ML20261H462

U.S Nuclear Regulatory Commission NRC Guidelines for Characterizing the Safety Impact of Issues

ML20261H462
Person / Time
Issue date:	01/31/2021
From:	Michelle Kichline, Antonios Zoulis NRC/NRR/DRA
To:
Klett A
Shared Package
ML20261H475	List: ML20261H428 ML20261H462
References
EPID L-2019-LRO-0074
Download: ML20261H462 (26)

Text

U.S. NUCLEAR REGULATORY COMMISSION GUIDELINES FOR CHARACTERIZING THE SAFETY IMPACT OF ISSUES January 2021 Prepared by:

Antonios M. Zoulis Michelle Kichline Office of Nuclear Reactor Regulation Division of Risk Assessment

TABLE OF CONTENTS

1.0 INTRODUCTION

............................................................................................................... 1 1.1 Purpose ................................................................................................................ 1 1.2 Applicability .......................................................................................................... 1 1.3 Scope ................................................................................................................... 2 1.4 Content of this Guidance Document .................................................................... 3 2.0 DEFINING THE ISSUE ..................................................................................................... 5 2.1 Assessing the Preliminary Screening Questions ................................................. 5 2.2 Assessing the Preliminary Risk Impact using Quantitative Analysis .................... 7 2.3 Important Considerations ..................................................................................... 8 2.4 Documentation ..................................................................................................... 8 3.0 EXPLORING THE IMPACT OF THE ISSUE .................................................................. 10 3.1 Generic Assessment Expert Team .................................................................... 10 3.2 Plant Integrated Decision Making Panel ............................................................ 11 3.3 Documentation ................................................................................................... 12 4.0 FINALIZING THE SAFETY IMPACT CHARACTERIZATION ........................................ 13 4.1 Step 1 - Screening for No Impact ....................................................................... 15 4.2 Step 2 - Screening for Minimal Impact ............................................................... 15 4.3 Step 3 - Determining Safety Impact Using Quantitative Analyses ..................... 19 4.4 Step 4 - Assess Need for Risk Management Actions........................................ 20 5.0 ASSESSING CUMULATIVE RISK ................................................................................. 21 6.0 PAPERWORK REDUCTION ACT .................................................................................. 21 6.1 Paperwork Reduction Act .................................................................................. 21 6.2 Public Protection Notification ............................................................................. 21 7.0 CONGRESSIONAL REVIEW ACT ................................................................................. 21

8.0 REFERENCES

................................................................................................................ 22 i

LIST OF FIGURES AND TABLES Figure 1-1: Safety Impact Characterization Process Overview.................................................... 4 Figure 4-1: Safety Impact Characterization Detailed Process Overview ................................... 14 ii

ABBREVIATIONS AND ACRONYMS ADAMS Agencywide Documents Access and Management System CDF core damage frequency CFR Code of Federal Regulations FLEX Diverse and Flexible Coping Strategy for Extended Loss of Power GAET Generic Assessment Expert Team IDP Integrated Decision-Making Panel LERF large early release frequency LOCA loss-of-coolant accident NEI Nuclear Energy Institute NRC U.S. Nuclear Regulatory Commission NUMARC Nuclear Management and Resource Council PRA probabilistic risk assessment RCP reactor coolant pump RG Regulatory Guide RITSTF Risk-Informed Technical Specifications Task Force RMA risk management action RMTS risk-managed technical specifications SGTR steam generator tube rupture SME subject matter expert SSC structure, system, and component TSTF Technical Specifications Task Force iii

1.0 INTRODUCTION

1.1 Purpose This guidance document describes an approach that is acceptable to the staff of the U.S.

Nuclear Regulatory Commission (NRC) for developing a risk-informed application for an exemption request or license amendment request that applies risk insights, consistent with the guidance in Regulatory Guide (RG) 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 3 (Reference 1). It provides general guidance concerning how to characterize that the safety impact of proposed changes in plant design and operation that have a minimal impact on safety. This guidance document does not have the force of law and does not contain any legal requirements.

1.2 Applicability Use of this guidance is limited to proposed changes to facilities for which the safety impact associated with the issue can be modeled using probabilistic risk assessment (PRA). This guidance is not applicable for holders of combined licenses under 10 CFR Part 52.

This process can be used by licensees that have implemented risk-informed initiatives under Title 10 of the Code of the Federal Regulations (10 CFR) Section 50.69, Risk-informed categorization and treatment of structures, systems and components for nuclear power plants, and Technical Specifications Task Force (TSTF) Traveler TSTF-505, Provide Risk Informed Extended Completion Times - RITSTF [Risk-Informed TSTF] Initiative 4b.1 This process is intended to build on licensees expanded use of PRA models for making day-to-day decisions and benefit from the use of Integrated Decision-Making Panels (IDPs) that were developed as part of implementation of 10 CFR 50.69. Licensees that have completed all of the implementation items and license conditions associated with implementation of 10 CFR 50.69 and TSTF-505 may use this process to characterize the safety impact of proposed changes.

Licensees do not need to have categorized any structures, systems, and components (SSCs) in accordance with 10 CFR 50.69 to use this process.

Licensees that have not implemented an IDP under 10 CFR 50.69 may choose to apply a 10 CFR 50.69 equivalent IDP as documented in Nuclear Energy Institute (NEI) guidance, NEI Guidelines for the Implementation of the Risk-Informed Process for Evaluations Integrated Decision-Making Panel (Reference 2), to use this process. Licensees that use a 10 CFR 50.69 equivalent IDP must also have an approved and implemented TSTF-505 amendment.

Licensees with an approved and implemented TSTF-505 amendment and a 10 CFR 50.69 (or equivalent) IDP can leverage their PRA models to perform safety impact characterizations using this process. The NRC may determine, on a case-by-case basis, that licensees with an approved and implemented amendment for TSTF-425, Relocate Surveillance Frequencies to Licensee Control-RITSTF Initiative 5b, in lieu of an approved and implemented TSTF-505 amendment, may use this process to characterize the safety impact of proposed changes.

1 NRC has approved some licensee programs for Risk-informed Completion Times consistent with NEI 06-09, Risk-Informed Technical Specifications Initiative 4B, Risk-Managed Technical Specifications (RMTS) Guidelines, which also can be used in lieu of TSTF-505 to characterize the safety impact of issues. Any references in this document to TSTF-505 also include NEI 06-09.

1

1.3 Scope Figure 1-1 on page 4 provides a high-level overview of the process to characterize the safety impact of issues.

For the purposes of this guidance document, all the following must apply in order to characterize an issue as having a minimal safety impact:

• The issue contributes less than 1 x 10-7/year to core damage frequency (CDF).

• The issue contributes less than 1 x 10-8/year to large early release frequency (LERF).

• The issue screens to no impact (per Step 1, Section 4.1) or minimal impact (per Step 2, Section 4.2).

• Cumulative risk is acceptable using the guidelines in Section 5.

If any of the criteria above are not met, then the proposed change cannot be characterized as having a minimal impact on safety in accordance with this guidance document.

The process described in this guidance document does not replace or affect the NRCs use of the Reactor Oversight Process Significance Determination Process for assessing the safety significance of more-than-minor performance deficiencies.

This process is anticipated to be useful when the actions needed to correct an issue would result in a minimal safety impact. This process may also be useful for issues in which there is a safety benefit to not implementing costly or burdensome actions to restore compliance.

Examples of issues for which this process may be used include, but are not limited to, the following:

Actions needed to address inspection findings, Resolution of issues identified through other regulatory or licensee processes, Responses to orders requiring changes or modifications to the plant, and Generic issues requiring changes or modifications to the plant.

For issues having generic implications, a generic safety characterization could, for example, be performed by an industry or NRC Generic Assessment Expert Team (GAET). This generic assessment could then be used to inform a plant-specific assessment of the generic issue which accounts for plant-specific risk contributors, such as seismic or flooding risk, through a licensees multi-disciplinary plant IDP.

This process may not be used for:

Any immediate actions necessary for continued safe operation (e.g., to support an NRC finding of adequate protection, to restore compliance with a technical specification, to resolve an environmental compliance issue with an adverse effect on public health and safety, or to remove a threat to personnel safety).

Any immediate repairs necessary for continued power production (e.g., replacing a damaged main transformer).

Any issues for which the safety impact cannot be directly assessed using PRA (e.g., fuel changes, changes to emergency planning programs, or changes to security).

2

Changes to the technical specifications.

1.4 Content of this Guidance Document Section 2 presents guidance for defining the issue being assessed.

Section 3 presents guidance for exploring the issue in detail using the GAET and/or IDP.

Section 4 presents guidance for finalizing the safety impact characterization.

Section 5 presents guidance for assessing the cumulative risk impact.

Section 6 presents guidance for using the safety impact characterization in the regulatory process.

3

Figure 1-1: Safety Impact Characterization Process Overview 4

2.0 DEFINING THE ISSUE This guidance is applied after identifying an issue that requires NRC review for resolution. Once it is identified that some action is needed to address the issue, then the licensee would need to define the range of possible resolutions, choose a path forward, and determine the safety impact of that resolution. This guidance can also be applied after the partial resolution of an issue initially having a more than minimal safety impact results in the remaining unresolved aspects of the issue having a minimal safety impact.

The safety impact characterization process starts with defining the specific issue for which the safety impact is being assessed. This should be done by a subject matter expert (SME) who is knowledgeable about the issue. The SME collects any available NRC and industry information.

When evaluating an issue, the safety impact being characterized is the difference between the safety of the plant if it were fully compliant and that of the plant with the existing issue.

Defining the issue may begin at a generic or plant-specific level. A generic evaluation characterizes the importance of the regulatory issue at a generic level and provides an overall assessment and important attributes for consideration in the plant-specific evaluation. The generic evaluation may be carried out by an SME or team of experts. The generic SME evaluation is then reviewed by the GAET for implementation at applicable plants. The licensees SME will revise the generic evaluation as needed to address the plant-specific considerations identified by the GAET and any plant-specific differences from the information provided by the GAET. The plant-specific process is carried out by the licensee using a plant IDP, which reviews the generic characterization provided by the GAET and the plant-specific evaluation provided by the licensees SME. If the issue does not apply generically, then the issue is only defined at the plant-specific level by the licensees SME and reviewed by the plant IDP.

The SME should define the issue in enough detail for the GAET or plant IDP to review the issue and make a final determination about the safety impact. However, the process can be iterative if needed. The SME should collect any readily available information for the GAET or plant IDP to review but may identify unknowns for the GAET or plant IDP to consider further. The GAET or plant IDP may decide they need additional information in order to complete their review and direct the SME to obtain additional information. Completely defining the issue includes two essential activities:

1. Performing a detailed assessment of the preliminary screening questions.

2. Performing a preliminary risk assessment using a PRA model.

2.1 Assessing the Preliminary Screening Questions The SME should document the initial assessment of the preliminary screening questions. This phase of the process involves screening the issue for any impact on safety, regardless of whether the impact is adverse or beneficial. The plant IDP will develop final responses to similar screening questions.

The preliminary screening for any safety impact involves addressing the following set of questions:

Does the issue:

5

1. YES NO Result in any impact on the frequency of occurrence of an accident initiator or result in a new accident initiator?

2. YES NO Result in any impact on the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a transient, accident, or natural hazard?

3. YES NO Result in any impact on the consequences of an accident sequence?

4. YES NO Result in any impact on the capability of a fission product barrier?

5. YES NO Result in any impact on defense-in-depth capability or impact in safety margin?

Although the answers to the questions are either yes or no, all answers must be explained in detail for consideration by the GAET and/or IDP. If any of the questions are answered YES, then the SME should discuss whether the impact is adverse or beneficial. The SME should discuss any adverse impacts with the risk analyst who will be performing the preliminary risk evaluation and have the risk analyst quantify the risk impact, if possible.

In determining whether there is any impact on safety, the first step is to determine what SSCs and human actions are affected by the issue. Next, the effects of the issue should be determined. This evaluation should include both direct and indirect effects. Direct effects are those where the issue (e.g., changing the motor on a pump or changing the mounting of an electrical cabinet) changes the performance of the SSC directly, such as by decreasing its reliability or decreasing its margin to failure under accident conditions. One can directly attribute the overall impact on how the SSC performs by quantitative analysis, operating experience, or engineering judgment. Indirect effects are those where the issue could affect other risk contributors.

In addressing the preliminary screening questions, the following should be noted:

The term capability in Questions 2 and 4 addresses the capacity of SSCs or personnel.

Consider the following examples:

o The flow capacity of a system could be decreased by replacing a pump with a lower capacity pump.

o The tornado resistance of a wall could be decreased by removing supports.

o The seismic capacity of a relay could be decreased by replacing the relay with a lower capacity relay.

o The human error probability of an action could increase by decreasing the amount of time the operator has to perform the action.

There is similarity in Screening Question 3 with the questions in 10 CFR 50.59 and the guidance in Nuclear Energy Institute (NEI) 00-04, 10 CFR 50.59 SSC Categorization Guideline (Reference 3). For Screening Question 3 above, consequence is intended to mean radiological dose from risk-significant accident sequences. The impact could be direct, such as an improved containment spray system that could reduce radiological releases in a core damage accident, or indirect, such as an increase in containment bypass events. Reducing the frequency of core damage is addressed elsewhere and is not the intent of this question.

6

2.2 Assessing the Preliminary Risk Impact using Quantitative Analysis The quantitative evaluation of risk impact is an important factor in determining that the total safety impact of an issue is low enough to characterize the safety impact of the issue as minimal. Therefore, if all of the following conditions apply, licensees can leverage their PRA models to perform quantitative risk assessments to support using this process:

The issue is completely within the scope of the licensees PRA model or can be bounded using surrogates.

The licensee has implemented an IDP consistent with risk-informed initiative 10 CFR 50.69 or equivalent.

The licensee has implemented risk-informed initiative TSTF-505 and has completed all license conditions from the safety evaluation.

The licensees PRA model was found acceptable to support approval of a TSTF-505 application by the NRC.

The issue is within the scope of the portion(s) of the PRA model that was found acceptable by the NRC (e.g., if seismic was screened out of acceptability, then seismic issues cannot be addressed using this process).

The PRA model must include the capability to assess the change in CDF and LERF, and the risk evaluation must include a quantified assessment of all significant sources of risk (i.e., external events, internal flooding, and fires) that can be impacted by the issue being assessed. Where PRA models are not available, conservative or bounding analyses may be performed to quantify the risk impact (e.g., external events, low power and shutdown).

A risk analyst must use an acceptable PRA model to calculate the change in CDF and LERF.

The change in CDF and LERF must be calculated as the difference in the risk to the plant with the existing issue and the risk to the plant if there were no issue (i.e., if the plant were fully compliant). The risk analysis may not include any credit for proposed risk management actions (RMAs), compensatory actions, or any other activities implemented to reduce the risk impact associated with the issue. The risk analyst should document whether there are any beneficial safety impacts associated with the issue.

The preliminary risk evaluation may initially be performed on a generic level. For a generic assessment, the risk analyst may need to perform multiple risk calculations using a representative sample of plant PRA models. The representative sample of plants will depend on the issue being addressed and what plants have acceptable PRA models. For example, if the issue applies to a certain plant design or vendor, then the risk evaluation should be performed using a sample of plants of that design or vendor, respectively. Once the generic risk evaluation is reviewed by the GAET, a plant-specific risk evaluation must be completed in order to apply this process on a plant-specific level. The plant-specific risk evaluation for a generic issue must address any considerations identified by the GAET. If the issue does not apply generically, then the risk is only calculated at the plant-specific level by a plant risk analyst and reviewed by the plant IDP.

7

The risk analyst should document any assumptions made when performing the risk evaluation, whether the issue was within the scope of the licensees PRA, and whether any surrogates were used to account for the impact of the issue. The impact of uncertainty on the evaluation should be considered. For any initial screening questions that were answered YES, the risk analyst should quantify the risk impact associated with the adverse impact.

2.3 Important Considerations In order to fully understand the safety impact of an issue and account for relevant insights in an integrated manner, the assessment should consider the following important common elements:

Ensuring the issue is well-defined: Although the goal of the overall process is to have clearly defined issues prior to evaluation by the GAET or IDP, the actual assessment may indicate that additional definition is appropriate. As the assessment progresses to subsequent steps, the actual conduct of the assessment may identify additional considerations not identified in the initial definition(s). Thus, it is critical that the specific issue is appropriately defined and communicated in order to illustrate the safety impact due to the issue.

Being realistic as to not bias the assessment: The level of realism and analyses will vary depending on the issue, but in order to avoid bias, realistic analysis is the objective. The process should include sensitivity analyses to address the key assumptions and sources of uncertainty that are driving the results. If the risk impact is exceedingly small, or clearly large, then a bounding evaluation may suffice.

Considering uncertainty: Both the GAET and IDP need to be aware of any specific issues, including external events, for which there is uncertainty. Sensitivity analysis should be performed, commensurate with the impact of the issue, to address any key assumptions and sources of uncertainty that may influence the results.

Evaluating the overall nature of the risk impact of a potential action: Both beneficial and adverse effects should be considered (e.g., replacing a small pump with a large pump could reduce the available margin of an emergency diesel generator, or closing and depowering pressurizer power operated relief valve block valves to prevent spurious operation could reduce effectiveness of feed and bleed operations).

Identifying the extent of the impact: The specific intended impact of the issue, as well as other related or indirect effects, should be considered (e.g., FLEX provides mitigation for more than external hazards even though that is its fundamental intended purpose). In other words, one specific issue could impact the specific function under consideration as well as multiple other separate plant functions. As discussed above, this could include both positive and negative impacts that may not be immediately evident if the impacts of issue are considered independently.

2.4 Documentation The issue should be documented in enough detail so that a person who is not familiar with the issue can understand the issue and how the safety impact characterization was made.

Documentation should include:

A detailed description of the specific regulatory issue.

8

Related and publicly available references, such as:

o Regulatory documents including regulatory analyses, orders, Commission papers, NUREG and NUREG/CR reports, relevant Commission and Advisory Commission on Reactor Safeguards meeting slides and transcripts, regulatory guides, interim staff guidance, and generic communications such as bulletins and information notices. Safeguards information shall be treated consistent with current practice.

o Industry documents including NEI guidance documents and correspondence with the NRC, research reports (e.g., Electric Power Research Institute and owners groups),

and conference papers.

o International Atomic Energy Agency and Nuclear Energy Agency reports.

Screening question results, including explanations.

Quantitative safety impact characterization results and associated discussions, including sensitivity analyses.

Technical bases for conclusions regarding safety impact.

9

3.0 EXPLORING THE IMPACT OF THE ISSUE After the issue has been defined by the SME, the potential impact of the issue is explored in depth by a multi-disciplinary team of experts (i.e., GAET and/or IDP). This team of experts is responsible for ensuring the issue is fully defined and all the potential safety impacts have been identified. If the team identifies that it needs additional information in order to make a final recommendation regarding the safety impact, additional experts should be consulted. The goal of this phase of the review is to identify and review all the available information regarding the issue and characterize its safety impact.

This review may be performed on a generic or plant-specific level. The generic and plant-specific processes involve similar steps. The generic process starts with a generic evaluation performed by an SME that is reviewed by a GAET and is used to inform the plant-specific evaluation that will be reviewed by the plant IDP. The plant-specific process starts with a plant-specific evaluation by an SME that is reviewed by the plant IDP. The generic process is intended to address issues that impact multiple plants, where generic evaluation would simplify or otherwise inform the plant-specific review process. The generic evaluation may be carried out by an expert team consisting of either NRC or industry members. For the generic process, the GAET characterizes the importance of the regulatory issue at a generic level and provides an overall assessment and important attributes for consideration in the plant-specific evaluation. When a generic evaluation is performed, a plant-specific evaluation must also be performed for each plant that plans to use this process to characterize the safety impact of an issue as minimal. If a generic evaluation is not necessary, then a GAET is not performed, and the issue is only reviewed on a plant-specific level. The plant-specific process is carried out with the use of a plant IDP, which reviews the generic characterization provided by the GAET (if performed) and the plant-specific evaluation provided by a plant SME, to arrive at plant-specific safety impact characterization. This safety impact is characterized as having either no impact or minimal impact.

The GAET can provide generic importance characterization information and attributes to the industry or can be used by the NRC to determine if additional regulatory action is required.

Using this information in conjunction with a plant-specific evaluation, the plant IDP is responsible for making the plant-specific safety impact characterization. Both the GAET and plant IDP are multi-disciplinary teams of experts. The following guidance is provided relative to the makeup of these two panels.

3.1 Generic Assessment Expert Team The GAET is comprised of industry or NRC experts with relevant expertise about the issue being evaluated. The GAET composition will vary depending upon the issue. Generally, the GAET is composed of knowledgeable personnel whose expertise represents the important process and functional elements of the industry and regulatory processes, such as operations, engineering, nuclear risk management, industry operating experience, and licensing. The GAET members are expected to have the essential understanding of the issues safety impact, and familiarity with the safety impact characterization process guidance and approach. The team can call upon additional personnel, SMEs, or external consultants, as necessary, to assist in the characterization of issues. Experience, plant knowledge, and familiarity with current regulatory issues are important elements in the selection of GAET members. Members may be experts in more than one field; however, excessive reliance on any one members judgment should be avoided. In general, there should be at least five experts designated as members of the GAET with joint expertise in the following fields:

10

plant operations design and systems engineering safety analysis PRA and risk-informed decision-making licensing An SME knowledgeable in the technical discipline or disciplines relevant to the issue being evaluated should function as the lead presenter of the regulatory issue to the GAET. The SME should provide its evaluation and present the results of the preliminary screening questions and preliminary risk evaluation to the GAET. The SME should take responsibility to ensure that all relevant documents are available to the GAET. The SME should also ensure that the results of the GAET deliberation are documented and records are maintained.

A consensus process should be used for decision-making for the GAET. Differing opinions should be documented and considered. However, a simple majority of the panel is enough for final decisions regarding the safety impact of the issues. The GAET should apply objective criteria and minimize subjectivity.

3.2 Plant Integrated Decision-Making Panel The composition of the plant IDP is the same as for the GAET, except that the members of the plant IDP and the SME for the plant IDP should have plant-specific knowledge and experience.

The IDP discussed here is intended to be consistent with the IDP implemented as part of 10 CFR 50.69 or equivalent. The IDP is composed of knowledgeable plant personnel whose expertise represents the important process and functional elements of the plant organization, such as operations, engineering, nuclear risk management, industry operating experience, licensing and maintenance. The plant IDP can call upon additional plant personnel or external consultants, as necessary, to assist in the evaluation of issues. The precise makeup of the plant IDP is determined by the licensee. Experience and plant knowledge are important elements in the selection of plant IDP members. Members may be experts in more than one field; however, excessive reliance on any one members judgment should be avoided. In general, consistent with other licensee expert panels, there should be experts designated as members of the plant IDP with joint expertise in the following fields:

plant operations design and systems engineering safety analysis PRA and risk-informed decision-making licensing An SME knowledgeable in the technical disciplines relevant to the issue being evaluated should function as the lead presenter of the regulatory issue to the plant IDP. If a generic assessment is available, this assessment is used by the SME as a key input into the plant-specific assessment, along with relevant plant-specific information. The SME should provide its evaluation and present the results of the preliminary screening questions and preliminary risk evaluation to the plant IDP. The SME should take responsibility to ensure that all relevant generic and plant-specific documents are available to the plant IDP. The SME should ensure that the results of the plant IDP deliberation are documented and records are maintained.

11

The plant IDP should be aware of the benefits and limitations of the plant-specific PRA and other analyses, and, where necessary, should receive training on the plant-specific PRA, its assumptions, and appropriate implementation. This training facilitates making well-supported technical assumptions whether quantitative or qualitative information is used. The plant IDP should be familiar with the technical issue and the safety impact characterization process. In order to have a full understanding of the issue being characterized, all questions in each applicable step of the guidance should be answered, even if an initial yes response has already determined the outcome of that step.

A consensus process should be used for decision-making for the plant IDP. Differing opinions should be documented and considered. However, a simple majority of the panel is enough for final decisions regarding the safety impact of the issues. The plant IDP should apply objective criteria and minimize subjectivity. The plant IDP should be described in a plant administrative procedure that includes the designated chairman, panel members, and panel alternates; required training and expectations for the chairman, members, and alternates; requirements for a quorum; attendance records; agendas; and meeting minutes.

3.3 Documentation GAET: The GAET evaluation results, including a description of any important considerations that should be addressed in the plant-specific assessment, will be documented and provided to the industry and the NRC. Documentation will be maintained to facilitate any subsequent generic update or re-evaluation of the issue, as appropriate.

The GAET should document any considerations and characteristics that may affect the plant-specific assessment, particularly for safety. For example, the GAET may determine that based on reactor fleet considerations, the existing level of risk of an external initiator is 1 x 10-5 to 1 x 10-4/yr CDF on average. If information is available, the GAET would convey what attributes could make the plant-specific assessment higher or lower.

IDP: The IDP evaluation results, including a summary of the basis for each decision will be documented and provided to the NRC. In particular, the assessment of any GAET-identified important considerations and how they apply to the plant and a basis for any plant-specific departures from the GAET assessment must be noted. The level of documentation should be such that a sufficient basis is provided for a knowledgeable individual to independently review the information and reach the same conclusion. The basis for any engineering judgment and the logic used in the assessment should be documented to the extent practicable and to a degree commensurate with the safety impact and complexity of the issue. The items considered by the GAET, SME, and IDP must be clearly stated.

For each issue, licensees should maintain:

a copy of the generic package, if applicable; a copy of the plant-specific package the SME submits to the plant IDP; a summary of the plant IDP discussion on the issue; a revised copy of the package, if applicable; and the final safety impact characterization assigned to the issue.

12

4.0 FINALIZING THE SAFETY IMPACT CHARACTERIZATION After the plant IDP has reviewed the initial characterization of the issue provided by the SME, the plant IDP is responsible for providing the final safety impact characterization. The final safety impact characterization consists of assessing:

1. the final screening questions, and

2. the final risk impact using a PRA.

Both of these activities are essential to characterizing the safety impact of the issue. The final screening questions are similar to the preliminary screening questions. The information presented for reviewing the preliminary screening questions also applies to reviewing the final screening questions. Assessing the final screening questions is progressive and includes two basic steps: (1) a series of screening questions to address whether there is any adverse impact to safety, and (2) a series of similar screening questions to address whether the impact to safety is minimal.

Screening determinations are made based on the technical information supporting the issue.

Technical or engineering information that demonstrates that the issue has no adverse effect on functions, or methods of performing or controlling functions may be used as a basis for screening the issue.

The plant IDP reviews the issue until it has confidence that the safety impact characterization results would not change if additional information was obtained or developed. If the plant IDP does not have confidence in the safety impact characterization results, the plant IDP should develop a plan to obtain the information needed to have confidence in the results of the review.

For example, the plan could include interaction with the NRC and conduct of additional analyses.

In addressing the screening questions, the following should be noted:

The term risk-significant in the screening questions refers to SSCs performing risk-significant functions, including nonsafety-related and safety-related SSCs and human performance. Nuclear Management and Resource Council (NUMARC) 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants (Reference 4), provides specific guidance on risk-significant criteria.

NUMARC 93-01 was developed to determine the risk significance of components scoped into the maintenance rule. However, the guidance in NUMARC 93-01 can be applied to determine the risk significance of all events, including initiating events and human actions, relevant to this characterization process by including all events in the assessment of risk-significance.

Risk impact should be based on the relative change in risk associated with baseline CDF and LERF. Generally, items that are not risk-significant are those that contribute less than 1 x 10-7/year and 1 x 10-8/year for CDF and LERF, respectively.

Figure 4-1 on the following page provides a detailed overview of the safety impact characterization process.

13

Figure 4-1: Safety Impact Characterization Detailed Process Overview 14

4.1 Step 1 - Screening for No Impact Step 1 involves screening the issue for any adverse impact on safety. The Step 1 screening process is not intended to be resource intensive and is not concerned with the magnitude of the adverse or beneficial effects that are identified. Any change that adversely affects risk is screened in and must be evaluated in Step 2. The screening for no impact involves addressing the following set of questions:

Does the issue:

1. YES NO Result in an adverse impact on the frequency of occurrence of an accident initiator or result in a new accident initiator?

2. YES NO Result in an adverse impact on the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a transient, accident, or natural hazard?

3. YES NO Result in an adverse impact on the consequences of an accident sequence?

4. YES NO Result in an adverse impact on the capability of a fission product barrier?

5. YES NO Result in an adverse impact on defense-in-depth capability or impact in safety margin?

If ALL the responses are NO, the issue screens to NO IMPACT. Continue to Step 3.

If ANY response is YES, continue to Step 2.

Although the answers to the questions are either yes or no, the answers to all questions must be explained in detail. Beneficial safety impacts should be noted in the responses to each question. If the issue is only associated with beneficial safety impacts, then the Step 1 screening questions would be answered NO, and the issue would screen to no impact.

4.2 Step 2 - Screening for Minimal Impact Step 2 involves screening the issue to determine if the magnitude of the adverse impact on safety identified in Step 1 is minimal. Step 2 should be performed in conjunction with Step 3, as risk-significance information from the risk analysis is necessary to answer the Step 2 questions.

This step involves addressing the following set of questions, which are modified versions of the Step 1 questions:

Does the issue:

1. YES NO Result in more than a minimal increase in frequency of occurrence of a risk significant accident initiator or result in a new risk significant accident initiator?

2. YES NO Result in more than a minimal decrease in the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a risk significant transient, accident, or natural hazard?

3. YES NO Result in more than a minimal increase in the consequences of a risk significant accident sequence?

4. YES NO Result in more than a minimal decrease in the capability of a fission product barrier?

5. YES NO Result in more than a minimal decrease in defense-in-depth capability or safety margin?

15

If ALL the responses are NO, the issue screens to MINIMAL IMPACT. Continue to Step 3.

If ANY response is YES, stop. The issue has a more than minimal impact on safety.

Although the answers to the questions are either yes or no, the answers to all questions must be explained in detail. Responses must include a discussion as to whether the identified impacts were addressed by the risk analysis. Any question that is answered NO in Step 1, will also be answered NO in Step 2. Guidance on addressing the above questions is provided below.

Question 1: Does the issue result in more than a minimal increase in the frequency of a risk-significant accident initiator or result in a new risk significant accident initiator?

In answering this question, the first step is to identify the risk significant accident initiators that have been evaluated that could be affected by the issue. Then a determination should be made as to whether the frequency of these accident initiators occurring would be more than minimally increased. Finally, the licensee should determine if any new risk significant accident initiators have been created. This could be a result of an increase in the risk significance of an accident initiator that was previously not risk significant. The table below shows an example of typical accident initiators and operating modes (e.g., at power, low power, or shutdown conditions) that should be considered:

Accident Initiator Categories More than Minimal Risk Significant?

(Representative) Increase?

Transients initiated by frontline systems Transients initiated by support systems Primary system integrity loss (e.g.,

SGTR, RCP seal LOCA, LOCA)

Secondary system integrity loss Internal flooding Internal fires Earthquakes External flooding Tornados and High Winds Other External Hazards Spent Fuel Pool Low power and shutdown conditions External hazards: External hazard frequencies cannot be reduced or increased by a plant-initiated or NRC-initiated change. However, the frequency and severity might be changed for certain external hazards (such as external flooding) with changes beyond the nuclear power plant site. For example, damage to a nearby dam could increase the frequency and severity of an external flood that could affect the nuclear power plant site. Such changes can be considered in this process if under the control of the licensee. Otherwise changes related to external hazards will be considered in the second question.

16

The table below shows several ways that the frequency of accident initiators can be changed.

Accident Initiator Frequency More than Minimal Potential Effect?

Considerations Increase?

Changes in maintenance, training Changes in specific SSCs (e.g., installing a more reliable component)

Changes in materials Equipment replacements to address age related degradation Changes in redundancy or diversity Addition of equipment Changes in operating practices Reasonable engineering practices, engineering judgment, and PRA techniques should be used in determining whether the frequency of occurrence of a risk-significant accident initiator would more than minimally increase as a result of the issue. A large body of knowledge has been developed in the area of accident frequency and risk-significant sequences through plant-specific and generic studies. This knowledge should be used in determining what constitutes more than a minimal increase in the frequency of occurrence.

Question 2: Does the issue result in more than a minimal decrease in the availability, reliability or capability of SSCs or personnel relied upon to mitigate a risk-significant transient, accident or natural hazard?

In answering this question, the first step is to identify the risk significant SSCs and human actions that could be affected by the issue. This question addresses the reactivity control function, including anticipated transients without scram. Anticipated transients without scram is not an accident initiator, it is an accident sequence. Next, a determination should be made as to whether availability, reliability, or capability of SSCs or personnel relied upon to mitigate a risk-significant transient, accident or natural hazard would be more than minimally decreased.

Similar to accident initiators, the availability, reliability, or capability of SSCs or personnel can be changed in several ways, such as those described in the table below:

Availability, Reliability, or Capability More than Minimal Potential Effect?

Considerations Decrease?

Changes in maintenance, testing, training Changes in specific SSCs (e.g., installing a more reliable component)

Changes in materials Equipment replacements to address age related degradation Changes in redundancy and diversity Addition of equipment Strengthening of equipment 17

Moving equipment (to reduce the impacts of spatial events)

Eliminating the need for recovery action Improving performance shaping factor related to human performance Changes in operating practices An appropriate calculation can be used to demonstrate the change in likelihood in a quantitative sense, if available and practical. Qualitative engineering judgment and/or an industry precedent is typically used in 10 CFR 50.59 evaluations and can be used here to determine if there is more than a minimal increase in the failure probability. An issue is considered to have a negligible effect on the likelihood of failure when a change in likelihood is so small or the uncertainties in determining whether a change in likelihood has occurred are such that it cannot be reasonably concluded that the likelihood has actually changed (i.e., there is no clear trend toward decreasing the likelihood).

Question 3: Does the issue result in more than a minimal increase in the consequences of a risk-significant accident sequence?

In answering this question, the first step is to identify the risk significant sequences that have been evaluated that could be affected by the issue. The following questions can assist in determining which accidents could have their radiological consequences affected as a direct result of the issue:

Will the issue change the effectiveness of an action?

Will the issue play a direct role in mitigating the radiological consequences?

Next, a determination should be made as to whether the consequences would be more than minimally increased. In addressing the definition of what constitutes a more than minimal increase in consequences, an increase of greater than 10 percent in dose for risk-significant sequences is used as the criterion. This threshold is generally consistent with the 10 CFR 50.59 guidance in NEI 00-04 (Reference 3). There are increasing uncertainties going from the Level 1 portion of a PRA study (CDF estimation) to Level 2 (containment performance) to Level 3 (offsite dose consequences). An increase of less than 10 percent in calculated consequence is small enough that it cannot be reasonably concluded that the consequences have changed. Small changes in inputs and assumptions could easily have more of an effect than a calculated change of less than 10 percent in offsite dose from a severe accident sequence.

SSCs, which indirectly affect dose, should also be considered, such as the following:

containment bypass containment isolation and capacity hydrogen control long-term containment integrity 18

Question 4: Does the issue result in more than a minimal decrease in the capability of a fission product barrier?

This question focuses on the fission product barriersfuel cladding, reactor coolant system boundary and containment. The prior question also indirectly addresses containment.

Guidance on barrier definitions and impacts on barriers can be found in the 10 CFR 50.59 guidance provided in NEI 00-04. As discussed in NEI 00-04, each barrier is associated with specific design basis parameters such as fuel cladding temperature, reactor coolant system cool-down rate, and containment pressure. It is expected to be rare that an issue will result in an impact on the design basis parameters that can be directly calculated. Rather, judgment is required here in ascertaining whether the decrease in capability of a fission product barrier is more than minimal.

Question 5: Does the issue result in more than a minimal decrease in defense in depth capability or safety margin?

RG 1.174 (Reference 1), provides additional guidance.

4.3 Step 3 - Determining Safety Impact Using Quantitative Analyses A preliminary risk evaluation was completed before the IDP. In Step 3, the preliminary risk evaluation is revised to incorporate any new information and analyses (e.g., focused scope analyses as needed) from the GAET or IDP in order to estimate the final risk impact associated with the issue. Information from the final risk analysis should be used to assist in answering the final screening questions in Step 2. The final risk analysis must identify whether the impacts documented in Step 2 were included in the risk analysis.

As discussed earlier, only those licensees with an acceptable PRA model can leverage their PRA models to perform quantitative risk assessments to support using this process, if all of the following conditions apply:

The issue is completely within the scope of the licensees PRA model or can be bounded using surrogates.

The licensee has implemented an IDP consistent with risk-informed initiative 10 CFR 50.69 or equivalent.

The licensee has implemented risk-informed initiative TSTF-505 and has completed all license conditions of the safety evaluation.

The licensees PRA model was found acceptable to support approval of a TSTF-505 application by the NRC.

The issue is within the scope of the portion(s) of the PRA model that was found acceptable by the NRC.

The plant-specific PRA must include the capability to assess CDF and LERF, and the risk evaluation must include a quantified assessment of all significant sources of risk (i.e., external events, internal flooding, and fires) that can be impacted by the issue being assessed. Where PRA models are not available, conservative or bounding analyses may be performed to quantify the risk impact (e.g., external events, low power and shutdown).

19

A risk analyst will use the licensees acceptable PRA model to calculate the change in CDF and LERF. The change in CDF and LERF will be calculated as the difference in the risk to the plant with the existing non-compliance and to the plant if it were fully compliant. The risk analysis may not include any credit for proposed RMAs or other activities implemented to reduce the risk impact associated with the issue. The risk analyst must document any assumptions made when performing the risk evaluation, any uncertainties associated with the analysis, whether any parts of the issue were outside the scope of the licensees PRA, and whether any surrogates were used to account for the impact of the issue. The final quantitative risk analysis must include an evaluation of the impact on internal events risk, as well as the impact on any relevant external events. The risk analysis, including documentation of any influential assumptions and uncertainties, shall be maintained for inspection by NRC personnel.

The PRA results will be compared to the relative change in risk of the licensees overall CDF and LERF. An issue is not risk-significant (i.e., minimal or less than minimal) if both of the following apply:

• the issue contributes less than 1 x 10-7/year to CDF, and

• the issue contributes less than 1 x 10-8/year to LERF.

If the risk results are less than the criteria above, the issue is considered to have a minimal impact on safety.

4.4 Step 4 - Assess Need for Risk Management Actions Based on the assessment of the screening questions in Steps 1 and 2, and the outcome of the final quantitative risk evaluation in Step 3, a final safety impact is determined. If the result of Step 1 indicates that there is no impact on safety, and the result of Step 3 indicates that there is minimal impact on safety, then the issue is characterized as having a minimal impact on safety and RMAs do not need to be considered. If the results of Steps 2 and 3 both indicate that there is a minimal impact on safety, then the issue is characterized as having a minimal impact on safety and RMAs must be considered to offset the risk increase due to the issue.

RMAs are typically associated with managing configuration risk when equipment is out of service or for temporary non-compliances. However, in this case, the non-compliance will become the permanent plant configuration if the licensing action is approved. Therefore, only long-term actions to reduce risk associated with the new configuration need to be considered, such as permanent procedure changes or simple plant modifications. For example, if an automatic interlock is defeated permanently, procedure changes to verify proper manual operation of the equipment may be appropriate to reduce the risk associated with removal of the automatic interlock.

20

5.0 ASSESSING CUMULATIVE RISK Once an issue has been characterized as having a minimal impact on safety, the cumulative risk impact of permanent changes to the risk profile of the plant must be evaluated consistent with the principles discussed in RG 1.174. As part of the evaluation of risk, licensees should understand the effects of the current application considering past applications. The PRA used for the current application should already model the effects of past applications. However, qualitative and synergistic effects are sometimes difficult to model. Tracking changes in risk (both quantifiable and nonquantifiable) that result from plant changes provides a mechanism to account for the cumulative and synergistic effects of these plant changes and helps demonstrate that the licensee has a risk management philosophy in which PRA is not just used to systematically increase risk, but is also used to help reduce risk where appropriate and where it is shown to be cost effective.

Increases in CDF and LERF resulting from proposed licensing basis changes should be limited to small increments. The decision process should track and consider the cumulative effect of such changes, whether they result in an increase or a decrease in risk.

The cumulative risk impact is evaluated based on plant-specific CDF and LERF. Cumulative risk is acceptable for the purposes of this guidance if baseline risk remains less than 1 x 10-4/year for CDF and less than 1 x 10-5/year for LERF once the impact of the proposed change is incorporated into baseline risk.

6.0 PAPERWORK REDUCTION ACT 6.1 Paperwork Reduction Act This document provides voluntary guidance for implementing the mandatory information collections in 10 CFR Part 50 that are subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et. seq.). These information collections were approved by the Office of Management and Budget (OMB), under control number 3150-0011. Send comments regarding this information collection to the FOIA, Library, and Information Collections Branch, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202 (3150-0011), Office of Management and Budget, Washington, DC 20503.

6.2 Public Protection Notification The NRC may not conduct or sponsor, and a person is not required to respond to, a collection of information unless the document requesting or requiring the collection displays a currently valid OMB control number.

7.0 CONGRESSIONAL REVIEW ACT These guidelines are a rule as defined in the Congressional Review Act (5 U.S.C. 801-808).

However, the Office of Management and Budget has not found it to be a major rule as defined in the Congressional Review Act.

21

8.0 REFERENCES

1. U.S. Nuclear Regulatory Commission, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Regulatory Guide 1.174, Revision 3, January 2018, Agencywide Documents Access and Management System (ADAMS) Accession No. ML17317A256.

2. Nuclear Energy Institute, NEI Guidelines for the Implementation of the Risk-Informed Process for Evaluations Integrated Decision-Making Panel, August 2020, ADAMS Accession No. ML20245E147.

3. Nuclear Energy Institute, 10 CFR 50.69 SSC Categorization Guideline, NEI 00-04, Revision 0, July 2005, ADAMS Accession No. ML052910035.

4. Nuclear Energy Institute, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, NUMARC 93-01, Revision 4F, April 2018, ADAMS Accession No. ML18120A069.

22