ML20211L714

Industry Position Regarding Safety Margin: Dispositioning Degraded or Failed Management Measures Above and Beyond Regulatory Requirements, and Meeting Performance Criteria; Follow Up to May 6, 2020 Letter on Smarter Program Inspection Prior

ML20211L714
Person / Time
Site:	Nuclear Energy Institute
Issue date:	07/24/2020
From:	Schlueter J Nuclear Energy Institute
To:	Laura Dudes, Andrea Kock, John Lubinski, Eric Michel Office of Nuclear Material Safety and Safeguards, Division of Fuel Management
APearson NMSS/DFM/IOB 415.3174
References
Download: ML20211L714 (12)

Text

JANET SCHLUETER Sr. Advisor, Fuel and Radiation Safety 1201 F Street, NW, Suite 1100 Washington, DC 20004 P: 202.739.8098 jrs@nei.org nei.org July 24, 2020 Ms. Andrea Kock Director, Division of Fuel Management U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

Subject:

Industry Position regarding Safety Margin: Dispositioning Degraded or Failed Management Measures Above and Beyond Regulatory Requirements, and Meeting Performance Criteria; Follow Up to May 6, 2020 letter on Smarter Program Inspection Priorities Reference No: 689

Dear Ms. Kock,

This letter is sent on behalf of the Nuclear Energy Institute1 (NEI) and its affected fuel cycle facility members. NEI sent a letter to you on May 6, 2020 stating our view that continuing discussions on safety margin is a high priority item. From our perspective, two programmatic issues warrant further discussion:

1) potential for inspection credit when licensees establish a robust safety margin that exceeds regulatory requirements and demonstrates a strong safety and security performance record; and 2) the regulatory basis for recent violations where degraded or failed management measures were cited as Severity Level IV violations even when all performance requirements were met. This letter and its attachments outline industrys position on item 2 including our recommendation on the August 15, 2017 revisions to the U.S.

Nuclear Regulatory Commission (NRC) Inspection Manual Chapter (IMC) 0616. The programmatic issue described in item 1 is ripe for further discussion during an NRC public meeting being planned for Fall 2020.

Industry will likely make a presentation on the issue of potential credit during the Fall meeting to help facilitate the discussion.

Safety Margin Credit and Violations When in Compliance Industry raised the topic of credit for safety margin that has been long since established by licensees most recently in the context of the NRC Smarter Programs fuel cycle inspection initiative. During these 2019 1The Nuclear Energy Institute (NEI) is responsible for establishing unified policy on behalf of its members relating to matters affecting the nuclear energy industry, including the regulatory aspects of generic operational and technical issues. NEIs members include entities licensed to operate commercial nuclear power plants in the United States, nuclear plant designers, major architect and engineering firms, fuel cycle facilities, nuclear materials licensees, and other organizations involved in the nuclear energy industry.

Andrea Kock July 24, 2020 Page 2 public meetings, industry introduced the concept whereby NRC could consider granting inspection program credit when licensees implement a level of safety margin that is above and beyond regulatory requirements. More specifically, the industry recommendation was that a robust safety margin that goes beyond regulatory requirements combined with a strong safety and security performance record would be the basis for reduced inspection frequency/hours of certain licensed program areas. As part of the discussion regarding this recommendation, industry recalled recent enforcement cases where licensees received Severity Level IV violations due to reduced safety margin, despite the fact that applicable performance requirements were met.

The basis for these Severity Level IV violations was, and is still, not transparent. As a preliminary matter, it is not clear that a failed or degraded management measure that does not result in failure to meet the performance requirements of 10 CFR 70.61 is a violation at all. For instance, Example e on page AppB-34 of Inspection Manual Chapter 0616 (IMC 0616) states there is no violation in a scenario where a licensee failed to implement a management measure, which, in turn, caused the failure of an IROFS, if the licensee could credit IROFS from other accident sequences to ensure the accident remains highly unlikely. Example e predated the 2017 revision to IMC 0616, which added the problematic risk-based compliance concept and Example j (documented on page AppB-10 of IMC 0616), which are discussed below. If the NRC is changing position on its interpretation of the requirements regarding management measures, then they should consider the backfitting implications of that new or different interpretation.

Putting that important threshold issue aside, the severity of these violations was evaluated by the NRC staff using the 2017 version of IMC 0616 with the new Example j and risk-based noncompliance concept found in the Screening Process. As discussed below, industry does not agree with the discussion of risk-based noncompliance contained in Appendix B to IMC 0616, or Example j. Rather, if the NRC determines that a failed or degraded management measure that does not result in noncompliance with the performance requirements should be considered a violation (contrary to Example e), then such violations should be considered minor and (at most) result in a non-cited violation. This concept is simply illustrated in. It should also be considered that issuing a Severity Level IV violation for reduced safety margin when performance requirements are met creates a strong disincentive for licensees to maintain additional safety margin, despite the fact that licensees are doing so for legitimate reasons. These two very important and intertwined issues need further dialogue to ensure mutual understanding and a clear regulatory path forward.

Industry Concerns with New and Problematic IMC 0616 Risk-based Noncompliances and Example j in August 2017 revision Since the August 2017 revision of IMC 0616, there have been a number of Severity Level IV violations issued to fuel cycle licensees citing Example j of IMC 0616 as the basis for these violations (which is found on page AppB-10 of the redline version).

Andrea Kock July 24, 2020 Page 3 The August 2017 revision of the IMC 0616 also introduced the concept of risk-based noncompliances in the Screening Process, described in Appendix B. This was the first introduction to our knowledge of the undefined concept of risk-based noncompliance. The IMC 0616 text specifically calls out assessing any remaining risk margin above and beyond the likelihood requirements of §70.61(b) and (c), stating that non-compliances involving little to no remaining risk margin are generally more significant than those that involve substantial margin above and beyond the likelihood requirements of §70.61(b) and (c). This in essence introduces the concept that a noncompliance can exist, despite that fact that a licensee is meeting the performance requirements of 10 CFR 70.61.

Example j was added in the August 2017 revision of IMC 0616, and its addition appears to indicate a significant change in NRC direction. The NRC added Example j without any public discussion as to its regulatory or safety basis. Yet, this example has served as a strong driving force for several violations across the fuel cycle fleet over the last 3 years. Given this trend, the staff appears to be using the IMC to impose a new or different interpretation of the requirements in subpart H to Part 70.

Industry believes that regulating in this fashion is inconsistent with both the backfitting requirements of 10 CFR 70.76 and the agencys Principles of Good Regulation. It is our firm position that Example j and the Appendix B text regarding Screening Process in the 2017 revision of IMC 0616 regarding risk based noncompliances should be removed from the IMC. Additional technical basis for industrys position is provided in Attachment 2 and an IMC Comparison document is provided in Attachment 3.

Overarching Process Concerns Regarding IMC Revisions It is not NRC practice to issue an IMC under revision for public review and comment. Rather, the only opportunity for licensees and stakeholders to have visibility of such changes is when the IMC has been finalized and is being implemented. This practice does not allow industry or public stakeholders to receive proper clarity on the regulatory basis of a given revision(s) or transparency on the development of these changes. This process is also true regarding NRC Enforcement Policy.

We feel that in not issuing potential revisions to IMCs for public comment, the opaque process presents an opportunity for potential backfit, which appears to be the case for the August 2017 revision of IMC 0616.

The regulatory basis for the changes in that revision are not self-evident, nor did NRC document the basis in any publicly available document. We would like to better understand NRCs rationale for withholding IMC revisions from public stakeholder comment and engagement, which is not in line with the NRCs Principles of Good Regulation, specifically Openness and Clarity.

Andrea Kock July 24, 2020 Page 4 We look forward to future discussions with DFM and Region II staff on this matter. Please reach out to me with any questions on the content of this letter or its attachments.

Sincerely, Janet Schlueter c:

John Lubinski, NRC/NMSS Eric Michel, NRC/RII/DFFI Laura Dudes, NRC/RII/RA : Safety Margin Illustration : Industry Position on Degraded or Failed Management Measures Violations : IMC Version Comparison

© NEI 2020. All rights reserved. : Safety Margin Illustration It is the position of NEIs Fuel Cycle Facility members (including Part 40 and Part 70 licensees) that:

THEN this is no more than a Minor event.

AND the Performance Criteria is still met with other IROFS when the affected IROFS is assumed to fail, IF a management measure for an IROFS (Items Relied on for Safety) declared in the integrated safety analysis (ISA) has been degraded or

failed,

© NEI 2020. All rights reserved.

1 l P a g e

Industry Position on Degraded or Failed Management Measures Violations

References:

10 CFR 10 CFR 70.61 10 CFR 70.62 Safety program and integrated safety analysis

• §70.62(a)(3)

• §70.62(d) Management Measures Enforcement Policy Section 6.2.d.1 Section 2.3 Dispositions of Violations Section 2.3.1 Minor violation Section 2.3.2 Non-cited violation Inspection Manual Chapter 0616, Appendix B, page 1 Screening Process (Rev 8/15/17) 0616, Appendix B, Example j (Rev 8/15/17)

Industry Position As a preliminary matter, we believe that the NRC should examine the backfitting implications of what appears to be a new or different interpretation of the requirements of 10 CFR 70, Subpart H, i.e., that a failed or degraded management measure that does not result in failure to meet the performance requirements of 10 CFR 70.61 constitutes a violation of subpart H. As discussed in the cover letter submitted with these comments, we believe this position is inconsistent with Example e found on page AppB-34 of IMC 0616, which predated the addition of the risk-based noncompliance concept described in the Screening Process found on Appendix B page 1 and Example j in August 2017.

In the event that the NRC determines that the position taken in the 2017 revision to IMC 0616 does not constitute a backfit, or can be appropriately justified pursuant to 10 CFR 70.76, it is the position of NEIs Fuel Cycle Facility members (including Part 40 and Part 70 licensees) that, in scenarios where the NRC determines that a failed or degraded management measure which does not result in failure to meet the performance requirements of 10 CFR 70.61 constitutes a violation of subpart H, such violations should be considered minor. That is, if defense-in-depth is available to meet the requirements of approved performance requirements, no violation greater than a minor violation has occurred. Licensees should investigate any failed or degraded management measures through their internal corrective action program, but this does not represent a more than minor violation.

Background

10 CFR 70.62, licensee-specific safety programs and Integrated Safety Analysis (ISA), represent the regulatory requirements with regard to the necessity of the licensee to establish an ISA (accepted by the NRC) to assure the state of the facility meets the Performance Requirements listed in 10 CFR 70.61. The ISA demonstrates that a licensee has met these regulations.

Additionally, 10 CFR 70.62 requires the establishment of management measures to ensure

© NEI 2020. All rights reserved.

2 l P a g e that engineered and administrative controls and control systems that are identified as items relied on for safety pursuant to §70.61(e) of this subpart are designed, implemented, and maintained, as necessary, to ensure they are available and reliable to perform their function when needed, to comply with the performance requirements of § 70.61 of this subpart.

There are numerous times when a licensee, for a variety of reasons, has additional IROFS in a given accident sequence beyond those needed to meet the performance requirements of 10 CFR 70.61. This additional defense-in-depth, while not necessary, is a common industry practice to ensure all aspects of the regulation are still met, even with an IROFS failure. It should be noted that these instances of defense-in-depth, beyond that required by regulation, is a conservative safety approach.

When a condition exists where a management measure is deficient, degraded, or not fulfilling its intended purpose to ensure the IROFS is available and reliable, then the accident sequence(s) where the affected IROFS is used must be evaluated. Because of the additional defense-in-depth described above, the licensee can often demonstrate that the performance requirements are met even without the impacted IROFS. We question whether a violation has actually occurred in these situations and, if so, whether such violation should ever be characterized as more than minor. We understand such conditions should nonetheless warrant investigation and correction by the licensee to assure the management measure in fact can perform its intended purpose.

Process and Programmatic Concerns Since the August 2017 revision of IMC 0616, there have been a number of Severity Level IV violations issued to fuel cycle licensees citing Example j of IMC 0616 as the basis for these violations (also assuming use of the Appendix B Screening Process). The Appendix B Screening Process and Example j were added in the August 2017 revision, which appears to indicate a significant change in NRC direction. It is our firm position that Example j and the related risk based non-compliance verbiage from the Screening Process should be removed from the IMC.

It is not NRC practice to issue an IMC under revision for public review and comment. Rather, the only opportunity for licensees and stakeholders to have visibility of such changes is when the IMC has already been finalized. This practice does not allow the industry or public stakeholders to receive proper clarity on the regulatory basis of a given revision(s). This process is also true regarding the NRC Enforcement Policy.

The recent Severity Level IV violations received by several fuel cycle facilities have been consistent with the conditions cited above. That is, these violations represented scenarios where there was a degraded or failed management measure even though the facility continued to meet the Performance Requirements of 10 CFR 70.61 (even assuming the loss or complete absence of the potentially affected IROFS). Example j of the IMC states that the condition is Not minor if: The failure resulted in no remaining risk margin above and beyond the performance requirements of §70.61(b) and (c); or the overall change in risk resulting from the

© NEI 2020. All rights reserved.

3 l P a g e failure was high, and the licensee did not maintain a significant level of risk margin above and beyond the requirements of §70.61(b) and (c). This, in effect, is making the failure of the management measure for an IROFS not required to meet the requirements of 10 CFR 70.61 and/or 70.62 a violation of regulation, essentially reinterpreting the regulation through an example in IMC 0616.

Industry believes that it is important to note that in the example provided above the NRC is elevating the importance of a management measure above the importance of the actual IROFS when compared to Example e on page AppB-34 of Inspection Manual Chapter 0616 (IMC 0616) which states there is no violation in a scenario where a licensee failed to implement a management measure, which, in turn, caused the failure of an IROFS, if the licensee could credit IROFS from other accident sequences to ensure the accident remains highly unlikely.

While the degraded or failed management measure is a condition warranting investigation and corrective actions to prevent future occurrence, it does not mean that the 10 CFR requirement has been violated or not met.

Furthermore, it appears that IMC 0616, in effect, imposes a new standard associated with a change in risk (to an undefined high) as the basis for determining whether the severity level of purported violations is characterized as minor or not minor. Additionally, Example j (page AppB-10 of the redline version) states Minor because: The licensee maintained significant risk margin above and beyond the performance requirements of §70.61(b) and (c); or the overall change in risk resulting from the failure was low, and the licensee maintained some level of risk margin above and beyond the requirements of §70.61(b) and (c). This example and explanation create the necessity for licensees to maintain a risk margin above and beyond that required by the licensees NRC approved ISA methodology and beyond the minimum requirements imposed per 10 CFR 70.61 and 70.62.

© NEI 2020. All rights reserved.

1 l P a g e

IMC Version Comparison IMC 0616 Comparisons & Notable Changes:

Revision 7/28/14 and Revision 8/15/171 Page #

Industry Comments Version There were significant additions to the introduction section of Appendix B Pgs. 27-28 (B-1,2)

General Comments Risk-based non-compliance is not defined.

This is all based on the non-stated premise that a non-compliance is determined. It introduces undefined terms such as substantial change and negligible change in risk, although it does discuss risk index shifts to provide some insight to what the terms substantial vs.

negligible mean.

These additions introduce the concept that you can have a non-compliance even though a licensee is meeting the Performance Requirements of 10 CFR 70.61. This is effectively rewriting regulation.

2017 The Screening Process had a major rewrite including a most significant paragraph on page AppB-1 introducing the notion of risk-based non-compliances, new to the IMC.

Pgs. 27-28 (B-1,2) 2017 The IMC discusses the consideration of overall risk associated with the non-compliance (previous versions did not address this issue). This paragraph discusses: 1) the overall change in risk resulting from the non-compliance and 2) any remaining risk margin above and beyond the likelihood requirements of 70.61(b) and (c).

Pg. 27 (B-1) 2017

[N]on-compliances involving little to no remaining risk margin are generally more significant than those that Pg. 27 (B-1) 1 Current version

© NEI 2020. All rights reserved.

2 l P a g e IMC 0616 Comparisons & Notable Changes:

Revision 7/28/14 and Revision 8/15/171 Page #

Industry Comments Version involve substantial margin above and beyond the likelihood requirements of §70.61 (b) and (c).

2017 The 2014 and 2017 screening questions are consistent with regard to the ISA screening questions calling for a change in risk such that the licensee fails to meet the 10 CFR 70.61 (b) or (c) performance requirements?

Pg. 30 (B-3)

ISA #5 Pg. 28 (B-2)

ISA #4 This question implies that for a violation to occur you must have a case of falling below the 10 CFR 70.61 performance requirements.

2014 2017 An additional question states Does the violation involve the failure of a management measure such that an IROFS would not be available or reliable to perform its intended safety function when needed as required by 70.61(e) and 70.62(d) and is it risk significant?

Pg. 30 (B-3)

ISA #7 Pg. 28 (B-2)

ISA #6 The question does not give consideration as to whether that IROFS was required to meet the regulatory performance requirements.

2014 2017 Noncompliances Involving the Failure to Meet 70.61 (b),

(c), and (d) Performance Requirements and The failure of an IROFS within its analyzed failure rate does not necessarily constitute a failure to meet 70.61(b) and (c) performance requirements.

Pg. 28 (B-1)

Pg. 30 (B-1)

The 2014 and 2016 revisions did not discuss the notion of measuring the change in risk to determine if a violation had occurred. They simply focused on the failure of an IROFS and its impact on the ability to meet performance requirements.

2014 2016

© NEI 2020. All rights reserved.

3 l P a g e IMC 0616 Comparisons & Notable Changes:

Revision 7/28/14 and Revision 8/15/171 Page #

Industry Comments Version Numerous examples in Appendix B use the words failed to implement management measures as required by 10 CFR 70.61(e) and 70.62(d) to ensure that IROFS were available and reliable to perform their function when needed to comply with the performance requirements of 10 CFR 70.61.

Pgs. 33-36 (B-7-10)

Pgs. 47-48 (B-21-22)

This statement strongly suggests that for a violation to occur, performance requirements must not be met.

2017 Example e of the ISA section calls out a violation if:

Failure to implement management measures to ensure that IROFS were available and reliable to perform their intended safety function as required by 10 CFR 70.61(e) and 70.62(d). (emphasis added)

Pg. 61 (B-34)

Pg. 60 (B-34)

This strongly implies that as long as performance requirements are met there is no violation. In fact, in the 2014 and 2017 revisions Example e states that there is Not a violation if: The inspectors or the licensee could credit IROFS from other accident sequences to ensure the accident remains highly unlikely.

2014 2017

© NEI 2020. All rights reserved.

4 l P a g e IMC 0616 Comparisons & Notable Changes:

Revision 7/28/14 and Revision 8/15/171 Page #

Industry Comments Version Example j introduced:

The licensee failed to implement adequate management measures, resulting in a condition where an IROFS was unavailable, unreliable, or less reliable than assumed in the ISA.

Pgs. 36-37 (B-10-11)

This example introduces the notion that a determination of significant risk margin above and beyond the performance requirements of 70.61(b) and (c) in the determination of either Minor or Not minor (emphasis added).

Furthermore, this new example discusses the determination of the overall change in risk resulting from the failure was high, and the licensee did not maintain a significant level of risk margin above and beyond the requirements of 70.61 (b) and (c).

The combination of the examples coupled with the introduced concept of risk-based non-compliance essentially rewrites or at least requires a licensee to go beyond the requirements of regulation via an Inspection Manual, which is not subject to public input nor direct Commission endorsement.

2017 Industry did not identify significant changes to the 6/27/16 revision regarding the management measures issue, save some changes to Example e on pages 62-63 (App B-33-34). In fact, the 2016 revision deleted a noteworthy phrase or the licensee could credit IROFS from other accident sequences to ensure the accident remains highly unlikely. However, this phrase was reinserted in the 8/15/17 version.