risk assessment to guide inspectors to risk $Njntficant actNitMs. SSCs are not avanable. Due to Performed on outage basis, not annual inspection should focus polentially high numbers of outel-on At1R, Containment isolation durtng reduced water inventory, service SSCs dunng the refueang Muf loop (PWRs) operatlon, cool down/heatup/startup. period, configuration risk can be avaltatullty of altamate power sources / switchyard. and Refueang Ngh. Times of reducedinventory operations. Includes 30 hrs / refueling of Identificat6on and are the most critical.

Resokstion of Problems / tssues.

111- 1 1

Tcbla 1, Risk information Matrix No.1 (continued)

Cosussmstoms boerecimLE AmeA Faeouency 2 UN 7 Ptn Ltvet or Erront BASIS vran 1 M B Safety System Design and None thennial 120 tws1yr System selecton with input ham regional SRA. Select one or Funcekmoutyof high risk signskant X Portormance CapetWay  ;

two systems, de sveng on comptoney. Region based biennial SSCs are veruled,Inche3ng design i risk important syAm design review. 240 hrs r eceway. besse, support hecuans instensson. [

tesano. ._ _ -, j luncsons. Factore contribunng to risk reduction 4ncrease are vergned through vendoNon of the success crlierte.

I M B Survelpance Testing Safety System MontNy 48 tws Iyr I Select systems survelMonce that are performed on systems Provides indiceeon of system '

30 to Portormance ranked Ngh in importance in the tRe specinc risk study, or N not operebusy. Plant configuraWon and Indicators eveRoble, from RIM 2. Inspect en everage of 2 / monNL system restorsuon are importenL i Tolat inspection hours required were reduced because of the evadabilNy of a PL Assumes 2 risk signihcent activities per  ;

month of 4 hrs each. Includes 12 hrs / yser of Identmcation and Resolution of Problems / lssues.  !

f i

l M B Temporary Plant None As Required 28 hrst yr Screen for temporary modifications with reimavely high risk The modifications may result in e 90 10 ModificeNons }

configurations. RIM 2 should be used N plant specthe informellon departure from the design bests and  !

has not yet been developed. Includes 4 hrs 1 year of system success criterle, and con IdenpliceHon and ResoluWon of Problemstissues. result tri e conngurellon that may be en v. ; L_J safety concem. .

Temporary or unrecognized sisk I changes due to the modification t may evolve into high risk conNgurations t 5

I n

e.

t 5

m 111- 1 2 I i

l in,:I id i lii!!,

io t i,in ihI '

I11i iIll!!

}' ' .

l!I ll d  !

i} t il

j'lli}li ll d p i II ,1 -I 11

!!am! i'lli I

h OIfN,illgi I!

hielii l t

!kf i

gE liilidimi d i nil !b  !:lden E

m , c .

g c 1

1 1  ! 11 I ii I I

\ a

! I e 1 l 01 idy l 1 1

! I i 11 th l! 11 9

!I i !

'i l l a a i a i

. . 4 Tcble 1 Risk information Matrix No.1 (continued)

CoRusenstosse heerscTastsAREA Farauriscy 2. user een LEVEL OF EF:Vstt Bases Ytan SEC Response to Coriengency None Biennial 10412 yrs Conduct and Evolueto Secur#y Exercise. Three inspectors This is a high afsk-significant  !

Events (Protective Strategy includes onsNe inspection of Physical Protection as port of and implementemon at function necessary to protect  ;

exercise. Expert Judgement basis for hours. ogainst the design basis threat of ProtecWwe Stralogy) l radiologicalsabotage. The elsk ,

consequence to radiological  !

sabotsp 11 a successful attack did occur is f%

I References for Table 1. RIM No.1

1. Chung, J.W., Travis, R., etc., " Generic Risk insights for Westinghouse and Combustion Engineering Pressurized Water Reactor", I Brookhaven National Laboratory, NUREG/CR-5637

2. Chung, J.W., Travis, R., etc., " Generic Risk insights for General Electric Boiling Water Reactors", Brookhaven National Laboratory, NUREG/CR-5692

3. Chung, J.W., Vesely W.E. Thadani, A.C.," Risk Management Strategies - Qualitative and Quantitative Approaches", presented in PSA'95

[

International Conference, Probabilistic Risk Assessment Methodology and Applications. t

4. Chung, J.W., Wong, S., Riley, J.E., " Risk Profile Methodology of Plant Configuration and Pilot Applications: Lessons Leamed", Draft NUREG-1605. l

5. " Individual Plant Examination Program: Perspectives on Reactor Safety and Plant Performance", NUREG-1560 '

l

6. " Preliminary Perspectives Gained from initial Individual Plant Examination of Extemal Events (IPEEE) Submittal Review, Draft NUREG.

7. Vesely, W.E.,"A Systematic Process For Risk-Prioritizing inspection Activities", presented to USNRC on December 8,1998, Contract Report.  !

8.  !

Vesely, W.E., and Davis, T.C.," Evaluations and Utilizations of Risk Importances", Battelle Columbus Laboratories. NUREG/CR-4377.  ;

9. Vesely, W.E., and etc.," Measures of Risk Importance and their Applications", NUREG/CR-3385  ;

I l'

lil-14 <

f t

Tcble 2 Risk Information Matrix No. 2: PWRs '

PWR fyetessie that were R44 knporteret et Asper Pfartte end Romeone for Importance Itot erlorttired urethin thle sortton of the TetWe important Cornerstones i s Reasons W W m

, initleting Mitigetton Barrier Events Systems i

Systems selected based on CDF contribution from NUREG-1560 f

r Offsite The loss of offsite power is an important initiator event, if lasting beyond 30 minutes. X X  !

Power loss of offsite power could occur as a result of adverse weather conditions, switch yard I activities, degraded grid, component failure, design inadequacy, or human error (e.g., '

when maintenance on part of system is being performed). Losses of offsite power due to t

adverse weather corxletions could be important since the harsh weather condition such i

as freezing could impact other mitigating systems. -

i

' Some losses of offsite power could be recovered by operator actions. Recovery of offsite  !

power fs shown to be important in PRAs.

Emergency Common cause failures of multiple emergency diesel generators has been a major risk X X AC concem. '

The unavailability of one diesel generator either due to failure or maintenance, combined with the failure of the other safety trains that are fed from the remaining emergency bus, have also been a major contributor to risk. Therefore, configuration control would be important dur'ng maintenance or emergent work on EDGs.

• Recovery of Emergency AC or EDGs in SBO sequences is important.

RCP Seals in the event of an SBO, the failure of RCP seals due to loss of seat cooling (CCW) and X X injection (charging system) would induce a LOCA. Maintaining or quickly recovering  !

cooling to the seals is important. '

RCP seal failures in Westinghouse pumps during normal operation could result in a small LOCA initiator. Such events have occurred in the past. Improper installation of seal cartridge, shaft eccentricity, and injection flow instabilities are some of the failure causes.

l i

l 111- 1 5 t i

t r

Table 2 Risk Infotmation Matrix No. 2: PWRs (continued) rwn sy wim w moe nn,e, e = an n n .no n n. v a_. ; i N.e erlottete.d selshin this portion of th. T.he.  !

Important Cornerstones Systems Reasons for importance

• Initiating Mitigation Barrier Events Systems ,

Systems selected based on CDF contribution from NUREG-1560 t DC Batteries The plant I&C and the turbine driven AFW are fed from DC buses. During SBO X X X scenarios, DC load shedding is important to extend battery depletion time. This provides more time for recovery of AC power in an SBO sequence. '

During normal operation total or partial loss of DC system could be a major risk contributor and in some piants could cause severe transients and loss of decay heat removal.

Low LPl/LPR system is important in LOCA sequences. A major concem in PWRs is the X X X Pressure failure of operators to property switch to the recirculation mode. In some plants this injection would be done automatically, therefore is of lesser concem. In an ice condenser (LPI) containment, the switch over could be more important due to shorter time period involved. i Another important issue related to the LPI system deals with a LOCA due to failure of l

high and low pressure interface. A series of interface check valves, isolate the RCS from the LPI system. Large back-leakages through a pair of these interface check valves  !

result in an interfacing ('V" sequence) LOCA. Three major concems are: the capability l to isolate through closure of MOVs (design) ,the survivability of the remaining intact train  !

(EO), and the operator actions.

t PORVs Feed and Bleed is the option of last resort in removing decay heat. Reliability of PORVs X X X l and block valves and the associated human actions for feed and bleed are important in i this mode of operation. Depending on the plant design, either one or both PORVs would be required for feed and bleed. Both PORVs and Block valves require either DC or AC [

power. Therefore, in loss of vital AC or loss of DC scenarios, the PORVs may not be i credited. In some plants, feed and bleed may not be possible due to the low head of safety injection pumps. Feed and bleed capability usually does not exist in CE plants. I In transients, the failure of PORV to re-close results in a LOCA scenario Spurious actuation of PORV due to fire is also reported in some fire PRAs.

i lll-16 i

r

Tcbla 2, Risk information Matrix No. 2: PWRs (continued)

Pwn s r wi.e w.r. ne.e an, raine eas een e..no n n. e.,1,.e, e.

N.4 _f.,.J- ^wittiin thi. porte.n of th. T.tel.

Important Systems Cornersh Reasons forimportance from lPEs initiating Mitigation Barrier Events Systems Systems selected based on CDF contribution from NUREG-1560 SGs SG atmospheric dump valves (ADVs) are important as a means of rapid heat removal X X X and an attemate way to depressurize the RCS during a small LOCA with loss of HPl. -

During transients, the ability to depressurize the SGs and the use of the condensate system for heat removalis quite important for CE plants, where the feed and bleed capability does not exist.

Flooding of steam generators after core daraage is an important accident management strategy which results in scrubbing of radionuclides and reducing the public health ellects.

SGTR is a failure of the RCS pressure boundary.a_nd is an important containment bypass mode for most PWRs.

RWST Important for LOCA mitigation. The size of the RWST and the appropriate maintenance X of the water level plays an important role in determining the time available for switch over to the re-circulation Phase. Means for replenishing the water in RWST are also important.

HPl/HPR '

The HPl/HPR system could be used as a mitigating system for LOCAs and as a means X

of cooling through feed and bleed during transients. During the injection phase, the common cause failures of injection discharge valves and multiple failures or combined failures and maintenance unavailabilities of the pumps are the major contributors. During the recirculation phase; the loss of pump cooling, human error associated with switch over, and containment sump clogging are the major contrit utors. )

l I

i i

1 111- 1 7 l ..

Tcble 2, Risk Information Matrix No. 2: PWRs (continued)

Pwn sr.e th. w ne.a an,we.ne.eas e re.ne..a4 n e.,no .ne.

Not ortorttfr.d within the. portion of th. T.tp.

Important Cwnwstones Systems Reasons forimportance

• initiating Mitigation Barrier Events Systems Systems selected based on CDF contribution from NUREG-1560 AFWEFW Important for decay heat removal on transients and sequences initiated by full or partial X loss of AC or DC power (e.g. SBO sequences). Initiation of AFW and providing an ~

extended source of water (for example from fire water) are considered important in PRAs.

AFWEFW could fail due to system interaction and common cause failures. Common cause failure (CCF) induced by steam binding as a result of leakage frorn main feed water through the AFW pump discharge check valves, which flashes to steam in AFW pump, is one example. Undetected flow diversion, for example thrcugh the cross connections, is another system failure scenario.

The turbine driven AFW pump could have large unavailability due to maintenance. Other contributors to failuro of AFW pumps are local failures of the steam admission line, and of the turbine driven pump.

Cross-ties Cross-ties between systems and units will provide more redundancy and therefore are X X important to plant safety. However, in some plants these cross connections have been shown to result in increased chance for diversion of flow, and increase in complexity of human actions.

Instrument The loss of instrument air could not only cause an initiating event such as MSIV closure, X X Air System but also could impact the operation of many mitigating systems including AFWS, PORVs, SG relief, and Boron injection. It is also important to note that in some plants loss of instrument air cnuld impact the HVAC system which is shown to be risk significant.

Service Dependency of plant systems on SW (both normal and emergency) is important. The X X X Water SW system is typically the heat sink for the CCW system, however there is some cooling capacity in CCW even if SW is lost. In addition to the systems cooled by CCW, loss of SW could affect AFW pumps (both motor- and turbine-driven), EDGs, and HVAC 1

systems.

lll-18

r i

Table 2 Risk Information Matrix No. 2: PWRs (continued)

}

rwn sym wi w mann,.mmmas.m,n en se ,.d feet snovasses witheri thee eerieen or the Tense important Cornerstones

Systems Reasons forimportance IPEs Initiating Mitigation Barrier  !

l Events Systems 5

Systems selected based on CDF contribution from NUREG-1560 i

CCW Loss of CCW is quite important in several PWRs. since it impacts several mitigating X X X systems and could cause LOCA, as a result of RCP sealleakage. Dependency of plant *

• systems on CCW is important. The CCW system is also dependent on support systems t

(AC power and SW). i Containment Containment isolation failures are important at many PWRs (e.g., large dry and sub- X X Isolation atmospheric containments). Early failure of containment prior to core damage or shortly after core damage could result in a LERF. j Failure of high/ low pressure interface valves is an important containment bypass mode (see the discussion under LPI). SGTR is another mechanism for containment bypass, however of lesser consequence, if the SG is filled with water (see the discussion under SG).

Coritainment The water in the sump after a LOCA is the main source for the recirculation phase of the X Sump ECCS. Sump clogging either due to pieces of broken thermal insulation around the primary pipes or from foreign materials left inside the containment during refueling (e.g.,

plastics) could be an important risk contributor. '

HVAC Loss of HVAC system in some areas such as switchgear rooms, could cause a loss of X X X System AC power. A major cause for loss of DC In some plants was loss of the DC equipment HVAC system. Among other ways, loss of HVAC could occur as a result of closure of fire dampers after a fire test. Availability of early detection systems, such as temperature alarms, would be important for the timely restoration of the HVAC. HVAC systems require support systems to operate. One support system of concern is the instrument air

system.

j lll-19

y Table 2, Risk Information Matrix No. 2: PWRs (continued)

Additional PWR ltems that Were Risk knportant af Afost Ptsofs and Reasons for importance important Cornerstones i Systems Reasons for importance i from IPEs initiating Mitigation Events Systems O I Additional Systems - Important based on high RAW (note 2)

RPS Reactor protection system for preventing ATWS (in some plants identified by RAW and X  !

some by FV). Failure of the reactor protection system results in ATWS scenarios that -

are considered important in somu plants. Failure of reactor protection system is 1 i

dominated by the CCF of the scram breakers and mechanical failure of the control rods. '

For plants with a diverse rod insertion system, high unavailability of the system is a l

secondary contributor.

Primary The failure of primary pipes including reactor vessel integrity is a low probability event X X  !

System with a high consequence, integrity L

Shutdown Risk insights Normal AC Loss of offsite power is an important initiator in shutdown risk. Duration of loss of offsite X '

Power power which is risk significant varies depending on the plant operational state and the "

decay heat. As an example, it could vary from 40 minutes for hot shutdown to as high as 1.5 hr for mid loop operation. Loss of offsite power frequency could be higher during shutdown because of surveillance and maintenance activities of electrical equipment, ,

switch yard, and potential degradation of the grid.

Emergency SBO is a dominant risk contributor during shutdown specially in mid-loop operation. X X AC Loss of emergency AC, with loss of offsite power, is considered as a major initiator to shutdown risk. '

RHR Loss of RHR during mid-loop operation is a primary contributor to shutdown risk. It is X X considered as one of the primary initiators during shutdown. '

RCS Introduction of weaknesses into RCS pressure boundary has been found to be a X X i Pressure potential problem. Possible weaknesses include thimble tube seals, steam generator Boundary nozzle dams, and freeze seals.

111- 2 0

Table 2, Risk Inform: tion Matrix No. 2: PWRs (continued)

Additional PWR ltems that Were Risk /mportant af Most Plants and Reasons for importance important Cwnerstones Systems Reasons for importance from IPEs InitiMN Mitiptim Events Systems Configuration An important issue in shutdown risk relates to shutdown configuration management and X X Management control. Utilities have used different methods for assuring the configuration control with varying degree of effectiveness. Some utilities have a minimum requirements list, which specifies equipment by function that should be available. Some other utilities have a -

comprehensive ORAM (Ou' age Risk Assessment and Management Plan). The adequacy of the methods used and the operator's understanding of plant configuration is shown to be important in shutdown.

111- 2 1

Valfe 2, Risk Information Matrix No. 2: PWRs (continued)

Additional PWR ltzma ttnt W;ra Rf;kimporf:nt ct Most Pl;nta and Raccons for import;nce Cornerstones Systems Reasons forimportance from iPEs Inttfating Mitigation Events Systems amer Shutdown Risklosights (continued)

Reactivity Reactivity accidents, mainly as a result of Boron dilution, are suspected to be major X Accidents contributors to risk. However, currently there is some uncertainty in this regard.

RCS The pressure relief capability when RHR is lost is important. Primary pressurization Pressure X X occurs as a result of thermal expansion of the coolant or steaming in the reactor vessel Relief on loss of RHR.

Level Inadvertent draining during mid-loop operation could occur either by human errors or by X X Instruments equipment failures. Reliable levelinstrumentations would help to prevent or detect for Mid-loop !aadvertent draining initiators.

Fire Protection insights Switchgear A fire in the emergency switchgear room in some plants could fail cabling for CCW and Room X X X HPI systems therefore causing an RCP seal LOCA. In other plants, this could result in the loss of tha ESW system, which fails the diesel generator (the only source for the AC power), therefore causing an SBO. The SBO scenario could become more severe upon loss of RCP seal cooling, inducing RCP seal LOCA.

Cable A fire in the cable spreading room in some plants could be a significant contribution to X X X Spreading risk. It would follow a scenario similar to that of control room fire.

Room Cable Vault A fire in cable vault and tunnel could fail cabling for CCW and HPl systems therefore and Tunnel X X X causing RCP seal LOCA and also damaging mitigating systems.

Control Room A fire in control room can force evacuation of control room and in some plants could X X X cause spurious actuation of PORVs with subsequent failure to re-close. It should be noted that once the control room is abandoned, there is typically no independent Indication of the PORV position.

Fire Protection insights (continued)

!!!-22 M

Table 2, Risk Information Matrix No. 2: PWRs (continued)

Additional PWR ltems that Were Risk knportant at Most Plants and Reasons for importance important Cwnestones Systems Reasons for importance from IPEs M MWah Events Systems BW Fire i The three general areas to address fire risk are: prevention, mitigation / suppression, and X X Protection safe shutdown capability. NUREG/CR-4230 found that the following fire protection Systems system features were the most important to risk: qualified cables, rated barriers, automatic suppression, and automatic doors and dampers.

Internal Flooding insights Buildings with The type of equipment, layout, elevation, adjacency to the water sources and their X X X Potential for piping are major consideration in identifying the buildings that are susceptible to flooding Flooding and could contribute to plant risk. This issue requires plant specific treatreent.

Sources of The IPEs have identified the following sources of intemal flooding: Circulating water X X X Flood system, Fire water system, Service water system, Component cooling water system, Auxiliary feed water system, Main feed water system, and intake structure.

i Human Actions Restoration in scenarios involving loss of HVAC system, the room cooling can be re-established X X X of Room either by recovery of HVAC or opening doors and utilizing portable fans.

l Cooling i t

Establishing in LOCA scenarios the switching of ECCS lines from injection to recirculation is done X I Recirculation manually. Failure to do so or human error involving valve alignment is important.

Feed and Failure of the operator to initiate and perform the feed and bleed operation as a last X Bleed resort of heat removal. '

Water Supply Use of water pumps to traMer water, from other sources of make up to the CST, is X for AFW considered important in scenarios when long term cooling through SG is needed.

r i

Human Actions (continued)

~

1 i

, 111- 2 3 I i

Tabla 2, Risk Informttion Matrix No. 2: PWRs (continued) l Additional PWR ltems that Were Risk important at Afost Plants and Reasons for importance Important Cetones Systems Reasons for importance from IPEs M MW

• Events Systems Extending the in SBO scenarios, the operator could extend the duration of the availability of DC by X Battery load management to assure the availability of turbine driven AFW pump and the ,

Curation necessary instrumentation and control. This human action is considered important in most PRAs. -

l i Recovery of Some losses of AC power could be recovered by either manual transfer of the source of X X  :

Emergency power, or recovery of onsite normal / emergency AC power. This recovery action is l AC or Offsite considered risk significant in many PRAs.

Power Shutdown Almost all actions, including actuation of various equipment, would be done manually X X X Operation during shutdown. The operator's understanding of the plant configuration is necessary for the successful manual actions.

lil-24 i

m Table 2, Risk Information Matrix No. 2: PWRs (continued)

PWR ltems that Were Potenflallyimportant and Reasons for importance Not orlorltized within this portion of the Table important Sy s Cornerstones Reasons for importance Initiating Mitigation Barrier Events Systems Systems selected based on inclusion in several plants in the IPE Data Base Boron Boron injection is a necessary action during ATWS scenarios. In some CE plants Boron X Injection injection was also required during some SGTRs when the fast cooling of the secondary System through ADVs occurs. In some plants Boron injection valves are integral part of charging and high pressure injection lineup. Depending on plant specific design, the major concerns are: failure to manually actuate the boron injection, failure of a single MOV to open, and (of a lesser concem) the boron precipitation.

DC System Total or partialloss of the DC system could cause severe transients and affect the X X X operation of the mitigating systems, including loss of decay heat removal. The impact of partialloss of DC varies significantly among plants.

Vital AC Total or partialloss of the vital AC system could cause severe transients and affect the System X X X operation of the mitigating systems. The impact of partialloss of vital AC varies from plant to plant.

Containment in some PWRS loss of CHR leads to early over-pressurization of containment and its

Heat X X tailure in LOCA scenarios. If this occurs prior to core damage,it would result in flashing Removal of waterin the containment sump and loss of ECCS in recirculation phase, which could (CHR) result in core damage at a later time. Loss of CHR could also result in late containment failure after core damage has occurred.

MSIVs MSIVs are relied on to isolate during a steam line break, and SGTR. Spurious closure of X X MSIVs causes transients with loss of PCS. Failure of MSIV to perform the above l i

functions has been a major contributor in some plants.

Primary PSRVs are relled on in ATWS scenarios to open and limit the peak primary pressure X X Sately Relief early in the scenarios. Set point drift is not of concern but rather the failure of the valve to l Valve open is considered important.

1 111- 2 5 l

Table 2. Risk Information Matrin No. 2: PWRs (continued)

PWR ltems that Were Potenttatty!mportant and Reasons for importance Not prioritized within this portion of the Table important ys s Cornerstones p Reasons for km 's S Initiating Mitigation Barrier Events Systems Systems selected based on inclusion in several plants in the IPE Data Base (continued)

Condensato As a source of water to the AFWS, CST failure could be significant in some plants. In Storage , X some plants the means to replenish water to the CST, using fire water, is considered as Tank an important risk reduction strategy.

Human Actions Make up to In some W3-toop plants, credit is given for make up to the RWST.

RWST X Recovery of in some plants there are means of attemale cooling for RCP seals that could be relied on X X RCP Seal in scenarios involving loss of CCW. However, the alignment of the system is manual and Cooling requires operator action.

ATWS Upon failure of RPS, the operator should perform several actions, starting with manual Response X X scram, ensuring turbine trip, and most importantly initiating boron injec'.;on.

Isolation of in some plants there is a capability to isolate an interfacing systems LOCA through X X ISLOCA manual actions. Operator failure to isolate on interfacing LOCA in the LPI system is considered risk significant in these plants.

Initiation of This human action involves failure to manually start the motor driven AFW pump, given X AFWS auto start failure, and failure to manually start locked out turbine driven AFW pump.

Notes for Table 2. RIM No. 2 PWRs:

3.

The Systems listed as Risk Important at Most Plants were derived from NUREG-1560, " Individual Plant Examination Program: Perspectives on Reactor Safety and Plant Performance", listed as: Important for most PWRs in Table 3.9; or related to those containment performance perspectives of Table 4.9 listed as having significant probability for most BWRs.

111- 2 6

Table 2, Risk Information Matrin No. 2: PWRs (continued) 4.

Contains this Table. those systems generically determined to have high Risk Achievement Worth (RAW > 10), that were not contained in th 5.

Table developed to provide generic PWR risk insights for use in the development of a generic Risk-informed baseline inspection 6.

PWR Systems that Were Potentiallyimportant were extracted from the IPE Database, when they appeared in the top ten sequence several plants. PWR Human actions that Were Potentially Important were extracted from NUREG-1560 Table 5.3, when they occu more than two plants (but less then 50% of the plants).

I 111- 2 7

Table 2, Risk inform tion Matrix No. 2: BWRs .

CWR Systems that Were Risk.t ,--i.rW af Albst Pfants and Reasons for importance Not erloritized within this nortion of the Table important Systems Cornerstones Reasons for importance From Ms initiating Mitigation Barrier Events Systems Systems selected tissed on CDF contribution from NUREG-1560 Offsite AC Power The loss of offsite power is an important initiator event, if lasting beyond 30 minutes. X X Loss of offsite power could occur as a result of adverse weather conditions, switch yard activities, degraded grid, component failure, design inadequacy, or human error (e.g., when maintenance on part of system is being performed) Losses of offsite power due to adverse weather conditions could be important since the harsh weather condition such as freezing could impact other mitigating systems. AC system design and maintenance contribute to the overall reliability of the system (including both offsite and onsite AC power). Features important include: Number of offsite lines, design of switch yard, cross-tie capability, availability and reliability of equipment.

Some losses of offsite power could be recovered by operator actions. Recovery of offsite power is shown to be imp <sttant in PRAs.

Onsite Emergency CO,T.,ven cause failures of multiple emergency diesel generators has been a major X AC Power risk concem.

The unavailability of one diesel generator either due to failure or maintenance, combined wM the failure of the other safety trains that are fed from the remaining emergency bus, have also been a major contributor to risk. Therefore, configuration control would be important during maintenance or emergent work on EDGs.

Recovery of Emergency AC or EDGs in SBO sequences is important.

e lil-28 l

Table 2, Risk Information Matrix No. 2: BWRs (continued)

BWR Systems that Were Risk important at Most Plants and Reasons for importance Not Drlorltl2ed within this Dortion of the Table important Cwnerstones Systems Reasons for importance From IPEs initiating Mitigation Barrier Events Systems Systems selected based on CDF contribution from NUREG-1560 HPCI Used to p ovide injection and remove Decay Heat (DH) from the core on an SBO. X Availability and Redundancy of High Pressure injection Systems (HDCl & RCIC) is important to Transients with Loss of injection Sequences On a transient with loss of DHR, two issues are: NPSH Problems with ECCS in the Suppression Pool; and the Capability of the ECCS to Pump Saturated Water.

Mitigating system redundancy can be impacted by harsh environments in containment (before cont. failure).

On a transient with loss of DHR, resulting in containment failure, Mitigating system redundancy (for Systems Located Outside of Containment and Rx Bldg) can be impacted as a result of harsh envircnments in adjacent structures (after cont.

failure).

RCIC Used to provide injection and remove Decay Heat (DH) from the core on an SBO. X Availability and Redundancy of.High Pressure injection Systems (HPCI & RCIC) is important to Transients with Loss of injection Sequences.

On a transient with loss of DHR, two issues are NPSH Problems with ECCS in the Suppression Pool; and the Capability of the ECCS to Pump Saturated Water.

Mitigating system redundancy can be impacted by harsh environmen+s in containment (before cont. failure).

On a transient with loss of Decay Heat removal (DHR), resulting in containment tailure, Mitigating system redundancy (for Systems Located Outside of Containment j and Rx Bldg) can be impacted as a result of harsh environments in adjacent structures (after containment failure).

Ill-29

Table 2, Risk Informrtion Matrix No. 2: BWRs (continued)

BWR Systems that Were Risklmportant at Most Plants and Reasons for importance Not prioritized within this portion of the Table important Cornerstones Systems Reasons for importance From IPEs initiating Mitigation Barrier Events Systems Systems selected based on CDF contribution from NUREG-1560 HVAC for HPCI & Loss of HVAC may cause common mode failure of HPCI & RCIC. X RCIC Diesel-Driven Used to provide injection and remove DH from the core on an SBO. Use of firewater X Firewater requires significant planning and training, but is credited in several plants.

Isolation Used to remove Decay Heat (DH) from the core on an SBO. A larger IC capacity X Condenser (IC) provides more time before makeup to IC is required and allows more time for operators to recover AC power. The ability of the IC to remove CH is defeated if an RV (Relief Valve) sticks open.

DC Batteries DC power is required for operation of the AC independent systems (e.g., IC, HPCI, X RCIC, and ADS or SRVs). Battery depletion times typically range from 2 to 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br />. Load shedding is important to extend depletion time. This provides more time for recovery of AC power.

Failures of support equipment, such as DC power can fail the EDGs. 4 DC Buses Loss of De buses is an important initiator since it can cause reactor trip and X X compromise the operation of the mitigating systems.

Service Water Failures of support equipment, such as SW can fail the EDGs. X Failure of EDGs due to loss of SW is an important contributor to SBO. SW design is very unit specific.

e T

lll-30

r Tcbb 2, Risk Inform: tion Matrix No. 2: BWRs (continued)

BWR Systems that Were Risk important at Most Plants and Reasons for importance Not Drlorltized within this Dortion of the Table important Cornerstones Systems Reasons for importance From IPEs initiating Mitigation Barrier Events Systems Systems selected based on CDF contribution from NUREG-1560 l

Automatic The ability of the IC to remove DH (e.g., on an SBO) is defeated if a RV sticks ope.i. X Depressurization System and Relief Failure to Depressurize is important on Transients with Loss of Injection Sequences. .

Valves (ADS /RVs) Many plant procedures direct operators to inhibit ADS on transients. When high '

pressure injection falls, operators must manually depressurize with ADS.

On selected sequences such as SBO, depressurization is required after failure of high pressure injection systems to allow for injection with low pressure systems. A '

complicating factor is that some procedures initially direct the operator to inhibit ADS. In some PRAs this appears in cutsets up to 45 % of CDF.

Excessive SRV discharge to a hot suppression pool is found to lead to late containment failure.

MSIVs inadvertent MSIV closure is an important initiator in BWRs. Failure of MSIV to close X in steam line break scenarios could result in LOCA outside containment. i i

Common Support injection System and DHR system dependencies on Support Systems Defeats X Systems for Redundancy. Support system (cooling water, Inst. Air, and AC or DC power) injection and DHR failures can impact multiple mitigating systems. t l Systems L

i lll-31 j l

Tcble 2. Risk information Matrix No. 2: BWRs (continued) .

BWR Systems that Were Risk Important af Afost Plants and Reasons for importance Not prioritized within this portion of the Table Important Cornerstones Systems Reasons for importance From IPEs Initiating Mitigation Barrier Events Systems Systems selected based on CDF contribution from NUREG-1560 Decay Heat An important class of sequences is Transients with Loss of DHR. In these X X Removal (DHR) sequences, coolant injection succeeds but DHR fails and RVs open, sending steam to SP. Many licensees made Mods to DHR systems and improvements to ensure continued system operation under harsh environment conditions.

Some PRAs had Limited Analysis to Support DHR Success Criteria: No Credit was taken in Some Plants for Attemale DHR Systems (e.g., Venting). Some plants had higher contribution from these transients due to not crediting all attemate DHR systems. Also, not all plants treated the results of harsh environments the same.

On a transient with loss af DHR, two issues are NPS!! Problems with ECCS in the Suppression Pool; and the Capability of the ECCS to Pump Saturated Water.

Mitigating system redundancy can be impacted by harsh environments in containment (before cont. failure).

On a transient with loss of DHR, resulting in containment failure, Mitigating system redundancy (for Systems Located Outside of Containment and Rx Oldg) can be impacted as a result of harsh environments in adjacent structures (after containment failure).

Containment Heat Failure of CHR systems is important to Transients with Loss of DHR sequences. X X Rer", oval (CHR) rystems/ Drywell less Restrictive Drywell Spray Ir.~tlation Criteria are important since high pressure Spray loads at time of core debris melt ~.'hrough of Reactor vessel and Fuel Coolant Interaction are important contri'onors to early containment failure.

Ill-32

Tcble 2, Risk Information Matrix No. 2: BWRs (continued)

BWR Systems that Were RiskImportant at Afost Plants and Reasons for importance Not erloritized within this portion of the Table i

=  ;

W ant Cornerstones F

Systems Reasons for importance From IPEs gg, gygg ,g g,g Events Systems  ;

Systems selected based on CDF contribution from NUREG-1560 '

Containment Operator Training on Depressurization of Containment is important since high Venting X X ,

t pressure loads at time of core debris melt- through of RV & FCI are important contributors to early cont. failure. i Venting is found to be an effective means of avoiding uncontrolled containment i failure for Mark I and ill containments in core damage events.

t Feedwater Loss of feed water is an important initiator in some BWRs. ,

X i Availability and Redundancy of High Pressure injection Systems is important to Transients with Loss of injection Sequences f' Suppression Pool On a transient or LOCA sequence, with failure of the PCS and the SRVs open, X X  !

(SP) Cooling containment temperature and pressure increase and must be controlled. This can  ;

be done by containtrent heat removal, suppression pool cooling. or containment '

venting. Actions are required to remove DH before adverse conditions are reached  ?

(e.g., hi SP temperature leaoing to loss of ECCS pumps). '

~

Altemative Water Ensuring the Drywell Floor is Flooded in Core Damage Event is important to prevent X i Sources for late containment failure since High pressure and temperature loads caused by CCI Flooding of are an important failure mode. ,

Drywell Floor  !

Combustible Gas i Hydrogen bums are an important contributor to early containment failures Mark Ill X '

Control /lgniters in IPEs. i Containment of I Mark til BWRs Combustible gas bums are important in Mark llis to prevent late containment failure. I r

b lil-33 .,

i

Tcbla 2 Risk Inform; tion Matrix No. 2: BWRs (continued)

Additional BWR ltems that Were Risk knportarrt at Afost Plarers and Reasons for Importance l t

important Cornerstones i Es Initiating Mitigation Barrier Events Systems Additional Systems -Important based on high RAW (note 2) i RPS/CRDMs Failure of the RPS could result in ATWS scenarios which is important risk contributor X in some BWRs.

t 4160 V Failure or unavailability of 4160 V switchgear could result in loss of offsite power and X X switchgear compromise the operation of mitigating systems.  !

t Shutdown Risk insights BWR shutdown risk insights to be determined later.

Fire Protection insights Fires in BWRs are relatively important to Total CDF. Fires in the following areas are typically important: X X control room, cable spreading room, and various switchgear rooms. The actual fire areas or rooms that are important are plant specific and are identified in the plant IPEEEs or PRAs.

The three general areas to address fire risk are: prevention, mitigation / suppression, and safe shutdown. X  !

NUREG/CR-4230 found that the following fire protection system features were the most important to risk:

qualified cabling,3-hour fire barriers, automatic suppression systems, and automatic doors & dampers.  !

Internal Flooding Insights intemal flooding sequences are not dominant contributors to CDF in most BWRs. These events involve X X rupture of water lines or operator errors that result in the release of water that can cause the failure of required mitigating systems through: loss of cooling, submergence or spraying. The most important factor is the plant-specific layout. Separation and compartmentalization reduce the impact of internal flooding. For BWRs, no floods were identified that could fail 31! necessary mitigating systems.

A few BWR plants identified important sequences that generally involve Service Water System breaks X X that impact equipment both through loss of SW cooling and flood-related impacts on other mitigating systems (such as electrical switchgear).

n 111- 3 4 i

t Tabla 2, Risk Information Matrix No. 2: BWRs (continued) i Additional BWR ltems that Were Risk knportant af Most Plants and Reasons for importance hWW Cornerstones . ,

Systems Reasons forimportance from IPEs initiating Mitigation Barrier Events Systems  !

t Internal Flooding Insights (continued) l t

Risk significant improvements at some plants were: periodic inspection of susceptible piping to reduce X X  !

potential of flooding, enhancement of flood response procedures, and training for flooding, including i

isolation of flood source. L Human Actions I Perform Manual On selected sequences, depressurization is required after failure of high pressure X Depressurization }

injection systen;s to allow for injection with low pressure systems. A complicating factor is that some procedures initially direct the operator to inhibit ADS. In some i PRAs this appears in cutsets up to 45 % of CDF. [

Containment On a transient or LOCA sequence, with failure of the PCS and the SRVs open, X X  !

Venting containment temperature and pressure increase and must be controlled. This can be i i

done by comalnment heat removal, suppression pool cooling, or containment Align venting. Actions are required to remove DH before adverse conditions are reached Containment or (e.g., hi SP temperature leading to loss of ECCS pumps).

Suppression i

Pool Cooling '

i Initiate SLC Manualinitiation of Standby Liquid Control (SLC) system is needed ATWS X Scenarios.

lil-35

. ~

Tabla 2, Risk informition Matrix No. 2: BWRs (continued)

BWR ltems that Were Potentia 11yimportant and Reasons for importance Not prioritized within this portion of the Table important Cornerstones Items Reasons for importance From IPEs initiating Mitigation Barrier Events Systems Systems selected based on inclusion in several plants in the IPE Data Base Loss of LOlA was important as an initiating event in a number of IPEs. X instrument ,

air (LOIA)

LPI The high redundancy and diversity of coolant injection systems in BWRs lowers the X  :

importance of LOCAs. However, they do still appear as contributors to the total CDF.

i The LPI System is an important mitigator for large and medium LOCAs, One key aspect of the LPI system is the proper functioning of the low reactor vessel pressure permissive.

Core Spray The high redundancy and diversity of coolant injection systems in BWRs lowers the X (CS) importance of LOCAs. However, they do still appear as contributors to the total CDF. ,

CS is used as one of the injection systems for LOCAs.

Standby i important for the injection of boron during ATWS events. X l Liquid Control Attemate Failure of the ARI system appears as contributor to ATWS sequences in many plants.

X j Rod '

Insertion (ARI) i

)

I 111- 3 6 8

Table 2. Risk Information Matrix No. 2: BWRs (continued)

BWR ltems that Were Potenflaflyimportant and Reasons for importance Not Drlorttired within this portion of the Table important erstones items Reasons for importance From IPEs Initiating Mitigation Barrier Events Systems Human Actions l Level Control Effective Rx Vessellevel controlis needed during an ATWS in order to reduce core in ATWS power. X X Align / Initiate This relates to loss of injection and loss of DHR sequences. Alternate sources of Attemative X injection include: SW, firewater, CRD, FW booster pumps, SP cleanup, and a few plant injection unique systems.

Recover The importance of recovery of SW or the ultimate heat sink depends on the cooling X Ultimate requirements of mitigating systems and the time available before they fail af ter loss of Heat Sink cooling. Recovery is also needed to allow adequate removal of DH from the core.

Some of these are possible just from the main CR, while others require local operator actions.

Inhibit ADS Some IPEs conclude that core damage will occur if ADS is not inhibited in an ATWS X X event due to Instabilities created at low pressures.

Mis-calibrate Various pressure switches are important for initiating ECCS and operating ECCS Pressure X permissives. Common cause mis-calibration of these switches can affect multiple trains Switches of safety systems.

Initiate l For the early BWR plants, this action is important during accidents to ensure the isolation X continued viability of the cooling from the IC.

Condenser Control FW The actions of operators to properly control the FW system can be important in transient Events (e.g., X X and small LOCA sequences.

After Loss-of-Instrument Air) 111- 3 7

Tcble 2, Risk information Matrix No. 2: BWRs (continued)  !

BWR ltems that Were Potentiettyimportant and Reasons for importance Not orlorltized within this portion of the Table hWant Cornerstones '

Items Reasons forimportance From IPEs initiating Mitigation Barrier Events Systems i Human Actions (continued)

Manually Where these low pressure injection systems fail to automatically actuate, then operator i X

Initiate Core action to manually initiate them becomes necessary.  !

Spray or Other Low- i Pressure System '

Mis-calibrate This is mis-calibration of the permissives needed to open the low pressure core spray \

Low- X and LPCI injection valves, which are needed in several sequences. Also included is the '

Pressure failure to restore these permissives after testing.

Core Spray Permissive -

Provide On transient sequences, loss of HVAC (due to various reasons) can jeopardize ECCS X Allemate equipment operation. The operators may be able to take actions to provide attemate i Room room cooling, such as opening doors and providing blowers. '

Cooling (In

• Event of '

Loss of HVAC)  !

Recover This action relates to operator recovery of failed or unavailable 8njection systems and Injection X l can be important in sequences where such failures are dominant, Systems i" DC Load While not well modeled, the shedding of DC loads is needed to extend the battery Shedding X  ;

charge in order to operate the AC independent HPCI and RCIC systems and to keep the After SBO SRVs open (to allow low pressure vessel injection from a diesel-driven fire pump). This

, extends the time to core damage and that operators have for recovery of AC.

111- 3 8 t

___ _____m ., , , , . , _ _ _ _ _ _ _ _ _ _ _ _ _ , _ _ . . . . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ . _ _ _ _ . _ _ _ _ . - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ . _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

____7____,

Table 2, Risk Information Matrix No. 2 Notes for Table 2. RIM No. 2. BWRs 2.

The Systems listed as Risk Imponent at Most Plants were derived from NUREG-1560," Individual Plant Examination Program: Perspectives -

on Reactor Safety and Plant Performance," listed as: Important for most BWRs in Table 3.2; or related to those containment performance perspectives of Table 4.2 listed as having significant probability for most BWRs.

3.

Contains those systems generically determined to have high Risk Achievement Worth (RAW > 10), that were not contained in the first part of this Table.

4. BWR Systems that Were Potentially Important were extracted from the IPE Database, when they appeared in the top ten sequences o'f several plants. BWR Human actions that Were Potentially Important were extracted from NUREG-1560 Table 5.1, when they were identified as important in more than two plants (but less then 50% of the plants).

5. Table developed to provide generic BWR risk insights for use in the development of a generic Risk-informed baseline inspection program.

1 lil-39

_ . _ . . _ - . _ _ _ . _ _ _ _ m ___._ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _____.___._____...__.______.__.____-- _.-_. -. ________ . _ _ _ _ . _ _ _

1 1

a l )

l l

l l

l I

DETAILED DISCUSSION OF THE PROPOSED ASSESSMENT PROCESS IMPROVEMENTS i

l Team Leader Michael Johnson Team Members John Flack Tim Frye David Gamberoni Bob Haag Don Hickman Bill Jones Alan Madison Glenn Meyer Chris Miller Bob Pascarelli Bill Reckley Mark Satorious I

i l

l I

Attachment 4

. I I

l EXECUTIVE

SUMMARY

i A multi-disciplined, interoffice task group was formed to continue developing assessment process improvements that were initiated under the Integrated Review of Assessment Processes (IRAP) effort. The efforts described in this attachment focus on the design of a new l performance assessment process within the structure of regulatory oversight described in Attachment 2 to this Commission paper. The assessment task group included representatives from each regional oftice and the Offices of Nuclear Reactor Regulation (NRR), Analysis and Evaluation of Operational Data (AEOD) Enforcement, and Nuclear Reactor Research.

The charter of the assessment task group was to develop a process that will allow the NRC to integrate various information sources relevant to licensee safety performance, make objective conclusions regarding their significance, take actions based on these conclusions in a predictable manner, and effectively communicate these results to the licensees and to the public. The efforts of the assessment task group were closely coordinated with the framework, inspection, and enforcement efforts, which are also described in this Commis'sion paper.

Several key principles were identified that have a direct affect on the assessment process l design:

e Both performance indicators (Pis) and inspection results will be inputs to the assessment l process e

Performance indicators and comerstone inspection areas (groups of inspection results by comerstone area) will have established thresholds e

Crossing thresholds will have similar meaning and result in the NRC considering a similar range of actions A four level review system, shown in Table 3.1, was developed that provides continuous (Level 1), quarterly (Level 2), semi-annual (Level 3), and annual (Level 4) reviews of licensee performance data (Pis and inspection results). The system is designed such that the lower level reviews (Level 1/ Level 2), which are performed for all plants, are informal reviews of performance data, and the review activities are not resource intensive. The mid level review (Level 3) is more formal and is focused on assessing performance to determine appropriate NRC and licensee actions. The Mid-Cycle Level 3 review generates an inspection planning letter. The End-of-Cycle Level 3 review generates both an assessment report and an inspection planning letter. The highest level of review (Level 4) is recerved for plants requiring consideration of agency-wide actions. This review is analogous to the current Senior Management Meeting (SMM); however, the focus has been changed from an assessment '

activity to an oversight and agency action approval function.

An action matrix, shown in Table 3.2, was developed to provide guidance for consistent consideration of actions. The actions are graded across five ranges oflicensee performance in all four response categories (management meeting, licensee action, NRC inspection, and regulatory actions) and in terms of annual communication of assessment results. Action decisions are triggered directly from the threshold assessments of Pls and inspection areas.

} i i

e

- - - -, + , w, , - . . - -

l For example, a single Pl or inspection area crossing its threshold would require the NRC to t

consider the actions listed in the second performance range of the action matrix (such as regional initiative inspection to determine the cause of the assessment input degradation). More '

l i

significant changes in performance, such as one degraded comerstone would result in the '

consideration of more significant actions (such as inspection focused on the cause of degradation).

i The action matrix is not intended to be excessively rigid. It establishes expectations for interactions, licensee actions, and NRC actions. It does not preclude additional action (or less action), when justified.

l Communication of assessment results involves quarterly updates of assessment data, semi-l annualinspection planning letters, and annual assessment reports. The Commission has l negative consent approval of all assessment results and NRC actions prior to an annual Commission meeting. All assessment results are released at the Commission meeting to provide proper balance and context. This differs from the current SMM, which focuses primarily on poor performers.

i l

l l

i l

1 l

ii

CONTENTS Page i Executive Summary i 1- Introduction 1

1.1 Background 1 1.2 NRC Integrated Assessment Process 3 1.3 NEl Risk-informed, Performance-based Assessment Process 3

1.4 New Performance Assessment Process 5 1.5 Follow-on Efforts . 6 1.6 The Assessment Task Group 7 2 Defining Principles and Definitions 10 3 The New Performance Assessment Process 12 3.1 Review Mechanisms 12 3.2 Conducting the Assessment 16 3.3 Taking Action 18 3.4 Verifying Action Completion 23 4 Process Evaluation 24 4.1 initial Benchmarking 24 4.2 Steady-state Evaluation 24 Tables Page Table 3.1 Review mechanisms for the new performance 13 assessment process.

Table 3.2 Action matrix. ig Table 3.3 Assessment report critical sections. 22 Table 4.1 Success criteria for the assessment process. 27 i

i i lii

1 INTRODUCTION 1.1. Background l The individual components of the current Nuclear Regulatory Commission's (NRC) assessment processes for operating commercial nuclear reactors were developed and implemented at different times. The systematic assessment of licensee performance (SALP), was being l developed before the Three Mile Island accident and was implemented in 1980. It was intended

! to provide a systematic, long-term, integrated evaluation of overall licensee performance.

l The senior management meeting (SMM), was developed in response to the 1985 Davis Besse l loss-of-feedwater event and was first implemented in 1986. It was developed to bring to the attention of the highest levels of NRC management those plants where operational safety performance was of most concem.

Plant performance reviev's (PPRs), were developed to provide for better allocation of NRC i

resources and were implemented in 1988. PPRs are conducted more frequently than SALPs or l SMMs and were developed to provide mid-course adjustments in inspection focus in response l to changes in licensee performance and emerging plant issues.

The plant issues matrix (PIM) provides an index of the primary issues, generated through inspection findings and licensee event reports (LERs), that are evaluated during the SALP, SMM, and PPR processes. It was developed as part of the effort to improve the integration of inspection findings following the South Texas Lessons Leamed Task Force, and was implemented in 1996.

Each process served a specific purpose and the individual processes were improved incrementally since implementation. However, the manner in which the NRC assesses the safety performance of its licensed nuclear utilities has become a matter of concem both within the NRC itself and by industry and stakeholders. The following weaknesses were identified:

. Many of the process components are redundant and have similar end products.

. The assessment criteria differ between process components, especially SALP and the SMM, and are not viewed as sufficiently objective.

. The processes are subject to inconsistent implementation among the regions.

The processes are more resource-intensive than originally intended, particularly when the safety-significance of the results obtained is considered.

In summer,1997, the Commission approved the staff's request to perform an integrated review of the processes used to assess licensee performance. This approval and previous staff j requirements memoranda provided severalissues to be addressed in this review, including that l any assessment process developed as a result of staff efforts:

1 i . Have clear roles and responsi'o ilities (including for the Commission)

! . Maintain data integrity (which implies that the process not distort the data and that

! there be precision in the data; data may be weighted, but weightings must be known j and consistent) 4 1

i l

a 1

r___ _ . _ _ _ _ _ _ _ _ _ _ . _ ._ _ ._ _. _ . _ _ _

l l

l

-+

Include a decision model/ criteria

+ identify risk significance

• Be simple /non-redundant / efficient Be complete (which implies that all relevant information be included)

Be well integrated (that is, both the process itself be well integrated, and information inputs and output be integrated) j

• . Include a self-assessment process (to evaluate its own effectiveness)

Be objective (but not necessarily quantitative)

• Be consistent l

• Be timely i e Be validated 1

Include performance ratings (for both good and poor performance) '

. Be predictive (and reduce reliance on events)

Be scrutable (be open, clear, and transparent; include public involvement) -

Initial efforts to perform the integrated review commenced in September 1997, with the Integrated Review of Assessment Processes (IRAP). Preliminary results from the IRAP were forwarded to the Commission in March 1998 via SECY 98-045, " Status of the Integrated Review of the NRC Assessment Process for Operating Commercial Nuclear Reactors." These results are summarized below in section 1.2. While the NRC was performing the IRAP, the Nuclear

! Energy institute (NEI) developed an attemative proposal for regulatory oversight (including assessment). The Commission subsequently approved the staff soliciting public comments on both the IRAP preliminary results and on other potential changes to the assessment processes.

Ongoing public interactions between the NRC staff, the Advisory Committee on Reactor Safety, l the Commission, and industry caused the staff to broaden its review of assessment to oversight l l

in general (inspection, assessment, and enforcement). This resulted in a change in direction from that proposed t y IRAP to one within a new regulatory structure that is described in Attachment 2 of this Commission paper that includes "comerstones" of safety performance.

The new approach resulted from the confluence of the two proposals generated by the NRC staff and industry (NEI), respectively, aimed at addressing the problems with the current l processes. The assessment process proposed by the NRC staff, called the integrated l

assessment process (IAP), would have used inspection findings as its primary data source and would have provided a mechanism for checking the inspection-based assessment results against other data sources, such as industry performance indicators (Pis), the trending l methodology developed by the NRC's Office for the Analysis and Evaluation of Operational Data I

(AEOD), and licensee-generated self assessment data. In contrast, the NEl proposal would have used a performance-based model that relied primarily on licensee-generated Pl data and required minimal NRC involvement dess a performance threshold was crossed. Each of these proposals is briefly described below.

Initial development of the new regulatory oversight structure occurred during a public workshop that was held on September 28 through October 1,1998. Tiie results of that workshop were a general acceptance of the framework concept, modifications and additions to the approach, and high-level development of the framework.

1 2

-. - . _ - .- _ - -. _ _ . - - - ~ ~ _ _ . _ . . --

1 j The following subsections briefly describe the IAP, the NEl proposal, and the new assessment process. Section 3 of this attachment describes the processes by which the assessment will be j conducted.

1.2. NRC integrated Assessment Process The IRAP involved NRC regional and headquarters (HQ) staff, and used a principle-based

approach (i.e., starting with objectives and attributes, then designing processes to achieve them) to evaluate existing processes and design new ones, where necessary. The IRAP proposed j

that the inspection program would continue to observe licensee performance and document j those observations in inspection reports. Performance issues would be entered into the PIM i and would be assigned a significance rating and template category tag. The template would be l a tool for sorting inspection issues and includes both functional and cross-functional categories.

j Functional categories include: operational performance, material condition, engineerir@esign, t

and plant support. Cross-functional categories include: human performance, problerr, identification and resolution, and programs and process. Each PIM entry wcu!d be binned into 1

both a functional and cross-functional category.

The graded PIM entries would be aggregated by template category, and numerical thresholds j would be used to produce an assessment rating for each template category.

! The performance of every plant would be assessed annually, at a regic al meeting. This j meeting would allow for the review of, and reconciliation between, the iplate assessment and i other indicators. A decision logic model would be applied to the asse sent results to I

determine the range of NRC actions that should be considered as wr" is the appropriate i communication methods. NRC actions would be taken in a graded ap, oach, with different levels of NRC management responsible for the action, depending upon licensee performance.

l Assessment results would be issued in writing to both the licensee and the public and would be

reviewed with the licensee at a public meeting; again, NRC (and licensee) participation in the i

public meeting would be graded bassd upon the assessment results.

I 4

l This proposal focused on actions and proposed elimination of labels such as watchlist and J superior performer plants.

) 1.3. NEl Risk-informed, Performance based Assessment Process The NEl approach would use the existing regulatory requirements (primarily 10 Code of Federal Regulations (CFR) Parts 50 and 100) as a basis for setting licensee performance expectations that relate to public health and safety. For assessment purposes, these performance expectations would be grouped into three tiers:

l, j

• Tier I: Public health and safety - maintaining the barriers for radionuclide release, and j controlling radiation exposure and radioactive materials.

Tier 11: Safety performance margin - minimizing operational events that could challenge the barriers and ensuring that engineered safety systems can perform their intended safety functions.

3

- - - _ . . ~ . - . - - -.- - -. - - - .. --. . - . - - - . . - - .

a i

I

• Tier 111: Overall plant performance - plant safety performance trends are used as leading indicators for problems that might develop in the Tier il performance areas.

Each performance expectation would have a set of Pls that would be used to evaluate the achievement of the expectation. For Tier I, the performance expectation of barrier integrity would be evaluated using three Pis: reactor coolant system (RCS) activity (level of fission products), RCS boundary (leakage rate from primary boundary), and containment integrity. The performance expectation of control of exposure and radioactive materials would also have three Pls: emergency preparedness, radioactive material control (release and shipment of radioactive materials), and exposure control (for both workers and the public).

For Tier 11, the performance expectation related to operating challenges would be monitored using four Pis: unplanned automatic scrams, safety system actuation, shutdown operating margins, and unplanned operating transients. The performance expectation related to mitigation capability would be assessed on the basis of high risk-significant structures, systems, and components performance.

Tier lil would be monitored using an index of plant safety, which would be trended to show the direction overall safety performance could be headed.

I With the exception of the Tier ill trending indicators, allindicators would have an objective regulator threshold and a safety threshold value. The regulator threshold defines the level of performance at which the safety performance margin has declined to a point where regulatory attention may be warranted. The safety threshold defines the level of performance at which the  ;

safety performance margin has declined to a point where plant operation is not permitted until '

corrective action is taken to restore margin.

The thresholds, in tum, define three response bands: a utility response band, a regulator response band, and an unacceptable band. If performance is within the utility response band, utility management would maintain performance within the control band; the NRC would perform baseline inspections or opt to evaluate / participate in licensee self-assessments and audits, particularly in those areas not covered by the safety performance indicators, and monitor the Pls.

The regulator response band defines the point at which the regulatory response increases to questioning the adequacy of licensee corrective actions and programs and processes related to the performance area for which the band has been crossed. The degree of regulator response would be determined by how close performance is to the unacceptable band. Performance far from the unacceptable band threshold would receive minimal regulatory action while performance closer to the unacceptable band would receive more aggressive action, such as increased inspection, confirmatory action letters (CALs), and civil penalties (cps).

The unacceptable band defines the point at which plant operation is no lenger allowed until corrective action is taken.

The licensees and the NRC would have different, but complementary, roles in this assessment approach. The NRC would first assess results, by verifying the Pls and reviewing inspections 4

and corrective actions. Based on the assessment results, the NRC would develop and implement inspection plans with the scope of those plans being defined by the response bands, as described above. Similarly, the NRC would take regulatory action as indicated by the response band. The licensee would monitor and report on the Pls; inform the NRC of its self-assessment and audit plans and make the results of self-assessments and audits available to the NRC prior to planned inspections; and perform root cause analysis, identify corrective action, and report the status of corrective actions to the NRC prior to NRC regulatory actions.

1.4. New Perfonnance Assessment Process The new regulatory oversight framework is a hierarchical structure that begins with a focus on the NRC's overall safety mission and identifies strategic areas in which performance must be maintained for the overall safety mission to be achieved. Each strategic performance area, in l tum, has a set of comerstones (areas) that support the strategic performance area. The comerstones comprise those major essential elements, the presence of which provide reasonable confidence that licensee performance is such that goals are achieved. Performance must be maintained in the comerstone areas to achieve the Agency strategic performance area goals and to meet the overall safety mission. It is important to note that other regulatory processes, such as licensing activities, also contribute toward meeting these goals.

Pts and inspection provide the data to assess performance. Decision thresholds are used to determine the regulatory action warranted by licensee performance. The new regulatory oversight framework and its development are discussed in detail in Attachment 2 to this Commission paper.

Within the framework, each comerstone has an underlying structure comprising its desired results, attnbutes important to achieving those results, areas to measure, and means of measurement. Several characteristics of that structure are important to the subsequent discussions.

First, the measurement methods for each comerstone comprise a mix of PI data and a comerstone inspection area (IA). While there was a preference for identifying Pls for each cornerstone, it was recognized that there are gaps in the information provided by objective Pl data. Therefore, complete assurance of licensee performance in a particular comerstone area may require examining both P1 and inspection data.

In addition, in much the same way as was proposed by NEl, it is expected that each Pl and IA will have thresholds or bands which determine when regulator response is triggered.

Finally, it is important to note that the workshop resulted in a set of defining principles or boundary conditions to guide more detailed development of the framework and the processes for implementing it. These defining principles inc!ude:

There will be a risk-informed baseline inspection program (RIBIP) that establishes the minimum regulatory interaction for alllicensees RIBIP will cover those risk-significant attributes of licensee performance not adequately covered by Pis 5

l RIBIP will also verify the adequacy of the Pls and provide for event response

+

Pls supplemented with some inspection will form the rebuttable presumption for licensee l

assessment If risk-significant inspection findings and other information sources indicate that the PI results do not accurately portray licensee safety performance, the findings and information may be used to develop a " compelling case" to overtum the indicator results l Thresholds can be set for licensee safety performance, below which increased NRC

interaction (including enforcement) would be warranted

~

l Enforcement actions taken (e.g., number of cited violations, amount of CP) should not be an input into the assessment process. However, the issue that resulted in the i enforcement action will continue to be an input to assessment Assessment process results might be used to modulate enforcement actions (although i

assessment results would not affect the assessment of severity of the violation) 1.5. Follow-on Efforts The NRC staff formed four task activities: the technical framework group, the inspection group, i the assessment group, and enforcement. This attachment documents the results of the l

assessment task group. Task force members comprised a broad spectrum of NRC staff with expertise in assessment, including representatives from the Office of Nuclear Reactor Regulation (NRR), AEOD, Office of Research, Office of Enforcement (OE), Office of the Executive Director for Operations (EDO), and the regions, in addition, numerous regularly scheduled public working meetings were held to solicit timely feedback on the work of the NRC

staff. A public meeting that focused specifically on the assessment team's efforts was held on November 12,1998. Conclusions of that meeting have been incorporated into this attachment.

Key interfaces with the other task groups are discussed below.

1.5.1. Technical framework group. The technical framework group was charged with completing the development of the new regulatory oversight structure, including identifying l comerstones, and specifying in detail all Pls and inspection bases needed to provide a representative sample of performance in each comerstone, as well as thresholds forjudging l each piece of assessment data.

The assessment group communicated several key assumptions to the technical framework group, including that:

e to the extent possible, redundancy in the Pls and cornerstone IAs used within the framework should be minimized; to the extent that a Pl is used multiple times in the framework, it will also be used multiple times in the assessment e

, the meaning of the thresholds for all Pls and cornerstone IAs should be similar - that is, it will take an approximately equivalent change in risk or performance to cross into the I 6 y

_ _ _ _ _ _ _ _ _ _ _ _ . . . _ _ _ _ _ ~ . _ . _ _ _ _ . _ _ _ . . _ . . . . _ _ _ . _ _ . _ . _ - _

regulator response threshold 1.5.2. Inspection group. The inspection group (as discussed in Attachment 3 to this Commission paper) was charged with defining the scope of the RIBIP.

j Methods will be developed such that each inspection finding entered into the PIM is tagged with a code indicating to which comerstone lA or Pl it applies (depending on whether it is primary data source being used to fill a gap in the comerstone sampling data or whether it is being used to verify a Pl), its risk significance (using guidance provided in an inspection finding risk matrix),

and context for the finding. In addition, in much the same vein as the technical framework group is providing thresholds for PI data, the inspection group will provide thresholds for those IAs '

being used as primary data sources for sampling performance in a comerstone.

1.6. The Assessment Task Group The purpose of the assessment task force was to develop the process which will allow the NRC i

to integrate various information sources relevant to licensee safety performance, make objective conclusions regarding their significance, take actions based on these conclusions in a predictable manner, and effectively communicate these results to the licensees and to the pubiic. This task group also developed recommendations on the best methods to transition from the existing regulatory oversight processes and implement the proposed new oversight process.

The scope of this effort was limited to operating power reactors, and does not include, for example, permanently shutdown or decommissioned reactors or fuel fabrication or material licensees.

l IRREE l Key tasks for the assessment task group included:

i Developing a methodology for the integration of information inputs (Pl results as well as risk-significant inspection findings and other information sources) so that the assessment results are objective and transparent Developing decision criteria or a decision model so that NRC actions can be taken in a manner that is scrutable and predictable by both the licensees and the public e

identifying the necessary program requirements to support a voluntary licensee assessment data reporting process and developing a recommendation on how those licensees who do not participate in a voluntary program would be accounted for and assessed Determining methods for communicating to both licensees and the public the assessment results and NRC actions taken; evaluating the appropriateness of taking a

, graded approach to communications

, Determining how licensee performance in response to NRC actions is monitored and 7

1 measured and how the results feed back into the assessment process Developing the assessment process mechanisms, including determining the appropriate frequency for routine assessment of licensee performance; identifying the appropriate i

staff positions for conducting the assessment and determining their responsibilities; i

determining the level of senior NRC management involvement required for the '

performance assessments; and developing a process for handling changes in the assessment input' results as they occur so that appropriate action is not reliant on the performance of a periodic assessment Developing a methodology for the continuous self-assessment of program effectiveness subsequent to implementation 1

e Developing a recommendation for implementing the new process, including the necessary actions required to validate the new process prior to implementation and whether implementation should occur via a phased-in approach for alllicensees or a pilot l program with targeted or voluntary participation Determining appropriate methods to transition from the current assessment processes to the new approach, including providing a recommendation regarding the continued l suspension of SALP e

Interfacing with OE to develop concepts of how assessment results affect enforcement actions and how " regulatory significance"is defined and used in the oversight process Acoroach Because the IRAP effort began by developing a high-level assessment process, its results provide a generic framework for assessment. Briefly, the process steps suggested by IRAP are arranged into three sub-processes and include:

e process development and evaluation, comprising those activities related to 1) developing a decision model by which assessments are performed,2) providing guidance regarding information collection needs, and 3) conducting an evaluation of the assessment process to effect process improvements; the first two of these are intended to only occur once in their full elaboration e

core assessment, which comprises 1) conducting the assessment and deciding on a course of action using the decision model, and 2) communicating and implementing the necessary course of action, and e

on-going evaluation, which is an on-going checking of the reasonableness of the i

{ 1 " Assessment input

• is used as a generic term which encompasses all data used in j assuring performance within a comerstone, and includes both Pls and cornerstone IAs.

i i

8 f

3 i

i

assessment resuMs and the decisions made as a consequence of those results.

Thus the assessment team adopted the IRAP process representation as a starting point for its work, recognizing that many of the details may not apply to the new regulatory oversight framework.

This attachment focuses on the core assessment sut>-process and the process evaluation l portion of the process development and evaluation sub-process. The decision model and l implementation guidance are discussed in the context of where and how they are applied in the l process. Because Pls and inspection findings are used together in the assessment approach, the group determined that an elaoorate evaluation that brings in other data to contradict assessment results is not needed.

I l

l 1

I 9

r l

l

I l

2 DEFINING PRINCIPLES AND DEFINITIONS By the conclusion of the workshop, thoughts about the new regulatory oversight framework had progressed in directions that challenged some of the defining principles stated initially. Further i

work on the framework, inspection program, and assessment process provided additional l clarification on the defining principles. A modified set of defining principles, which reflect the conceptual changes to the assessment process, are provided below.

Defining principles that remained unchanged following the workshop include:

l e l There will be a risk-informed baseline inspection (RIBIP) program that establishes the minimum regulatory interaction for all licensees e j RIBIP wil; cover those risk-significant attributes of licensee performance not '

adequately covered by Pls RIBIP will ala,o verifehe adequacy of the Pls and provide for event response Thresholds can be set for licensee safety performance, below which increased NRC interaction (including enforcement) would be warranted l Enforcement actions taken (e.g., number of cited violations, amount of CP) should not be an input into the assessment process. However, the issue that resulted in the enforcement action will continue to be an input to assessment Assessment process results might be used to modulate enforcement actions (although assessment results would not affect the assessment of severity of the violation)

Further thought about the statements regarding RIBIP covering risk-significant attributes of licensee performance not adequately covered by Pls and verifying the adequacy of the Pls has lead to a modification in the current understanding of " compelling case" compared to how that term was used in the original set of defining principles. Two additional principles represent this change:

Adequate assurance oflicensee performance requires assessment of both Pls and cornerstone lAs; Pls and comerstone IAs deemed necessary for assessment can have equalimportance in the assessment based on the risk significance of the performance issues A " compelling case" to overtum (de-emphasize) P1 results may be made when inspections aimed at verifying the adequacy of the licensee's collection and reporting of Pls indicate significant weaknesses or when the licensee fails to report Pls The principle related to thresholds has been expanded to reflect more detailed understanding of h0w thresholds will be used in the new process:

e Both the Pls and the comerstone lAs will have established thresholds, risk-informed, where possible 10

-. - _ - - - - . . . - .. - _-- _ . - .--- ~_- . . - - . . - - - - . . -.-.-

Crossing of a PI threshold and a comerstone lA threshold will have similar meaning with respect to safety significance; said another way, Pl and comerstone IA thresholds will be approximately equalin terms of their risk significance, where possible An action-level will be set for unacceptable performance Three thresholds are envisioned for the data inputs, the:

e licensee response band, in which performance does not require NRC engagement, also called the " green" band in the NEl proposal; e

regulator response band, in which performance concems prompt NRC engagement, in which the NRC would consider taking actions but in which action may default to the licensee with NRC oversight, also called the " white" band in the NEl proposal; e

required regulator response band, in which performance concems prompt NRC action, also called the " yellow" band.

In addition, there is a safety goal for the plant as a whole, which indicates unacceptable performance that requires an order to suspend, modify, or revoke licensed operations.

I l

1 l

11

I 3 THE NEW PERFORMANCE ASSESSMENT PROCESS The assessment process is continuous, in which data from Pls, inspections, and other sources (such as licensee self-assessments) are mpplied for each plant and reviewed by NRC staff at the appropriate level. Periodically, this process is aggregated into more formal reviews which increase in level over a defined (annual) assessment cycle.

The assessment process has four main functions:

collecting and integrating the data for each plant and comparing the data to predefined standards of performance to determine the level of performance achieved by a particular plant, e taking action, which includes determining appropriate NRC actions based on a predefined logic model for the performance level achieved and obtaining NRC approval for the actions, e communicating assessment and action determination results to NRC and licensee officials and to the public, e verifying action completion, which includes ensuring that required licensee actions have been completed and have corrected the safety concem.

Raw performance data is updated based on licensee submittal of Pl data and branch chief (BC) submittal of PIM data. This data should be widely available to the licensee, public, and NRC staff throughout the assessment cycle. This availability will allow licensees and rnernbers of the public to view and comment on performance information on a continuous basis, and minimize the occurrence of surprises in the assessment process.

Further details regarding conducting the assessment, taking action, and verifying action completion are described in sections 3.2 through 3.4, respectively. The review processes for conducting these steps are described in section 3.1 below.

3.1. Review Mechanisms NRC staff reviews of the raw and integrated data take place on four different levels and frequencies: Level 1 reviews are performed by inspectors, Level 2 by the Divisions of Reactor Projects' (DRP) BCs in the regions, Level 3 by regional management (division directors [DDs]

and regional administrators (ras]), and Level 4 at the agency level. These levels are described in tabular form in Table 3.1 and in narrative form in the sub-sections below.

3.1.1. Level 1. A Level i review is conducted continuously by inspection staff. This is an informal ongoing activity. Resident and region based inspectors and various staff analysts will use the data to track performance in particular areas. Routine meetings held by the senior resident inspector (SRI) with the resident inspector (RI) staff can be used to perform this review.

No formal assessment or communication to the licensee or public is expected.

12

4 j

Table 3.1. Review mechanisms for the new performance assessment process.

i Level of Frequency / Partic! pants Desired Communication Review Timing Outcome

(* indicates lead) j Level 1 Continuous SRI b, regional Performance None required inspectors, analysts awareness Level 2 Once per DRP; BC', PE, SRI, input / verify Updated data set l quarter / RI Pl/PIM data, l Two weeks after detect ear 1y end of quarter trends Level 3 Semi-annually / Divisions of Reactor Detect trends, Six month inspection

Mid-Cycle Three weeks Safety (DRS) or DRP plan look ahead letter j after end of DD*, DRP and DRS inspection for second quarter BCs six months End-of- Annually / DRS or DRP DD*, Assessment Six month inspection j Cycle Four weeks NRR representative, of plant look ahead letter i after end of BCs, princip., performance, j assessment inspectors,OE,01, approve /

i cycle other HQ offices as coordinate appropriate regional actions Level 4 Annually / DIR NRR*, ras, Approvel Commission briefing, Two weeks after DRS/DRP DDs, coordinate assessment letter, Level 3 end-of- AEOD, DISP, OE, 01, agency including NRC cycle other HQ offices as actions actions, and public appropriate meeting 3.1.2. Level 2. A Level 2 review is conducted quarterly by the DRP BC who has oversight responsibility for the facility, using branch resources. This is an informal data gathering and assessment activity, the primary purpose of which is to verify the accuracy of the quarterly data before releasing it to the public. It is triggered by the receipt of new data, which industry representatives have indicated could be made available to the NRC within approximately 15 days of the end of each quarter.

If significant changes in performance were identified, Level 2 reviews could be used to trigger significant sction. Typically, only small changes in the assessment inputs would be expected.

Event follow-up is triggered separate from the :.r.usment process and results are factored in as are any other inspection results. Communication to the licensee and public of Level 2 assessment results is not expected except as guided by the action matrix shown in Table 3.2.

Public release of the quarterly update of the Pl and inspection data is the outcome of this review.

13 e

1 4

J i 3.1.3. Level 3. A Level 3 review is conducted semi-annually by the region for each plant for 4

which it has oversight responsibility. The Level 3 review consists of an inspection planning review at the mid-point of the assessment cycle and a comprehensive end-of-cycle assessment.

j lt is expected that a rolling one-year window will be established for data inclusion, with l

} information being provided regarding the age of the data (i.e., date of last update).

1

] 3.1.3.1. Mid cycle Level 3. The mid-cycle Level 3 review is similar to the current regional

resource planning meeting (plant performance review), and uses the data compiled during the previous 12 months. Level 3 mid-cycle reviews are used primarily to plan and assign inspection activities. Performance changes in the assessment inputs may be apparent, and may lead to  !

the assignment of inspection activities beyond the RIBIP, as directed by the action matrix.

[

2 The mid-cycle review meeting will be chaired by a DRP or Divisions of Reactor Safety (DRS) DD or deputy DD, and will be staffed by members of the DRP and DRS branches responsible for

directing inspection resources. RA involvement would not normally be required for the mid-cycle i Level 3 raview, except as directed by the action matrix for significant changes in performance.

l The mid-cycle review will be held at approximately the six month point in the annual aswssment l

l cycle (within three weeks of the end of the second quarter).

The deliverable from the mid-cycle review is a letter to the licensee which details planned

inspection activities for the next six months and indicates the reason for planned inspections outside the normal baseline inspections, if any.

9, l 3.1.3.2. End-of cycle Level 3. The end-of-cycle Level 3 review is intended to be the annual

] comprehensive review of plant performance. It is similar in scope to the current SMM screening meetings. The purpose of the end-of-cycle review is to conduct a comprehensive assessment of licensee performance using all Pl and PIM data and to plan inspection activities for the next j six months. The BC will be responsible for providing the briefing package for this meeting. The briefing package willinclude, for each plant, the threshold assessment and supporting data for each assessment input, a summary of the area; of concem, and an overall assessment of whether licensee performance is acceptable or unacceptable. It will also include a recommended action level, with justification as to how the recommendation was arrived at (i.e.,

an explanation that ties the recommendation to the decision logic model or action matrix).

The end-of-cycle review meeting will be chaired by DRP or DRS DD or deputy DD. A senior manager from DRP, DRS, and NRR will attend along with the DRP BC and inspectors and BCs with oversight of significant inspections at the site throughout the cycle and the Office of Investigation and OE. The primary role of the HQ participants will be to provide perspective and ensure consistency in application of the process across regions and to ensure that assessment actions are consistent with other agency actions. Note that, because Pl and comerstone IA results are publicly available, all stakeholders have the opportunity to review the assessment data prior to the end-of-cycle review meeting, and can express concems at any time during the process. The results of the review will be presented to the RA for final approval. An inspection planning meeting with appropriate BC attendance may be conducted during or following the end-of-cycle review to determine the resources and schedules for inspections required during the next cycle.

14

Results of the assessment will be compared to the action matrix to determine appropriate actions to consider. Major changes requiring agency level action approval will be addressed as required in the action matrix, and will be forwardeo for Level 4 review.

i The deliverable from the Level 3 end-of-cycle review is an assessment letter to the licensee. In addition to the Level 3 planning information (six month plan), areas of NRC concem and any agency-wide actions will be included, as needed. Level 3 results will also be communicated via a public meeting, with the required level of NRC and licensee involvement being determined by the assessment results, as described in the cetion matrix.

Plants needing additional review, as defined by the action matrix, will be forwarded to the Level 4 review. Assessment letters and public meetings for plants not requiring a Level 4 review will be held until after completion of the Level 4 process for all plants. Hence, Table 3.1 shows the assessment letters as a communication output from the Level 4 review, not the Level 3 End-of-Cycle review. A single Commission meeting will be held following the Level 4 review to gain Commission approval for the assessment results and planned actions from the Level 3 end-of-j cycle and Level 4 reviews.

3.1.4. Level 4. A Level 4 review is conducted annually by senior NRC managers, with chairmanship by the Director of NRR, for plants needing additional review as defined by the

action matrix. The review uses data compiled by the Level 2 and 3 reviews. Note that, because there are performance-based criteria that determine when a plant is subjected to LIrvel 4 review, i' the Level 4 review will not be held if no plants meet the criteria; in that case, the assessment cycle is concluded with the Level 3 end-of-cycle review. (The Commission briefing would still be held and assessment letters would still be issued).

}

' The Level 4 process involves a collegial review of Level 3 plants requiring additional oversight due to adverse performance, with senior regional management presenting assessment results and proposed NRC actions for selected plants. The review will take place shortly (approximately two weeks) after the end-of-cycle Level 3 review.

I j

The purpose of the Level 4 review is to ensure a coordinated, balanced, and consistent agency j response. Chough the Level 4 approval path is analogous to the SMM, it is different from the i SMM is several critical respects:

e

• essentially the same materials used by the BC at the Level 3 review (with necessary modifications barc.sd on the outcome of that meeting) will be used in the Level 4 review; this should sente to gready reduce the administrative burden of the current SMM, and Level 4 review is reserved for plants where performance degradation meets certain criteria; there is no review of superior performers - again, this should streamline the process and place emphasis on those areas requiring agency attention.

NRC actions will be based on the results of the Level 4 assessment and will be consistent with guidance in the action matrix. Results of the assessment for plants discussed in the Level 4 review will be provided to licensees in an assessment letter. Level 4 results will also be communicated via a public meeting, with the required level of NRC and licensee involvement 15

being determined by the assessment results, as described in the action matrix.

Communications for Level 3 and Level 4 reviews will be released concurrently.

3.1.5. Commission review. The EDO will give the Commission an annual briefing to convey the assessment results for allplants, with a focus on Level 4 review plants, if any. The Commission will have negative consent on all assessment results and NRC actions prior to their release. The Commission review should occur within eight weeks of the end of the assessment cycle.

3.2. Conducting the Assessment Conducting the assessment comprises two steps: organizing / compiling data and comparing grouped data to a standard. Notice that each of these steps is applied on a per plant basis.

That is, there is no provision for aggregating data across plants to compare one plant to another, provide for rankings, or even aggregate a list of all plants' assessments.

The organization and compilation of data implies that data serve as an input to the process.

Because the team made some assumptions about the form and content of that data, as well as some decisions as to how to act in cases where data are not submitted as expected, receiving data is shown below as a process step.

In general, the process steps related to conducting the assessment (section 3.2) and taking action (section 3.3) would only occur in the context of the end-of cycle Level 3 review unless a significant change was noted in the status of an assessment input, as described in the discussions of Level 2 and mid-cycle Level 3 reviews above.

3.2.1. Receiving data. For the process to work, licensees must use a standard format, provided by the NRC, to report raw data and a threshold assessment (according to pre-established criteria) for each Pl. These data will be reported quarterly, although it is acknowledged that some Pls may not change with that frequency. These data will be assumed to be valid unless RIBlP Pl verification inspections indicate otherwise, as described in section 3.2.2 below, if the licensee fails to provide required data or inspection suggests that the Pl data provided by the licensee is inadequate, the NRC will need to increase the scope of the RIBlP for that plant, thereby using inspection resources to collect data normally obtained through a Pl.

This response enables the NRC to obtain information necessary to assess performance in each of the comerstones, even in those instances where Pls are inadequately reported.

Similarly, inspection results will be documented using a standard format, an adaptation of the current PIM, for forwarding inspection findings to the assessment process. As is the current situation, inspection data will be updated at the completion of the resident inspection report interval, or at the frequency it is collected (such as for special inspections). The formally issued PIMs should be updated at least as often as Pls (quarterly), although, as with the Pls, some data will be collected less frequently. Each item contained in the PIM will be identified with a code indicating to which comerstone lA or PI it applies (depending on whether it is primary data source or is being used to verify a PI), its significance (using guidance provided in an inspection finding risk matrix), and context for the finding.

16

3.2.2. Organizing / compiling data. The new regulatory oversight framework provides the basic structure for organizing the data. Data will be group by comerstone using the Pl or comerstone lA identifier. Pls are assigned to comerstones by the framework team. An IA is also assigned to each comerstone with individualinspection findinge assigned to comerstones by PIM codes, as 4 discussed in section 3.2.1.

1 If RIBIP verification inspection findings verify a P1, assessment of the Pl continues as usual. If I inspection findings indicate a problem in collecting or reporting of the Pl data, the RIBIP scope will be increased to include the Pi area until such time as P1 adequacy is restored. A similar approach would be taken in cases where a licensee failed to report data.

The BC is responsible for this process step, although delegation to the PE or SRI with BC oversight is possible. Data are reviewed as they are received, but at least quarterly, in conjunction with the Level 2 review.

3.2.3. Comparing data to a standard. Changes in performance will be the determining factor in whether the regulator threshold has been crossed for each assessment input. Pis will have established thresholds (risk-informed, where possible) such that crossing into the white band will have one level of safety significance and crossing into the yellow band will have greater safety significance. The threshold values will be consistent wit L rAhough not directly mapped to, Regulatory Guide 1.174,"An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis,"where possible. See attachment 2 for a detailed discussion of threshold development efforts. l Similarly, each individualinspection finding will have a significance categorization to aid in determining if comerstone inspection area thresholds have been crossed. Individualinspection findings will be aggregated by comerstone inspection area. A group of low significance individualinspection findings (inspection observations, as defined below) alone would never be sufficient for crossing the yellow threshold in a comerstone IA. The following represents a potential categorization scheme:

. An inspection observation is defined as an NRC identified non-conformance with NRC requirements that has little or no safety significance. These items would be captured by licensee corrective action programs, e An inspection finding is defined as an NRC or licensee identified non-conformance that if uncorrected, would compromise the ability to meet the objective of the comerstone linked to the inspection area. Comerstone objectives could still be met pending completion of corrective actions with implementation of compensatory measures.

• A significant finding is defined as an NRC or licensee identified non-conformance that if uncorrected significantly challenges the ability to meet the comerstone objectives relative to public health and safety. Comerstone objectives can not be assured without completion of significant corrective actions.

This or an attemate categorization scheme will require further re',nement.

17

Potentialinspection area thresholds using this categorization scheme:

e Green-white threshold for an inspection area: 1 inspection finding or many inspection observations e

White-yellow threshold for an inspection area: 1 significant finding or 2-3 inspection findings Using this scheme, the NRC can engage when any assessment input (Pl or lA) crosses the green-white threshold. Declining performance on multiple inputs to a single comerstone or on the inputs to more than one comerstone can then be used to triggor more comprehensive NRC sction decisions, as described below in the action matrix.

3.3. Taking Action in this portion of the assessment process the assessment results are translated into an associated action level. The "taking action" component comprises three steps:

e applying a decision model to produce an action level, '

e seeking approval for the recommended assessment and action level, and a communicating the assessment and action.

Note that the action matrix is not intended to be excessively rigid. It establishes expectations for interaction, licensee action, NRC inspection, and regulatory action decisions. It does not preclude additional action (or less action), when justified.

3.3.1. Apply a decision model(or action matrix). The action level (from a range of possible actions) is determined by applying an action matrix as discussed below. This step is also performed by the branch chief, with oversight by the division director. Although it is expected that regions will use the action matrix to guide their actions in cases where crossing of a threshold is identified during Level 2 and mid-cycle Level 3 reviews of the data, formal application of the action matrix is required during the end-of-cycle Level 3 assessment.

Table 3.2 shows the action matrix, which details the correspondence between licensee performance and NRC action. Recall that " white"is used as a shorthand way of saying that performance has crossed into the regulator response band and " yellow" means that regulator response is required. The matrix also shows the communications for given performance / action 13vels.

l 18

Table 32. Action matrix LICENSEE PERFORMANCE INCREASING SAFETY SIGNIFICANCE >

g i$$ *hfhhh hksAederhent e AnhrkrYlhrIrba}bhih One DegradMe.d.ii.?N Eepe$thidMN fMR$dMNis$

M'k 8 inputs (Pis and %d,.k 99W6*6 Comerstone, Musiiple pt.c ( M ) Mads;s F

or Comerstone Comerstone (2 3Fi-d u) Nskj,.,.j{$5hd lGreert@$f'WM Inspection Areasi T inspection Area @.MT

@fMNN,h AssessmentIrd'iFh W Degcaded Comerstoiies PerformanceW??Md?

or Multiple'YellowiQfg(

White or1 AssessnEehlf  !*MJd-W i.$NiRM E ZF?.'ID

!EW.E.

$2 dQi;R input Yellow)'38'bi Assessment inputs'iby- We,ig sis @hjM5 u:y,%g WCQ7?r :%,3,5j .'.p yW<w 'npc-. cv.','h'.gW, g@t*G**- f.u- j$ @4@'$$

• 0 ?*.C

q.a?m 'Mr.

u v.~ mc>g

-. g w

,w;; y .

,. teT Q Vr.ppa,TpqN  ?!

d 1y..#;/N ?Mh'MM 'p~ F.EM.v.%n o4y:4 rSp @Jrtw.d  ;*. * .r;J.

w-.

y T- ..'%.p < ny d?p% 1R.k W ,;# sc;qJ4ya,%.

Wgg m.et %pA, 4 2.o Managerbeht % Routme Resident SRl/BC Meet with - DD/RA Meet with inspectorInteraction EDO Meet with Senior Commission meeting with Meeting jffcW4 Licensee Licensee Management Licensee Management

. :w g.M '

Senior Licensee

.- .....s Management Ucensee'Aclion Licensee Correcthre Licensee Corrective Licensee Self Licensee Performance .

bph $th.' Action Action with NRC Assessment with NRC Improvement Plan with :

W 9 OW %;S.M Oversight Oversight NRC Oversight u) .

..a ...

Z .NRC inspectiort Risk. Informed RegionalInitiative . Inspection Focused on Team inspection 4 k @('.Nh.J. ff Baseline inspection Inspechon Cause of Degradation Focused on Cause of! -

bn?.W.

u) Program w . . .

Overall Degre&*m r

[ Regulat Actions v( I None -Document Response to Degrading Area in

-Docket Response to -10 CFR 50.54(f) l.ette'r 7; Order to Modify Suspend, a W )d;.,f ,

.% inspechon Report Degradmg Condihon -cal) Order - 7.L j or Revoke Licensed

){y$ (ConsiderN+f (Cons #derN41} f j 4 Activities

-Remove P6tibrmance Inspechon for 2 Inspechon for2 ' ?'::

$..Gl'Y$.)

' - QQy '-

Mitigating Factorhorn ,

Enfau a.uu:

Consecutive Cycles in ConsectMve Cyclesin

• This Rwu) This Rw,0-)

l

'dssessn$mlN DD m DD review / sign ,,e -

RA review / sign assess.i. l.:v.. RA reviewisign '4 'JM RA review / sign 8 . Report -

ment report essessment report (w/ ; . assessment report (w/ assessment repori(w/M. assessment report (w/

Q +dJN;y"iQ

,49. Mh (w/ inspection plan) m Inspection plan) g v, . p inspection plan) inspechon plan) f .y e.il Inspechon plan) o * '- ng.CyMp..y >

.~..

E z7*

2 ..

g Public%  :

re SRI or Branch Chief SRI or Branch Chief RA Discuss

. f, o ' Assessmmsg; .

EDO Discuss , ., Commission Meeting with entg Meet with Licensee Meet with Ocensee

Performance with Performance with Senior Meetlng C 'a i Senior Licensee Licensee .' Management to Discuss R-.:IM.;If Licensee Management ;#

, Licensee Performance

! < Reukmal Rsie I W2.t .Mes Rc 'z >

19 J

~' ' ' '

~'K' ' ' ~

~ . . . . .. . . . . . . . . . . ..

1 Three characteristics of this matrix are worth noting:

(1) the list is organized to sho'w actions from lowest to highest " severity" with the implication that there is a maximum action that would typically be taken at a given level, but that there is latitude for selecting a less severe action, depending upon the circumstances; (2) there are overlaps in the actions possible for the various assessment outcomes, such that the most severe action for a more favorable outcome may be used as the least severe action for a less favorable outcome (for example, regional initiative inspection may be selected as the appropriate action for multiple white Pls within a cornerstone);

(3) unlike in the current assessment process, the revised assessment process includes the option for performance being unacceptable which results an order to modify, suspend, or revoke licensed activities as a maximum consequence.

As shown in Table 3.2, a combination of licensee action, NRC inspection,_ans! regulatory action could be invoked when performance in any assessment input crosses the regulator response threshold. A more detailed decision logic will underlie the action matrix, to guide decisions regarding which of the possible range of actions is most appropriate for the situation under evaluation. Note that feedback regarding licensees' failure to complete actions specified during the prior assessment period or licensees' having taken actions that were unsuccessfulin mitigating the concem is considered in making action determinations. Such cases may constitute cause for imposing more severe actions.

Principles to be embodied in the undertying logic include:

Licensee action to address degrading performance should be considered first The effectiveness of the licensee's corrective action and quality assurance programs will influence whether NRC action should be pursued NRC inspection beyond RIBIP will be performed in lieu of (or in addition to) licensee action if previous licensee actions have been ineffective in addressing degraoing

' performance, orif the effectiveness of the licensee's corrective action and quality assurance programs is in doubt e

issuance of a 10 CFR 50.54(f) letter is the first regulatory action to take in response to systemic degradation of licensee performance If the licensee response to the 50.54(f) letter is adequate, then mutually agreed upon performance metrics will be established for any licensee commitments Subsequent inspection planning meetings will determine actions necessary (e.g., NRC inspection, licensee self-assessment) to monitor the performance metrics so that licensee performance in addressing these commitments is ref'ected in future assessments 20

e inadequate licensee response to a 50.54(f) letter will result in the issuance of a CAL, specific order, or order to modify, suspend, or revoke licensed activities. Mutually agreed upon performance metrics wi!! be established for any licensee commitments made in the CAL or order. Subsequent inspection planning meetings will determine actions necessary (e.g., NRC inspection, licensee self-assessment) to monitor the performance metrics so that licensee performance in addressing these commitments is reflected in future assessments e

if licensee actions taken to correct a white assessment input have been ineffective, as evidenced by the input remaining white during the subsequent assessment cycle, the NRC may consider more significant actions When a plant is in an extended shutdown to address significant performance concems, the pl ant will be removed from the normal performance assessment process. NRC Inspection Manual Chapter (IMC) 0350 will be used to monitor plant activities. Once the IMC 0350 process has been closed out, the plant will be placed back in the normal assessment process.

Although existing regulatory vehicles were chosen for the regulatory actions, and many current actions were preserved, there are also noticeable differences from current practices. In particular, notice the absence of either a watch list or trending letter in either the action list or the needed communications discussed below. Direct recognition of " good performers" has also been eliminated, but balance is provided by communicating results for all plants, not just those g

that have problems. The action levels are graded based on licensee performance. As performance declines, the severity of actions increases.

Similarly, as shown in Table 3.2, communication with the licensee and with the public is graded.

Grading takes place both with respect to the level of the communication and the level of NRC staff involved in the interaction. In all cases, it is assumed that the report of the assessment results (with a cover letter and supporting data) as well as an updated inspection plan will be sent to the licensee and the public document room. Regional involvement in all communications is assumed.

3.3.2. Approve the recommended assessment and action level. This step, which would be executed by the RA (but could be graded based on the assessment), serves as a final check on the appropriateness of the assessment and action level recommended by the BC. It is intend d to ensure that:

e regional resources are sufficient to support the planned actions for all regional plants, and a

necessary interfaces have been conducted for actions that are outside the RA's independent sphere ofinfluence.

The approval mechanism will vary, based upon licensee performance, as described in the above discussion of the end-of-cycle Level 3 and Level 4 reviews. Plants not having either a ystlow assessment input or multiple white assessment inputs within a comerstone will generally receive no higher level NRC management review (i.e., will not be forwarded for Level 4 review).

21

.m__. _ _ . _ . . _

l t

l 3.3.3. Communicate the assessment and action. Both the assessment and the resultant i actions (with sufficient detail to understand how they were arrived at), will be communicated to the licensees, NRC management, the input providers (i.e., the inspectors), and the public in an assessment report. Both the level of communication and the responsibility for these communications is defined by the action matrix. In general, the BC or DD communicates assessment results for cases in which no assessment inputs have crossed the regulator response threshold, the RA would communicate the results where the regulator response threshold has been crossed for multiple assessment inputs within a comerstone, the EDO would communicate results related to the crossing of multiple assessment input thresholds in multiple comerstones, and the Commission would be involved in communicating results that indicate a plant is unacceptable for operation. Additional communication will be taken as govemed by the action matrix.

A standard assessment letter will be sent to alllicensees annually. In some cases, there may be a need for the licensee to respond in writing. A communication plan, will provide additional details on a standard assessment report format, will specify the allowable time frame for responses, and how responses will be handled. By way of example, however, the assessment report is expected to contain four critical sections as shown in Table 3.3.

Table 3.3. Assessment report critical sections.

1) an overall statement regarding plant Overall plant performance is acceptable.

performance

2) a statement of any areas of concem The NRC notes degraded performance in the initiating events area

3) an enumeration of any " tripped" as evidenced by the regulator threshold assessment inputs (Pls, IAs) having been crossed in PI XYZ (specific details would be given). No performance degradations were noted in other areas.

4) a statement of actions to be taken The NRC intends to conduct a regional initiative inspection focused on understanding the cause(s) of this degradation within the upcoming six month inspection cycle.

Further, should the plant have a violation while this or other Pls or IAs remain in the regulator response band, civil penalties will be considered.

3.3.4. Consideration of licensee feedback. As noted in the discussion of end-of-cycle Level 3 reviews, the fact that assessment inputs and their associated threshold determinations are publicly available, both the licensees and the public have an ongoing opportunity to provide comments on the data inputs to the assessment process, 22

l In addition, the licensee will be afforded the opportunity to comment on the actions to be taken.

The assessment report will forward proposed actions to address degrading licensee performance. Actions taken in response to events or unacceptable performance (e.g.,10 CFR

' 50.54(f) letters or CALs) will be taken expeditiously, outside and separate from this process, as needed. In routine circumstances, the licensee will be given 30 days from the date of assessment report issuance to respond to the assessment results and proposed actions.

i Licensee input (such as a licensee proposal to perform self assessment in lieu of NRC inspection) will be evaluated and final actions will be planned, communicated, and implemented.

3.4. Verifying Action Completion i As shown in the action matrix, most assessment outcomes will involve corrective action by the i licensee. Whether corrective action has been taken, and whether it has been successfulin correcting the safety issue that prompted the action, are important data points in determining NRC actions in subsequent assessments. Having the same assessment inputs persist in a state meriting regulatory engagement across assessment cycles warrants consideration of more severe actions, as shown in the action matrix.

l l The inspection program will provide the check on licensee actions. The inspection plan will be j used to formalize verification assignments to Ris and SRis, such that the Level 1 reviews provide statu !nformation on licensee completion of actions. Guidance regarding processes for verifying licensee actions will be developed. The BC will use that guidance to determine how and when completion of the actions by the licensee will be verified and will assign inspection resources accordingly.

l l

l l

l 23

1 l

4 PROCESS EVALUATION l l

Two types of evaluations of the new performance assessment process are planned. An initial benchmarking effort will be undertaken prior to and during the initialimplementation of the new l assessment process. Evaluations of the steady state performance of the process will occur  ;

periodically once the new assessment process is fully implemented. Each of these evaluation l types is discussed below.

l 4.1. Initial Benchmarking Although full details of the initial benchmarking cannot be determined until the plan for transitioning from the current to the planned process has been fully developed and approved, it l is expected that benchmarking of the assessment process will occur in several phases that track l to a phase-in period for the new process, including a:

r l benchmarking of the individual Pls (to be conducted by the framework team),

l test application, planned for early,1999, in which an initial trial of the workability of the l proposed process, including ability to reliably assign risk significance and assessment I

area information to individual PIM entries, evaluate assessment input, comerstone, and overall results, and reach conclusions related to actions to be taken that are consistent ,

with actions suggested by concurrently or historically available independent data, will be l conducted on a few plants, subject to the availability of the required assessment inputs, j pilot (partial) implementation evaluation, planned for summer-fall,1999, in which similar characteristics of the assessment process and results as detailed for the test application will be evaluated for a sub-set of plants taking place in a pilot or phased implementation, and

• fullimplementation evaluation, planned for summer,2001, in which similar characteristics of the assessment process and results as detailed for the test application will be evaluated for all plants.

The fullimplementation evaluation will represent a segue to the steady-state evaluation process, a.d willlikely involve considerations similar to those described in section 4.2, but is expected to be more comprehensive and formal than the steady state evaluations.

4.2. Steady-state Evaluation The steady state evaluation sub-process component comprises five main process steps, each of which is discussed in detail below:

• aggregation of outcomes,

• evaluation of process compliance,

• evaluation of results against independent data sources, i

e incorporation of process feedback, and

• objecti/es based evaluation of process.

4 24 a

~_ _

i .

Feedback from the steady-state evaluation may affect almost any component in the overall process, depending on what process step is seen as contributing to identified problems.

Feedback from this sub-process could also affect the inspection program, if inadequacies in that program were identified as causing assessment-related problems, as well as the enforcement program, if plants' enforcement histories were found to be systematically different than their assessment results, it is not intended that the steady-state evaluation would occur after every assessment cycle (except, perhaps, in the first year following complete implementation). Rather, it would occur with somewhat lower frequency- every two years is the recommended cycle. Or, it could be triggered by the presence of new information or priorities that might have an effect on the conduct of assessments.

Detailed devebpment of how the steady-state evaluation would be implemented has yet to be undertaken. Initial thinking regarding what would be accomplished at each step of the process is documented below.

4.2.1. Aggregation of outcomes. This step mainly implies a compilation of the results of the assessments conducted during the review cycle. The aggregation should result in the organization of data across several assessment cycles such that pattems that may not have been picked up in a single assessment cycle can emerge.

4.2.2. Evaluation of process compliance. This step is intended to communicate the need for examination of the documented assessments to determine whether there have been deviations from the process guidance in sufficient numbers to consider that there may be some systemic process flaw at the root of the deviations. Of particular interest are repeated overrides of the action matrix by the decision aethority, which may indicate that the action levels are inappropriate. Repeated requests for additional data needed to complete the assessment (such as additionalinspections or licensee self assessments), which may be indicative of problems in the data collection strategy, will also need to be evaluated.

4.2.3. Evaluation against independent data sources. Results of the assessma'1t. process will be compared to the results of other evaluations (including sources such as previous NRC assessments; accident sequence precursor analyses; enforcement histories; assessments conducted by other organizations; protests of results by licensees; and stakeholder assessments, such as that represented by public interest groups. One concem in performing comparisons with extemally provided data is the quality and currency of that data, so one might add the caveat that extemal comparisons would be performed as long as data quality could be verified and the same data had not be used in a previous steady-state evaluation.

l In cases where discrepancies are identified, an attempt will be made to understand the sources of the discrepancy. Causes could include: differences of opinion due to evaluation of different data; NRC assessments being of higher severity due to consequences of the licensee's failure to take action from previous assessments or to take unsuccessful actions; or NRC error. The latter is expected to be rare, and will not result in a retrospective adjustment to assessment results. It will, however, result in a requirement to examine the adequacy of the assessment 25

~

_ _._ _ _ _ =.;. - - ---

l inputs, the decision process model, and/or the implementing guidance to understand and correct i factors that may have led to the error.

( 4.2.4. Incorporation of process feedback. There are many stages throughout the overall assessment process at which stakeholder input is possible. For example, licensees may question the significance of inspection findings or assessment results; inspectors or licensees may indicate difficulties in providing (completing or reporting) required assessment inputs; or public comment regardin0 the scrutability or appropriateness of assessment resuns could be i

received as a result of public meetings to communicate findings, in this step, that input is l systematically evaluated for trends - especially cases where diverse stakeholders identify the j same process problems - and consideration is given to whether process changes are l warranted. In addition, there may be new information (such as new NRC priorities) that might be i considered with respect to its implications for process changes.

4.2.5. Objectives-based evaluation of process. Here, the process and all of the evaluations performed on it in the previous steps are compared to the process objectives and criteria to determine whether the process:

l l

• meets its stated objectives in its "as is" condition, and/or 1

! e could be expected to continue to meet (or resume meeting)its stated objectives were it modified consistent with recommendations obtained through either the evaluation of process compliance or the incorporation of process feedback (or both).

Tabic 4.1 below shows the objectives and criteria that were developed for the IAP, with changes to be consistent with the new performance assessment process. The table is provided as an example of the types of objectives and criteria that can be considered.

i I

l 26

Table 4.1. Success criteria for the assessment process.

Objective Being Measured Success criteria and Measurement Methods Simplicity /non- e Task analysis on new process shows not more than 10% non-redundancy /emciency compliance with activities as assigned per process diagram (by position or by the addition of tasks)

• Pre-post survey of NRC staff satisfaction shows statistically significant improvement Resource constraints (which also Level of effort spent on assessment is 25% less than with current speak to efficiency) process, as indicated by the regulatory inspection tracking system for Ris and SRis and estimates of time spent for BCs and above Scrutability and data integrity Number of executive over-rides (cases where the outcome is something different than the input) at end-of-cycle Level 3 or Level 4 is less than 5%

Consistency (repeatability) Inter-rater reliability of 95% on categorization and assignment of risk significance of the PIM and execution of the process model (threshold assessment and action determinations)

Validity Plant peer group predictive validity correlation coefficient = .90 on assessment results and actions taken Scrutability Pre-post survey of stakeholder perceptions of process scrutability shows statistically significant improvement Timehness e 95% of available data is documented within two weeks of the end of the assessment period 95% of end-of-cycle Level 3 reviews occur within four weeks of assessment period end e 95% of Level 4 reviews occur within two meks of endef-cycle Level 3 reviews e 95% of Commission meetings occur within eight weeks of the end of the assessment cycle  ;

a 95% of letters to licensees out within one week of Commission I notification and within 60 days of the end of the assessment period Data integrity Number ofinstances in which retrospective review of assessment results compared to independent data sources reveals discrepancies is less than 5%

Predictiveness Over time, the number of severity level ill and higher violations, the number of yellow assessment inputs, and the number of plants referred to Level 4 review decrease 27 I 4

1 i

1 i

TRANSITION PLAN Attachment 6 l

l t

- _ _ _ - -- -. . - - - . - - =- . - - . . . _ - - - .

l l l

l 1 INTRODUCTION I

This attachment provides the plan to be used by the NRC to transition through the l implementation of the revised oversight process. The transition plan includes change management strategies for creation of management systems necessary to support those desired changes. Together, these aspects are key ingredients in enabling an organization to successfully implement change.

The transition plan contains milestones for both the NRC and industry. Successful implementation will require a continuing interface with the industry and other stakeholders at various stages. Significant investment in staff and management resources will be required to complete necessary supporting documents and infrastructure, develop and train staff, and manage all aspects of the resulting change effort.

The transition plan contains challenging but achievable goals. The milestones reflect best estimates based on recognized challenges. Adjustments will be made as necessary to allow for l

resolution of unanticipated problems (e.g. difficulty in assigning significance to inspection findings, difficulty in collecting Pl data in a consistent manner, unexpected change in resources, etc.) or additional direction from the Commission.

2 DISCUSSION The attached table shows the major milestones for the transition, creating a shared vision, and creating management systems to support the change. " Plan / process development" identifies the objectives and the " Implementation" identifies those necessary activities to support those objectives. " Training" and " Communication" identifies those activities necessary to foster and reinforce a shared vision. " Phase in with Existing Processes" identifies those interfaces with current processes.

Successful implementation is predicated on several key assumptions, including that:

- The Commission approve the revised oversight process without major changes by March 1999

- The pilot process (risk-informed baseline inspection program, Pl collection) begins by June 1999

- The successful benchmarking of selected plants to new process by March 1999

! - The successful establishment of the " Change Coalition" and " Transition Task Force" by l January 1999

)

i 1

i

I 2.1. Pilot Program The pilot program will be conducted using two plants from each region including both PWRs l

and BWRs . The NRC will coordinate with the industry to identify those plants that will use the risk-informed baseline inspection program in lieu of the current process. Draft inspection procedures and approved performance indicators will be developed prior to beginning the risk-informed baseline inspection program (RIBIP) for the pilot plants. Success criteria will be l established prior to beginning the pilot program and if successful, full implementation will begin.

2.2 Communication l Communication of the new oversight process for both internal and external stakeholders will l begin with a high level vision of the approach and overall direction. Subsequent training will result in a progressively more detailed fashion. A highlight of the communication effort is an in- i depth training of all inspectors and affected managers at a joint NRC and industry workshop.

l Periodic press releases will be released as major milestones are achieved during ]

implementation of the process. '

2.3. Phase in with Existing Process l SALP suspension will continue indefinitely and will eventually be discontinued upon successful implementation of the pilot program. Plant Performance Reviews (PPRs) will continue on a six month cycle until replaced by Level 3 reviews. Senior Management Meetings (SMMs) will continue on a yearly spring cycle until replaced by Level 4 reviews.

l l

3 CHANGE COALITION As discussed above, a key factor during the implementation of the new process focuses on creating and maintaining a shared vision within the NRC. The Change Coalition is criticalin l ensuring that the necessary culture change occurs within the agency. The identification and i cultivation of " opinion leaders" at both the Headquarters and Regional Offices will be important to creating alignment within the agency and extending that vision to other stakeholders. These agents of change will form the " Change Coalition." It is anticipated that the industry will be ,

conducting a similar process during the implementation of the program. Future meetings '

between the NRC and industry will focus on the progress of the culture change and any t recommendations to improve the process.

4 TRANSITION TASK FORCE (TTF) l A Transition Task Force, which is separate from the Change Coalition, will be formed in order to manage the phase out of the existing process and the phase in of the new assessment l process. The role of the Transition Task Force will be to complete the development of detailed l implementing instruments and infrastructure. The following are tasks of the Transition Task l

Force, as indicated by the attached transition plan, and will require approximately 17-19 FTEs.

This estimate includes current FY99 expended resources of 6.5 FTEs. The current budget for FY 1999 has allocated 25.4 FTEs.

4 2

i l

{

4.1. Process Development / Implementation ,

- Develop Pilot Plan, including success criteria l - Review and incorporate public comments, revise process as appropriate

! - Develop individual RIBIP inspection procedures (IPs) for pilot use (8-10 IPs)

- Finalize guidelines for establishing significance of inspection findings

- Develop modifications to inspection Manual Chapter (IMC) 2515 Light-Water Reactor Inspection Program- Operations Phase - revise program guidance j

- Develop modifications to IMC 0610 Inspection Reports - report writing

)

- Quantify change in burden based on implementation of the new process (SRM M981102)

- Develop replacement to the PPR IMC, including PIM guidance and inspection planning

- Develop a new assessment precoss Management Directive

-Identify computer infrastrecture needs

- Establish data (PI) format needs and definitions

- Benchmark. process against prior plants (Clinton, Millstone, etc.)

- Oversee pilot implementation

- Develop necessary changes to draft documents listed above 4.2. Training / Communication i

- Conduct training for all inspectors

- Conduct a pilot utility workshop

- Develop required training

- Conduct regional meeting with stakeholders

- Conduct a joint NRC/ industry pre-implementation workshop l

l l

l l

l l

l 1

3

DRAFT Revised Regulatory Oversight Process

- Transition Plan -

12/10/98 Data Plan / Process Training . -Implementation Communication , Phase in with Development (Revised Process) Existing Processes Nov Process 98 Development D:c 12/28- Begin 12/18 - Identify 12/1 - Brief 12/17 (Week of) -

98 Benchmarking Change Champion Regional DRS lssue Guidance of Selected and Change Directors for' Plants (Process) Coalition (CCL) Format / Content of 12/3-Brief ACRS PPR Letters 12./18 - 12/22-Transition (Modified to Transition Task Task Force' (TTF) 12/8 - Brief Support SALP Force Identified Named Oversight Steering Suspension)

(Detailed Committee Process Development, 12/16 - NRC/NEl Pilot Meeting to Discuss Implementation; Final Process Phase in; Details interface issues) 12/22 - Brief 12/24-Comm. Regional DRP Paper to EDO Directors 12/22 - Meet with NEl to Discuss Pilot Plan l

4

DRAFT Revised Regulatory Oversight Process

- Transition Plan -

12/10/98 Data Plan / Process

• Training . .. Implementation Communication Phase in with Development- (Revised Process) Existing Processes Jan 1/1- 1/25 - TTF in place 1/11 (week of) -

99 Commission Meeting Conducted Paper to OCM 1/22 - 30 day with CCL (roles, public comment expectations, buy-1/11 - Pilot period begins in)

Plants named 1/15 - Commission 1/14 - FRN Briefing on Process issued to begin Recommendations l Public Comment l Period 1/19 - Press Release to 1/29 - Define Announce 30 Day inspection Comment Period Program Organization 1/26 - Brief NRR

' (Approach to Managers Grouping similar Tasks into 1/26 Brief ACRS Procedures, on Final identifying Recommendations inspector Job Responsibilities, etc.)

1/26 - Draft Pilot Plan Completed I

l 1

1 i

e 5 12/10/98

DRAFT Revised Regulatory Oversight Process

- Transition Plan -

12/10/98 Data . Plan / Process . . ' - Training - '

implementation - Communication - . Phase in with Development c (Revised Process) Existing l

+

Processes Feb 2/1 - Transition 2/1 (week of) - PPRs Conducted 99 Task Force Meeting of CCL Using Existing Activities Begin PIMs I (e.g.,IP 2/2 - NEl Meeting Development, with Industry; Site etc.) VPs/ Licensing Managers - East

2/19 - Complete l Process 2/3 - NEl Meeting Benchmarking with Industry; Site for Selected VPs/ Licensing Plants Managers - West l

l 2/23 - Develop 2/11 NEl Task Commission Force Briefing of l Paper to Provide NSIAC l Results of Public l Comment 2/23 - Public i

Comment Period Ends Regional Meetings (coincident with PPRs to describe l

new process) 6 12/10/98 l

1 i

DRAFT Revised Regulatory Oversight Process

- Transition Plan -

12/10/98 1

Dats Plan / Process Training -

Implementation - Communication, Phase in with Development  :(Revised Process) Existing i

Processes

! Mar 3/19- 3/3-5 Regulatory SMM Screening

} 99 Commission Information Meetings Paper Conference 4

^

Forwarded to (Introduce High the Commission Level Concepts)

(Results of ,

! Public 3/26 - Draft IP and i Comments) IMC 0610 & PIM Guidance for Pilot

, 3/26 - Use issued for

Development of Comment (made  ;

2 Draft available to the Procedures public) f Completed 3/31 Receive SRM on

Proposed Staff 1 Changes.

1

, Apr 4/9 - Pl Data 4/21 SMM i 99 Format

Established '

l (draft) ..

(NRC/NEI) i m

7 12/10/98

l DRAFT Revised Regulatory Oversight Process

- Transition Plan -

12/10/98 D:t Plan / Process Training Implementation Communication Phase in with Development (Revised Process) Existing Processes May 5/14 - PI 5/10 - Joint 5/24 - Joint Brief Commission 99 Reporting Utility /NRC/NEl NRC/NEl Meeting on SMM results Format Finalized meeting for Pilot to Resolve issues (NRC/NEI) Plant Training Prior to Pilot (Mgr/BC/PE/ SRI) 5/17-Issue Letter to Pilot Plants to ini!! ate Pilot Process 5/21 - Process and Procedure Guidance Finalized for Pilot Use Jun 6/1 - Issue 6/15 - Provide 6/1 - Begin Pilot 6/15 - Issue Press 99 Revised Training to the Process (RIBLI, PI Release on Enforcement Regions on collection)(previous Enforcement Guidance Enforcement two years, monthly Revisions data)

Jul 7/30 - Check-in 7 /15 - First PI 7/15-30 Conduct 99 with Pilot Utilities Data Submitted Regional Meetings and Regional (Monthly for Pilot with States on implementors Only) details of new (NRC/NEI) process IRsissued Aug -

8/15 - Pl Data PPRs Conducted 99 Submitted Using Existing inspection irs issued Program / Process 8/27 - Pilot Plant Level 2 Review Conducted 8 12/10/98

- an-am.as. a - m a a.a4 m,-w maa-ai m~ a, _. a ss, am J4- .42: 4J.is- 1. J--- ,__. _-a, , m. a a, , ., a4 a es-m 4ya_u DRAFT Revised Regulatory Oversight Process I Transition Plan -

12/10/98 Date Plan / Process- Training . implementation Communication Phase in with Development (Revised Process) Existing Processes Sep 9/10 - Review of 9/15 - Pl Data Brief Commission 99 Pilot (NRC/NEI) Submitted TAs on Progress

- consistency

- data quality IRsissued

- insp. results

- enforcement 9/24 - Develop l Revisions to the IPs and Process Based on Pilot Lessons 9/24 - Develop any Proposed Organization Re-alignment to Support implementation

~

of the Revised Process l

Oct 10/4 - IPs and 10/11 Conduct 10/1- Pl Data 10/11-25 (TBD) -

99 Reporting training of all Submitted Conduct Joint Format Finalized Reactor Program NRC/ industry 2- l Staff on New IRsissued day Workshop Process (NRC/NEI) l (coincident with l PPRs) Issue a Press Release Regarding 10/11 Conduct the Workshop Training for Regional Branch Chiefs on Process Implementation 9 12/10/98

DRAFT Revised Regulatory Oversight Process

- Transition Plan -

12/10/98 D:ts Plan / Process Training implementation Communication Phase in with Development (Revised Process) Existing Processes Nov 11/15 - Pl Data 99 Submitted irs issued 11/30 Pilot Plant Level 4 Review Conducted (Using 12 month PI Data, 6 Month inspection Results)

D:c 12/15 - Final Brief Commission 99 Review of Pilot TAs (NRC/NEI)

- consistency

- data quality

- insp. results

- enforcement 12/15 - Measure Process Performance for Pilot Plants Against Success Criteria. If met, Proceed with Full implementation.

Jan 1/1 - Revised 1/1 - Risk Informed 1/15 - Press 1/1 SALP 00 Oversight Baseline Inspection Release issued Discontinued Process Program Announcing Full Becomes implemented for all Process Effective for All Plants Implementation Plants and SALP Deletion 1/1 - Pl Data 1/1 - MD on Reporting Begins SALP Deleted for All Plants 10 12/10/98

1 DRAFT Revised Regulatory Oversight Process

- Transition Plan -

12/10/98 D:ts Plan / Process Training implementation ' Communication Phase in with Development (Revised Process) Existing Processes Feb PPR Conducted 00 -

Mar Conduct sMM 00 screening Meetings Apr Conduct Level 2 Conduct Last 00 Review sMM May 00 Jun 6/15 - Issue 00 MDs on new process 6/30 - Review Process implementation (NRC/NEI)

Jul Conduct Level 2 00 Review Aug 00 sp 00 Oct Conduct Level 3 00 Review (Mid-cycle)

Nov 00 Drc 00 11 12/10/98

DRAFT Revised Regulatory Oversight Process

- Transition Plan -

12/10/98 Dato ~ Plan / Process Training implementation Communication Phase in with Development (Revised Process) Existing Processes Jan Conduct Level 2 01 Review Frb 01 l Mar 01 Apr Conduct Level 3 01 Review (End of Cycle)

Conduct Level 4 Review (End of Cycle)

May 5/15 - Review Commission 01 Process Briefing on implementation Assessment Results Press Release issued 1

12 12/10/98

)

! DRAFT

Revised Regulatory Oversight Process j - Transition Plan -

12/10/98 l Date Pla#rocess

. Training Implementation Communication ' Phase in with .

Development -

(Revised Process) Existing -

j ,

' Processes

{ Jun 6/25 - Conduct 6/7-End of Cycle 1 01 Process Review. Letters sent l Identify Lessons

] Learned. 6/30 - Implement j Develop Lessons Learned

Appropriate From Assessment j Modifications.

f 4

3 k

5 13 12/10/98

l DRAFT Revised Regulatory Oversight Process

- Transition Plan -

12/10/98

• TRANSITION TASK FORCE - TASKS Process Development / implementation l O Develop PPot Plan, including success criteria (Moderate) i O Develop individual RIBL inspection procedures for pilot use. (8 - 10 IPs) (Substantial)

O Finalize guidelines for establishing significance of inspection findings (Moderate)

O Develop modifications to IMC 2515 - revised program guidance (Moderate)

O Develop modifications to IMC 0610 - report writing (Substantial)

O Review and incorporate public comments, revise processes as appropriate (Small-Moderate) i O Quantify change in burden based on implementation of the new process (SRM l

M981102)(Moderate)

O Develop replacement to the PPR IMC, including PIM guidance and inspection planning (Moderate)

D Develop a new assessment process Management Directive (Moderate)

O Identify computer infrastnicture needs (Moderate)

O Establish data (PI) format needs and definitions (Moderate)

O Benchmark process against prior plants (Clinton, Millstone, etc.)(Substantial)

O Oversee pilot implementation (Moderate)

D Develop necessary changes to draft documents above (Moderate)

Training / Communication O Develop required training (Substantial)

O Conduct training for all inspectors (Substantial)

O Conduct pilot utility workshcp (Small)

O Conduct joint NRC/ industry pre-implementation workshop (Substantial) 14 12/10/98

.I

.m_._.__.. . - _ _ _ . _ . _ _ . . ._. _.. _ _ _ _. _ _ _ .. _ _._ _ _ _ . . . _ _ . .

l DRAFT .

Revised Regulatory Oversight Process

- Transition Plan -

12/10/98 l

0 Conduct regional meeting with stakeholders (Moderate) l l

l l l l

l i

I l

I l

l l

t i

I r

I l

i I l 1

, 15 12/10/98 4

s 3 , _