ML20211F896

Revised Reactor Oversight Process Pilot Program Guidelines

ML20211F896
Person / Time
Issue date:	08/18/1999
From:	NRC
To:
Shared Package
ML20211F885	List: ML20211F882 ML20211F896 ML20211F922 ML20211F929
References
PROC-990818, NUDOCS 9908310099
Download: ML20211F896 (114)

Text

.

4 i

G 47 (D..)

F REVISED REACTOR OVERSIGHT PROCESS I

PILOT PROGRAM GUIDELINES l

Revision A 9908310099 990818 PDR ORG NRRA PDR

%QNOdNb

e e

TABLE OF CONTENTS 1 I NTR OD UCTION........................................................ 1 1.1 P u rpose...................................................... 1 1.2 Scope....................................................... 1 1.3 Objectives.................................................... 1 2 PILOT PROGRAM OVERVI EW........................................... 2 2.1 Objectives of the Pilot Program.................................... 2 2.2 Pilot Program Major Milestones.................................... 3 3 PILOT PROGRAM GROUND RULES......................................... 4 4 CONDUCT OF OVERSIGHT PROCESSES DURING PILOT....................... 7 i

5 PILOT PROGRAM SUPPORT ORGANIZATION............................... 12 5.1.

' Pilot Plant Support Staff......................................... 12 5.2 Procedure Development Group................................... 13

)

5.3.

Pilot Program Evaluation Panel................................... 14 6 PILOT PROGRAM CRITERI A.............................................. 16 6.1 Performance Indicator Reporting.................................. 16 6.2 Risk-informed Baseline inspsction Program......................... 16 6.3 Significance Determination Process............................... 17 6.4 Assessme nt................................................. 17 6.5 Enf orce ment................................................. 18 6.6 Information Management Systems................................. 18 6.7 Ove r all...................................................... 1 8 j

7 PILOT PROGRAM RITS GUIDANCE........................................ 20 8 PLANT ISSUES MATRIX GUIDANCE....................................... 26 I

9 PILOT PLANT SELECTION...................,........................... 32 i

Revision A t

e a

1 INTRODUCTION 1.1 Purpose The purpose of the pilot program is to apply the proposed new regulatory oversight process I

described in Commission papers SECY-99-007 and SECY-99-007A to a select number of plants. Performance indicator (PI) data reporting and the revised inspection, assessment, and enforcement processes will be exercised at the pilot plants. Lessons learned from this pilot effort will allow the processes and procedures to be refined and revised as necessary prior to fullimplementation.

1.2 Scope The pilot program will be a 6-month effort that will involve two sites from each region. The plants selected, as shown in Table 9.1, represent a cross-section of design and licensee performance across the industry. The pilot plants will collect and report Pl data, be inspected by the NRC under the new risk-informed baseline inspection program, have enforcement actic,

.taken under the new enforcement policy, and be assessed under the new streamlined assessment process.

1.3 Objectives The objectives of the pilot program are to (1) exercise the new regulatory oversight processes to evaluate whether or not they can function efficiently, (2) identify process and procedure problems and make appropriate changes prior to full implementation, and (3) to the extent possible, evaluate the effectiveness of the new processes. The pilot program will also measure the agency and licensee resources required to implement the new PI reporting, inspection, assessment, and enforcement processes in order to quantify the resource changes. The results of the pilot program will be evaluated against pre-established criteria. Full implementation of the new oversight process will commence pending successful completion of the pilot program, as measured against these criteria.

1 Revision A

\\

L

s e

2 PILOT PROGRAM OVERVIEW 2.1 Objectives of the Pilot Program The objectives of the pilot program are to apply the new Pl, inspection, assessment, and enforcement processes to a limited number of plants in order to (1) exercise the new regulatory oversight processes ind evaluate whether or not they can function efficiently, (2) identify process and procedure problems and make appropriate changes prior to full implementation, and (3) to the extent pocsible, evaluate the effectiveness of the new processes. The pilot program rtill also measure the agency and licensee resources required to implement the new Pl reporting, inspection, assessment, and enforcement processes in order to quantify the resource changes. Ground rules for how these new processes will be applied to the pilot plants are discussed in Section 3. The conduct of the pilot program is described in section 5. As described in Section 6, pilot program criteria have been established to measure the ability to meet these objectives. Full implementation of the new oversight process will commence pending successful completion of the pilot program, as measured against these criteria.

Specific objectives of the pilot program are as follows:

1.

Perform a limited-scale exercise of the following processes to evaluate whether they can function efficiently, including:

Pl dat'a reporting by the industry Performance of a risk-informed baseline inspection program by the NRC Evaluation of Pl and inspection results and determination of appropriate actions through the assessment process Implementation of a revised enforcement process that is integrated with the

. other new oversight processes NRC time reporting and information management systems 2.

Identify problems with processes and implementing procedures and make appropriate changes to support f ull implementation, including:

lssuing final Pl collection and reporting guidance to the industry Issuing new or revised inspection program documentation (e.g., inspection procedures, inspection manual chapters) lssue final significance determination process (SDP)

Issue final enforcement policy revisions NRC time reporting and information management systems ready Assessment process management directive issued 2

Revision A

e 3.

To the extent possible, evaluate the effectiveness of the new regulatory oversight processes to determine whether:

The Pis and their thresholds provide an appropriate, objective measure of plant performance The baseline inspection program adequately supplements and complements the Pls so that the combination of Pts and inspection provide reasonable assurance that the cornerstone objectives are being met The baseline inspection program is effective at independently verifying the accuracy of the Pls The SDP thresholds provide an appropriate, objective measure of the safety significance of inspection findings The new enforcement policy results in enforcement actions for issues that are consistent with the safety significance resulting from the significance determination process i

The use of the new assessment process and action matrix results in more consistent and predictable NRC action decisions for plants with varying levels of performance 2.2 Pilot Program Major Milestones j to Commission paper SECY-99-007 provided the plan that the NRC would use to transition through the implementation of the revised oversight processes. The following i

provides a summary of those transition plan activities related to the pilot program and an updated schedule based on continued development work and coordination with the industry and public.

4 2.2.1 Pilot Activities Pilot plants start Pl data collection May 1999 Commence pilot program May 30,1999 Periodic NRC/ Industry public meetings to review pilot results July 1999 thru November 1999 Mid cycle assessment review December 1999 Analysis of pilot results against criteria 3

Revision A

T s

3 PILOT PROGRAM GROUND RULES The following ground rules define how the pilot program will be performed for the participating sites; they were developed to ensure that the objectives of the pilot program would be met.

These ground rules were developed in conjunction with the regions and with headquarters program offices; comments from the industry and the public were considered and incorporated as appropriate.

The pilot program ground rules are as follows:

The pilot plants will receive the new baseline inspection program in lieu of the current core program.

The pilot plants will be assessed under the new assessment process in lieu of the current processes (i.e., no August plant performance review (PPR) for the pilot plants). The pilot plants will undergo a periodic assessment at the mid-cyc!9 review, scheduled to take place at the beginning e ' nocember 1999.

Pilot plants will be subject to the new enforcement policy, in lieu of the current enforcement policy.

All inspectors leading an inspection (senior resident and specialist inspectors) will receive j

training on the new oversight processes prior to conducting the inspection.

j Pi data collection for the pilot program will start in April 1999, and the first PI report will be due from the participating licensees by May 14,1999. The pilot plants will be asked to collect and report two years worth of historical Pl data (when possible) to supplement the data collected during the pilot program.

The historical Pl data submittal by the pilot plants will represent a "best effort" to collect and report the data by the participating licensees. This is intended to acknowledge rio difficulties inherent in collecting some of new data required for the Pls that has not been previously maintained by the licensees. While the NRC will use this historical data to assess performance, the requirements of baseline inspection procedure 71151,

" Performance Indicator Verification," will not apply.

The risk-informed baseline inspection program will be conducted at the pilot plants as follows:

The regions will plan the new baseline inspection program to be conducted for all pilot plants prior to commencing the pilot.

Periodic adjustments will be made to the inspection schedule to add or remove initiative inspections.

All new baseline inspection procedures will be performed in each region, where practical, during the pilot program. However, each procedure need not be performed at each plant. For example, the periodic problem identification and 4

Revision A

resolution inspection procedure might be tested at only four pilot plants, one in each region.

The Pi verification portion of the baseline inspection program will be tested at all of the pilot plants.

As many inspectable areas as possible will be inspected based on their intended frequency and the availability of associated activities. Some inspectable areas may not be covered because they will not be appli~ able to the pilot sites; such as c

the refueling and outage related activities.

Regional inspection planning meetings, with program office oversight and assistance, will be held for each pilot plant in May 1999. At that time, previously scheduled regional initiative inspections will be reevaluated to determine the continued need for the inspection under the new oversight framework. The following criteria will be used to determine the need for any regional initiative inspection at the start of the pilot:

The initial submittal of Pls, based on historical data, indicate tripped thresholds and the need for follow up regional initiative.

Significant licensee performance concerns are not appropriately indicated in the initial submittal of Pls due to the limitations in collecting the historical data.

A significant inspection finding within the last year indicates a licensee performance concern that requires additionalinitiative inspection.

The need for additional initiative inspection will be determined based on how the Pi i

results and baseline inspection findings are processed through the action matrix. This I

initiative inspection effort will be known as supplemental inspection in the revised reactor I

oversight process. These supplementalinspections are intended to focus on root cause, I

extent of condition, corrective actions, and licensee identification / resolution of problems.

l The TTF will make the supplemental inspection procedures available to the regions when I

they are developed and ready to be piloted. In the interim, any supplemental inspections I

required during the pilot program should be consistent with the above guidance. The i

TTF will review the supplemental inspection planning for the pilot plants to ensure i

consistency.

I i

During the pilot program, some pilot plants may receive inspection effort in addition to I

that required by the current regulatory oversight processes. This may result from the I

need to adequately exercise the new baseline inspection procedures at a sufficient I

number of sites to collect lessons learned and experience with the new procedures.

I While this may be the case, it is also expected that less inspection than normal would I

then occur at these sites for the remainder of the annual inspection cycle. In other 1

words, while a pilot site may receive some additional inspection during the pilot period, I

less inspection would occur after the six-month pilot program. The end result will be that I

the baseline inspection program will be essentially accomplished over the first annual l

J cycle.

I I

5 Revision A

r However, the case may occur where additional inspection is planned above its I

intended frequency with the sole intent of adequately testing the program. The l

Office of Nuclear Reactor Regulation (NRR) has proposed that this inspection i

effort be non-billable to the pilot plant licensees. As proposed to the NRC's Chief I

Financial Officer (OCFO), NRR would capture this non-billable effort in a separate I

inspection report and inform the OCFO staff that this inspection report should be I

non-fee billable. However, any follow-up activities to these non-billable l

inspections, such as additional supplemental inspection or enforcement actions, I

would be fee billable to the licensees and would be documented in a fee billable I

inspection report.

I Subsequent to the completion of the pilot program, pilot plants will continue under the new oversight processes if full implementation is delayed for the short term (3 months or less), if it is expected that full implementation will be delayed for more than 3 months, I

then the staff will evaluate restoring pilot plants to the current regulatory oversight processes.

I 6

Revision A l

4 CONDUCT OF OVERSIGHT PROCESSES DURING PILOT Each of the new oversight processes will be implemented and performed as described by its associated procedure. In addition, the following will apply while implementing these processes during the pilot program.

The pilot plants will report Pls to the NRC by the 14* calender day each month during the pilot program. The Pls will be forwarded to the appropriate 1 regional Division of Reactor

~ Projects Branch Chief for review, and then posted on the NRC Intemet Homepage within two weeks of submittal by the licensees.

Inspection may be required to review indicators or inspection findings that have crossed I

a threshold to understand the cause, and the licensee actions intended to address the I

cause of the problem. While this inspection effort is not intended to be an inspection of I

the root causes of the issue, the information is necessary to assess licensee I

performance and develop the appropriate NRC follow-up action. This effort is above the I

j baseline inspection program and will be covered by the supplemental inspection program I

when is' sued. Until the supplemental inspection program is issued, this type of effort I

should be charged as regional initiative under inspection procedure (IP) 92901, IP 92902, 1

IP 92903, or IP 92904, as appropriate.

I The disposition of any Pls that have crossed a performance threshold based on historical I

performance issues (May 14 and June 14,1999 submittals) should be handled in the l

cover letter of the first resident inspection report. The cover letter should state the I

following: 1) describe the Pi and the performance band entered,2) describe when the Pl I

entered the performance band and the problem or event that caused it,3) describe the i

NRC actions that will be taken in response to the indicator tripping a threshold, and the l

basis, or 4) describe the basis for the NRC not taking any additional action for historical I

issues, including a description of the previous NRC actions and licensee corrective I

actions taken at the time of the issue.

I I

The follow-up of any other indicators that cross a threshold during the pilot program i

should be by docketed letter using the format of MD 8.x, exhibit 5. This includes both the i

documentation of additional NRC follow-up, or no follow-up necessary, and the basis for i

eithe:r action.

I I

Routine resident inspections will continue to be conducted over approximately a 6-week time period. All inspection reports, except those for major team inspections, will be I

issued within 30 days from the end of the inspection. The Plant Issues Matrix will be I

updated within 14 days from the date of inspection report issuance.

I Backshift coverage will be performed as follows during the pilot program. Deep backshift I

should be performed at the rate of 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br /> per year, per site. For the pilot program, this I

corresponds to 25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> of deep backshift per site. The primary focus of deep backshift I

will be the performance of IP 71150, Plant Status, along with the observation of any I

planned or emergent work in accordance with the baseline inspection program. There is I

no set number of hours for backshift coverage since it is expected that the normal I

7 ReWWon A

inspection program willinvolve some backshift coverage. The definitions of backshift I

and deep backshift as described in IMC 2515' remain the same.

I The completion of inspections during the pilot program should be tracked using IMC 1

2515*, attachment 3, Table F. Each region should forward a copy of this table reflecting I

those inspections completed at the end of each inspection. For resident inspections, this

.I table may be updated and forwarded at the end of each resident inspection period I

(approximately every 6 weeks). Completed tables should be forward by the region to the I

appropriate regional point of contact.

l l

A Significance Determination Process and Enforcement Review Panel will be established during the pilot program to ensure that the SDP is implemented in a consistent manner.

This panel will meet bi-weekly as necessary to discuss all proposed potential risk significant issues before they are issued in their final form. In aadition, an Operational Support Team from the Probabilistic Safety Assessment Branch, NRR, will be assembled to support the regions in performing SDP evaluations. Details of these support organizations is provided in draft inspection manual chapter 06XX, " Significance Determination Process."

Outstanding NRC open inspection items (NOVs, EAs, URis, and IFis) that existed at the I

beginning of the pilot program should be reviewed and closed out during the pilot I

program as regional initiative under the appropriate IP 92900 series procedure. This I

initiative should be preplanned, scheduled and communicated to licensees as extra I

regional initiative that is a one time startup cost for implementing the new process.

l 1

For open NOVs, the follow up inspection should verify that the item is in the I

licensee's corrective action system and prioritized with corrective actions I

scheduled or under development.

I l

For open EAs, the follow-up effort would involve the normal regional follow-up of I

the issue per the inspection procedure.

I I

Open URis and IFis should be evaluated using the SDP. Items that are I

characterized as green, without a Phase 2 evaluation, should be verified in the CA I

program and closed. Those URIs or IFis that go to Phase 2 review should be I

followed up by the SDP and time spent on this charged to the SDP TAC. The I

closecut of all issues should be documented in inspection reports as appropriate.

I I

A mid-cycle review and inspection planning meeting, including the issuance of a 6-month inspection look-ahead letter, will be held for each pilot plant in early December 1999.

The assessment cycle for this mid-cycle review will end approximately November 13, 1999, and willinclude the 5 months of pilot data (Pis and inspection findings) collected at that time.

i The pilot plants will be discussed as part of the April 20R0 senior management meeting (SMM) process. At the SMM screening meetings, the pilot plant performance review and discussion of agency action will be based on the PI results and baseline inspection findings, as applied to the action matrix. The action matrix will be used to the extent 8

Revision A 1

)

practicable to determine which pilot plants need to be discussed further at the SMM.

This effort will exercise the end-of cycle assessment process for the pilot plants, with lessons learned incorporated into the assessment process procedures.

All NRC process and procedure users sh6uld use the feedback form, shown as Figure 4.1, to record lessons learned, comments, and feedback. This form should be used to capture comments on any of the new oversight processes, including the inspection program, assessment process, and the SDP. As described below, comments on the inspection procedures should be recorded on Figure 4.2. This form should be filled out after the initial use of a procedure, and again on subsequent uses to capture additional comments and feedback. Completed forms should be forwarded to the NRC regional points of contact for further evaluation.

Feedback, comments, or lessons learned while performing the inspection procedures should be recorded on the Inspection Procedure Comment Form, shown as Figure 4.2.

These forms should be filled out after the initial use of each inspection procedure or inspectable area attachment, and again on subsequent uses to capture additional comments and feedback. Completed forms should be forwarded to the NRC regional points of contact for further evaluation.

Any feedback or comments received from a licensee regarding the pilot of the new regulatory oversight process should be recorded on a Regulatory impact Report, NRC Form 649, or equivalent. Completed forms regarding the pilot of the new oversight process should be forwarded to the NRC regional points of contact for further evaluation.

9 Revision A o

e OVERSIGHT PROCESS FEEDBACK / COMMENT FORM Document

Title:

1 Document No. (if applicable):

Attachment No. (if applicable):

Inspection Report No. (if applicable):

Inspection Type (circle one): Resident / Specialist / Team Plant Name:

Region:

Date(s)of use:

Address the following statements using the following rating scale: 1e Disagree,2= Moderately Disagree,3= Neutral, 4= Moderately Agree,5= Agree. Please identify errors and inconsistencies in the procedure and provide comments and suggestions for improving the procedure, 1.

The procedure requirements, and the way they were implemented, D'*S'" 1 2 3 4 5 ^*"

met the stated objectives. What changes, if any, are required?

2.

The procedure guidance is clear and easy to use.

D**S'" 1 2 3 4 5 ^S'"

What changes, if any, are required?

3.

The actions specified by the procedure are performed at a

• • " 1 2 3 4 5 ^r" sufficient frequency. What changes, if any, are required?

9 4.

Excessive resources were not required to implement the

• • S'" 1 2 3 4 5 ^8'"

procedure as written. What changes, if any, are required?

5.

While implementing the significance determination process were any significant inspection issues inappropriately screened out?

6.

Other Comments / Suggestions:

/

Procedure User (Print)

Date

( If comments are extensive, please mark them on a copy of the procedure and attach)

Figure 4.1 - Oversight Process Feedback Form Revision A 10

o INSPnCTION PROCEDURE COMMENT FORM Inspection Procedure No.:

Attachment No.:

Title:

Inspection Report No:

Inspection Type: Resident /DRS/ Team Plant Name:

Region:

Date(s):

Address the following statements using the following rating scale: 1= Disagree,2= Moderately Disagree,3= N'eutral, 4= Moderately Agree,5= Agree. Please identify errors and inconsistencies in the procedure and provide comments and suggestions for improving the procedure, 1.

The level of effort required for the inspection was consistent with that D**8'" 1 2 3 4 5 ^8'"

in the IP. If not, what is the appropriate level of effort and basis for IP revision?

2.

The procedure met the inspection objectives.

D"" 1 2 3 4 5 ^9'"

If applicable, describe how the procedure (or how it was implemented) failed to meet the inspection objectives.

3.

The inspection requirements were appropriate based on risk.

• • 8'" 1 2 3 4 5 ^8'"

What inspection requirements should be added, deleted or revised based on risk? Based on implementing the Significance Determination Process for inspection findings, how should the inspection requirements be revised to better identify risk significant findings?

4.

The inspection procedure was clear and easy to use. If not, how D**0'" 1 2 3 4 5 ^9'"

should the inspection guidance be revised to better clarify the j

inspection requirements?

5.

The IP does not result in an unreasonable impact on licensees.

"" 1 2 3 4 5 ^S'"

How should the IP be revised to preclude unreasonable licensee impact?

/

Inspector or Date

' inspection Area Lead Figure 4.2 Inspection Procedure Comment Form 11 Revision A

5 PILOT PROGRAM SUPPORT ORGANIZATION 5.1.

Pilot Plant Support Staff The transition task force (TTF) will provide support to the pilot plant sites and regions throughout the pilot program. As shown in Table 5.1, two TTF members will be assigned to each region as the points of contact during the pilot program. These pilot plant support staff members will be the focal point for regional questions on program implementation, will make periodic site visits to monitor NRC and licensee implementation of the program, and will solicit NRC staff and licensee comments on program effectiveness. Specifically, the responsibilities of the support staff are to:

Visit each site at least once per inspection period to obtain feedback from the residents, licensee staff, and observe performance of inspection procedures.

Observe a sampling of resident inspector and specialist inspector exit meetings with licensees.

Observe regional assessment and planning meetings for the pilot plants to provide guidance and assistance as necessary.

Collect feedback and forward to the appropriate task lead for evaluation and incorporation.

The insights gained by the pilot program support staff will be part of the input that is considered by the Pilot Program Evaluation Panel.

Table 5.1 - Points of Contact Primary Point of Contact Backup Point of Contact Region i Tim Frye Ron Frahm Jr.

I 301-415-1287 301-415-2986 i

Region ll Pete Koltay Jeff Jacobson 1

301-415-2957 301-415-2977 i

Region ill Morris Branch Roy Mathew 301-415-1279 301-415-2965 Region IV Jim Isom Sam Malur i

301-415-1109 301-415-2963 i

Oversight process development will continue throughout the pilot program as lessons are learned. Table 5.2 shows the TTF task leads who may be contacted to answer questions regarding any of the oversight processes and work in progress. Many of these task leads, such as the PI task lead, will also make frequent visits to the pilot sites and regions to monitor the implementation of the processes.

12 Revision A

o Table 5.2 - Task Leads Lead Phone E-mail Transition Task Force Alan Madison 301-415-1490 ALM Pilot Program Coordinator Tim Frye 301-415-1287 TJF Pl Reporting Don Hickman 301-415-6829 DEH2 Inspection Program Steve Stein 301-415-1296 SRS Significance Determination Process Morris Branch 301-415-1279 MXB2 Assessment Bob Pascarelli 301-415-1245 RJP3 1

Enforcement Barry Westreich 301-415-3456 BCW Information Technology Ron Frahm Jr.

301-415-2986 RKF 1

5.2 Procedure Development G6a)

A procedure development group will be established during the pilot to revise *he baseline inspection procedures to incorporate lessons leamed during their initial implementation. Each inspection procedure and inspection program document will have an assigned procedure owner.

This procedure owner will be responsible for collecting problems and lessons leamed from the procedure users, evaluate the need for a procedure change, and then update the procedures as necessary. The procedure owners for each baseline inspection procedure are shown in Table 5.3.

Table 5.3 - Baseline inspection Procedure Owners IP No.

Title Contact Phone E-Mail Overall Coordination of Procedure Development Steve Stein 301-415-1296 SRS Group Efforts 71111 Reactor Safety-Initiating Eventr,,

Sam Malur 301-415-2963 SKM Mitigating Systems, Barrier Integrity 71114 Emergency Preparedness Roy Mathew 301-415-2965 RKM 30'-415 1109 JAl I

71121 Occupational Radiation Safety Jim Isom 1

71122 Public Radiation Safety Jim Isom 301-415-1109 JAl I

71130 Physical Security Jim isom 301-415-1109 JAl I

i 71150 Plant Status Peter Koltay 301-415-2957 PSK 71151 PI Verification Peter Koltay 301-415-2957 PSK I

13 Revision A

IP No.

Title Contact Phone

-Mail 71152 Problem identification and Peter Kottay 301-415-2957 PSK l

Verification 71153 Event Follow up Peter Koltay 301-415-2957 PSK IMC 2515' Light-Water Reactor inspection Steve Stein 301-415-1296 SRS Program - Operations Phase IMC 0610 Inspection Reports Steve Stein 301-415-1296 SRS The procedure development group will be coordinated by the TTF during the pilot program. The TTF will ensure that procedure comments and lessons learned are collected and evaluated in a timely manner. The TTF will coordinate procedure revisions by the procedure development group, and ensure that revised procedures are forwarded to the procedure users.

5.3.

Pilot Program Evaluation Panel 5.3.1 Purpose The Pilot Program Evaluation Panel (PPEP) will function as a management-level, cross-disciplinary oversight group to monitor and evaluate the success of the pilot effort. The purpose of th'a PPEP is to allow the individual panel members to provide an objective evaluation as to whether the criteria have been met. The PPEP will not provide recommendations or advice to the agency, as a group, regarding the readiness to proceed with full implementation of the new oversight processes. However, the PPEP members are welcome to submit advice, comments, or recommendations regarding the readiness for full implementation on an individual basis, separate from the PPEP effort.

It is important to note that Federal Advisory Committee Act (FACA) requirements restrict the ability of the PPEP to provide an overall group review of the success of the pilot program. The staff is working to establish the PPEP as a FACA compliant panel, in accordance with 10 CFR Part 7, which will allow panel recommendations on the success of the new oversight processes to be forwarded to the Commission for consideration.

5.3.2 Scope The PPEP will meet periodically during the pilot program to review the implementation of the oversight processes and the results generated by the PI reporting, baseline inspection, assessment, and enforcement activities. These meetings will be publically announced in advance, open to the public, and all material reviewed placed in the public document room. A meeting summary will be prepared following each meeting to document the results of the meeting.

14 Revision A

C G

5.3.3 Objectives F,e objective of the PPEP is to monitor and evaluate the implementation of the new regulatory oversight processes at the pilot sites. The PPEP will evaluate the pilot program results against pre-established pilot program criteria. For those criteria that are intended to measure the effectiveness of the processes, and that generally do not have a quantifiable performance measure, the PPEP will serve as an " expert panel" to review the results and evaluate how well the criteria were met. At the end of the pilot program, the individual PPEP members will provide an objective evaluation as to whether each of the criteria have been met. The staff will use the PPEP evaluation to determine the need for any additional process development or improvements prior to full implementation.

5.3.4 Organization The PPEP will be a cross-disciplinary group of about 12 people, with membership anticipated to be as follows:

PPEP Chairman - Deputy Director, Division of Inspection Program Management, NRR Three regional division directors (combination of Division of Reactor Safety and Division of Reactor Projects division directors)

TTF Executive Forum Chairman Office of Enforcement representative One Nuclear Energy institute (NEI) representative

=

Four pilot plant licensee representatives One member of the public One State regulatory agency representative 5.3.5 Schedule The PPEP will meet approximately every six weeks during the pilot program to review and monitor the implementation of the new regulatory oversight processes. A tentative schedule for PPEP meetings is as,follows:

June 1999 PPEP kick-off meeting to review purpose and objectives of the panel July 1999 First PPEP meeting to discuss and review the results of the pilot program.

j September 1999 PPEP meeting to discuss and review pilot program results.

December 1999 Final PPEP meeting to evaluate the pilot program against the criteria.

5.3.6 -Reports The results of PPEP meetings will be recorded in a meeting summary placed in the public document room. These meeting summaries will include all material handed out at the meetings.

The final PPEP evaluation of the pilot program against the criteria will be included as part of the staff recommendation to the Commission regarding fullimplementation of the new regulatory oversight processes.

15 Revision A

o 6 PILOT PROGRAM CRITERIA The following criteria will be used to evaluate the results of the regulatory oversight process improvement pilot program. These criteria will be used determine whether the overall objectives of the pilot program have been met, and whether the new oversight processes (1) ensure that plants continue to be operated safely, (2) enhar.ce public confidence by increasing predictability, consistency and objectivity of the oversight process so that all constituents will be well s~erved by the changes taking place, (3) improve the efficiency and effectiveness of regulatory oversight by

]

focusing agency and licensee resources on those issues with the most safety significance, and (4) reduce unnecessary regulatory burden on licensees as the processes become more efficient and effective.

i

- The criteria have been set up with thresholds (e.g.,8 out of 9 plants) to help determine if the i

processes and procedures are fundamentally sound and ready for full implementation. Failure I

to meet a criterion indicates a potential program or process problem that needs to be addressed I

prior to full implementation. It does not indicate that the process or procedure is unworkable and I

can not be used to support the revised oversight process. Meeting a crit'erion indicates that I

while there may be an isolated problem that needs to be addressed, the programs and I

processes are generally sound, meet their intended objectives, and are ready for full I

I implementation.

6.1 Performance indicator Reporting The following criteria will measure the efficiency and effectiveness of PI reporting.

Can Pi data be reported accurately by the industry, in accordance with the reporting guidelines? They can, if by the end of the pilot program, each Pi is being reported accurately for at least 8 out of the 9 pilot plants.

Can Pl data results be submitted by the industry in a timely manner? They can, if by the end of the pilot program, all Pl data is submitted by each pilot plant within one business I

day of the due date.

6.2 Risk-informed Baseline inspection Program The following criteria will measure the efficiency and effectiveness of the baseline inspection program, including inspection planning, conduct of inspections, and inspection finding documentation.

Can the inspection planning process be performed in a timely manner to support the assessment cycle? It can, if the planning process supports the scheduling of all required I

inspections for the upcoming period and the issuance of a 6-month inspection look-I ahead letter within 4 weeks from the end of an assessment cycle for at least 8 out of the

' 9 pilot plants.

Are the inspection procedures clearly written so that the inspectors can consistently conduct the inspections as intended? They are, if by the end of the pilot program, resources expended to perform each routinely performed (e.g., monthly) inspection I

f procedure are within 25% of the average for at least 8 out of the 9 pilot plants. Similar i

16 Revision A

data and analysis will be assessed for less frequently performed procedures (e.g.,

I biennial safety system design inspection). Inspection procedure quality will also be i

determined by an analysis of the numerical rating factors and a review and evaluation of I

the comments received on the procedure feedback forms.

I Are less NRC resources required to provide adequate oversight of licensee activities through inspection? They are,if the direct inspection effort expended to perform baseline and regional initiative inspection activities are less than the resources that would I

have been expended under the current inspection program. Review will be based on a I

comparison of the pilot program direct inspection resources against the regional average I

during the pilot and the resources required for the same plant prior to the pilot.

I Can inspection reports be issued and the plant issues matrix (PIM) updated in a timely I

manner to support the assessment process? They can if by the end of the pilot,90% of I

the pilot plant inspection reports (except those for major team inspections) were issued I

within 30 days of the end of the inspection period with the PIMs updated within 14 days I

of the issuance of the inspection reports.

I Are the scope and frequencies of the baseline inspection procedures adequate to address their intended cornerstone attributes? They are, based on the evaluation of any I

specific examples of risk-significant aspects of licensee performance which are not I

adequately covered by the baseline inspection program. These examples will be I

solicited from the NRC staff, the public, and the industry through the use of inspection I

procedure feedback forms and surveys.

I 6.3 Significance Determination Process l

The following criteria will measure whether the significance determination process can be I

effectively used to categorize the risk significance of inspection findings in a timely manner.

I I

Can the SDP be used by inspectors and regional management to categorize inspection i

findings in a timely manner? It can, if the phase 2 evaluations can be completed within i

30 days of the phase 1 evaluation,90% of. the phase 3 evaluations can be completed I

within 90 days of the phase 1 evaluation, and 100% of the phase 3 evaluations can be I

completed with 120 days of the phase 1 evaluation.

I Can inspection findings be properly assigned a safety significance rating in accordance with established guidance? They can, if a review of inspection findings by the SDP l

operational suppoit team, chosen for 95% assurance, demonstrates that at least 95% of I

the findings were properly categorized by the SDP. This review will also confirm that no risk-significant inspection findings were screened out. Additionally, by the end of the i

pilot, there should be no instances where the Significance Determination Process and i

Enforcement Review Panel changes an SDP determination performed by the regions.

I 6.4 Assessment The following criteria will measure the efficiency and effectiveness of the new assessment processes.

17 Revision A l

o Can the assessment process be performed within the scheduled time? It can, if for at least 8 out of the 9 pilot plants, a mid-cycle assessment of the Pts and inspection findings can be completed, with a letter forwarding the results and a 6-month inspection look-ahead schedule, within 4 weeks of the end of the assessment cycle.

Can the action matrix be used to take appropriate NRC actions in response to indications of licensee performance? It can, if there is no more than one instance (with a goal of zero) in which the action taken for a pilot plant is different from the range of actions I

specified by the action matrix.

Are assessments of licensee performance performed for the pilot plants in a manner that is consistent across the regions and that meets the objectives of the assessment program guidance? They are, as determined by a review and evaluation of the outputs of the assessment process generated by each region.

I 6.5 Enforcement

~

The following criteria will measure the effectiveness of the new enforcement policy.

Are enforcement actions taken in a manner consistent with the assessment of inspection findings that results from the SDP? They are, as determined by a review by the Office of I

Enforcement of the issues evaluated by the SDP operational support team audit.

I 6.6 Information Management Systems The following criteria will determine whether the NRCs* information management systems are ready to support full implementation of the new regulatory oversight processes.

Are the assessment data and results readily available to the public? They are, if by the end of the pilot program, the NRC information systems support receiving industry data, and if Pls and the current plant issues matrix are publicly available on the Intemet within l

I 30 days of the end of the data period (end of month for pilot) for at least 8 out of the 9 I

pilot plants.

Are the time reporting and budget systems, such as the Regulatory Information Tracking System (RITS), ready to support the process changes? They are, if by the end of the pilot program, the new RITS codes are established and the new codes are being used I

j properly.

I J

Are the NRC information support systems, such as the Reactor Program System (RPS)

=

and its associated modules, ready to support full implementation of the new oversight processes? They are, as deterrnined by the status of the systems identified as I

necessary to support the revised reactor oversight process.

I 6.7 Overall The following criteria will measure whether the revised reactor oversight proces rneets its I

overall objectives.

I 18 Revision A

O O

Do the combination of Pls and inspection findings provide an adequate indication of licensee performance? Does the oversight process provide a reasonable assurance that the cornerstone objectives are being met and safe plant operation is maintained? It I

does, based on a review and evaluation of any specific examples of risk-significant I

aspects of licensee performance that are not adequately accounted for in the revised I

reactor oversight process. These examples will be solicited from the NRC staff, the i

public, and the industry through public comment, feedback forms, and stakeholder I

surveys.

I Do the new oversight processes result in NRC assessments of licensee performance and NRC actions that are more understandable, predictable, consistent, and objective as perceived by both the industry and the general public? They are, if the industry and I

public have a better understanding of the regulatory oversight process, the assessment I

of licensee performance, and the reasons for NRC actions taken. Comments will be I

obtained through feedback forms and surveys of the industry and the public.

I Are the new regulatory oversight processes more efficient overall? They are, if by the end of the pilot program, the agency resources required to implement the inspection, assessment, and enforcement programs are projected to be less than currently required.

I Review will be based on a comparison of the resources expended for DIE and non-DIE I

activities at each pilot plant to the regional average during the pilot, and the same plant I

for the 6 month period prior to the pilot.

I Is the burden on licensees associated with the implementation of the revised reactor i

oversight process appropriate? It is, based on feedback of how the regulatory burden I

associated with each of the revised oversight processes has changed as compared to 1

the current oversight processes. These comments will be solicited from the NRC staff, I

the public, and the industry through the use of a public comment period, feedback forms,

-l and surveys.

I l

)

19 Revision A

I

]

I 7 PILOT PROGRAM RITS GUIDANCE The following tables provide guidance for NRC staff to charge time related to pilot program I

activities. Table 7.1 describes how direct inspection effort under the baseline inspection i

program should be charged by the staff. Table 7.3 describes how non-direct inspection time I

spent performing activities related to inspection preparation, documentation, assessment, and i

enforcement should be charged. Table 7.4 describes how time spent on non-docket related I

activities should be charged. Time spent on any activities not covered by tables 7.1,7.3, or 7.4 I

should be charged using existing RITS guidance.

I I

Use Form 7.2 to crosswalk pilot direct and non-direct inspection activities to existing RITS I

activity codes to determine the appropriate codes to charge time to. In addition to entering the I

time on the normal RITS form, record the breakdown of non-direct inspection activity hours I

using Form 7.2. The " Pilot Plant Activity Codes" are still being developed and should not be I

used to charge time to. Once the new " Pilot Plant Activity Codes" have been established and I

are functional in the RITS system, this form will no longer be necessary. Forward the completed I

form via either e-mail or fax each week to the appropriate regional point of contact.

I I

Table 7.1 - Baseline inspectable Area RITS Guidance (See Note 1)

I IP/lA NO.

TITLE

($& Mfd $$ltN6iss$rsiintyliliisilipidEvilidisilmhind SpidMidIEAMintrhrit/h$$hM 71111.01 Adverse Weather Preparations 71111.02 Changes to License Conditions and Safety Analysis Reports 71111.03 Emergent Work 71111.04 Equipment Alignment 71111.05 Fire Protection 71111.06 Flood Protection Measures 71111.07 Heat Sink Performance 71111.08 Inservice inspection Activities 71111.09 inservice Testing of Pumps and Valves 71111.10 Large Containment isolation Valve Leak Rate and Status Verification 71111.11 Licensed Operator Requalifications 71111.12 Maintenance Rule implementation 71111.13 Maintenance Work Prioritization and Control 71111.14 Nonroutine Plant Evolutions 71111.15 Operability Evaluations 71111.16 Operator Workarounds 20 Revision A

IPAA NO.

TITLE 71111.17 Permanent Plant Modifications 71111.18 Not Used 71111.19 Post Maintenance Testing 71111.20 Refueling and Outage Activities 71111.21 Safety System Design and Performance Capability 71111.22 Surveillance Testing 71111.23 Temporary Plant Modifications 1Imiig

[ N Y N k ddh3N M M h N M 71114.01 Drill and Exercise inspection 71114.02 Alert Notification System Testing 71114.03 Emergency Response Organization Augmentation 71114.04 Emergency Action Level Changes lllllf}

[ l['.l?}3

[iQyff9g&

71121.01 Access Control to Radiologically Significant Areas 71121.02 ALARA Planning and Controls 71121.03 Radiation Monitoring instrumentation II.YI,$

71122.01 Gaseous and Liquid Effluent Treatment Systems 71122.02.

Radioactive Material Processing and Shipping 71122.03 Radiological Environmental Monitoring Program kMh

!kb ykhw h

NlN kkMhNkN k[ N N k M f N 71130.01 Access Authorization 71130.02 Access Control 71130.03 Response to Contingency Events Y6?Nbh$bbdIS$Y$$$$$MIt!d77fikPisntlSensus 3@fMid@Ed6!$$$$M$ !@?^

71150 (Note 2)

Plant Status I

$)[d$Ndb5N$k$$MNh(hhI1ES$

N bb b

71151 Performance Indicator Venfication

%ypp:fAgedr mgfleW, =:~idoneNicollon and Resolution of Problems gib?",,%y gp%+

--w

~n=

--~-+

nw pn ce Gyc hv 71152 Problem Identification and Resolution of Problems 21 Revision A 1

)

7 IPAA NO.

TITLE MIlIMM$$$N$ $ M3@ @$8hf!(M1SIE M M Ml@I9hYMif51NO M iny~?idfi 71153 Event Follow Up Note 1 - Use "OA" as the IPE code for the above inspection related activities Note 2 - Charge time to IP 71150, Plant Status to Non-Direct inspection as shown on Form 7.2 1

22 Revision A

Form 7.2 -Cross Walk of Pilot Direct and Non-Direct inspection Activity Codes to existing RITS Codes l

I Name l

Hours for the week ending

/

/

I Docket No.

I Site inspection Report No.

l l

l Non-Direct inspection Activity RITS Guidance I

Pilot Plant Activity Pilot Hours for Existing RITS Existing Comments I

Description Plant Pilot Description RITS I

(Note 4)

Activity Program Activity l

Code Code 1

Reg.

Non-l Re l

Baseline lnspection BIP Routine inspection APP Preparation Prep / Doc Baseline inspection BID Documentation Reactive / initiative RIP Reactive inspectxin ARP inspection Preparation Prep / Doc Reactive / Initiative RID inspection Documentation Enforcement ENF Escalated Enforcement BA2 VIOs/NOEDs/Non-sDP Enforcement Normal Enforcement BA1 NCVs part of normalinspection Assessment AsM Assessment TAC _ _ _ (Note 3) i Significance Determination sDP sDP (Note 3)

Process (sDP)

TAC Phase 11 and til effort only - Phase I screening part of normalinspection IP 71150 Plant status IP 71150 Plant status TAC 1

Inspection Related Travel AT ns tion Related AT ll Allegation Follow-up

%gs$.M.,

k.

BJ2 Allegation Follow-up BJ2 (Prep / Doc) l(Prep / Doc) py l

l ll Technical Document l

I Technical Document l

5 I

RLD RLD WMYb F '

l Review l

l l

ll Review l

l Direct inspection Effort RITS Guidance l

l Baseline inspection BI e

utine OA NikN5NIMbd l

l Initiative inspection hhN Regional Initiative R1 RI hhihbh]

l

!h h

<f Reactive inspection RR Reactive inspection RR 23 Revision A J

l i

J

tr-Note 3 - Use the following TAC numbers as the " Existing RITS Activity Code" to charge SDP, 1

Assessment, and IP 71150 Plant Status time.

I I

SDP TAC #

Assessment TAC #

IP 71150 Plant Status TAC #

1 l

Cooper MA5569 MA5583 MA5597 l

FitzPatrick MA5570 MA5584 MA5598 l

Ft Calhoun MA5571 MA5585 MA5599 i

Harris MA5572 MA5586 MA5600 l

Hope Creek MA5573 MA5587 MA5601 1

Prairie Island 1 MA5574 MA5588 MA5602 l

Prairie Island 2 MA5575 MA5589 MA5603 l

Quad Cities 1 MA5576 MA5590 MA5604 I

Quad Cities 2 MA5577 MA5591 MA5605 l

Salem 1

. MASS 78 MA5592 MA5606 1

Salem 2 MA5579 MA5593 MA5607 l

Sequoyah 1 MA5580 MA5594 MA5608 l

Sequoyah 2 MA5581 MA5595 MA5609 l

l 1

Note 4 - Use the guidance in Table 7.3 to charge non-direct inspection time under the new I

oversight processes.

I I

Table 7.3 - Non-Direct inspection Activity Guidance l

ACTIVITY DESCRIPTION I

Baseline inspection Preparation Time spent preparing for the conduct of baseline I

inspection activities. Preparation may occur prior to I

and during an inspection.

I Baseline inspection Documentation Time spent documenting the results of baseline I

inspections, preparation of inspection reports, and i

the preparation / update of the plant issues matrix l

Reactive / initiative inspection Preparation Time spent preparing for the conduct of regional l

initiative and reactive inspection activities.

I Preparation may occur prior to and during an I

inspection.

I Reactive / Initiative inspection Documentation Time spent documenting the results of regional I

initiative and reactive inspections, preparation of 1

inspection' reports, and the preparation / update of the i

plant issues matrix l

Enforcement Time spent dispositioning inspection findings under I

the revised enforcement policy. This includes both I

time spent on violations under the new policy and i

non-SDP enforcement effort.

I Assessment Time spent preparing for and conducting all I

assessment activities including, continuous, I

quarterly, mid-cycle, and end-of-cycle reviews.

1 24 Revision A

I ACTIVITY DESCRIPTION I

Significance Determination Process Time spent evaluating the significance of all l

inspection findings using the significance i

determination process (phase 2 and 3 only).

1 IP71150 Plant Status Time spent understanding current plant status and I

activities, including control room and plant I

walkdowns and attendance of licensee status I

meetings.

I I

I Table 7.4 - Non-Docket Activity RITS Guidance l

TAC #

PA#

TITLE DESCRIPTION I

MA5132 131F TTF Change Coalition Activities Covers time spent in meetings, I

teleconferences, video conferences, I

etc..., associated with the TTF change I

coalition.

I MA5104 9A1E New Regulatory Oversight include both staff time spent in actual 1

Process Training training courses / workshops and self-I study time spent at sites, regions, or i

HQ l

MA3792 131F Development of Training HQ staff time spent to develop and i

present training i

M99263 111KJ Assessment Program Time spent in the development of the l

Development new assessment process l

MA3464 131F Baseline inspection Program Time spent in the development of the I

' Development baseline inspection program, including I

)

inspection manual chapters, I

inspection procedures, and the I

inspection finding significance I

determination process l

I 25 Revision A i

8 PLANTISSUES MATRIX GUIDANCE I

i The format of the plant issues matrix (PIM) has been modified for the pilot plants to I

accommodate the revised reactor oversight process requirements. This revised format does not I

apply to the remainder of the NRC-licensed plants. Additional PIM preparation guidance is I

included in Section 06.03 of draft inspection Manual Chapter (IMC) 0610*," Inspection Reports."

i The guidance contained here will take precedence over that in IMC 0610* if the two are found to I

be inconsistent. Inspection Manual Chapter 0610* will be revised prior to full implementation of I

the revised reactor oversight process to reflect the appropriate PIM guidance.

1 I

The primary differences between the revised PIM and the standard PIM include':

i l

1.

The " Functional Area" field has been replaced by the " Cornerstone" field.

I I

2.

The " Template Codes" field has been replaced by the " Significance Determination" field.

I I

3.

There will be a second paragraph added in the " Item Description". field that discusses the i

significance of the PIM entry.

I i

4.

The choices for the " Type" field have been changed and significantly reduced.

I l

5.

Cause codes will no longer be used.

1 I

6.

Reports can be requested by docket (unit) number in addition to by site name.

I I

I 8.1 Input (Data Entry)

I i

1.

Data will be entered into the revised reactor oversight process PIM via the Reactor l

Program System / item Reporting (RPS/lR) module, similar to the standard PIM data i

entry. The initial data. entry screen will look the same regardless of whether you are i

entering data for a pilot plant or a non-pilot plant. In order to minimize confusion and I

potential hurpan error, RPS/lR has been coded to recognize which plants are l

participating in the pilot program so that the data-entry person will be prompted with only I

the applicable choices. In other words, the pilot plant field / choices (i.e., cornerstone, I

significance determination) will be invisible to non-pilot plants and vice-versa. If you are i

modifying an existing record, you will be given a complete listing of choices for each field I

regardless of whether you are revising data for a pilot or non-pilot plant. When modifying i

PIM data for the pilot plants, care should be taken to use only the applicable choices I

consistent with this guidance.

I I

2.

There are only five " Type" selections available for pilot program plants, which will be l

l defaulted to the PIM list, as listed below. For Part 21s, LERs, and other items of interest i

l you wish to track, use the " Independent item" button on the tool bar and enter the l

appropriate data. In the " Type" field, select the appropriate item type from the pull down I

1 menu:

I 26 Revision A

a.

VIO (Violation)- Equivalent to a Notice of Violation per NRC's enforcement I

policy,' a formal written citation in accordance with 10 CFR 2.201 that sets forth I

one or more violations of a legally binding regulatory requirement.

I I

b.

NCV(Non-Cited Violation)- A violation for which the NRC chooses to exercise I

discretion and refrain from issuing a 10 CFR 2.201 Notice of Violation.

I I

c.

AV(Apparent Violation)- A potential noncompliance with a regulatory I

requirement that has not yet been formally cited as a violation in a Notice of I

Violation or order. Once the final regulatory action has been determined, the i

entry should be updated to VIO, NCV, or FIN as appropriate to reflect the action 1

taken (in accordance with the IR Users Guide). if no regulatory action is taken, I

the AV should be removed from the PIM (i.e., remove the check from the box to I

default to PIM). An Apparent Violation is similar to the existing RPS type code of l

Escalated Enforcement item (EEI).

I l

d.

URI (Unresolved item) - An item that requires more information to determine I

whether the issue in question is an acceptable item, a deviation, or a violation.

I Once the URI has been resolved, the entry should be updated to VIO, NCV, or i

FIN as appropriate to reflect the action taken (in accordance with the IR Users l

Guide). If no regulatory action is taken, the URI should be removed from the PIM i

(i.e., remove the check from the box to default to PIM),

I I

e.

F/N (Finding) -- An inspection observation that is not a violation of NRC l

requirements but has been placed in the context of other observations and I

findings and assessed for significance.

l l

3.

Enter a concise yet descriptive title for the PIM entry in the " Title" field. This title will be I

automatically printed on the PIM report atop the item description in the " item i

Description / Significance" column for each PIM entry. In the " Type Specific" box, enter I

the appropriate information as prompted from your Type selection (i.e., severity level, EA I

case number, etc).

I i

I 4.

In the " Functional Area / Primary" field, select the appropriate " Cornerstone"from the i

pull down menu. Here you are determining which aspect of safe nuclear plant operation I

has been challenged based on your finding. In essence, we will be capturing inspection I

findings by "comerstone" as opposed to SALP functional area, as we had in the past.

I I

a.

Initiating Events-The objective of this cornerstone is to limit the frequency of I

those events that upset plant stability and challenge critical safety functions, I

during shutdown as well as during power operations. Findings may result from I

inspection areas including (but not limited to) fire protection; testing of steam i

generator tubes and reactor coolant system piping; and operating equipment I

lineups.

I I

b.

Mitigating Systems - The objective of this comerstone is to ensure the I

availability, reliability, and capability of systems that mitigate initiating events to I

prevent reactor accidents. Findings may result from inspection areas including I

protection of equipment from external events; equipment design adequacy and 1

27 Revision A

r 8

0 design modifications; test procedure adequacy; operator training and certification; I

and emergency operating procedures.

1 I

c.

Barrierintegrity-The objective of this cornerstone is to ensure that physical I

barriers protect the public from radionuclide releases caused by accidents.

I Findings may result from inspection areas including configurations of control rod I

alignments during risk significant evolutions; configurations of key equipment in I

the reactor coolant system during shutdown; in-service inspection programs; I

equipment design adequacy and design modifications; and line-up of equipment I

penetrations.

I I

d.

Emergency Preparedness - The objective of this cornerstone is to ensure that I

actions taken by the emergency plan would provide adequate protection of the i

public health and safety during a radiological emergency. Findings may result I

from inspection areas including ensuring the adequacy of licensee assessments I

of exercises, drills, severe accident management guidelines, equipment, and i

facilities; and changes to emergency action levels in accordance with 10 CFR l

50.54(t) as appropriate.

I I

e.

Occupationa/ Radiation Safety-The objective of this cornerstone is to ensure I

adequate protection of worker health and safety from exposure to radiation from I

radioactive material during routine civilian nuclear reactor operation. Findings I

may result from inspection areas including the identification and monitoring of I

high radiation areas; source term control; ALARA planning; and contract health I

physics technician performance.

1 I

f.

Public Radiation Safety-- The objective of this cornerstone is to ensure adequate I

protection of public health and safety from exposure to radioactive material I

released into the public domain as a result of routine reactor operations. Findings I

may result from inspection areas including calibrations of and modifications to I

waste processing equipment; verifying operability of meteorological I

instrumentation; packaging and transportation of radioactive materials; and I

effluent sampling.

I i

g.

Physical Protection - The objective of this cornerstone is to provide assurance i

that the physical protection system can protect against the design basis threat of I

radiological sabotage. Findings may result from inspection areas including testing i

of barrier intrusion, detection, and alarm systems; search, identification, and I

control processes; response to security related incidents; and reporting of I

significant events.

I I

The

• Functional Area / Secondary" field will not be used. For a more complete listing of I

inspectable areas by cornerstone, see Table 3 from Attachment 1 to SECY-99-007, I

" Recommendations for Reactor Oversight Process improvements."

I i

5.

In the " Template Codes / Primary" field, select the appropriate " Significance l

Deterrninstion"from the pull down menu. Inspection findings will be run through the i

Significance Determination Process (SDP) to assess the safety significance and i

28 Revision A

1 e

determine the appropriate regulatory response. As a result of the SDP, the item will be I

assigned a color (green, white, yellow, or red) based on its significance.

I I

a.

Green-Licensee Response Band. As a result of the SDP, the finding was i

determined to only warrant NRC ' baseline" oversight (cornerstone objectives fully I

met, no significant risk or deviation from expected performance).

I I

b.

White -- Increased Regulatory Response Band. As a result of the SDP, the I

finding was determined to warrant an increased regulatory response (cornerstone I

objectives met with minimal reduction in safety margin, outside bounds of I

expected performance, within technical specification limits, changes in I

performance but with very small effect on accident risk).

I I

c.

Yellow-Required Regulatory Response Band. As a result of the SDP, the i

finding was determined to warrant a required regulatory response (cornerstone I

objectives met but with significant reduction in safety margin, technical i

specification limits reached or exceeded, changes in performance with a small I

effect on accident risk).

I I

d.

Red-- Unacceptable Performance Band. As a result of the SDP, the finding was I

determined to be unacceptable (plant performance significantly outside design I

)

basis, loss of confidence in ability of plant to provide assurance of public health I

j and safety with continued operation, significant reduction in margins of safety).

I J

l J

e.

TBD - Significance not yet determined. Further evaluation necessary. Items with I

j a significance of TBD should be considered draft items and should not be 1

included on the formal PIM.

I I

Not all PIM entries will be run through the SDP, such as violations of regulatory I

requirements that aren't hardware related. Examples of these types of items include 1

{

violations of 10CFR Sections 50.5, " Deliberate Misconduct," 50.7, " Employee Protection,"

l 50.9, " Completeness and Accuracy of information," and 50.73," Licensee Event Report i

System." For those items and similar violations of regulatory requirements, enter the I

appropriate severity level of the violation in the " Significance Determination" field.

I l

a.

SL-1-- Items not run through the SDP which resulted in Severity Level I violations.

I I

b.

SL-//-- ltems not run through the SDP which resulted in Severity Level 11 I

violations.

I I

c.

SL-ill -- ltems not run through the SDP which resulted in Severity Level 111 I

violations.

I I

I d.

SL-IV-- Items not run through the SDP which resulted in Severity Level IV I

violations.

I I

The " Template Codes / Secondary" and " Template Codes / Tertiary" fields will not be I

)

used. In addition, the "Cause Codes / Primary" and "Cause Codes / Secondary" fields will I

not be used.

I 29 Revision A

o 6.

Fill in the remaining fields on the Status and Procedures screens as you would for a i

standard PIM entry. Be sure to select the applicable dockets / units because we will be I

sorting and reporting by both site and docket number.

I I

7.

Enter a brief description of the PIM entry in the "/ tem Description / Significance" field.

I For Inspection Report items, the description should be essentially verbatim from the IR I

Summary of Findings. Press the < enter > key twice to begin a second paragraph within I

the same field and enter a brief description of the item's significance. The " Comments I

I (IFS Only)" will not be used.

I EXAMPLE:

I I

The 1-A emergency diesel generator (EDG) was found to be l

inoperable for 28 days due to improper wiring of the governor.

I This is a violation of Technical Specification 3.8.1 which limits EDG l

allowable outage time to 3 consecutive days. [from IR]

I l

This issue was characterized as a " white" finding based on the l

Phase 2 Significance Determination Process (SDP) review. The I

1 f

licensee's review of the significance of this issue was consistent i

with the inspector's determination. The EDG's safety function is to I

J mitigate a loss of off-site power (LOOP) event where the EDG is I

used to power the emergency electrical busses. The likelihood of I

occurrence of the LOOP event during the 28 day period was in the i

range of 1 per 10 - 10' years, based on Table 1 of the SDP I

Guidance. There was no additional LOOP mitigation equipment I

inoperable during this time period and the initiating event did not I

I occur.

I i

I 8.2 Output (Reporting) l

)

1.

Revised Reactor Oversight Process PIM reports will be requested via the RPS/lR or l

RPS/ Reports modules, similar to the standard PIM report request. Select

• Revised I

Oversight Process PIM Report" (Report #4) from the pull down menu under reports. Old I

style PIM reports can still be obtained using the "PlM Report" (#3) selection.

I I

2.

Select the docket number or site name for which you would like a revised PIM report.

I Note that the " Functional Area" and " Template Codes" columns have been replaced by i

I the " Cornerstone" and " Significance Determination" columns, respectively. In addition, I

f the "Lem Description" column has been replaced by the *ltem Description / Significance" 1

column, which should include a title, a paragraph summarizing the finding, and a second I

I paragraph describing the significance of the finding.

i 3.

PIM Reports which are sent as attachments to the assessment letters should be printed I

by site. The PIM reports which will be posted on the web page will be presented by l

docket number. In either case, the default will be to sort the PIM entries by cornerstone I

I in reverse chronological order.

I 30 Revision A

4.

When running a PIM report for the pilot sites, it would be prudent to verify whether the i

entries identify the appropriate dockets / units, and whether the " Cornerstone" and

• I

" Significance Determination" columns include only the relevant data (i.e., no " Functional i

Areas" or " Template Codes"). If you wish to obtain a PIM report for a pilot site for a time I

period which includes both pre-pilot and pilot activities, you should request a standard l

PIM report for the pre-pilot time frame (i.e., pre June 1,1999), and a revised PIM report i

for the applicable pilot period.

I l

i 31 Revision A

e 9 PILOT PLANT SELECTION The following criteria were used to identify potential sites for the pilot program:

To the maximum extent possible, licensees were chosen that had either volunteered to participate in the pilot program, or that had participated in the NEl task group working on improving the regulatory oversight processes. A number of different licensees were chosen to participate in order to maximize industry exposure to the new processes.

Plants were chosen to represent a broad spectrum of performance levels, but plants that were in extended shutdowns'because of performance issues were not considered.

A mix of pressurized-water reactors (PWRs) and boiling-water reactors (BWRs) was chosen.

A mix of plant vendors and plant ages was chosen.

To the extent possible, two plants with different performance levels within each region were chosen.

NRC regional office concems, such as experience of NRC staff associated with pilot plants and transition issues (such as expected departure of key NRC personnel during the pilot program), were considered.

Licensee concems, such as their involvement with other significant NRC activities (license renewal, steam generator replacement, etc.), were considered.

These criteria, and potential candidate plants, were discussed with NRC headquarters and regional management, and with NEl. All potential plants selected to participate were first contacted by NEl, and all agreed to participate in the pilot program. Before publicly announcing which sites were participating in the pilot program, the NRC staff contacted each of the j

appropriate State organizations to notify them of the site's participation in the pilot program.

After the State notifications were completed, a press release was issued on February 22,1999, to announce the pilot program and the participating sites. In conjunction with the pilot program,

)

the staff has offered to participate in public meetings with State and local representative to discuss the pilot program and the revised oversight processes.

l The following table summarizes the sites that the NRC and the industry agreed would participate in the pilot program. It is important to note that there are actually nine pilot plants since Public Service Electric & Gas Company (PSE&G) requested that both Salem and Hope Creek participate in the pilot program. NRC headquarters and Region I managem'ent agreed with this request.

I i

32 Revision A

1

)

e

=

i Table 8.1 - Pilot Plants m

f f;

I.

.f,;' '

7, g! g j

j i

Hope Creek Public Service Electric 2/2/2/1 BWR General

& Gas (PSE&G)

Electric (GE)

Type 4/

13 years f

I Salem 1&2 PSE&G 1/2/2/1 PWR 4 Loop Westinghouse (W)/

20 years i

FitzPatrick New York Power 2/2/2/2 BWR GE Type 4/

Authority 24 years ll Harris Carolina Power & Light 1/1/2/1 PWR 3 Loop W/

Company 12 years 11 Sequoyah Tennessee Valley 2/2/2/1 PWR 4 Loop W/

1&2 Authority 18 years lll Prairie Island Northern States Power 2/1/2/1 PWR 2 Loop W/

1&2 Company 25 years ill Quad Cities Commonwealth Edison 2/3/3/2 BWR GE Type 3/

1&2 Company 26 years IV Ft. Calhoun Omaha Public Power 2/2/1/2 PWR Combustion District Engineering (CE)/

26 years IV Cooper Nebraska Public Power 2/2/3/1 BWR GE Type 4/

District 25 years

SUMMARY

9 Plants 8 Licensees 1/1/2/1 5 PWRs 4 W plants to 4 BWRs 1 CE plant 2/3/3/2 4 GE olants Note 1 - SALP scores correspond to the following SALP functional areas:

Operations / Maintenance / Engineering / Plant Support 1

33 Revision A

F o

Inspection Manual Chapter 06XX l

l

)

3 i

NRC INSPECTION MANUAL PIPB Manual Chaoter 06XX SIGNIFICANCE DETERMINATION PROCESS 06XX-01 PURPOSE To provide guidance for the significance determination (Risk Characterization) of an inspection program finding. The inspection finding significance determination processes described in this procedure and its appendixes evaluate the significance of individual inspection findings so that the overall licensee pedormance assessment process can compare and evaluate them on a significance scale similar to the plant pedormance indicator (PI) information. Licensee-idantified issues, when reviewed by NRC inspectors, are also candidates for this process.

06XX-02 OBJECTIVE d

02.01 To characterize the risk significance or importance of an inspection finding consistent with the regulatory response thresholds used for performance indicators (Pis) in the NRC licensee performance assessment process.

02.02 To provide a risk-informed framework for discussing and communicating the potential significance of inspection findings.

02.03 To provide a basis for assessment or enforcement actions associated with an inspection finding.

02.04 To specify the minimum amount of documentation needed to allow reconstruction of the basis for any decisions associated with the risk significance ranking of an inspection finding.

i 06XX-03 DEFINITIONS Accarent Risk Sionificant issue. An issues that has been processed through the SDP and its risk estimation is greater than that associated with a Green finding.

Findino. As used in this chapter, an observation that has been placed in context and assessed for significance.

Observation. A fact; any detail noted during an inspection.

Sianificance Determination. The process for applying a risk characterization to an individualissue for the purpose of providing an ir)put to the NRC's Reactor Oversight Plant Assessment and Enforcement Processes.

06XX-04 RESPONSIBILITIES AND AUTHORITIES All NRC inspectors are required to assess the significance of inspection findings in accordance with the guidance provided in this inspection Manual chapter. General and specific responsibilities are listed below.

Issue Date: 08/10/99 Revision 1 DRAFT 06XX

04.01 Director. Office of Nuclear Reactor Reaulation.

a.

Provide overall program direction for the reactor inspection program.-

b.

Develop and direct the implementation of policies, programs, and procedures for regional application of the Significance Determination Process in the evaluation of findings and issues associated with the Reactor Oversight Program.

c.

Assess the effectiveness, uniformity, and completeness of regionalimplementation of the SDP.

04.02 Associate Director for Insoection and Proarams.

Direct the development of the SDP within NRR 04.03 Director. Division of Insoection Procram Manaaement I

a.

Jointly, with the Director, Division of Systems Safety and Analysis, develop and refine the i

SDP through periodic revisions based on new risk insights and feedback from users.

b.

Provide oversight and representatives as necessary to support the Significance Determination Process Oversight Panelin order to ensure consistent application of the process.

l 04.04 Director. Division of Systems Safety and Analvsis.

I a.

Jointly, with the Director, Division of Inspection Program Management, develop and refine j

i the SDP through periodic revisions based on new risk insights and feedback from users.

I I

I b.

Provide oversight and representatives as necessary to support the Significance i

Determination Process Oversight Panelin order to ensure consistent application of the i

process.

04.05 Director. Office of Enforcement a.

Ensure consistent application of the enforcement process to violations of NRC regulations with the appropriate focus on the significance of the issue, b.

Provide representatives as necessary to support the Significance Determination Process

. Oversight Panelin order to ensure consistent application of the process.

04.06 Director. Office of Research a.

Provide support in the development and refinement of the SDPs, which use risk insights from research activities.

b.

Provide representatives as necessary to support the Significance Determination Process Oversight Panelin order to ensure consistent application of the process.

04.07 Recional Administrator a.

Provide pr ram direction for management and implementation of the SDP to activities performed the Regional Office.

b.

Provide representatives as necessary to support the Significance Determination Process Oversight Panel in order to ensure consistent application of the process, Within the guidance of the Reactor Oversight Program, apply inspection resources, as c.

necessary, to determine the significance os specific issues identified.

06XX-05 BASIC REQUIREMENTS 06XX DRAFT Revision 1 Issue Date: 08/10/99

INSPECTION FINDIN3 Cl:NIFICANCE DFTERMINATION PROCESS (SDP)

Introduction SECY-99-007, dated January 8,1999, described the need for a method of assigning a risk characterization to inspection findings. This risk characterization is necessa so that inspection findings can be aligned with risk-informed plant performance indicators (P ) during the plant performance assessment process. Figure 1 describes the process flow typical inspection findings or issues. Figure 1 also outlines the different paths an issue could take with the final t u of each process being an inouL to the assessment and/or the enforcement process.

n orcement associated with violations o regulatory requirements will be processed in accordance with NUREG-1600, Rev 1, General Statement of Policy and Procedures for NRC Enforcement Actions and any applicabis Enforcement Guidance Memorandums (EMGs). Minor violations, as I

defined by the enforcement policy,ing this process they would be screened as green findi do not need to be reviewed using this process. However, if I

minor violations were evaluated us I

during the phase 1 review.

1 Appendix 1 of this attachment describes the significance determination of inspection findings, which I

have a potential impact on power operations, thereby affecting the initiating event, mitigating systems, or barrier cornerstones associated with the reactor safety strategic performance area.

It is expected that this process will address most of the risk-significant issues that would be experienced at a facility. Issues associated with, emergengy preparedness, radiation safety, safeguards, fire protection and shutdown risk also needs a SDP as well. Appendix 2 of this attachment provided the SDP processes for emergency preparedness, radiation safety, and saf eguards. Appendix 3 for findings associated with shutdown activities will be provided later af ter I

additional staff development and review. Appendix 4 addresses the significance of degraded fire I

barrier and suppression systems. Appendix 5 describes the SDP and Enforcement Review Panel I

concept and provides a sample worksheet for issues to be brought before the panel.

I I

Issue Date: 08/10/99 3

Revision 1 DRAFT 06XX

1 O

I,ise I3 a

a a

n N

$5 B b *e 5'EE S E 5

l sg) 3 mig o

a en d-

gg g.E s

=

sgIn :

hE I

W "3

$io j

i IN en i

E 1111 dg 1<

a (11

-j!

11 16 a

a II 5

5 81!,!

e il ji

[...!

.1 n

j.

p.g tb 1

s o sv r)i

=+

y c!.

1

.s 1: 4

+

gni,3_

=

=

33 6 sita a]

.j

=

e Eo 8

Appendix 1 Significance Determination of Reactor inspection Findings for At-Power Situations l

Entrv Conditions The process in this Appendix is designed to assess only those inspection findings associated with I

at power operations within the cornerstones of initiating events, mit'gation systems, and barrier i

integrity under the reactor safety strategic performance area. Compliance with Technical Specifications (TS) and design-basis assumpt,ons continue to provide defense-in-depth and saf ety i

margins. This process was developed to provide a determination of relative risk significance for I

conditions that may affect these assumptions. An actual initiating event will either be captured by a performance indicator (e.g., a reactor tr:ip)isk analysts outside of the process described or, if it is complicated by equipment malfunction or operator error, should be assessed by NRC r I

Obiectives 1.To characterize the risk significance of an inspection finding consistent with the regulatory response thresholds used for performance indicators (PIs) in the NRC licensee performance assessment process and for entry into the enforcement process.

2.To provide a risk-informed framework for discussing and communicating the potential significance of inspection findings.

Definino Characteristic The most important intended characteristic of this process is that it provide a means for inspectors I

and their management to elevate potentially risk significant issues early in the process for timely I

licensee correction and/or agency action, and screen those findings that have minimal risk I

significance into the licensee's corrective action program. The process presumes the user has a l

basic understanding of risk analysis methods.

Introduction The proposed overaillicensee assessment process (as defined outside of this document) evaluates licensee performance using a combination of Performance Indicators (Pis) and inspections.

Thresholds have been established for the Pis, which, if exceeded, may prompt additional actions to focus licensee and NRC attention on areas in which there is a potential decline in licensee performance. T he inspection finding risk characterize. tion process described in this appendix and illustrated in Figure 1 evaluates the significance of individual inspection findings so that the overall licensee performance assessment process can compare and evaluate them on a significance scale similar to the Pi information. Licensee identified issues, when reviewed by NRC inspectors, are j

also candidates for this process.

l Issue Date: 08/10/99 Al-1 Revision 1 DRAFT 06XX i

1 er u

ig F

n o

t i

a n

t e) z

_ 3mM g

i

_ 2r I n e

ei e

et enu s n

_ s c sif q a ee

_ a a

_ a ee r

hr

_ ha

_ h Rr Pc

_ Ph g

_ P ks C

ny S

is (a i t i

ni l

k R

iab R

s a

i R

m p )3 E

ea 2

I Rc h

R p

t ene i

hot w

SR t

iS de 9

yta(

9 SA e

f g

i i t

/

t a

0 EB nit i

eM oe)

/

c 1

l C &

k sS4 8

s g2 O

0 Anp

]

R SR i

k Me e

sR h (t i

o a

PME t

S i

EW t

t e

D s

N T iM n

t m

s e

OS O y

u r

l T Y P_

r a

s s

o e

I AST_

i gi dk io e t

n s

s in f

m e

d A

i e

o r

D ai f

n; es nT k

p) ni is NG A i

id z1 eR ee t

1 en cr Rs n

I e

in M

Su)

Cu

x. p r

1 c o) l MNS s

F k

c o pl

?

Rs 2

f oe e

St 2 d;t b

e RT E g

I eA S sat dx a

_ t N R in l

nd(

f ip p o E. T EA N d

de A

ine mme o

n n f

hs&

ai n

ead eit i v f

TG O i

D da cla(

et 2 e

S F

l ee eM ni eR EI T f

e R

ot ot k n2 s

l DITS b

n ke Ce iep Lv a

n t

e i

l t

r e

cua e

p pm do eEt Tt e

E MR a

c n

S gd

~. _

L eP imin(

ne i

g r

,E S

mo a

t i r e

C TN F

t I

rt sC S

ea U

2 g

)

a N NR Dn e

t i t

cia le g

ei el n

e p" T A EO b

I nr a

E C VC co r 9&

if I

i pE FE np iga U 4 I

'2 NG Sg'e p

k nI GN si t

iy S

I I l

(

Rp ST g

ep

)

s in A

A ts (od I

aF1 im2 in)

T ri ts n y2 E

N ecbp I

Sde t

eteS y

inc(

f a 1

ep Dm n

io I

isv e

R

?

T FARD XX60

inspectionfindin barner integrity)gsrelat dtorrctorsafstycorn:rstonss(initittingsvants,mitigatingsyst ms.,and will be assessed differently than the remaining areas (emergency plann' occupational exposure, public exposure, and physical secunty).

For the reactor sa cornerstones, excluding the EP area, each finding is evaluated using a risk-informed framewo that relates the finding to specific structures, systems, or components (SSCs), identifies the core damage scenarios to which the failure of the SSCs contribute, estimates how likely the initiating event for such scenarios might be, and finally determines what capability would remain to prevent core damage if the initiating events for the identified scenarios actually occurred.

Bases The approach described in this Appendix was developed using input derived from other agency documents, including the following:

• Regulatory Guide 1.174,"An Approach for Using Probabilistic Risk Assessment (PRA)in Risk-Informed Decisions ~on Plant-Specific Changes to the Licensing Basis;"

• Table 1 was based on generic values obtained from,NUREG/CR-5499, " Rates of Initiating Events at U.S. Nuclear Power Plants: 1987 - 1995;"

• The accident sequence precursor (ASP) screening rules as outlined in NUREG/CR-4674,

" Precursors to Potential Severe Core Damage Accidents."

In addition, Table 2 is based on generic equipment unavailability values that are generally I consistent with values obtained from more detailed PRA models.

I Process Discussion The inspection finding assessment process is a graduated approach that uses a three-phase process to differentiate inspection findings on the basis of their actual or potential risk significance.

Findings that pass through a screening phase will proceed to be evaluated by the next phase.

Phase 1 - Definition and initial Screenine of Findings: Precise characterization of'the finding and an initial screening-ouIof low-significance findings Phase 2 - Risk Significance Approximation and Batis: Initial approximation of the risk significance of the finding and development of the basis for this determination for those findings that pass through the Phase 1 screening Phase 3 - Risk Significance Finalization and Justification: As-needed refinement of the risk s,ignificance of Phase 2 findings by an NRC risk analyst Phases'1 and 2 are intended to be accomplished primarily by field inspectors and their first-line managers. Until a user becomes practiced in its use, it is expected that an NRC risk analyst may be needed to assist with some of the assumptions used for the Phase 2 assessment. However, after inspection personnel become more familiar with the process, involvement of a risk analyst is expected to become more limited.- The Phase 3 review is only intended to confirm or modify the results of significant (" white" or above) or controversial findings from the Phase 2 assessment.

Phase 3 analysis methods will utilize current PRA techniques and rely on the expertise of knowledgeable risk analysts.

Phase 1 and Phase 2 worksheets, intended for inspector use to aid in their use of the SDP are I

developed for each reactor pinnt. These work-sheets will contain plant design specific information I

to assist in the use of TaNe 2 of this appendix. These work-sheets should be used by the I

inspectors, although it is expected that some simple screening m,ay be done mentally. However, I

for any issue where a Phase 2 analysis is conducted, the information necessary to reconstruct the i

Phase 2 analysis must be documented in the inspection report so as to provide a clear basis for I the significance determination of the issue.

I Step 1 - Definition and initial Screening of Findings Step 1.1 - Definition of the Inspection Finding and Assumed impact

.it is crucial that inspection findings be well defined in order to consistently execute the logic required by this process. The process can be entered with inspection findings associated with I

performance problems that involve one or more degraded conditions concurrently influencing any I

mitigation equipment and/or initiating event frequency. The definition of the finding should be l

Issue Date: 08/10/99 Al-3 Revision 1 DRAFT 06XX

f b sed on tha known existing frets End should NOT includ3 hypothstical failurcs such as the one I single failure assumed for hcensing basis desi,gn requirements.

I l When determining the risk associated solely with the licensee performance problem, it is not I necessary to include equipment that is out of service for routine maintenance or testing. The I impact of the likelihood of this equipment not being available for mitigation purposes is generally l. included in the licensee's baseline PRA equipment unavailability values. However, for the purpose I of initial NRC response to events and dooraded conditions, the SDP analysis should assume the 1 entire plant configuration, including out-oT service equipment for routine maintenance or testing.

I This approach allows the NRC to validate that the other out-of service equipment was not a result I: of pettormance problems.

The statement of the finding should clearly identify the equipment potentially or actually impacted, as this will be used in the nsk characterization process. In some cases, the impact of the finding can be stated unambiguously in terms of the status of a piece of equipment, for example, whether it is operable or not, or whether it is available to perform its function or not. In other cases, the finding may specify conditions under which a piece of equipment becomes unavailable. In still other cases, those involving degraded conditions for example, the impact is not determined, and assumptions will have to be made for the purposes of assessing the risk significance.

xplicitly stated assumptions regarding the effect of the finding on the safety functions should Anfafly be conservative (i.e., force a potentially higher risk significan init because the finalresultwill j

always be viewed from the context of those assumptions. Subsequent the licensee or other sources is expected, in many cases, to reduce the significance of the finding, with an appropriate explicit and defensible rationale. Findings must also be well defined because I the assumptions can be modified to examine their influence on the results and thereby gain

.I sensitivity insights. The general rule is that the definition of the finding must address its safety function impact and any assumptions regarding other plant conditions. Examples include the 4

following:

1. The following situations represent two different findin s: a motor-operated valve (MOV) iri a pressurized-water reactor (PWR) auxiliary feedwater AFW) system is found with hardened osarbox grease (i.e., is degraded); and an MOV in the FW system is found with a broken wire fhat renders it non-functional. For the purposes of assessing the risk significance, the impact 1

of both could be characterized conservatively as "MOV does not perform its safety function of opening to provide flow to the steam generators." In the first case, it is necessary to assume that the hardened grease makes the valve unavailable, while in the second it is not.

{

2. A finding involving a deficiency [in the design of the plant could be stated as follows:

" Equipment / System / Component X would not perform its safety function of.... under conditions.

" For example, a remote shutdown panel that might be rendered inhabitable during a cable spreading room fire that causes a loss of offsite power due to inadequate heating, ventilation, and air conditioning (HVAC) dispersion of the resulting smoke, would be characterized conservatively as " plant cooldown not possible from control room or remote shutdown panel from resulting smoke and loss of pow) caused by cable spreading room fire due to i during a loss of offsite power (LOOP er to remote shutdown panel HVAC."

Step 1.2 - Initial Screening of the inspection Finding For the sake of efficiency, the initial screening is intended to screen out those findings that have minimal impact on risk early in this rocess. The screening guidelines are linked to the cornerstones as follows: If there is ne gible impact on meeting the reactor safety cornerstone I objectives, the finding can be identified having minimalimpact on risk and should be considered I as a green finding to be corrected under the licensee's corrective action process.

The decision logic is described as follows:

If the finding and its associated assumptions, as defined in Step 1.1, could simultaneously adversely affect two or more reactor safety comerstones, then the user should proceed directly to I the Phase 2 analysis. Alternatively, the finding can be screened as green immediately (characterized as having little risk impact and exit thin process) if it can be shown to NOT affect any reactor safety cornerstone. Finally, if the finding and its associated assumptions affect only i ONE reactor safety comerstone, it may still be screenad as green as follows:

06XX DRAFT Revision 1 Al-4 issue Date: 08/10/99

If only th3 mitigition syst:ms cornststone is tffseted, then th3 findin0 and its associated assumptions would be considered green and a Phase 2 analysis would not be necessary if any of the following were true: the finding represents a design or qualification issue, but the licensee has declared the affected equipment or system operable under NRC Generic Letter 9118 guidance (and inspectors are not challenging the licensee's determination), OR the finding does NOT represent a loss of safety function of a system, OR the finding represents a loss of safety function of a single train of a multi-train system for LESS THAN the allowed outage time (AOT) prescribed by the limiting condition for operation (LCO) for Technical Specification equipment, OR the finding has not resulted in the failure of a non-Tech Spec controlled risk-significant system, structure or component under the maintenance rule (10 CFR 50.65) for greater than 24 - I hours.

I If only the initiating event cornerstone is affected and the finding and associated assumptions have no other impact than increasing the likelihood of an uncomplicated reactor trip, the finding would be considered a green finding.

I If only the fuel barrier is affected, the issue will be screened out since a Pl exists for this barrier.

I If any reactor coolant system affected, the issue will be assess (RCS) Phase 2. barrier function to mitigate an accident seque ed in If the containment barrier is affected, the concern is referred to a risk analyst until more guidance can be provided. However, if the concern is associated with containment cooling function needed to preserve the NPSH capability of the ECCS equipment during the recirculation phase, its impact should also be evaluated as part of mitigation system cornerstone above.

An inspection finding that is NOT screened as green by the above-mentioned decision logic I

I sh uld be assessed sing the Phase 2 process described herein.

The SDP can help to better understand the sensitivity of various assumptions regarding plant I

(

capability to the change in plant risk. For example if an inspection finding screens as green in i

Phase 1, it may be useful to use the SDP phase 2 process to examine the effect of other plant i

equipment being unavailable or degraded simultaneously with that of the finding. If the outcome I

of the SDP can be significantly influenced by the unavailability of other equipment (e.g. if a i

" combined" finding could be characterized as white or greater)lable., then inspection effort may be I

warranted to verify the assumption that this equipment was avai l

l Phase 2 - Risk Significance Approximation and Basis Step 2.1 - Define or Select the Applicable Scenarios l

Once an inspection finding passes into Phase 2, it is evaluated in a more detailed manner. The first step in Phase 2 is to ask the question "Under what core damage accident scenarios would the finding, as defined in Step 1.1, increase risk?" That is, the inspector must determine which core I

damage scenarios are adversely impacted by the finding.

Determining which scenarios make an inspection finding risk important may not always be intuitive.

Therefore, high level (functional) plant-specific scenarios taken from PRAs have been provided as I

a set of Phase 2 worksheets for each plant d'esign. Additionally, documents such as current plant i

specific PRA ins'ghts, safety analysis reports, Tech Spec bases, and emergency operating i

procedures should be reviewed as needed to ensure that all applicable events and circumstances I

are considered. Identifying the scenarios begins with identifying the equipment and the assumed or actualimpact of the finding, and takes into consideration the role the equipment plays in either the continued operation of the plant or the response to an initiating event. This step leads to an mitigating system, or both. For the mit,in either contributing to an initiating event or a identification of the role of the finding igating systems, the impact may be one of two kinds: the finding results in the equipment function being compromised or the finding relates to the identification of a condition under which the function would become compromised.

In the first of these two cases, the function can be assumed to be lost, and the scenario of interest is the initiating event for which the equipment is required and the remaining equipment that by design can provide the same function as that which has been lost. For the second case, the 1

scenario definition must also include the condition under which the function would become compromised. For example, if the finding is that while performing the switchover to recirculation in a PWR, the safety injection (SI) pumps could be irreparably damaged due to cavitation, the Issue Date: 08/10/99 Al-5 Revision 1 DRAFT 06XX

scenario definition includ:s tha loss of cool:nt cccid:nt (LOCA) initiating ev:nt, th3 frilurs of tha charging system (if it is a viable alternative means of providing sump recirculation), and also the human error (which represents the condition under which the pumps would fail). If the finding were that the Si pumps could never be aligned properly for some reason (this extreme case is an example to demonstrate a point only), the scenan,o definition would involve only the LOCA and the charging system failures.

During this phase of the process, inspectors may determine that several different scenarios are affected by a particular inspection finding. This determination can occur in one of two ways:

First, the finding may be related to an increase in the likelihood of an initiating event, which may require consideration of several scenarios resulting from this initiating event.

Second, a finding may be related to a system required to respond to severalinitiating events.

For example, the discovery of a degraded instrument air system could affect plant response to both a loss of offsite power and a LOCA. Each of these two initiating events must be considered separately l The scenarios resulting in the highest significance will be used to establish the initial relative risk-significance of the finding. If a Phase 2 assessment of multiple applicable scenarios results in all

" green" significance, the user should seek assistance of a risk analyst, since the Phase 2 process 1

cannot effectively " sum" the significance of multiple low-significance scenarios.

In identifying possible core damage accident scenarios, consideration must also be given to the role of support systems as well as the primary system. For example,if a particular initiating event can be mitigated by more than one system providing the same saf ety f unction, but all such systems are dependent on a single train of a support system (e.g., service water or emergency ac power),

the limiting scenario may involve the failure of the single train of the support system rather than the I individual primary system trains. Therefore, for findings involving support system functional I degradation, each scenario given on the Phase 2 worksheet must be examined for the impact of I this degradation on the primary system functions and the user may need to create a new scenario I by collapsing multiple primary system functions into a single associated support system failure.

Step 2.2 - Estimation of the Likelihood of Scenario initiating Events and Conditions in Ste 2.1, sets of core damage accident scenarios were determined that could be made more likely y the identified inspection finding (degraded condition). This step should result in the identif cation of one or more initiating events, each followed by various sequences of equipment I failures or operator errors. To determine the most significant scenarios, perform the following analysis for each set of scenarios with a common initiating event.

If the finding does not relate to an increased likelihood of an initiating event, the initiating events for which the affected SSC(s) are required are allocated to a frequency range in accordance with guidance provided in the left-hand column of Table 1 herein. Table 1 is entered from the left column, using the initiating event frequency, and from the bottom, using the estimated time that the degraded condition existed, to arrive at a likelihood rating (A - H) for the combination of the initiating event and the duration of the degraded condition.

If the finding relates to an increased likelihood of a specific initiating event, the likelihood of that initiating event is increased according to the significance of the degradation. For example, if the inspection finding is that loose parts are found inside a steam generator, then the frequency of a steam generator tube rupture (SGTR) for that plant may increase to the next higher frequency category, and Table 1 is entered accordingly.

When the scenario includes the identification of a condition under which a function, a system, or a train becomes unavailable, then this fact must be factored into the assessment. It is not appropriate to assume that the affected function, system, or train is unavailable. At this point, it is necessary that a risk analyst assess the probability of the condition, and adjust the likelihood of the initiating event (or events) by the appropriate amount. For example:

- A finding is that if a control valve in the instrument air system f ails it could lead to overpressure of a low-pressure part of the system, thereby leading to the failure of the equipment controlled by the air system. The probability of interest is that of the failure of the valve during the mission time, which depends on the irnpact of the failure. For example,if the valve failure would lead to a reactor trip in addition to failing some mitigating equipment, the mission time is 1 year, and the 06XX DRAFT Revision 1 Al-6 issue Date: 08/10/99

initi; ting cv:;nt frequency would be th3 probability of failure of tha valve in one ystr. If the impact is simply on the mitigating systems for a LOCA, the mission time is that time required to place the plant in a safe, stable state, in this case, the LOCA frequency would be adjusted by the probability that the valve failure would occur during the mission time.

Finally, the definition of the finding and the selection of core damage accident scenarios should be strictly based on the known existing facts and should NOT include hypothetical failures, such as the one single failure assumed for licensing basis design requirements. However, the selection I

of scenarios need NOT be restricted only to those described in the SDP worksheets and tables.

I The SDP provides a simplified risk framework to examine all possible scenarios based on plant-I specific design. Inspectors should recognize that reasonable probabilities must be assigned to I

each failure event in any scenario they may postulate.

1 1

I Issue Date; 9973n,99 Al-7 Revision 1 DRAFT 06XX

Tcbl]1 - E;timated Lik:lihood Rating f;r initiating Ev:nt Oc:urr:nca During Degr ded Period (taken from NUREG/CR 5499)

Row Approx. Freq.

Example Event Type Estimated Likelihood Rating

>1 per 1 - 10 yr Reactor Trip A

B C

I Loss of Power Conv. Sys.

(loss of condensor, closure of MSIVs, l

loss of feedwater) j 2

1 per 10 - 10 yr Loss of Offsite Power B

C D

Small LOCA (BWR)

(Stuck open SRV only) ll MSLB (outside entmt) 2 8

1 per 10 - 10 yr SGTR C

D E

Stuck open PORV (PWR)

Small LOCA (PWR) lli (RCP seal failures and stuck open SVs only)

MFLB MSLB (inside PWR cntmt) 8 1 per 10 - 10' yr ATWS-PWR (elect only) )

Small LOCA (pipe breaks D

E F

IV 5

1 per 10- 10 yr Med LOCA E

F G

ATWS BWR(BWR)

Large LOCA V

5

<1 per 10 yr Large LOCA (PWR)

F G

H VI ATWS-PWR (mech only)

ISLOCA Vessel Rupture

> 30 days 30-3 days

<3 days Exposure Time for Degraded Condition Table 1 - Estimated Likelihood for initiating Event Occurrence During Degraded Period l

Use of Table 1 should result in one or more initiating events of interest with an associated likeithood rating ("A" through "H") for each.

Step 2.3 - Estimation of remaining mitigation capability The scenarios of interest have now been identified, and Table 1 has been used to estimate associated initiating event frequencies and to combine them with degraded condition exposure time to arrive at an estimate of the likelihood of the initiating events. Following an initiating event, core damage will result from a series of system, component, or operator failures, in this step, the user will approximate the probability of f aifing to mitigate the core damage scenarios associated with the condition identified by the finding. Findings defined in Phase 1 whl generally identify the potential for degrading a particular function. Therefore, the probability of preventing the scenarios that I include this degraded function will depend on the extent of remaining mitigation capability for providing the function.

I To count remaining mitigation capability in a probabilistically consistent manner, systems are considered to be either single train or redundant. A redundant system is a system that has more than one identical train, where the loss of one train does not lead to a loss of function. However, I all trains of a redundant system are subject to a possible common-cause failure. Successful 06XX DRAFT Revision 1 Al-8 issue Date: 08/10/99

mitig: tion may be provided by cach tr;in of div:rs3 singis-train syst;ms (e g., high-pr;ssurs I

injection in a boiling water reactor (BWR) for a loss of feedwater transient m provided by the high-pressure coolant injection (HPCI) and reactor core isolation coolant (

IC) systems, both single train systems), or by diverse redundant systems (e.g., low-pressure injection may be provided by the low-pressure core spray (LPCS) and the LPCI systems in a BW R-4, both multi train systems), or by mixtures of single-train and redundant systems. In some cases there may be time to recover the function or train that has been lost, which can be credited as a success path under certain conditions, in counting the number of remainin degradation assumed by the findi_ng,g available success paths for a scenario affect the user must select the most appropriate column of Table 2, Risk Significance Estimation Matrix," for each affected scenario. Each column in Table 2 represents about one order of magnitude difference from adjacent columns in the failure probability of remaining mitigation capability, and the descriptions in the column headings are intended as non-1 inclusive examples of mitigation methods that can typically be assumed. Refer to the site or I

design specific information that has been provided in the Phase 2 worksheets for basic information i

on the number of trains and redundant systems. Table 3 of this procedure also provides guidance I

on how to apply mitigation credit. In addition, the following rules and guidelines apply:

I

• Only equipment that the licensee has sco ed into the maintenance rule (10 CFR 50.65) may be credited for remaining mitigation capabil. This provides a minimum level of assurance that credited equipment meets pre-establishe reliability goals or performance criteria.

• The potential for common-cause failure of the remaining mitigation capability is accounted for I

in the column definitions of Table 2. Therefore, any actual evidence of a common-cause failure must be included in the definition of the inspection finding.

• Credit for recovery may be taken if there is a possibility of restoration of the SSC or a function that has been assumed to be lost due to the condition identified by the finding. Recovery actions should be credited only if there is sufficient time available, environmental conditions allow access, they are covered by operator training and written procedures, and necessary equipment is available or appropriately staged and ready. For recovery actions that are relatively complex, and/or require actions outside the control room, it is particularly important that the actions required are feasible within the time available to prevent core damage. If there is no remaining mitigation capability other than restoring the f ailed equipment, and the above conditions are met, I

then use of the " recovery of failed train" column on the Phase 2 worksheet will credit this I

recovery. For example, consider an inspection finding involving a potentially recoverable system failure, such as a failed automatic start feature, if status indication exists and simple operator action would be able to start the equipment within sufficient time to provide the system function, then credit can be given to recovery.

If other equipment is also available as remaining I

4 mitigation capability, then operator actions may be assumed for that equipment.

l

• Caution has to be exercised when taking credit for systems that are dependent on manual actuation (such as standby liquid control (SLC) in BWRs). If the time to initiate the system is short and performed under stressful conditions, then credit is allowed per Table 3 for " operator I

action under high stress", When there is ample time, as in the initiation of suppression pool cooling in BWRs, the human error probability is low enough that credit per Table 3 for " operator I

action is appropriate.

I When all scenarios have been identified and the associated initiating event likelihoods and I

remaining mitigation capability estimated, the Table 2 matrix described in the next section can be used to estimate the potential significance of the degraded condition, within the context of all assumptions made to this point Step 2.4 - Estirnating the Risk Significance of Inspection Findings The last step of the Phase 2 assessment process is to estimate the relative risk significance of the finding. The risk is estimated by employing an evaluation matrix (Table 2 herein), which utilizes the information gained from Steps 2.1 through 2.3. This matrix combines the scenario likelihood derived in Step 2.2 with the remaining mitigation capability determined in Step 2.3 and establishes an estimated risk significance for the particular finding. One of only four possible results can be obtained: Green, White, Yellow, or Red. These results are comparable to those used for Pls. The user must complete this assessment process for each scenario affected by the inspection finding before determining the scenario of highest significance.

Issue Date: 08/10/99 Al-9 Revision 1 DRAFT 06XX

w e

n n

e d

d d

d lo it e

e n

e e

e e

le r

r 0

h e

e o

R R

R R

n Y

W G

G d

s le ns oe ia ir t

f t

c s r

e n

n n

f a

R rh d

d d

r it on e

e e

i O

oig e

e e

k h

e e

e 1

ya th R

R R

le r

r r

a Y

W G

G G

r r et v

rr o

ee c

pd e

On R

u

)se

+

)

lp n

nsd 9

e o

otl 9

9 m

it ieia

/

t 0

9 r

a c

ctf E

2 in a

asf w

e n

n n

n

/

n 1

x oi d

d e

e e

e 0

R rh lo it a

R

/

r O o O ogya e

e le r

r r

r h

e e

e e

6 1

r R

R

/

h 1

a ahet Y

W G

G G

G v

8 t

r t

t ir r

r t

e er e

0 v

p pe o r

i w

O Odc e

(

n e x

(

t r

u i

a g

r D

t n

a it d

+d M

e a

u R

le nle n

oia n

s ia f

ia itf s

cf w

e n

n n

n n

o y

+f i

r i

,R aoin d

o i

e e

e e

e a

t e

e e

e e

t t

non R t

i 3

iaya O rya e

le i

i h

l l

lt; m ;, O R

r r

r r

r i

u or r a e Y

W G

G G

G G

m rrr b

t t

et t

0 a

1 v v

i r

1 e o t

1 p

oc pc s

a e

Or E

e l

C r

A e

n c

o md n

it s

ele ac a

n sa i

ti g

i yf f

a i

t t

sf w

e n

n n

n n

n n

i r

o n n o

it e

e e

e e

e i

e R i yi M

4 s

O ara R

h e

e e

e e

e g

ret e

r r

r r

r r

i

- v Y

W G

G G

G G

G S

r r

t g

ev o

k n

i it i

d luc s

e n

2 mr i

a 1 +

R i

m e

2 R

in f

e n

l

+a e+oi r

s ya e

n n

n n

n n

n b

nme R e sret i

e e

e e

e e

e a

r t

r t

vivd h

e e

e e

e e

e T

5 ial s O itt n

r r

r r

r r

r ruy daoe W

G G

G G

G G

G i

t ms rci t

l 2 ea 1

1 rf n

n foin e

ias

+ ia+ya r

a n

n n

n n

n n

s r m n mr rs t

t r

e e

e e

e e

e e

1

-ie R

en R

et e vd a

e e

e e

e e

e 6

i ia O us O ial t

t r

r r

r r

r r

r n

vi l t t

rusoe C

G G

G G

G G

G o

dr my m yci is t

l t

s 1

se a 3

2 1

rf ive R

d T

9 o F

g"E e to A

n g

h ei A

B C

D E

F G

H R

vl D

k X

iL X60

O e

Type of Remaining Capability Remaining Capability Rating l

Operator Action Under High Stress 1

l l

Definition: Operator action assumed to have about a 1E-1 I

probability of failing when credited as " remaining mitigation I

capability".

I Recovery of Failed Train 1

1 I

Definition: Operator action to recover failed equipment that is I

capable of being recovered after an initiating event occurs that I

requires the equipment (e.g., equipment was unavailable due I

to a switch misahgnment). Action may take place either in the I

control room or outside the control room and is assumed to I

have about a 1E-1 probability of failing when credited as I

" remaining mitigation capability" l

Operator Action 2

I I

Definition: Operator action that can occur with sufficient time to I

have about a 1E-2 probability of failing when credited as l

l

" remaining mitigation capability".

I 1 Train (diverse as compared to other trains) 2 l

l Definition: A collection of associated equipment (e.g., pumps, I

valves, breakers, etc.) that together can provide 100% of a l

specified safety function and for which the probability of being I

unavailable due to failure, test, or maintenance is assumed to I

l be about 1E-2 when credited as " remaining mitigation I

capability"d to be susceptible to common cause failure modes.

. Two or more trains are diverse if they are not I

considere I

1 Multi-Train System 3

I I

I Definition: A system comprised of two or more trains (as I

defined above) that are considered susceptible to common I

cause failure modes. Such a system is assumed to have I

about a 1E-3 probability of being unavailable, regardless of I

how many trains compnse the system, when credited as i

" remaining mitigation capability".

I 2 (diverse) Trains

[ adding example]

4 (= 2 + 2) l I

(2 diverse trains are assumed to have a combined 1E-4 I

probability of being unavailable) l 1 Train + Recovery of Failed Train

[ adding example]

3 (=2 + 1) i I

(1 train plus recovery of failed train is assumed to have a I

combined 1E 3 probability of being unavailable or failed) l I

Table 3 - Remaining Capability Rating Values l

Issue. Date: 08/10/99 Al-ll Revision 1 DRAFT 06XX

o Step 2.5 - Documenting the Results The results of the Phase 2 risk estimation will be communicated to the licensee through the inspection report process. It is expected that risk significant or controversial findings will require obtaining licensee risk perspectives and will most likely prompt a Phase 3 review, if the inspectors, and appropriate regional and Headquarters staff (when necessary), agree with the results of the Phase 2 assessment, the final results will be documented in an inspection report and no further review is needed. The extent of documentation should include allinformation needed to reconstruct the Phase 2 analysis. Although licensee perspectives will be considered, the NRC staff will retain the final responsibility for determining the risk significance of a finding and will provide its justification in an from those of the staff, the staff should explicitly justify the basis for its determination.pe inspection report or other appropriate document. When licensee assumptions or pers Phase 3 - Risk Significance Finalization and Justification if determined necessary, this phase is intended to refine or modify the earlier screening results from Phases 1 and 2.

Phase 3 analysis will utilize current PRA techniques and rely on the expertise of knowledgeable risk analysts. The Phase 3 assessment is not described herein.

06XX DRAFT Revision 1 Al-12 Issue Date: 08/10/99

A'ppendix 2 Significance Determination of Inspection Findings in the Emergency Preparedness, Radiation Safety, and Safeguards Area This appendix and its attachments represent the concepts for evaluating inspection findings in the emergency preparedness, radiation safety, and safeguards areas. Thresholds were selected on a significance scale similar to those established for the plant performance indicators that industry plans to submit.

L

\\

it 1

Issue Date: 08/10/99 A2-1 Revision 1 DRAFT 06XX

EMERGENCY PREPAREDNESS SIGNIFICANCE DETERMINATION PROCESS The objective of this comerstone is to ensure that the licensee is capable of implementing adequate protective measures to protect public health and safety in the event of a radiological emergency.

Licensee performance in-the comerstone is assessed by considering both the relationship of performance indicators (Pl's with regard to thresholds and inspection findings. The Sionificance to be combined with Pl(resuDetermination Process SDP dispositions individualinspection finding The SDP consists of flow chart logic to disposition inspection findings into one of the following categories: " licensee response band," " increased reg"ulatory response band," " required regulatory response band," or " unacceptable performance band.

During the development of Emerg,ency Preparedness (EP) PI's, the most ' risk significant areas were identified as distinct from other important program elements. These development efforts were periormed by a group of EP subject matter experts with input from members of the public. The SDP methodology recognizes failures in the identified risk significant areas as more significant than findings in other program areas.

Emeroency Preparedness regulations codify a set of emergency planning standards in 10 CFR 50.47Tb) and Appendix E to Part 50. The more risk significant areas of EP align with a subset of the planning standards and requirements. The SDP logic uses failure to meet or implement anning standards and other regulatory requirements as criteria for decisions. Failure to meet or i ement the more risk significant planning standards results in greater significance (e.g., a white fi ding as opposed to a green finding.)

The logic of the SDP intentionally parallels NUREG 1600, " General Statement of Policy and Procedures for NRC Enforcement Actions." The GREEN, WHITE, YELLOW and RED results generally align with current Severity. Levels IV, Ill, ll and I respectively. However, there are some differences that were generated as a result of subject matter expert efforts to identify the most risk significant areas of EP. The SDP does not sum unrelated findings to escalate the resultant response band disposition. However, a program failure may be indicated by contemporaneous failure to meet multiple planning stahdards. The SDP logic recognizes this unlikely, but significant, deterioration of an EP program and responds with findings of increased significance, includ'mg the potential for a set of concurrent findings being assessed as " unacceptable periormance."

A finding that is assessed as a GREEN indication does not mean that the performance associated with the finding is good or even acceptable. It may represent non-conformance or a violation.

intervention. It is considered to be within the " licensee response band.gh to warrant further Nj However, the safety significance of the finding is not great enou Licensees are still required to return to compliance with the regulation and their commitments. However, the licensees are given j

the latitude to self correct these findings.

06XX DRAFT Revision 1 A2-2 issue Date: 08/10/99

Guidance

1. Exercise performance is measured by the Drill / Exercise Performance and ERO Drill Participation performance indicators. Exercise weakness and deficiencies are expected to be identified and resolved by the licensee in accordance with 10 CFR 50.47 The inspection program is designed to verify that this expectation is met. However, poor (b)14. performance itself is no

2. A Finding is an observation of an emergency preparedness program element that has been placed in context and assessed for significance.

3. Failure to implement a planning standard means that it was not implemented during an emergency event, but that the program itself continues to meet the planning standard e. g., a personal error during an event.

4.' Failure to meet a planning standard means that the program is not in compliance with the planning standards of 50.47(b)f program compliance are the criteria of NUREG-0654, as articulated Plan. The measure o approved Emergency Plan.

5. A regulatory requirement is any requirement of 10 CFR or the Emergency Plan.

6. A violation of requirements may also involve a failure of the PIDR. This should be analyzed through the significance determination process for both the violation and the PIDR failure. The more significant determination should be the overall determination.

7. Failures of the PIDR program that result in green, white or yellow findings should also be provided to the inspection team responsible for the conduct of Inspection Procedure No. 71152 Identification and Resolution of Problems.

Issue Date: 08/10/99 A2-3 Revision 1 DRAFT 06XX

e NRC Significarce Deterrrination Process for Emergency Paparedness inspectan Fhdngs. Sheet i draft 3 April 19,1999 Finding identified i f WlMian af ygg

'*9 * *'y

'r ToViolatan reqmgmere Shed 2

.NO l

1 r

$5f[

> ToPIDR Problem Sheet 4 NO 1 F

$E een RSPS = The Risk Significant Planning Standards: 5047 (b) 5,4,9 & toard Apperdk E setbn N B,C, D(1) & D(3)

PS = The Plannirg Stardards crf 60.47 (b) ard the requirements d Appardk E PDR = Problem identfication and Resolu6cn System Trnely Resolutbn d failure to meet = RSPS, so Day; PS, t20 Day; other Regulatory Requirement,24o Dey Ttnely Resolutbn d failure io implement = RSPS, lmmediate (14 Day); PS, eo Day; cither Regulatory Requirement,120 Day 06XX DRAFT Revision 1 A2-4 issue Date: 08/10/99

e NRC Signifcanos Det:rmination Process for Emergency Preparedness inspection Rndings Sheet 2 draft 3 April 19,1999 Violation identified 1 P Fellure to NO implement or 7

GREEN meet PS?

YES 1 P Failure to YES P?

8%*yEven To PS Implementation Problem Sheet 3 NO 1 P Failure to NO 5 or more NO (Progr a ure)

I h$$$

7 WHITE 4

9 YES YES 1 P 1 P 3 or more NO tallures to meet YELLOW RSPS?

/

YES 1 r RED Issue Date: 08/10/99 A2-5 Revision 1 DRAFT 06XX

NRC Signmcance Determination Process for Emergency Preparedness inspection Findings. Sheet 3 draft 3 April 19,1999 PS Implementation Problem (Actual Event) i l

I r N

O GREEN NO P

^7

[m" rrdk WHITE RSPS1 NO NO 7

GREEN 1 r YES Failure to YES implement 7

YELLOW RSPS?

NO 7

WHITE NO I P GEN YES a re to YES RED m

EMERG RSPS7 NO 7

YELLOW 06XX DRAFT Revision 1 A2-6 issue Date: 08/10/99

e e

NRC Significance Determination Process for Ernergency Preparedness inspection Fridings Sheet 4 draft 3 April 19,1999 PIDR Problem 1 r PIDR FAILURE YES DrwEmercme To PIDR DrilVExercise Ev ebon Sheet 5 inapection Otmenration d L 1 P Failum Failure to Failure to 80 **0*'

NO 10 PS NO ID other or reeotve Peomt repioy me (meet or regererrent

[*'d, implemere penem

?

YES YES YES q r 1 P GREEN YES PS7 WHITE NO l f over YES re$ui GREEN 7e NO i f Inspection Otmerveton 1

1 Issue Date: 08/10/99 A2-7 Revision 1 DRAFT 06XX

\\

O NRC Si nificance Deterrnination Process for D

Emergency Preparedness inspection Findings. Sheet 5 draft 3 April 19,1999

{

l PIDR Drill / Exercise Evaluation Problem 1 r

[DN[P$

f,T,at YES Ps YES YES ROW implementation Irnplementagon to 10 Problem Problem 7

7

?

I NO 1 r NO o

1 V Repeat YES Fail,ufe

?

WHITE 7

NO NO 1 V GREEN I f Failure to ID reguietory NO Exercise requirement Observation mmentation problem

?

)

YES 1 P GREEN l

06XX DRAFT Revision 1 A2-8 Issue Date: 08/10/99

OCCUPATIONAL RADIATION SAFETY l

SIGNIFICANCE DETERMINATION PROCESS The objective of this corner stone is to ensure worker health and safety from exposure to radiation from licensed I

or un-licensed radioactive materials during routine operations of civilian nuclear reactors. The health and safety of workers is assured by maintaining their doses within the limits in 10CFR20 and ALARA.

I Licensee performance in the cornerstone is assessed by considering the Pi indication in combination with inspection findings. A baseline inspection is maintained to verify the accuracy and completeness of the Pl data (i.e., work control in radiologically si sufficient to measure performance (gnificant areas), supplement the Pi data in areas where the Pi alon i.e., problem identification and resolution), and complement the Pls with l

inspection findings of performance for areas not covered by the Pl (i.e., ALARA planning and controls, radiation monitoring instrumentation, and personnel dosimetry).

The Significance Determination Process (SDP) is the mechanism in which the significance of individual events (follow-up of an operational occurrence, substantiated allegation, or other inspection finding can be normalized cnd combined with the PI results to arrive at an overall cornerstone performance assessmen)t. Log cre provided to outline the process. A finding that gets through the process (flow chart) without tripping a decision

" gate" ends up as a GREEN indication. This does not mean that the performance on this individual finding is good or even acceptable. It still may be a non-conformance or a violation. It does mean that the safety sign ficance i

of the event is not large enough to warrant further NRC intervention. Licensees are still required to come into compliance with the regulation and their commitments. However, the licensees are given the latitude to self correct these non-conformances.

The decision gates in the SDP intentionally parallel the Enforcement Policy Supplement examples to f acilitate use of the SDP in evaluating the significance of inspection findings that are also subject to the enforcement process.

Althoug(h not a fast rule, the dREEN, WHITE, YELLOW and RED results generally align with cu Levels SL) IV, Ill, ll and I respectively. In addition, there is considerable overlap with the Performance Indicator definitions to allow the SDP to be used to determine those single events that, although they meet the Pi definition (and will be counted as a PI), they require separate reporting by Part 20 and may be a significant enough risk to worker health and safety to deserve their own " colored" assessment input.

ALARA Findinos Section 1101.(b) of 10 CFR Part 20 states that licensees shall use, to the extent practical, procedures and cngineering controls based upon sound radiation protection principles to achieve occupational doses that are as 4

low as is reasonably achievable (ALARA).

An ALARA finding is a finding whereby the licensee has f ailed to properly implement procedures and engineering controls based on sound radiation protection principles to ensure that doses associated with plant operations and maintenance are maintained ALARA.

Section 1101 of 10 CFR Part 20 requires that each licensee develop, document, and implement a radiation protection program that includes provisions for keeping occupational radiation doses ALARA. As contained in the Statements of Consideration in the May 21,1991 Federal Register concerning the revision to 10 CFR Part 20, the Commission continues to emphasize the importance of the XLARA concept to an adequate radiation protection program. A licensee's compliance with this requirement will be judged on whether the licensee has incorporated measures to track and, if necessary, to reduce exposures and not whether exposures and doses represent an cbsolute minimum or whether the licensee has used all possible methods to reduce exposures.

The metric chosen for the ALARA portion of the SDP for evaluating the significance of an ALARA finding is a plant's three-year average collective dose (consideration of doses to individuals and individual dose limits are treated in the Exposure Control portions of the SDP). Plants with effective ALARA programs iend to have lower overall collective doses than those which have poor or inadequate ALARA programs. On average the industries current ALARA perf ormance is considered very good. Total collective dose appears to be reaching an equilibrium minimum value in the last few years. Therefore, current the median value of the three-year av irage (MTYA) collective dose and the third quartile values are established as a decision gate standards. Due to the different challenges f or BWRs and PWRs, diff erent MTYA and third quartile values are established for these reactor types.

Issue Date: 08/10/99 A2-9 Revision 1 DRAFT 06XX

Anoth;r m3tric which is usrd to evalunted ALARA findings is the cccuracy of a licenste's dose goals establish:d for work packages. A job dose which exceeds the dose goal by 50% or more is indicative of poor pre-job planning and one proceeds to the next gate. If the actual job dose falfs within the pre-job dose estimate or exceeds it by 1:ss than 50%, then the finding is GREEN The next two gates evaluate the significance of the ALARA finding once the magnitude of the actualjob dose has exceeded the job dose estimate by 50% or more. Once the magnitude of an actual job dose reaches 20% of the MTYA for the appropriate reactor type, then the significance of the ALARA finding goes f rom GREEN to WHITE.

The occurrence of three or more job doses which are greater than 4% but less than 20% of MTYA (in a one calender year period) will also give a WHITE finding.

The final gates in the ALARA flowchart use a plant's source term as a metric and evaluate whether the finding is a source control finding or not, if a plant is a known high source term plant, then the licensee should be sensitive to this issue. The licensee should place increased emphasis on ensunng that radiation fields in the work area are minimized. If a plant is a high source term plant and finding is determined to be a source term finding (i.e., the finding will be classified as being YELLOW. job planning to reduce the radiation fields in high job dose resulted from inadequate pre-If the finding is not determined to be a source term finding, then the finding will be classified as being WHITE.

Similarly, if the plant is not a high source term plant, then more emphasis should be placed on work controls such as proper job planning, use of mockups, use of skilled workers, integration and coordination of jobs to minimized unnecessary setup and tear down of scaffolding and temporary shielding, etc. If a finding is identified (for a plant which is not a high source term plant) in which the high. job dose was a result of lack of attention to work controls (i.e., it is not a source control problem), then the finding will be classified a being YELLOW. If the finding is determined to be a source term finding, then the finding will be classified as being WHITE.

Exoosure Control Findinas Unintended Exposure is a failure of one or more radiation safety barriers that results in a significant unintended or unplanned dose. Radiation safety barriers include adequate radiation monitoring, physical controls, hazards cnalysis and surveys, instructions to workers (including RWPs, postings, Part 19 training, etc) and proper job controls. Since most of these are either required by 10 CFR or covered in technical specifications required procedures, the failure to implement one or more of these is generally a violation. To be significant, the consequence (unintended dose) needs to equal or exceed a set percentage of the dose limits in 10 CFR 20 ( 2%

of the stochastic,10% of the non-stochastic,20% of the limits to minors and fetus, and 100% of the shallow dose limit from a Discrete Radioactive Particle).

Exposure in excess of 10 CFR 20 limits is a YELLOW indication. This is an area where SDP deviates from the Enf orcement Policy (SL lll " equate" to WHITE findings). Based on the ICRP 66 total probability coefficient of 4E-4

/ rem, a 5 rem dose equates to a 2E 3 risk of death from cancer. Since preventing this risk is the objective of the Radiation Safety cornerstone, we have elevated its significants f rom that in the Enf orcement Policy. The threshold for a RED finding is consistent with the SL l significance in the Enforcement Policy.

Breakdowns in the Radiation Protection Program, or unintended exposures, that do not exceed a dose limit can still be considered significant if they constitute a " Substantial Potential for Overexposure." A substantial potential, consistent with the current Enforcement Manual (NUREG/BR-0195, subsection 8.4.1), is an occurrence in which a minor alteration of the circumstances would have resulted in a violation of Part 20 limits and it was fortuitous that the altered circumstances did not occur. In the SDP the finding can also be a YELLOW or RED depending on the dose rates (risk of a serious outcome) associated with the failure. In a Very High Radiation Area of 500 rads /hr, it can take as little as 3 minutes for a worker to receive 25 rem. Note however that the Enforcement Process (and possible civil penalty) will not engage unless the event had an " actual consequence" (in this case en actual overexposure). The Assessment Process rather than the Enforcement Process will determine further licensee and NRC action for events that do not result in " actual consequences."

The last decision gate in the SDP is intended to sort out significant issues and findings related to plant equipment -

and facilities. The Assessment Program is a risk informed process, and radiation dose is the measure of health risk associated with licensee activities. Therefore, this gate focuses on those issues that could or does compromise the licensees ability to assess dose. Since this gate culls out WHITE findings (comparable to SL lil),

it is intended that only significant, programmatic, f ailures of radiation monitoring and personnel dosimetry trip this gate. Examples of findings intended to be addressed by this gate include; 1) the licensee's failure to use a NVLAP certified dosimeter processor,2) a generic and uncorrected failure of the DADS to respond to, or record, radiation dose, and 3) improper calibrations of instruments or monitors that significantly bias their response which are used as a basis for establishing protective controls. An individual failure to survey or monitor should be 1

06XX DRAFT Revision 1 A2-10 issue Date: 08/10/99

considered as o f llurTa of a radi tion safIty barrier cnd ev;lutt;d for its potIntiil for unintrnd:d dosa or cubstantial potential for overexposure as discussed above.

Issue Date: 08/10/99 A2-11 Revision 1 DRAFT 06XX p

tfa rD

, ~

ON sy r

N 0

Y l

9 E

T 9

n gY 1

/

E S

w 1

/

F E

8 l

0 A

e t

S O

Da N

e N

u O

yr

=7 V5 N' g 1 R

ss l

r AW r

D i

I

,m Y 1

n.

R T

H 0 E

0 S

S g

A E

E 2

l Y

Y 1

I D

2 O

A A

N R

l

,i E

W L

O n

O N

m R

E A

v Y

l l

N l

wO O

1 I

O N

TA yr r

u/'

r E

n l

m P

D yY e

U 7

s 1

o R

1 S

p S

S C

E E

E u

l Y

s Y

CO O

1 N

nio yr is d

ge A

ve nf R

i nn L-i R

i i

A dt A

S T

ie Fd E

F Y

A i

RD XX60

\\

s l

OCCUPATIONAL RADIATION SAFETY Draft (ALARA)

ALARA finding 1r is 3 yr Ch Je $

b No e Dose e: (

st 250im Projecwd

,, GREEN l oos,.es Yes Yes 1F l GREEN l

l GREEN l 1r Dose "no"nc'es, GREEN l 2209.of *x vm 1P Yes c$ fem coi b

WHITE l m signest wergegeen ogme 2p vn 1P is Pie No Thee No so$Te 8 "'ee Conto YELLOW l Js \\

No Sou'ce Coe

l WHrrE l F* amp

• X is defined as the median value of the 3 year average collective dose for PWRs and BWRs for vn the years 1995 1997. Separate values of X exist for PWRs and ir l YELLOW l for BWRs.

Issue Date: 08/10/99 A2-13 Revision 1 DRAFT 06XX

)

i l

PUBLIC RADIATION SAFETY SIGNIFICANCE DETERMINATION PROCESS l

Radioactive Effluent Release Program This branch of the logic diagram focuses on the licensee's radioactive effluent release program.

{

11 assesses the licensees ability to maintain radioactive effluents ALARA. These are the design dose objectives contained in Appendix l to 10 CFR Part 50. Radiation dose to a member of the public is the success enterion.

)

i The regulatory basis for requiring radiological effluent monitoring pr,ograms is given in General Design Criterion j

60," Control of releases of radioactive materials to the environment, of Appendix A," General Design Criteria for l

Nuclear Power Plants," to 10 CFR Part 50," Licensing of Production and Utilization Facilities." Criterion 60 requires

(

a licensee to provide for a means to control the release of radioactive materials in gaseous and liquid effluents j

during normal reactor operation, including anticipated operational occurrences. An additional requirement is in Se-tion IV.B.1 of Appendix I to 10 CFR Part 50. This section requires a licensee to provide data on the quantities of radioactive material released in liquid and gaseous effluents to assure that such releases are within the ALARA design objectives. This data, pursuant to 10 CFR 50.36a, is reported to the NRC annually.

SDP determination process: Is there an event or occurrence in the licensee's radiological effluent monitoring program that is contrary to NRC regulations or the licensee's Technical Specifications (TS), Offsite Dose j

Calet tation Manual (ODCM), or procedures? If es, the question is what is the dose impact (as calculated by the licensee) of the event? If there was no radio ogical release associated with the event (no dose impact to a i

member of the public) then there is minimal

• risk" and the SDP classifies it as GREEN. The licensee is I

responsible to resolve the finding. The NRC will periodically inspect the effectiveness of the licensee's corrective cction program.

If the event resulted in an effluent release of radioactive material that, based on the methodologyin the !icensee's

)

ODCM, exceeded the dose values in Appendix l to 10 CFR Part 50 but is less than 0.1 rem, the SDP classifies the event as WHITE. In this case, the NRC will maintain some detail of oversight on the licensee's corrective cetions. NOTE: The licensee has a Performance Indicator (PI) in this area that uses dose values equal to the quarterly dose values given in the TS or the ODCM. This SDP is not to be used to " double count" the Pl. If a situation results in which the dose exceeds Appendix l values because of multiple effluent releases which l

exceeded the PI threshold it should not automatically be assessed as a degraded cornerstone. The SDP is to be used to assess the significance of a finding on an action or event by the licensee which was contrary to NRC regulations, the licensee's TS, ODCM, or procedures.

If the event resulted in effluent release of radioactive material that, based on the methodology in the licensee's ODCM, exceeded the annual public dose limit in 10 CFR Part 20 of 0.1 rem but is less than 0.5 rem, the SDP 2

classifies the event as YELLOW. The NRC would be significant NRC oversight of the licensee's corrective

}

cctions.

If the event resulted in effluent release of radioactive material that, based on the methodology in the licensee's ODCM, exceeded 0.5 rem, the SDP classifies the event as RED. The NRC has lost confidence in the licensee's ability to control radioactive effluents. Significant NRC interaction with the licensee will result.

{

1 Example:

The licensee had an inoperable radiation monitor on the radioactive liquid effluent discharge line. Because the monitor was inoperable, the licensee was required to pedorm grab sample monitoring of the liquid discharge. The licensee failed to perform the sampling to verify that the liquid effluent was within the activity pr,ojected based on prior analysis of the hold-up tank. This is the finding. Looking at the SDP flowchart, the key decision to determine the significance of the finding is dose. Was the calculated dose from the release above or below the values in the decision diamonds? The dose determines the significance color.

Radioactive Environmental Monitoring Program This branch of the logic diagram focuses on the licensee's ability to' operate an effective radioactive environmental monitonng program.

The regulatory basis for requiring radiological environmental monitoring programs is given in General Design Criterion 64, Monitoring Radioactivity Releases," of Appendix A, " General Design Cnteria for Nuclear Power Plants," to 10 CFR Part 50," Licensing of Production and Utilization Facilities." Criterion 64 requires a licensee to 06XX DRAFT Revision 1 A2-14 issue Date: 08/10/99 J

provida for a msens for monitoring th3 plant environs for radioactivity that may be rel ased during normal operations, including anticipated operational occurrences, and from postulated accidents. An additional requirement is in Section IV.B.3 of Appendix I to 10 CFR Part 50. This section requires that the monitoring program identify changes in the use of unrestricted areas (e.g., for agricultural purposes) to permit modifications in the monitoring program for evaluating doses to individuals from principal pathways of exposure.

Radiological environmental monitoring is important both for normal operations, as well as in the event of an accident. During normal operations, environmental monitoring verifies the eff ectiveness of the plant systems used for controlling the release of radioactive effluents. It also is used to check that the levels of radioactive material in the environment do not exceed the projected values used to license the plant. For an accident, the program provides an additional meant, to estimate the dose to members of the public.

SDP determination process: Is there an event or occurrence in the licensee's radiological environmental monitoring program that is contrary to NRC regulations or the licensee's Technical Specifications (TS), Offsite Dose Calculation Manual (ODCM), or procedures? If yes, the question is; did it degrade the licensee's ability to assess the impact of its radiological Effluents on the environment?

To answer the question with a yes means that the licensee's overall program is degraded. It does not mean that a few environmental samples over the course of a year were not taken, or improperly analyzed. A failure in one or two parts of the licensee's program is not sufficient to reach a " White" significance determination. A failure to evaluate a required pathway (i.e., no valid data to support an impact conclusion for that pathway) would result in a YES answer to the decision diamond. This is a high threshold to reach. Historically, inspection findings have documented that samples are missed, or a land use census was not performed, or the air samplers were broken for extended periods of time or they were not in the correct location. Overall, these findings have resulted in lost data, but not a complete failure to be able to assess the impact on the environment from that pathway. The significance determination of such event would be Green.

Example:

The inspector observed the collection of air filters from an indicator air sampling station. The inspector discovered that over the previous 12 month period, one of the air sampler was found to be inoperable on 32 separate occasions. This meant that up to 32 weeks of air sample data was missing and/or suspect. Because the monitor was inoperable, the licensee is required to prepare and submit to the Commission, in the annual Radiological Environmental Operating Report, a description of the reasons for not conductin plans for preventing a recurrence. The keensee failed to prepare and submg the program as required it the required report. This is the finding. Looking at the SDP flowchart, the key decision to determine the significance of the finding is whether or not the licensee was still able to assess the impact on the environment from radioactive gaseous effluents in this case the licensee was able to correlate the valid air sample data with known gaseous effluent discharges. Also, the licensee had valid air sample data from the sectors on either side of the faulty air sampler. Therefore, the licensee had some valid data to use to assess the impact on the environment. Thus, for this case the significance dstermination is Green.

Example:

The inspector reviewed changes to the radiological environmental monitoring program put in place during the last year. The licensee, based on a review of historical data which showed that no radioactive material of plant origin was detected in any of the fish samples collected in the past 5 five years, eliminated the collection of fish in the river where the discharge canal empties. The inspector identified this as an improper change to the environmental monitoring program because the change reduced the pathway monitoring to below the min, mum level acceptable i

to the NRC. Guidance for the environmental monitoring, program is given in the Radiological Assessment Branch Technical Position on Environmental Monitoring, Revision 1, November 1979. Regulatory Guide 4.1 provides a complete discussion of the program and changes to the program over time. The guidance in Regulatory Guide 4.1 allows the licensee to modify the program after 3 years of operational monitoring history if it can be dsmonstrated from the levels in environmental media or calculations (using measured effluents and appropriate dispersion and bioaccumulation factors) that the doses and concentrations associated with a particular pathway are sufficiently small, the number of media sampled in the pathway and the frequency of sampling may be reduced. For this case, the licensee reduced the number of sampfes and the frequency to zero. Thus, the pathway was not monitored. This action compromised the licensee's ability to assess environmentalimpact. The significance determination for this case is White.

Radioactive Material Control Program i

Issue Date: 08/10/99 A2-15 Revision 1 DRAFT 06XX

This branch of tha logic diagram focus:s on th3 lic::ns::e's radioactive material control program. It assesses the licensee's ability to prevent the inadvertent release of licensed radioactive material to an unrestricted area.10 CFR Part 20 contains the requirements for the control and disposal of licensed radioactive material. At a licensee's f acility, any equipment or material that came into contact with licensed radioactive material or that had the potential to be contaminated with radioactive material of plant origin and are to be removed from the facility must be surveyed for the presence of licensed radioactive material. This is because NRC regulations, with one exception in 10 CFR 20.2005, provide no minimum level of licensed radioactive material that can be disposed of in a manner other than as radioactive waste or transferred to a licensed recipient.

SDP determination process: Is there an event or occurrence in the licensee's radiological material control program that is contrary to NRC regulations? If yes, the question is what is the dose impact (as calculated by the licensee) of the event? If the dose impact was not more than 0.005 mrem and there were not more than 5 of these events in the inspection period, then the SDP classification is Green. If the dose impact was greater than 0.005 mrem or there were more than 5 events that were not above 0.005 mrem in the inspection period (may signify a programmatic breakdown), then the SDP classification is White. If the dose impact is greater than 0.1 mrem (exceeds 10 CFR Part 20 public dose limit), the SDP classification is Yellow. If the dose impact was greater than 0.5 rem, the SDP classification is Red.

Historically, these events have had calculated doses well below 0.001 mrem, thus, in most cases a Green significance determination is likely. However, if there were more than 5 events in the assessment period where licensed radioactive material was released, this may indicate a breakdown of the program.

Example:

The inspector reviewed survey records of material released from the restricted area of the plant. The records indicated that materials with no detectable licensed radioactive material were released for unrestricted use. During the inspection the licensee receives a call from another nuclear power plant that had received painting equipment that was " free released" from the licensee. The radiation survey performed at that plant of the incoming painting equipment documented the presence of licensed radioactive material. The painting equipment was shipped directly from one plant to the other. The plant that received the contaminated painting equipment planned to return it to the first licensee (as a radioactive material shipment). The finding is that the licensee did not perform an adequate survey to prevent the inadvertent release of licensed radioactive material into an unrestricted area.

To determine the significance requires a determination of the dose consequence to an individual from handling or being near the contaminated equipment. The licensee is responsible to evaluate the potential radiological hazard from the equipment. The significance determination will be based on the calculated dose for the event.

(

06XX DRAFT Revision 1 A2-16 issue Date: C8/10/09

O l

l N

E t

E T

f E

I H

R a

G W

r l

l D

ON S

i g.

E n

Y I

i r

y E

o nn m r.

e YTE X

l l

X F

E W

6 0

E T

O A

E I

L O

R H

L T

S N

G W

E F

Y AR l

l

?

D N

1 O

O N

no i

I s

T S

S S

i l

E m

E m

E v

A I.

Y Y

e Y

e s

e D

R p

r r

I i.

p 1

5 E

e A

0 0

R D

n 7

l 1

A 2

A R

C l

I s

S N

L tn E

EE e

Y v

R n B

EN G

5 U

l P

ON l

l E

W T

O I

L H

L O

W E

N Y

?

9 l

9 S

n S

S S

/

g E

it l

o E

E E

0 Y

a Y

m m

Y 1

in la Y

i

~

RaL c

t e

e D

/

d d*

w r

r at p

1 5

E 8

s 0

0 R

0 in M

n 9

F E,

a r

l T

e t

l a

D euss I

8 8

e 1

2 I

s!

l<

lI,:

8 g

't i

1 j

i ll, ijllil 8

• i !'

2

_s If

' 8 4

al(.

1 ' ill ' i ;h 1

1 1

i e

i I

i a

f

'I II;

' Il:

ll;

'I 5

in ' i O

b l'!

'f a

g in'i i

i 1

I j

e 1

i e

i

?n ' n l'&

r s

! il u

'i o

Radiation Limits riogno w.o.gn.uon Part 61 YES R

i on NO y

Exooeded?

YES Red a n

av.1., tion nta a

av.1.

1I YES I I YES dm dn YES YES 3 g g

Es$

m YES YES 3 g mi at YES Red Issue Date: 08/10/99-A2-19 Revision 1 DRAFT 06XX

a O

E Package Breach Breach of NO Package During Transit II YES NO

> Type A

If Green < NO Any Ws of YES YES>

Any Loss d NO kage y,ggo, m

Package Contents 3r Muu 1 RYES ublic1EDE NO

>25 mrem or White 4 OccupationTEDE Red

>5 ram 1f

>100 mrem-NO or y,;i, m

e

>25 rem YES Y

Red 06XX DRAFT Revision 1 A2-20 issue Date: 08/10/99

i Certificate of Low Level Compliance Burial Ground Low Level COC NO Burial Ground NO m

m Finding (LLBG) Access Problem If II YES YES Design YES LLBG NO Part 61 NO Documentation Green Access Waste Under-Green D

Denied.

Classificahon Neficiency NO 1I I

II Yellow White Cask YES Licensee banned by Low 4.evel Burial Design Green ground authontyforextended time Deficency (e.g.,repostednon-compliances) penod 3rNO Minor YES Contents Green Deficiency ifNO

>1 Crlucal NO Contents White Deficiency 3 RYES Yellow Issue Date: 08/10/99 A2-21 Revision 1 DRAFT 06XX

Notification & Emergency Information Failure to Make Notmestions NO j

Green m

m or Provkie

^

YES NO NO NO NO N1 N2 N3 N4 Green YES YES YES YES 3r p

p White White White White N1 - Failure to comply with 10 CFR 71.97 - Made a shipment w/o notifying state govemor prior to shipment entering state N2-Failure to provide emergency response info required by 49CFR172.602 N3 - Failure to respond during actual request IAW 49 CFR 172.604 N4-Failure to make notification of limits exeeded as required by 10CFR20.1906 06XX DRAFT Revision 1 A2 22 issue Date: 08/10/99

Att:chmInt 3 Physical Protection Significant Determination Process The safeguards risk assessment process recognizes that nonconformance issues have varying degrees of safety significance and in considerin the technical significance (i.e.g the safety significance of a nonconformance issue, it is appropnate to c

, actual and potential consequences).

Once a nonconformance issue has been identified, the risk of radiological sabotage has to be determined.

The issue is evaluated to establish whether there is no/ low risk or more than low risk of rrdiological sabotage.

If there is no/ low risk, the issue is within the (licensee response band) and will be resolved via the licensee's corrective action program.

8. Examples of events within the (licensee response band):

a, A failure to make, maintain, or provide log entries in accordance with 10 CFR 73.71 (c) and (d)

9. A failure to conduct a proper search at the access point

10. A failure to control access such that an opportunity exists that could allow unauthorized and undetected access into the protected area but which was neither easily nor likely to be exploitable.

11. A failure to report acts of licensed operators or supervisors pursuant to 10 CFR 26.73.

A failure to perform an appropria' e evaluation or background investigation so that information relevant to 12.

t the access determination was not obtained or considered and, as a result, a person was granted access by the licensee who would probably not have been granted access if the required investigation or evaluation had been performed.

13. Isolated nonconformarice with procedure requirements that are not indicative of a significant performance trend.

14.'

Protected / vital area barrier, alarm detection, and assessment nonconformance issues that do not impact an actual equipment performance (e.g., recording of test results, documentation for test sources, work request documentation).

conjunction with other safeguards failures; all were identified prior to any unauthon(zed entry in Re etitive events may be increased to a higher response band if the events can be considered a repetitive issue witgin the past 12 months The following nonconformance issues have been influenced by aggravating f actors. These issues were discussed by headquarters and/ regional safeguards staff in order to validate the safeguards risk assessment process.

l. A failure to protect safeguards information while information is outside the protected area and accessible to those not authorized access to the site.

The Physical Security Plan contains details of the protection afforded the site. An unauthorized individual with malevolent intent could possibly exploit the safeguards systems and gain entry into a Therefore, there is some risk involved with this event. Since the plan was unattended, protected o There were no other aggravated factors involved, that is, the plan was recovered, all secunty systems remained operable, and there was no unauthorized entry into the site. Since this was a single event involving safeguards information for the last 12 months, the issue is within the (licensee response band).

11. The, entry into a vital area from outside the protected area by an unauthorized individual who damages safety equipment.

An unauthorized individual inside a vital area has exploited the protected area physical security systems and presents a risk to safety. The event has been aggravated by the failure of vital area barriers and intrusion Issue Date: 08/10/99 A2-23 Revision 1 DRAFT 06XX

detection system. Other safeguards mitigating factors were " ineffective," that is, contingency response force failed to preclude unauthorized entry. Operational solutions were not successf ul and the calculated radiation dose exceeded the Commission guidelines established in 10 CFR 100. This event would be Category

• Red."

However, if operation solutions were successful, this would fall within a (required regulatory response band).

Ill. A failure of protected area search equipment, that is, metal / explosive detector /x-ray unit that results in the introduction to the protected area of firearms, explosives, or incendiary devices that could assist in radiological sabotage.

There is some risk associated with the event. If the contraband is available to unauthorized individuals with malevolent intent,it becomes easily exploitable. However,if the event is not aggravated by other factors, that is, it was detected and recovered before entry into a vital area, the risk of the event's contribution to radiological sabotage is low and could be dispositioned with the (licensee response band)if this was a single event involving unauthorized materials within the last 12 months.

Definitions:

Low Risk: A nonconformance activity has occurred that the licensee has determined presents no or low risk to the plant safety systems necessary to protect the public health and safety.

Predictable:

Based on the manner in which a program was being implemented. It was predictable that a violation would occur or that equipment, i.e., metal detectors, intrusion detection zones could be circumvented or defeated without generating an alarm based on special knowledge obtained beforehand.

Exploitable:

If individuals are aware of equipment or system deficiencies and those deficiencies are not properly compensated for then those deficiencies are exploitable. They can be used to the greatest possible advantage by an individual (s) against the security organization.

Aggravating Factor: An other factors that make the consequences of the event greater. Such as discovered degraded protected and vi at area barriers during an alarm assessment or a licensee drug screening facility not following good practices to ensure false specimens could not be substituted.

Operational Solutions: Intervention by control room personnel that would result in the safe shut down of the plant even if the contingency occurred and/or an adversary was able to render a piece of vital equipment inoperable or equipment configuration prevented an adversary from being successf ulin their attempt to endanger the public's health and safety..

OSXX DRAFT Revision 1 A2-24 Issue Date: 08/10/99

e W

s %1 99 s

of 6,

N 9

D se E

c R

1 P@ h nP a

t c

r e

l la n

M

?

esse S

s' E

s^

A%

Y eM 1

n r

s e

t ge l

O r

W v

f O

r it a?

l su L

a n

d a

aFe n nf L

g v

eoios E

s si r t i it t

i dc eat e Y

Mr r uc afe Wefoc S

euf O

pS u e gE N

O S E

r e

Y wfaS X

X6 0

?

W E

T O

T S

lg L

lg I

F H

A E

L SE W

R Y

E D

Y Y

1 l

n N

o i

E s

s t

?

E s

7 t

?

rS ni s

n s

R i

ENl v

eit o r

e er o

G e

t o

ht vhs n v

s n t c Eiar t

ar R

O 3wt 2 O

o a 3

2 O

F 1

1

^

N N

2 N

52-2A I

ET S

l5 H

I EY W

EUS e

N n"N S

c E

I s

a t

?

E E

n n

r e n s

R r

C o

vNs o G

t n

N Eiar t

E h

O 2wl 2 O

A M

N N

1 R

"m E

O FN I

O k

C is N

R e

O n

N o

r F

S O

N 9

N la?

/

E 9

O ce E

0 I

gg R

i TA

[, l 1

C oo G

/

oa I

t 8

dib k

0 I

a s

I F

a T

R S R

I e

N w

t E

o a

L D

D IC euss I

r l

1 Appendix 3 l

Shutdown Activities inspection Findings Significance Determination Process To be Provided at a Later Time h

Issue Date: 08/10/99 A3-1 Revision 1 DRAFT 06XX

a APPENDIX 4 I

I Determining Potential Risk Significance I

of I

Fire Protection and Post-fire Safe Shutdown Inspection Findings I.

I i

1.O lntroduction i

I The fire protection defense-in-depth (DID) elements are l

I (1) Prevent fires from starting.

I I

(2) Rapidly detect and suppress those fires that do occur I

I (3) Protect structures, systems, and components important to safety so that a fire that is not I

prom t extinguished by fire suppression activities will not prevent the safe shutdown of I

the p l

I A fire protection program finding can generall be classified as a weakness associated with I

meetin the objectives of one of the precedin DID elements. As a result, the Fire Protection i

Risk Si nificance Screening Methodology (F was de eloped to evaluate the potential tire risk sign)ificance of any fire protection DiDSSM I

I weaknesses that are important to post fire safe shutdown.

l l

Phase 1 of the FPRSSM is a screening method that is used by the resident or regional I

inspector to screen out fire protection findings (e.g., impairments to any fire protection feature)

I that are primaril unrelated to fire protection systems and features used to protect safe I

shutdown (SSD capability. Phase 1 is used as an oversight process to monitor operational I

conditions affec,ng fire protection systems and features. Th,s monitoring process identifies I

i i

conditions that could have a potential impact on the capability to maintain one SSD success I

path 2 free of fire damage.

I I

Findings that do not screen out as result of the Phase 1 screening should be subjected to the I

more detailed Phase 2 analysis. The Phase 2 analysis evaluates the syner I

these findings may have on risk by treating them collectively for a fire area.gistic impact that Because of the I

integrated approach taken by the Phase 2 analysis, this analysis is generally performed, with I

technical support from NRC fire protection engineers and risk analysts, to better understand I

the potential fire risk significance posed by the identified DID Phase 1 findings. For those I

cases where Phase 2 method determines that the inspection findings have potential risk I

significance, Phase 3, which is a more refined analysis, can be performed.

I I

2.0 Purpose 1

I The purpose of this two-phase screening methodology is to (1) focus resources on monitoring I

the performance and effectiveness of those fire protection mitigation features that are I

' Fire protection features sufficient to protect aDainst the fire hazards in the area, zone, or room under consideration must be capable of assuring that necessary structures, systems, and components needed for achieving and maintaining safe chutdown are free of fire damage (see Section lit.G.2a, b, and e of Appendix R to 10 CFR Part 50); that is, the structure, system, or component under consideration is capable of performing its intended function during and after the postulated fire, as needed.

2 An SSD success path must be capable of maintaining the reactor coolant process variables within those predicted for a loss of AC power, and the fission product boundary integrity must not be affected (i.e., there must be no fuel cladding damage, rupture of any primary coolant boundary, or rupture of the containment boundary).

Issue Date: 08/10/99 A4-1 Revision 1 DRAFT 06XX l

I important to protecting post-fire safe shutdown capability; (2) establish a threshold method I (Phase 1 method is described in Section 4.0) that will assist in recognizing which fire protection mitig(ation findings may have the potential to affect post-fire safe shutdown I

capability; and 3) determine the potential fire risk significance of observed findi s associated I

I with fire protection mitigation features and systems used to protect SSD capabili by I performing screening assessment (Phase 2 method is described in Section 5.0) f the as-I found condition (s). The Phase 2 screening analysis portion evaluates the "as-found" conditions I associated with each fire protection mitigating element of the fire protection DID philoso by I

(e.g., detection, suppression, and passive protection separating post-fire SSD functions within i each of the DID elements. The potential fire risk significance of the as-found condition )is I determined by performing ariintegrated assessment of the fire protection mitigation fi ings I and the potential impact they may have on SSD capability.

I I The Phase 2 methodology can also be used by an NRR fire protection reviewer or a regional I inspector as an aid for determining the potential risk / safety significance of: (1) a fire protection i design condition that deviates from the intent of the facilities licensing / design basis; or (2) a I Generic Letter 86-10 or 10 CFR 50.59 engineering evaluation documenting a change in a l licensee's fire protection program.

I I For the purpose of this guidance, weaknesses or findings will be defined as conclusions or I factual observations of those "in-plant" conditions that do not meet regulatory requirements, do I not conform to the facilities operating license fire protection condition, or are considered to I have risk implications due to an inherent fire protection / post-fire safe shutdown system design I weakness.

I I 3.0 Scope lI The scope of Phase 1 is to present a process that can help inspectors determine whether a l particular fire protection finding is important to the protection of the safe shutdown capability' I and has the potential of being risk significant.

I I Fire protection DID findings that have been determined to imply potential risk by the Phase 1 I screening method are subjected to a Phase 2 review. The scope of Phase 2 is to present a I process for regional and headquarters fire protection engineers and risk analysts to further i evaluate how a particular fire protection DID finding or set of findings affects SSD capability.

I in order to evaluate the potential risk significance, Phase 2 integrates the "as-found" I degradations or findings and evaluates their potential affects on fire mitigation effectiveness I and SSD capability. Phase 2 is focused on the following specific areas of fire mitigation:

1 i

• fire barrier effectiveness I

• fire detection / automatic suppression system effectiveness I

• manual suppression effectiveness I

• safe shutdown capability iI 4.0 Fire Protection Risk Significance Screening Methodology-Phase 1 I

I Not all plant fire protection systems and features are considered to be important to the i protection of post-fire SSD tapability. The results of the fire IPEEE (individual plant evaluation I of external events) can provide a relative ranking of the plant areas that are the major I contributors to fire risk. The top 10 areas identified by this IPEEE/PRA (probabilistic risk I assessment) ranking are generally important to post-fire SSD. These plant areas also present I the greatest challenges with respect to separation of redundant trains of post-fire SSD l capability, protection of this capability, and the ability to perform the operator actions f

I necessary to achieve and maintain post-fire SSD conditions.

i 1

i l Phase 1 method consists of two steps. Step 1 is a screening evaluation of a fire protection i finding or a set of findings and is intended to screen out findings that do not impact the 06XX DRAFT Revision 1 A4-2 Issue Date: 08/10/99

effectiveness of a fire protection DID element. For th' se findings that impact the effectiveness I

o of one or more of the DID elements, Step 2 is performed. Step 2 integrates the findings with I

the SSD capability provided for the fire area, zone, or room of concern and then presents I

insi,ghts with respect to the potential importance that these fire protection findings have on I

maintaining one success path of SSD capability free from fire damage i

I The steps that follow describe the general process for implementing Phase 1.

I I

Sten 1: Screening of Mrw Protection Mndings l

I The Step 1 screening process is described by Figure 4-1. This process identifies those fire I

protection findings that impact the mitigation effectiveness of one fire protection DID element.

I Findings that impact the effectiveness of one or more of the fire protection DlD elements I

8 potentially have risk implications. Once identified, findings affecting one or more of the DID I

elements require further screening in order to determine if they are potentially important to I

maintainin one success path of SSD capability free of fire damage. This screening is I

performed y Step 2 below.

1 I

Making judgments regarding how effective a fire brigade can be in extinguishing a challeng,ing I

plant fire requires an evaluator to have a comprehensive understanding of manual fire fighting I

techniques and operations. It is not the intent of Step 1 to expect resident inspectors tohave I

the expertise to evaluate fire brigade effectiveness and performance. In most cases, fire I

brigade performance can be important to mitigating a fire and reducing its potential risk and I

should be considered when performing a Phase 2 evaluation. Reliance on fire brigade I

performance and its effectiveness as a sole means of maintaining one success path of SSD l

capability free of fire damage is not viewed as an acceptable practice. In those cases in which I

manual fire fighting i.e., fire brigade is used as the sole means to control and extinguish a i

fire, one success pa(th of SSD capab)ility is gonerally maintained free of fire damage b,y i

passive fire barrier having a fire resistive rating of 6-hours. In Step 2, where fire bamers or fire I

i barriers in combination with an automatic fire suppression system are used as the primary I

protection scheme for maintaining an SSD success path free of fire damage, manual fire i

fighting performance or effectiveness is not considered the dominant protective element of the I

pnmary protection scheme. For those protection schemes that use passive fire barriers as I

primary protection, findings related to only manual firefighting or fire brigade effectiveness I

typically do not warrant the performance of a Phase 2 evaluation.-

1 i

4 8 Allowed outage times with the use of compensatory measures do not provide an equivalent level of fire safety to that of a fully operable fire protection system or feature. Long-term use (more than 30 days) of compensatory measures for degraded or inoperable fire protection features used to protect the safe shutdown capability is an indication of inappropriate attention and resources being given to managing fire risk vulnerabilities.

Issue Date: 08/10/99 A4-3 Revision 1 DRAFT 06XX

{

i 1

e l

l_

Floure 4-1: Screenina Process Phase 1 (Sten 11 l

For a given fire aren, zone, or roorn under consideration j

Yes Degradation or impairment of I

DID element was less than the Geady stated l

impairment or degradation of allowed outage time without the 4

appropriate compensatory l

fire protection feature or DID n

measure.

l l

V or l

No, screen out Degradation or impairment of I

AHects one of the foWng DID element existed for less g

fire mitigation DID elements:

than 30 days with the N

• P l

1. Detection and manual me I

suppression capabihty I

I

2. Automatic suppression p No, screen out I

capabinty V

I

3. Fire barriers I

m,

Yes, I

Go to Step 2 of Phase 1 1

1 I

I Sten 2: SafetyImoortance Determination l

I When findings affect one or more of the fire protection DID elements in a given fire area, zone, or room of concern, it is necessary,f the findings are potentially risk significance, the post-fire

{

I this screening step and determine i l

i SSD capability for the fire area, zone, or room of concern and the fire protection schemes I used to maintain one SSD success p'ath free of fire damage will have to be determined. For i those findings that do not screen out, a Phase 2 evaluation will be performed.

I l The SSD determination can be made by reviewing the plant's Fire Safe Shutdown Analysis mainta)in post-fire SSD for each fire area, zone, or room of concern can be determined.

I I

I addition, the FSSA will identify fire protection schemes used to protect the analyzed SSD I success path. Depending on the degree of physical and electrical separation provided for the i various~ SSD success paths, different fire protection schemes are used to ensure that one SSD l success path is free of fire damage. Figures 4-2 through 4-5 below, presents additional I screening guidance for determining if the fire protection DID findings are potentially significant.

I If a question is not asked about a DID principle along a specific screening path, the I assumption is that the degradations associated with the DID elements not being questioned I are low.

l

' Findings that do screen out should not be disregarded they should be referred to the licensee and placed in the licensee corrective action program.

06XX DRAFT Revision 1 A4-4 issue Date: 08/10/99

I SSD system with redundancy (e.g., allhigh-pressure reactorinventory control functions)is located in the sten, zone, or room of concern. The remaining recovery capabilityis none. No additional recovery capability exists for performing tlse essential SSO functions external to the ares, zone, or

\\

toom of concern.

FIRE AREA BOUNDARY l

Fi aron zone, orroom l

SSD TRAIN A FUNCDON l

l I

SSD TRAIN B FUNCRON l

I l

eNoNa$a oY M.

fu o

Figure 4-2 l

l For the SSD interaction as noted in Figure 4-2 above, the following three basic fire protection I

schemes are used outside of primary containment to protect and maintain one train of SSD I

capability free from fire damage:

I I

Scheme 1 Provide a 3-hour fire barrier separation that either encloses one SSD train or i

provides wall-to-wall and floor-to-floor separation between the redundant trains; I

or I

I Scheme 2 Provide a 1-hour fire barrier enclosing one of the SSD trains. The area must be i

protected by automatic fire detection and suppression systems; or l

l Scherne 3 Provide more than 20 feet of horizontal separation between the redundant SSD l

trains. The spatial separation between the redundant SSD trains must be free I

of intervening combustibles. The area must be protected by automatic fire I

detection and suppression systems.

I l

Determine which protection scheme is used.

I I

i l

i Issue Date: 08/10/99 A4-5 Revision 1 DRAFT 06XX

1 I

I I

Screenina Criteria for Floure 4-2 I

Yes is Protection is 3-hour fire barrier separating 4

4 l

Scheme 1 used?

redundant SSD functions affected y,,,

l by finding?

perform Phase 2 I

I If No, screen out l

l Yes No l

I is Protection is 1-hour fire barrier that is the automatic fire i

Scheme 2 used?

separates / encloses one SSD

+

suppression system

+ Yes, 1

function affected by finding?

affected by the finding?

Perfo m l

Phase 2 I

)f

Yes, l

perform Phase 2 No, screen out i

I I

I-1 I

I I

I I

Screenina Criteria for Floure 4-2 l

l Yes No I

I Are combustibles is the automatic fire is Protection

+

located in the suppression system l

Scheme 3 used?

combustible-free affected by the finding?

I zone?

Yes,.

I Perfon l

No 3(

Phase 2 l

)I g

y,,,

is detection or fire brigade

/

l perform Phase 2 effectiveness affected by g

finding?

I l

V l

No, screen out i

I I

l 06XX DRAFT Revision 1 A4-6 issue Date: 08/10/99 l

e I

SSD s tem with redundancyis located in the aren, zone, or room of concern. Remaining m

capability is recovery of one fire 4ffected SSO train (e.g., alternative shutdown method for controlroom).

FIRE AREA BOUNDARY l

l l

SSD TRAIN A l

l l

l SSD TRA,u s l

l Fire area, zone, or room of concern i

RECOVERY OF ONE SSD Recovery actions taken TRAIN outside the fire area of concem Figure 4-3 I

For the post-fire SSD interaction noted in Figure 4-3 above, one basic type of fire protection I

scheme is generally used.

I I

Scheme This scheme minimizes fire damage to the preferred SSD trains by providing I

automatic detection and fixed suppression in the fire area, zone, or room of I

concem (the control room is an exception, no fixed fire suppression is I

provided). In addition, this scheme provides an alternative shutdown system I

that is electrically and physically independent of the fire area, zone, or room of I

concem.

I I

I i

Issue Date: 08/10/99 A4-7 Revision 1 DRAFT 06XX

1 I

Screenina Criteria for Floure 4-3 I

l No No l

l Does fire barrier forming the l

Is fixed fire suppression is detection or fire l

system affected by the A

fire area boundaries interface l

finding?

with recovery areas. Are any +

brigade effectiveness

+ No.

of these fire barriers affected affected by the screen g

by the finding?

finding?

out g

l V

l Yes, Y Yes, perform Phase 2 y

l perform Phase 2

Yes, l

perform Phase 2 g

I I

I I

I SSD tem with redundancylocatedin the ares, zone, or room of concern. Remaining on capability is a recovery system with redundancy that is physically independent of mthe re area, tone, or room of concern and is manually actuated under time constraints.

I FIRE AREA BOUNDARY l

l l

ssD TRAIN A FUNCRON l

l l

l SSD TRAIN B FUNCTION I

Fire area, zone or room of concern I

Recovery system with redundancy thatis physically independent of the fire area, zone, or room of concem andis inanually actuated under tirne constraints l

Figure 4-4 I

I For the post-fire SSD interaction noted in Figure 4-4 above, three basic types of fire protection I schemes are used to protect one train of SSD from fire damage within the area of concern.

I These fire protection schemes are the same as those described for Figure 4-2. Determine

-I which protection scheme is used.

1 06XX DRAFT Revision 1 A4-8 Issue Date: 08/10/99

o l

Li::.sle;G Criteria for Floure 4-4 I

I l

Yes l

le Protection is S-hour fire barrier l

Scheme 1 used?

+

separating redundant SSD A

No, screen out I

functions affected by l

finding?

l I

l Yes l

V I

I I

is recovery system physically independent l

(separated by a 3-hour fire barrier) of the No, l

fire area, zone, or room of concem and 4 perform Phase 2 l

capable of being manually actuated under l

the time constraints?

l 1

V l

Yes, l

screen out i

I I

I I

l l

I I

I l

Issue Date: 08/10/99 A4-9 Revision 1 DRAFT 06XX l

l l

Screenina Critpfla for Floure 4-4 l

Yes No l

is 1-hour fire barrier that is the automatic fire 4

No, is Protection

-)

separates / encloses one 4

suppression system screen out Scheme 2 used?

SSD function affected by affected by the the finding?

finding?

g l

l Yes Yes if 1

3r l'I is recovery system physically independent I

(separated by a 3-hour fire barrier) of the fire area, I

zone, or room of concem and capable of being i

l i

y I

Yes, I

screen out No, I

perform Phase 2 I

I I

I I

I I

Screenina Criteria for Floure 4-4 l

l Yes No l

l is Protection

+

Are combustibles is the automatic fire l

Scheme 3 used?

located in the Y

suppression system affected' I

combustible free by the finding?

l zone?

I I

l Yes No l

Yes l

l Is detection or fire brigade ye effectiveness affected by the l

If finding?

l I

l is recovery system physically independent y

1 (separated by a 3-hour fire barrier) of the fire area, No, I

zone, or room of concem and capable of being screen out I

manually actuated under the time constraints?

i I

l v

l No,

Yes, l

perform Phase 2 screen out 06XX DRAFT Revision 1 A4-10 issue Date: 08/10/99

o l

l SSD system with redundancy is located in the area, zone, or room of concern.

l Remaining mitigation capability is a system with redundancy that is l

unaffected by the fire and immediately available (automatic initiation or no l

time constraints).

l MRE AREA BOUNDARY l

l SSO TRAIN A FUNCTION l

l l

SSD TRAIN B FUNC110N l

l Fire area, zone, or l

room of concern l

l MA3. L"C;Y mm

\\"sa n %

Figure 4-5 l

For the post-fire SSD interaction noted in Figure 4-5 above, three basic types of fire protection I

schemes are used to protect one train of SSD from fire damage within the area of con'cem.

l These fire protection schemes are the same as those described for Figure 4-2. Determine I

which protection scheme is used.

I I

Issue Date: 08/10/99 A4-l l Revision 1 DRAFT 06XX

1 I

I i

1 l

l Screenino Criteria for Floure 4-5 l

I Yes No, I

is Protection is 3-hour fire barrier screeri out i

Scheme 1 Y

separating redundant l

SSD functions affected by used?

I the finding?

I I

i l

V Yes i

l is recovery system physically independent (separated I

by a 3-hour fire barrier) of the fire area, zone, or room I

of concem and capable of being automatically initiated Y No, I

or manually actuated under no time constraints?

Perform Phase 2 I

I l

l V

Yes, l

screen out l

i I

.Yes No l

I l

Is Protection is 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> fire barrier that is the automatic fire l

Scheme 2 4

separates / encloses one +

suppression system 4

l used?

SSD function affected by affected by the l

the finding?

f nding?

I I

Yes Yes I

Y V

I I

l Is recovery system physically independent (separated I

by a 3-hour fire barrier) of the fire area, rone, or room I

of concem and capable of being automatically initiated l

or manually actuated under no time constraints?

I I

V I

Yes, No, I

screen out perform Phase 2 I

I I

I I

06XX DRAFT Revision 1 A4-12 Issue Date: 08/10/99

I Screenina Criteris for Floure 4-5 l

1 I

Yes No l

l I

is Protection Are combustibles is the automatic fire 4

4 Scheme 3 located in the suppression system affected by I

used?

combustible-free the finding?

zone?

I No l

Ye II l

l Yes is detection or fire brigade l

effectiveness effected by the l

finding?

l v-i v

II l

is recovery system physically independent (separated No, l

by a 3-hour fire barrier) of the fire area, zone, or room screen out l

of concern and capable of being automatically initiated or manually. actuated under no time constraints?

g i

I V

I No, Yes, screen out l

perform Phase 2 l

1 1

I l

l Issue Date: 08/10/99 A4-13 Revision 1 DRAFT 06XX

(

I 5.0 Fire Protection Risk Significance Screening Methodology-Phase 2 l

l. The FPRSSM is an integrated process that can be used to assess the relative risk significance I of identified weaknesses in the fire protection DID elements in a given fire area, zone, or room i under consideration. The following steps describe the general process that should be followed I when implementing this methodology (see Figure 5-1, " Fire Protection Risk Gignificance I Screening Methodology-Process Diagram"). In the case that the Phase 2 method I determines that the assessed findings have potential risk significance, Phase 3, which is a i more refined analysis, can be performed.

l l Sten 1: Groucina of Fire Protection and Post-fire Safe Shutdown Findinas l

I The specific fire protection inspection findings affecting the fire protection mitigation DID l features are grouped according to each specific fire area, zone, or room which they impact.

I Then an area-specific fire damage scenario is defined and its effects are postulated. Step 2 I provides guidance for defining fire scenarios. Step 1 and Step 2 should be performed during I an inspection in an integrated manner (i.e., observations of a fire protection degradation and I the related fire hazards in the area of concern).

I I Sten 2: Define the Fire Scenarlo I*

I in order to properly support the FPRSSM risk estimates, the inspector or the reviewer will need I to develop a postulated fire damage scenario that describes the fire and its potential for i propagation (see inspection Procedure (IP) XXX, Fire Protection Functional Inspection I (FPFI), Appendix H for further guidance) within the fire area, zone, or room under I consideration. Under this postulated scenario, the inspector or reviewer must make I deterministic / ualitative judgments regarding the effectiveness of various degraded fire I protection mit ation features or systems and their ability to protect a post-fire safe shutdown I path and mai ain it free from fire damage. Postulated f,res involving fuel sources in an area i

i under consideration are deemed meaningfulif they are capable of developing a plume and/or I a hot gas layer that has the potential to directly affect components of equipment that are I important to safety. If the postulated fires in the area of concern are not deemed meaningful, I the fire protection DID findings may not contribute to the change in risk; however, they.should*

I be considered as important.

l l Steo 3: Qualitative Evaluation of Findinas I Once the various inspection DID findings and a meaningful fire scenario have been I established for the fire area, zone or room of concem, the individual findings must be I evaluated with respect to their ability to satisfy the performance objective established by the I applicable DID element. Upon determining which DID elements have been affected by the I specific fire protection finding, a qualitative evaluation of each finding and its effects on I accomplishing the DID objective is performed. It should be noted that many inspection I findings can contribute to a degradation in a DID element. For example, poor training, poor i fire bngade/ operational drill performance, improperly installed detection, and inadequate hose I coverage of a fire area can all contribute to the degradation rating assigned to manual I suppression. Therefore,in order to perform this step, the existing plant conditions as noted by I the inspection finding are evaluated against the deterministic / qualitative evaluation guidance I and degradations categorization critena established in IP XXX, Appendix H.

I I The output from this deterministic / qualitative evaluation, results in a degradation rating (DR) l (e.g., High, Medium, or Low) being assigned to each DlD element.

I I

06XX DRAFT Revision 1 A4-14 Issue Date: 08/10/99

/

Sten 4: Asslanment of Quantitative Values l

I From Step 3," Qualitative Evaluation of the Findings," a DR is assigned to each DID element.

I Once the DRs for a DID element have been determined, they are quantified by assigning a i

value from Table 5.1.

I I

I I

Table 5.1 Quantification of Degradation Ratings ' DR) of the Individual DID -

I

(

Elements

• 1 Automenc Fire hianuelFire Fighting Levelof 3MourFJre 1-Hour Fire S

ion ENectiveneee Degradenen Berrier Berrier E. p:; K ^::

nc (Fire Bregede)

Outside inside control Control Room Room High 0

0 0

-0.25

-0.5 l

Medium

-1

-0.5

-0.75

-0.5

-1 l

Low

-2 (door)

-1

-1.25

-1

-1.5 I

I Dependencies exist between certain DID elements. Those dependencies and their values are I

, expressed in Table 5.2 below.

I I

l LTable 5.2 Quantification'of Dependencies Between DID Elements -

1 A$tomatic Fire Suppression AtenuelFire Fighting Ad} Dependency ustment Due to l

Ethnctiveness Degradetion Ettectiveness Degradation l

Medium High

+0.75 l

Low High

+0.5 l

l These dependencies are based on the fact that automatic suppression merely controls the fire, I

and the fire brigade is needed to completely extinguish the fire. The resulting adjustment has I

the effect of providing partial credit for automatic suppression when it has a low degradation I

and is paired with a high degradation of manual fire fighting capability. No credit is provided I

for automatic suppression when it has a medium degradation and is paired with a high I

degradation of manual fire fighting capability.

Table 5.3 Quantification"of Common Cause Contribution Between Sprinkler' I

i

~

Systems and Manual Fire Fighting Hose Stations I

j Automatic Fire S hinnualFire Fighting Ad}ustment Due to Common l

Ettectiveness redation Ettectiveness Degradation Cause l

Low Low

+0.25 l

I The Table 5.3 adjustment is made since a common water delivery and supply system exists I

both automatic and manual water-based systems.

l 5 Each of these values in Tables 5.1,5.2, and 5.3 is approximately an exponent of 10.

Issue Date: 08/10/99 A4-15 Revision 1 DPAFT 06XX

1 I Stoo 5: Determination of Fire lanition treauencv I

I The next step is to determine the fire ignition frequency for the fire area, zone, or room of I concern. If a fire ignition frequency can be obtained for the specific fire area, zone, or room of I concern from the plant-specific IPEEE, it should be used. However, if the IPEEE does not provide it, then it may be selected from Table 5.4*

I Table.5.4 Generic ignition Frequencies l

Plant Buildings or Rooms I

sulkNng or Room ignition Frequency (IF)/ Yr I

control Room 7E 3 l

Cable spreading Room SE-3 1

Diesel Generator Building 6E-2 I

switchgear Room 1E-2 l

Battery Room 3E-3 to 1E-2 l

Reactor Building 3E-2 l

Auxiliary Building 6E 2 l

Turbine Building 6E-2 I

Containment 9E 3 I Stec 6: Intearsted Assessment of DID Findinas (Excludina SSD) and Fire lanition Frecuency i Once Steps 4 and 5 have been completed, the res ective DID findings for a given fire area, l zone, or room of concem are assessed collectivel summing, using the following formula, I the fire ignition Frequency and the DR for eac the fire protection DID elements. This

) (NUREG/CR-5499))to determine the change in risk.on Frequency I value is called the Fire Mit i Determination Process (S I

I FMF = IF + FB + MS + AS + CC (when appropriate) i 1

I where 'IF = Fire ignition Frequency i

FB = Fire Barrier i

MS = Manual Suppression / Detection i

AS = Automatic Suppression / Detection I

CC = Dependencies / Common Cause Contribution l

I Table 5.6 below shows the association between the FMF and the approximate frequency in I Table 5.7 (same as SDP Table 1," Estimated Likelihood Rating for initiating Event Occurrence l During Degraded Period").

I 6 Generic ignition frequencies for specific buildings or rooms are provided in Table 4.4a (taken from AEOD data base, NRC's "Special Study: Fire Events-Feedback of U.S. Operating Experience-Final Report," June 19, 1997).

06XX DRAFT Revision 1 A4-16 issue Date: 08/10/99

l Table 5.6 Association of FMF to Table 5.7 I

(SDP Table 1) Approximata Frequencies for Calculation I

of Delta CDF I

itigation Frequency Table 5.7 Approximate Frequencies FMF > -2 1 per 10 to 10' l

2 2 FMF >-3 1 per 10' to 10' l

F 8

-3 2 MF >-4 1 per 10 to 10' l

-42 FMF >-5 1 per 10' to 10

l

-52 FMF >-6 1 per 10' to 10' l

FMFs6 Less than 10' l

l The approximate frequency (same as FMF) is adjusted in Table 5.7 by the length of time that I

the degradation existed. In practice, as part of the initial assessment, the inspector should I

assume that tne degradations are simultaneous, and that all occur for the length of time I

associated with the longest degradation. This is a conservative approach, and if desired, can I

be refined. To adjust the time of the degradation, a letter is selected on the basis of the I

degradation time from Table 5.7. The degradation of 3-30 days decreases the frequency by 1

10, and the degradation of less than 3 days decreases the frequency by 100.

I l

l l

l I

Issue Date: 08/10/99 A4-17 Revision 1 DRAFT 06XX

1 1

I i

Table 5.7 Estimated Likelihood Rating for Initiating Event Occurrence l

During Degraded Period I

l ? Approx. Freq.

Example Event Type Estimated Likelihood Rating I

>1 per 1 - 10 yr Reactor Trip A

B C

Loss of condenser 2

1 per 10 - 10 yr Loss of Offsite Power B

C D

Totalloss of main FW Stuck open SRV (BWR)

MSLB (outside entmt)

Loss of 1 SR AC bus Loss of Instr /Cntrl Air Fire causing reactor trip 1 per 10 - 10' yr SGTR C

D E

Stuck open PORV/SV RCP seal LOCA (PWR)

MFLB MSLB inside PWR cntmt Loss of 1 SR DC bus flood causing reactor trip I

1 per 10 - 10' yr Small LOCA D

E F

8 Loss of all service water I

1 per 10 - 10'yr Med LOCA E

F G

4 Large LOCA (BWR) 1 per 10 10' yr ge OCA(PWR) 5 F

G H

Vessel Rupture l

<1 per 10*yr G

H H

l Source: FDP Table 1, NUREG/CR-5499

> 30 days 30-3 days

<3 days 1

1 I

Exposure Time for I

Degraded Condition i

I Steo 7: Intearstion of Adlusted FMF with SSD I

I The FMF, which has been adjusted by the length of degradation, represents the integration of I IF with the DR associated with each of the fire protection DID elements. In this step, the FMF I is integrated with the SSD capability that is free from fire damage.

I I Fire damage has the ability to induce a transient, a loss of offsite power (LOOP), a loss of I cooling accident (LOCA), or a loss of reactor water makeup function. Assuming a postulated I fire scenano, the sequences corresponding to the appropnate initiator that are impacted by the I inspection findings are evaluated using Table 5.8 (same as SDP Table 2)," Risk Significance i Estimation Matrix."

i I in the FPRSSM, the CDF associated with the impact of the DID findings is strictly what is I calculated. However, for purposes of using this model, the CDF due to the DID findings will be I considered as the ACDF. This is consentative since the CDF due to the DID findings is 06XX DRAFT Revision 1 A4-18 Issue Date: 08/10/99

{

I greater than ACDF. Note that in the columns of SSD as the mitigating equipment increases in l

Table 5.8, failure probabilities decrease by a factor of 10.

I I

Stoo 8: GeneralRules for Acolvina FPRSSM i

l Since a fire barrier failure is represented by a probability, the ACDF is a combination of two i

contributions: a contribution from barrier failure, and one from the barrier success. Table 5.1 I

can be used to calculate both of these terms. For purposes of discussion, the term referring to I

the case in which the barrier fails will be eclied the double room term (DRT) and the case in I

which the barrier succeeds will be called the single room term (SRT). The SRT and DRT are I

shown by the figures 8.1 and 8.2 below.

I l

Single Room Term (SRT) Fire Barrier Provents Fira/ Smoke Propagation l

l Fire Area B Fire Area C SSD Train A SSD Train B 3-hour fire barrier (fire barrier Fire affected area successful. No fire / smoke impact on fire area B l

i Figure 8.1 Double Room Term (DRT) Fire Barrier Falla to Prevent FirWSmoke Propagation I

1 Fire Area B Fire Area C SSD Train A SSD Train B Fire affected area

%ur fire barrier fails (fire / smoke impacts fire grea B) l Figure 8.2 Issue Date: 08/10/99

. A4-19 Revision 1 DRAFT 06XX

I The safe shutdown (SSD) equipment failed for the SRT is the combination of mitigating equ,ipment, I associated cables, and actions in fire area C alone..The SSD equipment failed for the DRT is the I combination of mitigating equipment, associated cables, and actions in B and C.

I I As a result, the SSD impact can be different depending on whether the SRT or DRT is calculated.

I Note that the mitigating equipment for the DRT is a subset of or can be equal to the mitigation I equipment for the SRT.

I I Both the SRT and DRT are not needed in all cases. The following rules provide guidance on when to I use these terms. The purpose of the first rule is to prevent the overestimation of ACDF due to the I approximation that CDF total is equal to ACDF. The SSD/SRT and SSD/DRT should also be i. calculated or estimated for the entire initiator for the fire area (s) for the following comparison:

1 I (Rule 1)

If SSD/SRT = SSD/DRT (i.e., no SSD equipment or components in adjacent fire area)

I and the only finding is against a fire barrier, the ACDF = 0.

I I (Rule 2)

If the fire barrier has a high degradation and rule #1 does not apply, just use the DRT I

to calculate ACDF.

I I (Rule 3)

If the fire barrier has a medium degradation and rule #1 does not apply, I

I For 3-hour fire barrier, use only DRT if SSD/DRT is greater than or equal to 10 times i

SSD/SRT, I

I For 1-hour fire barrier, use only DRT if SSD/DRT is greater than or equal to 3 times i

SSD/SRT, I

I otherwise use SRT + DRT.

I I (Rule 4)

If the fire barrier has a low degradation:

I I

For 3-hour fire barrier, use only SRT if SSD/DRT is not greater than or equal to 100 times l

SSD/SRT, I

I otherwise, use only DRT.

I I

For 1-hour fire barrier, use'only DRT if SSD/DRT is greater than or equal to 10 times i

SSD/SRT, I

I otherwise, use SRT + DRT.

I l (Rule 5)

If SSD/SRT is equal to SSD/DRT and a finding against either MS or AS exists, only I

the SRT is necessary.

I I Once it is established which terms (DRT, SRT) are needed to calculate ACDF, these terms are I calculated on a sequence-by-sequence basis, so that the appropriate credit for SSD is given to each I sequence.

I I Sten 9: MMif4=*lons.'t:=22=w To Add Imanct of Sourlous Actuations

'II The decision to use the SRT, DRT, or both terms is made before considering spurious actuations.

I However, once this decision is made, the impact of spurious actuations on SSD should be added I provided the spurious actuation or actuations increases the severity of SSD by at least a factor of 10.

1 If the spurious actuations pass this test, then a factor of -1 should also be added to the FMF to I account for the probability of spurious actuations.

1 06XX DRAFT Revision 1 A4-20 issue Date: 08/10/99

IIIIIi I

l l

l l

l i i l

e w

e n

n d

d d

d e

e o

lo it n

e e

e e

le h

e e

R R

R R

r r

7 Y

W G

G n

)

(

fo n yi w

e n

n n

a d

d d

e e

e vt lo it rer e

e e

le h

e e

e

)

od 6

R R

R W

G G

G r

r r

Y

(

ce eli Rfa n

h io X

x t yta e )s X

i i c r

w ntumt w

e n

n n

n 6

n n

h ia acii d

d lo it e

e e

e 0

mdarr t

a

)5 e

e h

e e

e e

e nl et

(

r suads R

R le r

r r

r t

n yd u n n Y

W G

G G

G T

t 1

o F

sen u o

y ra c

A 1

i a

l m

R t

t i

(

D i

p b

r a) pP 2

1 I*a aD fo n

F CS io le n

y b

o nfo a

r t

e o

e it a

i c

i3 v

n a2 c

R it n

w e

n n

n n

n T s

t o

h i d

g wcc s e

!o i

e e

e e

e t

l yi

)

h e

e e

e e P a

a ip e n O niet R

!e G

t ti r

r r

r r

ie a

maami Y

W G

G G

G G D c

n t

4 MS

+r i

t

)

4 S

n edmia f

A t

t r l

t

(

a gm id s n oots io le yut nn e

a n

r n

sdu nr a

earo c

ti i

r S

iF 1

f 1 r(oc a(

u k

m o

s e

S i

R s

R ia it n

h+

yf w

e n

n n

n n

n r

wcon e

e e

e e

e t

R n i lo it 8

e h

e e

e e

e e

s O maya le r

r r

r r

r 5

tedet 3

Y W

G G

G G

G G

r r

)

re i

iv s nvd a

yuoe

(

h d

sdci l

eea a

2 1 rrf T

hy f

c on e

n n

n n

n n

n t

1i+wn i

e e

e e

e e

e e ya it a

)

h e

e e

e e

e e

s+et W

G G

G G

G G

G r r nmd r

2 r

r r

r r

r r

n e svd

(

ie at u iv noe r sd dici a

l t

ye rea 1 sr 2t rf e

s y

9 mhc s

i n n

n n

n n

n n

n 9

t re s ewa e

e e

e e

e e

e

/

)

ivin t

d 1

e e

e e

e e

e e

shn

(

r r

r r

r r

r r

0 da ycu G

G G

G G

G G

G 1

r s

3 ad t

/

2 2e er 8

0 e

d g oe t

nt oS a

t n

itivlim A

B C

D E

F G

H D

eh a

iEe o e

t n

krU(

u F

i ss I

9 dn f

a o

y t

c s

c d

s

)

n g

D a

n e

n M

p g

m i

S a

u d

m n

a s

s e i S

S I

g q

n S

id e

g e

r F

h R

d n

n k

T i

u F

it P

A n d

n d S i

D w

i s

d la n

F oo n

F F

ir n

s i V io D

g t

M i

i s r

F e

it f

f v

n o

F in yt f

o in e

n n

a y

r t

o it ig t y lp s u-s a

Yt o s

r a

nc d

t e

2a n i r

i i

s o

lt e

en e

p st pit e

u eu s ei c

r t

a i me s

A ec t

ca ed a

a u

F s u u

r sq t

n u Q o e e dj o e c n ae la r

A N

c sq p

a f

s e

ad c

v o

n sF s

a f

o 9

n ha F

f f

s c

9 s

f o An o

le n

e

/

I nt Pe S

E n

f t

o n

it la H

o e

e n

it u

o s

et 0

r e

a dito n R it v

n ei o

a sc 1

) o ap

/

g wl m i t n it la fic ne 8

Mi ig la ip it n

/

a n m

ag a

t e

r Sc ih n

u t

e g

i er i

ig r

r i g

e d

r t

r 0

a s

t e e e

n oS io c

Se mf ig G D Q A D InF I

G Mu Lc e

o o

t r

r e

u s

e t i t

e Rt e o n

o r

o Pr i s e

t a

F( P 1

2 3

4 5

6 7

8 9 ir f

a R

r

(

p p

p p

p p

p p

pu D

f e

o e e

e ep yr n a e

e e

e e

te t

S SS e

oe S

S S

S S

S S

t t

t t

t t

t giF u

o it v l f ci S

t de ps IS oo ei n

s o c n e hn I

s 2

t 2

ea c

Mi 4

w7 A

f gin ng ini eS ek r s d

ci SR n

a el a

t es ci k

pel t

nt i

esu s

n r

a e cns ct e

f o i

c ee i

r acr f

iP i

t f

t l t s

o o

n gf e e io w

y n

ngm S

ks ie b

)

o sa s

r it v

d o

e a

egs se r

ie tc n

n ons ic E

it it r

dEe f

Ro e

o im s ).

E n

p e

s3 nr E

e S

c e

e oP d

e t

sga e in i

n P

e t

i o

d nnes co M

s t

r eina n

l o a P

io a

p e

n e

c c dih ei R

f t

nieP t

v ir n

i t

f a

Lf r(

a rn r

t ns g

Pi f

r m

on e

o o

io s

e g

p er tci b

R n

m r e t

ep

/o i

i iFt r

n p

s e

sm y

g o

e t

1 S. D 1

nu n

t r

f e

e n

is i

n c

a n

io r s d

oa n

e S

S e

e e

S f

r nd i

d

- s f

u o n ns iS 1 g 2

r iv Y

c e

r n

ia o

e pi p

g o

t S

R i

as it t cc R

ed e

F r t n

t i t

ah ee

(

Sf S

,s T

pg pp ss e

F eisn nn rPi ii Y

ARD XX60 Ill!IlliIIll g

Il lIIllIliglllIllI

I I

1 I

Appilcation of I

Fire Protection Risk-Significant Screening Methodology I

to I

Hypothetical Cases I

l Case 1: Cable Spreading Room I

I 1

A sinole CSR exists in a plant. The CSR is located adjacent to a fire area that contains the remote I

shutdown panel (RSP). A 3-hour barrier separates the two fire areas. The CSR has an automatic I

~

carbon dioxide suppression system. A credible fire scenario can be developed that will damage l

cables and expose the barrier to fire. The ignition frequency for the CSR is SE-3/yr.

I I

I Example 1 A i

1

)

The 3-hour fire barrier wall has a high degradation. The automatic carbon dioxide suppression I

system has also a high degradation. The fire brigade has a medium degradation. Each of these i

degradations has lasted longer than 30 days.

I I

(

Since the fire barrier has a high degradation, only the DRT is used for SSD. No credit is given for I

SSD for the DRT since no equipment or human actions exist at the RSP to mitigate core damage I

outside of the two areas which are separated by the degraded fire barrier.

I I

The fire mitigation frequency (FMF) = IF + FB + AS + MS I

I

. where IF = ignition frequency i

FB = fire barrier i

AS = automatic suppression / detection l

MS = manual suppression / detection i

I Thus FMF = -2.3 + 0 + 0 - 0.5 = -2.8 i

I From Table 5.7 (SDP Table 1) locate the Approximate Frequency = 1E-2 to 1E-3. Since the '

I degradation is greater than 30 days, select C from the table.

I I

Since both trains of SSD could be damaged by the fire and no recovery capability exists outside the I

area of concem, select none from Table 5.8 (SDP Table 2). As a result, the color representing the I

change in CDF is Red.

I I

Example 1B l'

i Suppose the 3-hour fire barrier wall has been improved to a medium degradation. All other I

degradations remain the same. SSD for the SRT is 1E-1 due to the RSP which is a factor of 10 less I

than SSD for the DRT. Therefore, we can still only use the DRT.

I I

Thus; FMF = -2.3 - 1 + 0 - 0.5 = -3.8 I

I From Table 5.7 (SDP Table 1) locate the in Approximate Frequency =1E-3 to 1E-4. Since the I

condition lasted longer than 30 days, select D from Table 5.7.

I I

Given the SSD still equals none, Table 5.8 (SDP Table 2) will produces Red.

1 I

Examole 1C.

I I

Issue Date: 08/10/99 A4-23 Revision 1 DRAFT 06XX i

1 Suppos3 ths 3-hour fire barri r wall cnd cutomatic suppression system are repaired so that no I degradation exists in either. The manual suppression continues to have a medium degradation.

I I Since the 3-hour fire barrier wall has only a low degradation, the relationship between SSD/DRT and I SSD/SRT needs to be re-evaluated. The SSD/DRT is not greater than 100 times the SSD/SRT, I therefore, use the SRT in this case.

I I Thus; FMF = -2.3 + 0 - 1.25 - 0.5 = -4.05 I

i From Table 5.7 (SDP Table 1) locate Approximate Frequency = E-4 to 1E-5. Since all degradations I lasted longer than 30 days, select E from Table 5.7.

I I Given that the SSD is equivalent to the human recovery of a failed train, Table 2 produces a White I condition.

'l I Case 2: Auxiliary Feedwater Room i

I An AFW fire area contains a turbine auxiliary feedwater (TDAFW) pump. The only other AFW pump, I the motor driven auxiliary feedwater (MDAFW) pump, is located in a different fire area. The MDAFW l pump cabling runs through the AFW room, but is protected by a 1-hour fire barrier. The AFW room I is protected by an automatic sprinkler system. The cables for the MFW pumps have not been traced.

l The ignition frequency for the AFW room (excluding that equipment protected by the 1-hour fire j

l barrier) is 3E-3/yr.

f I

I In this case, the initiator that the fire produces is a plant transient condition. Loss of AFW and no j

i credit for MFW dictates that the dominant sequences will be those failures. The two sequences that I are dominant iven the transient initiator are (1) loss of AFW, loss of MFW, and loss of feed and 2 loss of AFW, loss of main feedwater (MFW), and loss of high pressure I bleed capabili i recirculation (

R)). Each of these sequences will need to be evaluated for the AFW room since fi 1 failures impact all these sequences.

l i

l High pressure injection is not located in the AFW room and, therefore, feed and bleed capability is I available after the fire. The RHR, which provides cooling for the sump after feed and bleed I operations and supplies (feeds) the high-pressure injection for HPR is not located in the AFW room.

l Therefore, HPR is also available.

I I

I Examole 2A I

I The 1-hour barrier has a high degradation. The automatic sprinkler supptession system has a high I degradation. The fire brigade has a medium degradation. Each of these degradations has lasted I longer than 30 days.

I I Since the barrier has a high degradation, only the DRT is used for SSD.

I I For sequence 1, the SSD/DRT is feed and bleed capability. For sequence 2, the SSD/DRT is HPR.

I I The fire mitigation frequency is the same for sequences 1 and 2, is l

I FMF = -2.5 + 0 + 0 - 0.5 = -3.0 l

I For each case, from Table 5.7 (SDP Table 1) locate the Approximate Frequency = 1E-3 to 1E-4, I select D.

I sequence has 1 train as SSD/DRT). T(SDP Table 2) produces a White condition (since i For both sequence 1 and 2, Table 5.8 I

I l AFW room.

i 06XX DRAFT Revision 1 A4-24 Issue Date: 08/10/99 i

6 4

Examole 2B I

l Suppose the 1-hour fire barrier is restored to its full functional condition. Now it is assigned a low I

degradation. The automatic sprinkler system and the fire brigade continue to have the same I

degradations as in Example 18.

I I

The fire mitigation frequency, is the same for sequences 1 and 2:

1 I

FMF = -2.5 + -1 + 0 + -0.5 = -4.0.

I I

Therefore, locate the Approximate Frequency = 1E-3 to 1E-4., and select E from Table 5.7 (SDP l

Table 1).

I l

'To decide whether a DRT, or both the DRT and SRT is needed, compare the SSD/DRT with i

SSD/SRT. (SSD/DRT has already been calculated above for both sequences.)

l I

For sequence 1, SSD/SRT is made up of the MDAFW and ieed and bleed, which are two diverse I

trains of systems. For sequence 2, SSD/SRT is made up of MDAFW and HPR, which are again two i

diverse trains of systems. The SSD/SRT for both sequences is again the same.

I I

Therefore, in each case SSD/DRT = 100 times SSD/ SAT. Thus the DRT is the only term needed for I

sequences 1 and 2. The SSD/DRT was 1 train for both sequences.

I I

Thereforo, from Table 5.8 (SDP Table 2), each of sequences 1 and 2 produces a Green result.

1 (Rules for adding Greens are still under development at this time. Addition of Greens may become a l

White.)

i I

I l

Issue Date: 08/10/99 A4-25 Revision 1 DRAFT 06XX

Appendix 5 SIGNIFICANCE DETERMINATION PROCESS AND 1

ENFORCEMENT REVIEW PANEL This appendix provides guidance concerning,a, joint NRR/OE/RES/ Region review panel which has 1

been established to help ensure that the significance determination processes appendices 1,2,3, and 4, which use a risk characterization, are implemented i(SDP) described n a consistent manner. Consistency is important since SDP provided the bases for the assessment and enforcement programs.

The panel will include the following:

The panel will be chaired by the Branch Chief or an altemate Section Chief from the Inspection Program Branch of NRR.

One member of the Operational Support Team from the Probabilistic Safety Assessment Branch, NRR.

A management member or a designated altamate from the Office of Enforcement (OE).

As designated by the panel chairman, there will be regional representation to include a DRP Branch Chief and a SRA from at least 1 of the 3 remaining regions not associated with the issue being I

i reviewed.

Designated regional panel member and a SRA from the region associated with the issue being reviewed.

4 A member representing the Office of Research.

I Other interested parties may attend by invitation of the panel members.

1 The regional panel member should normally be the projects section/ branch chief responsible for the

)

site for which the SDP was conducted or another person designated by regional management.

j Another regional section/ branch chief should be designated by regional management as the attemate regional panel member.

General Procedure:

The panel will meet bi-weekly if necessary, for the purpose of reviewing all Phase 2 evaluations that I

were determined by the initial review to be of ential risk significant (i.e. marginal whites or any I

issue greater than g~ reen) and to independent discuss all I

being considered before they are issued in th r final form. proposed potential risk significa

~

The designated regional panel member is responsible for bringing any proposed risk significant assessment inputs or violations to the attention of the panel in a timely manner so that the issuance of the inspection report is not unnecessarily delayed. A panel questionnaire similar to that attached I

to this Appendix should be used.

I lt is expected that all decisions regarding the assessment or enforcement actions will be made by consensus, all members agreeing, if there is no consensus, the matter will be referred to the Director, Division of System Safety and Analysis, and the director of the Office of Enforcement for resolution.

Issue Date: 08/10/99 A51 Revision 1 DRAFT 06XX

Tha pin:1 will clso dell with any policy issu:s that are idsntifird by any panzl rn:mbsr or associited with the activities of the Operation Support Team from the Probabilistic Safety Assessment Branch, NRR.

The panel may also request program support from RES and other NRC groups to further development and use of the SDP. Additionally, the panel may cause audits of the SDP to ensure appropriate guidance and training has been provided to the field inspectors and their managers.

The panel shall meet, in person or by telephone conference call, on a schedule that is mutually agreed to by the panel members and that will not unnecessarily delay the issuance of the inspection report.

The designated attemate may act for the member.

Others including, the regional inspector, resident inspector, project manager, etc., may be asked to attend the meeting or provide input to the discussions.

The panel shall maintain a record of all risk decisions results reviewed by the panel so they will be available for future comparison. Eventually, dance.these will be used to develop a set of examples which could b added to the SDP assessment gui The panel shall continue to review potential risk significant issues until NRC management agrees that such reviews are no longer needed. For the present, it is recommended that the panel plan on performing these reviews for the pilot plant efforts and the first year after the new reactor oversight process takes effect (i.e., until January 1,2001) ions.or until adequate SDP guidance, with appropriate examples, is developed and provided to the reg l

l I

06XX DRAFT Revision 1 A5-2 issue Date: 08/10/99

1 O

Appendix 5 SDP AND ENFORCEMENT REVIEW PANEL WORKSHEET Worksheet #

Panel Date Region Licensee Facility Docket No(s).

License No(s).

l Insaection Report No(s).

Date of Identification Date when SDP Phase 1 Screening Complete Date when SDP Phase 2 complete Date of Exit Interview Panel Chairman Responsible Branch Chief / Lead inspector HQ SRA Representative OE Representative HQ Attendees Regional Attendees Brief Summa of lasues/ Potential Risk:

1.

N M *f E *Is'.*g/. N 7 M 'a'n fa M E. E I 5I,$ $ N N N E.T M Y ei E " '* # " * * '

Issue Date: 08/10/99 A5-3 Revision 1 DRAFT 06XX 9

2.

Regional Recommended Significance:

Desenbe the proposed segrifficance. Is a pre-decisional regulatory conference necessary? Is achon warranted against any individual? How does this action fit into overall strategy associated with the Plant Assessment Process?

3.

Analysis of Significance:

a.

Risk Significance - SDP Assessment (worksheets attached). Provide Summary of licensee's Significance Review if available. Is there a need for a SDP Phase 3 review prior to final disposition?

i b.

Actual Consequences or Outside SDP process

( willful,50.9, dose, release, reporting, other)"

I 4.

Recommended Assessment Color and Enforcement Action (Pilot Process)

ComDarison with the Non Pilot Enforcement Poliev 5.

Apparent Severity Level (s) and Basis under non-pilot Enforcement Policy:

Indicate Seventy Level for each violation or group of violations. Reference examples from enforcement policy supplement.

Address aggregation, repetitiveness, willfulness, etc.

f 6.

Factors for application the non pilot Enforcement Policy:

These items should be addressed for each violation or group of violations.

a.

Enforcement History Last 2 years:

List SL lli or above, Orders, similar violations, etc.

~

b.

Is Credit Warranted for identification? Explain:

Describe method of identification (NRc, licensee, revealed through event, allegation, etc.). Describe any missed opportunities.

c.

Is Credit Warranted.for Corrective Actions? Explain:

Were actions prompt and comprehenssve? Include date hcensee was aware of problem requinng corrective action 11 different from above.

consicht issues in Figure 61," List of issues That May.igate or Escalate Sanction?

Should Discretion Be Exercised to Mit d.

warrant Discretion." If yes, identify issue and bnefly explain.

7.

Is action being considered against individuals?

8.

Non-Routine issues / Additional Information/ Lessons Learned:

a.

Is generic communication (IN, GL, etc.) needed for this issue?

b.

Is inspection or significance determination guidance needed?

c.

Is there a need for NRR programmatic guidance or interpretation of requirements?

d.

Are there any other lessons learned?

e.

Are these issues related to an allegation?

06XX DRAFT Revision 1 AS-4 issue Date: 08/10/99

f.

Is there any other information about this case that should be considered and is important to note?

8.

Panel Decision:

Issue Date: 08/10/99 A5-5 Revision 1 DRAFT 06XX

o Additional inspection Report Guidance

)

1

REVISIONS TO August 18,1999 IMC 0610*

1.

COVER PAGE A.

Standard Paragraphs We've added a sentence to the first paragraph that tells the addressee that inspection results were discussed with a named member of his staff.

"The results of this inspection were discussed on July 24,1999, with Mr. D. Prue and other members of your staff." This tells the addressee who to contact for more information about the inspection. Note that this person's name should also appear in the exit meeting summary at the end of the inspection report.

We've provided guidance for a more standard second paragraph that describes the inspection:

"This inspection was an examination of activities conducted under your license as they relate to [ topic of inspection if it is a single topic and can be stated simply. Ex: radiation) safety and compliance with the Commission's rules and regulations and with the conditions of your license. Within these areas, the inspection consisted of a selected examination of procedures and representative records, observations of activities, and interviews with personnel. Specifically, this inspection focused on the implementation of your radiological effluents and radiological environmental monitoring program."

B.

Body of Letter We've changed the order of discussion for the body of the letter. Issues that may and up other than green (apparent violations) should be discussed first.

They are the issues of greatest importance from a risk standpoint. Then the green and NCV issues will be discussed. We've also clarified how to address issues when only some of the green issues are violations (NCVs). Ex:

" Based on the results of this inspection, one potentially safety significant issue was identified with an apparent violation of your technical specifications dealing with emergency core cooling systems. Although the systems have been returned to service and the condition of concem no longer exists, the NRC will soon l

inform you of its final determination of the significance of the condition and any associated enforcement action.

- The NRC also identified five additional issues of low safety significance that have been entered into your corrective action program and are discussed in the summary of findings and in the '

body of the attached inspection report. Of the five issues, three were determined to involve violations of NRC requirements, but o

because of their low safety significance the violations are not' cited. [lf no issues are violations, so state.) If you contest these noncited violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with a copies to the Regional Administrator, Region

the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident inspector at the Dirojac facility."

11.

SUMMARY

OF FINDINGS A.

Standard Paragraph For the pilot inspections (this will not be added to IMC 0610*), add the following standard paragraph before listing the findings.

" Inspection findings were evaluated according to their potential significance for safety, using the NRC's Significance Determination Process, and assigned colors of GREEN, WHITE, YELLOW or RED. GREEN findings are indicative of issues that, while they may not be desirable, represent little effect on safety.

WHITE findings indicate issues with some increased importance to safety, which may require additional NRC inspections.

YELLOW findings are more serious issues with an even higher potential to affect safe performance and would require the NRC to take additional actions. RED findings represent an unacceptable loss of margin to safety and would result in the NRC taking significant actions that could include ordering the plant shut down.

Those findings that can not be evaluated for a direct effect on safety with the Significance determination Process, such as those findings that affect the NRC's ability to oversee licensees, are not assigned a color."

B.

PI Verification The results of any PI verification will be summarized in a section following the comerstones. The section should be subdivided into the cornerstones that are applicable to the PI's that were verified. The summary should include the name of the Pl, the period of time for which the Pl data was verified, and the results, even if there were no problems.

C.

Clear Writing To reemphasize, the entries in the Summary of Findings will be the PIM entries.

They have to be clear, concise, and complete. They should describe in clear, plain language the issue and why it is important.

i a

D.

Documenting Related issues in the course of identifying issues that are put through the SDP, inspectors may also identify, through licensee documents ( such as LERs) or routine evaluation and characterization of the issue, one or more contributing factors that are in violation of NRC regulations. For example, the licensee or the inspector determines that a containment isolation valve was inoperable during a mode change that required the valve to be operable. The SDP identifies this as a Green issue; however, it is also a violation of TS requirements. During the course of his activities in understanding the issue of the inoperable valve, the inspector may identify additional violations associated with the issue; e.g.,

inadequate post maintenance testing or failure to implement prompt corrective action.

In such cases we recommend that only one entry be in the Summary of Findings 4

under the associated comerstone (Barrier Integrity for this example). That entry would include (1) the color (Green), (2) a brief description the SDP issue -

(isolation valve inoperable while changing modes), (3) information on why the issue is in the green, licensee response band, (4) that some number of NCVs associated with this issue were identified and were entered into the licensee's corrective action program and are detailed in the report. The summary would also briefly list the requirements violated (e.g., TS 3.4.5, inadequate post-J maintenance testing, failing to take prompt corrective action).

For this example the summary of findings would have one entry. All details required to support the NCVs will continue to be recorded in the report in accordance with 0610 guidance.

Ill.

REPORT DETAILS i

A.

We've restored the brief status of plant as the first paragraph in the report details.

B.

The list of inspectable areas at the end of the report is eliminated because each inspectable area inspected will include a scope and findings section (even if there are no findings).

IV.

OTHER MINOR CHANGES A.

Summary of Findings. Add the word comerstone before each cornerstone section. E.g.,"Comerstone: Initiating Events" B.

Body of Report:

1.

Section number for " Reactor Safety" is "1." The "5" in the May 21,1999 version of IMC 0610* was a result of Wordperfect 8's automatic paragraph numbering feature.

2.

Add the comerstones following each major section title. Ex:

"1.

REACTOR SAFETY Comerstones: initiating Events, Mitigating Systems, Barrier Integrity Comerstone: Emergency Preparedness 2.

RADIATION SAFETY Comerstone: Occupational Radiation Safety Comerstone: Public Radiation Safety 3.

SAFEGUARDS Comerstone: Physical Security" 4

r 1

J

\\

i

(

Inspection Procedure 71130 l

)

i j