ML25129A113
| ML25129A113 | |
| Person / Time | |
|---|---|
| Issue date: | 06/26/2025 |
| From: | Jeannette Arce NRC/NMSS/DFM/IOB |
| To: | |
| Shared Package | |
| ML25129A111 | List: |
| References | |
| CN 25-021 | |
| Download: ML25129A113 (1) | |
Text
NRC INSPECTION MANUAL NMSS/DFM INSPECTION MANUAL CHAPTER 2606 ASSESSMENT OF THE RISK RESULTING FROM A POTENTIAL SAFETY NONCOMPLIANCE AT A FUEL CYCLE FACILITY Effective Date: 06/26/2025
Issue Date: 06/26/25 i
2606 TABLE OF CONTENTS 2606-01 PURPOSE............................................................................................................. 1 2606-02 OBJECTIVES........................................................................................................ 1 2606-03 APPLICABILITY.................................................................................................... 1 2606-04 DEFINITIONS........................................................................................................ 2 04.01 Control....................................................................................................................... 2 04.02 Credited Control........................................................................................................ 2 04.03 Enabling Event.......................................................................................................... 2 04.04 Likelihood.................................................................................................................. 2 04.05 Safety Basis.............................................................................................................. 2 04.06 Safety Concern.......................................................................................................... 3 04.07 Unanalyzed Condition............................................................................................... 3 04.08 Uncredited Control.................................................................................................... 3 2606-05 RESPONSIBILITIES AND AUTHORITIES............................................................ 3 05.01 Director, Division of Fuels, Radiological Safety, and Security (DFRSS)................... 3 05.02 Director, DFM............................................................................................................ 3 05.03 Branch Chiefs, DFRSS.............................................................................................. 3 05.04 Branch Chiefs, DFM.................................................................................................. 4 05.05 Fuel Cycle Facility Inspectors.................................................................................... 4 05.06 Office of Nuclear Regulatory Research, Division of Risk Analysis, Director............. 4 2606-06 REQUIREMENTS................................................................................................. 4 06.01 Assessing Risk Following a Potential Noncompliance.............................................. 4 2606-07 REFERENCES.................................................................................................... 13 : Safety Significance Worksheet................................................................... Att1-1 : Sample Safety Significance Worksheet...................................................... Att2-1 : Sample Safety Significance Worksheet...................................................... Att3-1 : Revision History for IMC 2606.................................................................... Att4-1
Issue Date: 06/26/25 1
2606 2606-01 PURPOSE This inspection manual chapter (IMC) provides guidance for determining the risk of an accident at a fuel cycle facility resulting from a noncompliance. Specifically, this IMC details an approach to analyze the safety-significance of an upset condition, control failure, or degraded condition (including an unanalyzed condition) resulting from a potential noncompliance using the licensees NRC-approved safety analysis methods, as applicable. It is not for assessing whether a noncompliance occurred or whether an event was reportable.
2606-02 OBJECTIVES This IMC provides the NRC staff with a method to use facility safety information to evaluate a potential noncompliance at a fuel cycle facility based on risk. The considerations in this IMC are only applicable to determining safety significance, and may not be used to determine compliance, to assess the root cause, or to assess the overall significance (including regulatory significance). The determination of risk or safety-significance is an important consideration in determining any appropriate agency enforcement action.
2606-03 APPLICABILITY This IMC is applicable to fuel cycle licensees licensed under Title 10 of the Code of Federal Regulations (10 CFR) Parts 40 and 70, with or without an approved integrated safety analysis (ISA). The process in this IMC is a structured analytical method and relies on the use of either the licensees NRC-approved ISA methodology or the risk assessment method discussed in Section 2606-06 of this IMC.
The risk assessments discussed here are applicable to assessing the significance of noncompliances involving controls and management measures failing or becoming degraded.
Risk assessment should be based on controls, which may or may not include items relied on for safety (IROFS), established before occurrence of the potential noncompliance. For the purposes of this manual chapter, the term, IROFS also may be used to describe credited controls for 10 CFR Part 40 licensees. Consideration may also be given for controls that were not specifically credited for the affected accident sequence, but which were formally established beforehand for other reasons. Engineered features and operator actions which were not documented and controlled, consistent with the approved methodology and prior to the potential noncompliance, should not, in general, be considered. In limited cases, consideration may be appropriate for process conditions or the natural and credible course of events when based on a compelling argument demonstrating reasonable assurance that such conditions would necessarily be present and when allowed by the licensees approved methodology.
Any noncompliance involving the application of this IMC is going to be of more-than-minor significance, because failing to identify necessary controls as IROFS for the purposes of compliance with 10 CFR 70.61 is a more-than-minor noncompliance. This is also consistent with the risk guidance in IMC 0616, Appendix B, Examples of Minor Violations. This IMC is only for assessing the risk of more-than-minor noncompliances and is not for screening noncompliances as minor or more-than-minor.
Issue Date: 06/26/25 2
2606 2606-04 DEFINITIONS Terms used in this IMC are as defined in NRC regulations and guidance (e.g., NUREG-1520, Standard Review Plan for the Review of a License Application for a Fuel Cycle Facility). Any specialized terms for use in this IMC are defined below.
04.01 Control A structure, system, component, or operator action relied on to prevent or mitigate an accident of concern. The term control implies that the engineered features or administrative actions must be formally recognized, documented, implemented, and maintained as such by the licensee prior to occurrence of the potential noncompliance, and includes IROFS, other safety controls (e.g., double contingency controls), systems of controls working together to perform a single safety function, and formal licensee programs (e.g., fire protection program, chemical safety program, material control and accounting program). These controls must be able to perform a safety function that would prevent or mitigate an accident of concern.
04.02 Credited Control A control that is documented, implemented, and maintained by the licensees approved methodology, as required by the license for that control, for an accident sequence or contingency applicable to the potential noncompliance that occurred.
04.03 Enabling Event As defined in NUREG-0750, Nuclear Regulatory Commission Issuances, Volume 61, January
- June 2005, an enabling event is a subsequent event that must take place for the accident sequence to proceed to a point where adverse consequences might occur. Enabling events have a conditional probability of occurrence and, as such, some licensees refer to them as a conditional probability.
04.04 Likelihood The probability or frequency of occurrence of an accident of concern (e.g., resulting in an intermediate or high-consequence event as specified in 10 CFR 70.61). Likelihood may be expressed in terms of the frequency of an initiating event, the probability of failure of a control on demand, or the frequency of an accident. While likelihood may be presented in terms of probability or frequency, it may be evaluated quantitatively or qualitatively, in accordance with the licensees approved methodology. Individual fuel cycle licensees define specific likelihood categories (e.g., highly unlikely, unlikely, not unlikely, and credible) in their safety analyses and ISAs.
04.05 Safety Basis Licensee safety analyses that ensure compliance with regulatory requirements and the safe operation of the facility with licensed materials. Safety basis documents include the ISA, license application, and all other safety analyses, technical evaluations, calculations, and other supporting documentation the licensee used to establish safety limits and controls.
Issue Date: 06/26/25 3
2606 04.06 Safety Concern An ongoing condition, such as a continuing operation, in which the risk of an accident of concern is determined to be unacceptable for long-term operation (e.g., the likelihood of a high-consequence event is more than highly unlikely or that of an intermediate-consequence event is more than unlikely).
A significant safety concern is one in which the likelihood of a high-consequence event is unlikely, or that of an intermediate-consequence event is not unlikely.
An immediate safety concern is one in which the likelihood of a high-consequence event is not unlikely, or a high-or intermediate-consequence event has occurred or is imminent.
04.07 Unanalyzed Condition An event or condition that results in the facility being in a state that the licensee did not previously analyze in a licensees safety basis documentation (e.g., criticality safety analyses, ISA documentation). Unanalyzed conditions do not include events or conditions that the licensee considered and dismissed as not credible or considered as bounded by another event or condition, provided such events and conditions were recognized and formally documented.
04.08 Uncredited Control A control that is not recognized or formally documented by the licensee with maintaining risk at an acceptable level for an accident sequence or contingency applicable to the potential noncompliance that occurred, but which is recognized, documented, implemented, and maintained (according to the licensees approved methodology). In the context of Part 70, this is often referred to as a non-IROFS control.
2606-05 RESPONSIBILITIES AND AUTHORITIES 05.01 Director, Division of Fuels, Radiological Safety, and Security (DFRSS)
- a. Coordinates resource activities related to the IMC with the Division of Fuel Management (DFM) and other offices or divisions, as needed.
- b. Communicates safety concerns to appropriate senior management.
05.02 Director, DFM
- a. Coordinates resource activities related to this IMC with DFRSS.
- b. Provides technical resources to facilitate determination of safety concerns and significance.
- c. Communicates safety concerns to appropriate senior management.
05.03 Branch Chiefs, DFRSS
- a. Provide on-site inspection resources to perform the assessment of safety concerns and significance.
Issue Date: 06/26/25 4
2606
- b. Communicate safety concerns and significance as determined by inspectors to DFM and appropriate senior management.
05.04 Branch Chiefs, DFM
- a. Provide inspection and technical review resources as needed to facilitate determination of safety concerns and safety significance.
- b. Communicate safety concern and significance determinations to DFRSS and appropriate senior management.
05.05 Fuel Cycle Facility Inspectors
- a. Apply this IMC to determine whether there is a safety concern related to a potential noncompliance and request assistance as needed.
- b. Apply this IMC to determine the safety significance of a potential noncompliance and request assistance as needed.
- c. Coordinate with DFM and other staff as needed to gather the technical information necessary to determine whether there is a safety concern and to assess the safety significance of a potential noncompliance.
- d. Communicate safety concerns and significance determinations to the appropriate licensee and NRC management.
- e. Document the application of this IMC in any resulting enforcement action discussed in an inspection report (see IMC 0616).
05.06 Office of Nuclear Regulatory Research, Division of Risk Analysis, Director Coordinates technical resources, as needed, to assist DFRSS and DFM in reaching consensus on technical issues associated with the assessment.
2606-06 REQUIREMENTS 06.01 Assessing Risk Following a Potential Noncompliance This IMC describes a method for assessing risk based on a licensees safety evaluation of the accident sequence or contingency involving the potential noncompliance that occurred. To the extent practical, the inspection staff should perform this assessment while onsite and perform any inspection (e.g., of credited controls, of uncredited controls) immediately to obtain the best risk information while still onsite. However, in some cases it may be necessary to review licensee documentation in office (e.g., the licensees evaluation of a control) before the inspection report is issued. In this case, the staff should follow the processes described in IMC 2600. If the result aligns with the SL-IV example 6.2.d.1 in the Enforcement Policy, because the violation is not a SL-I, -II, or -III, the violation is a SL-IV violation, and the staff should disposition the violation using the normal enforcement process for non-escalated violations. (Inherently, any noncompliance involving the application of this IMC is going to be of more-than-minor significance; this is consistent with the risk guidance in IMC 0616, Appendix B.) Likewise, if the result for a high-consequence accident sequence is that the violation is Unlikely based on the
Issue Date: 06/26/25 5
2606 licensees ISA, the violation will align with the SL-III example in 6.2.c.1, and so the staff should follow the escalated enforcement process.
Additionally, the inspectors should coordinate with the DFM branch chief to obtain assistance from non-regional NRC staff as needed. Involving a regional Senior Reactor Analyst (SRA) is particularly encouraged for cases where multiple uncredited controls are being assessed or where the assessment results in a large change in the significance of the noncompliance being assessed (e.g., from not unlikely to highly unlikely).
Following this guidance should lead to avoiding unnecessary use of the escalated enforcement process. This could result in up to a 100-hour resource reduction for the NRCs significance determination activities per escalated enforcement action, in addition to a reduction in licensee resources.
The process for assessing the risk consists of: (a) identifying the accident sequences or contingencies affected by the potential noncompliance; (b) determining the controls and other considerations applicable to those accident sequences or contingencies, including degraded or failed controls and those remaining available and reliable; (c) assessing the consequence of the sequences or contingencies based on the previous determination; and (d) assessing the likelihood of the consequence to determine the risk following the potential noncompliance. The consideration of likelihood may be done quantitatively, qualitatively, or deterministically. This process is discussed in further detail below. Attachments 1, 2, and 3 provide blank and sample assessment forms that can be used to follow the process and communicate the results.
- a. Identify the Accident Sequences or Contingencies The staff will determine from the licensees safety basis documentation (e.g., criticality safety evaluations, ISA) the accident sequences or contingencies associated with the abnormal condition or control failure that occurred. If the licensees safety basis documentation does not specifically identify the affected accident sequences or contingencies, such as may occur when an unanalyzed condition is discovered, the NRC staff should first identify whether the event or condition is similar to another sequence or contingency that was analyzed. In addition, the staff should evaluate the potential for applicability to other sequences and contingencies that may also be affected.
Section 06.01 (c) and (d) will discuss assessing consequence and likelihood in terms of what events and controls may be considered, and to what extent.
- b. Identification and Consideration for Controls Licensees subject to the regulations of Subpart H of 10 CFR Part 70 are required to designate as IROFS engineered or administrative controls necessary to meet the 10 CFR 70.61 performance requirements. Whether all necessary controls have been designated as IROFS is, therefore, a matter of compliance; however, the safety significance of a noncompliance is influenced by the quality of the management measures applied to a control, such as how the control is treated in the licensees configuration management program. The staff should consider and credit all formally established and documented controls applicable to the situation and commensurate with their availability and reliability, depending on the management measures applied to them.
Issue Date: 06/26/25 6
2606 Previously, it was common to discuss crediting IROFS versus other safety controls and whether full credit or partial credit for a given type of control should be applied to them, as in the case of controls which are failed or degraded. This IMC revises that approach. Specifically, the amount of risk reduction should not be based solely on the type of control, except as a crude and bounding estimate, but rather should also take into account all relevant characteristics (what NUREG-1520 calls availability and reliability qualities). Rather than attempting to give partial credit when there are reduced management measures, credit will be given appropriate to the type of control (whether an IROFS or other formally established and documented safety control), taking into account the management measures that were actually applied to it (as opposed to what were required to be applied).
Other than considering how a control is treated in the licensees management measures programs, the staff should make no distinction between IROFS and other formal controls with regard the assessment of safety significance. The staff may also consider other characteristics of controls, as appropriate. The staff should consider all relevant information so as to arrive at the most realistic determination of safety significance.
Therefore, enabling events and the natural and credible course of events may also be credited if the licensees approved ISA methodology allows this accreditation. The licensee must justify enabling events and the natural and credible course of events based on experimental measurements, physical arguments, the nature of the process, etc., when there is adequate assurance that the credited event or condition will be present when needed.
The staff should not give credit, however, for as-found conditions, by which is meant conditions the licensee does not ensure via formal controls or such other considerations as described above. In cases where an accident did not actually occur, there will be some physical reason that can be found to explain this fact. The staff should not credit such factors if the licensee does not ensure or formally control them. For example, the staff should not credit the fact that only a small amount of material was present at the time of a potential noncompliance if much larger amounts of material are routinely present or allowed under existing plan procedures.
For assessing significance, the staff may credit events and conditions which were identified after-the-fact, such as controls for other accident sequences or contingencies.
This is the case even if a licensee has not recognized the impact of these events or conditions on the safety significance. The staff has discretion whether to consider such events and conditions. The NRC is not under any obligation to consider any events or conditions that the licensee has not used to justify the safety significance. The licensee is responsible for safety, identifying controls and justifying their applicability, availability, reliability, and pedigree. The burden is on the licensee and not the NRC staff to justify reducing the safety significance based on such events and conditions, and the staff should not expend undue resources in doing so. Giving consideration to after-the-fact events and conditions (including uncredited controls) in assessments of safety significance is a separate consideration from determining compliance because the expectation is that licensees analyze and control sequences and contingencies prior to operating a process. Any after-the-fact events or conditions put forward by the licensee or otherwise considered by the staff should be carefully evaluated and the justification for their applicability to the sequence or contingency in question documented as appropriate.
Issue Date: 06/26/25 7
2606 Having determined that a given control or specific event and conditions are applicable and should be considered in assessing safety significance, the staff should then determine how much credit is warranted. The only relevant considerationas with deciding whether it should be considered as discussed in the previous paragraphsis the degree of assurance the staff has that the control or event will be present when needed to perform its safety function. The amount of credit or risk reduction appropriate to a control or event, regardless of whether it was identified as an IROFS or safety control, depends primarily on the management measures and ISA methodology that are actually applied to it. Controls not designated as IROFS may still be subject to relevant management measures in accordance with license commitments (e.g., configuration control, maintenance, training, procedures) according to the ISA methodology. With regard to assessing safety significance, any difference between IROFS and controls that are not IROFS lies only in the difference in management measures applied to these two classes of items. This is a separate question from that of compliance with the regulatory requirements.
In cases where the control has failed or is degradedmeaning its reliability and availability are reducedbecause the licensee has applied improper management measures, the staff may find it appropriate to credit the control to a lesser extent than would be the case when all management measures were appropriately applied. To assess how much credit is warranted, the staff should use the licensees own safety analysis methods (including the licensees ISA methodology) to determine how much credit would be given based on the management measures that were actually applied. In so doing, the staff must adhere to any limitations and caveats of the method to give the appropriate credit.
For example, assume a licensee follows the index method of NUREG-1520, Rev. 2.
Using Table A-10, Failure Probability Index Methods, a passive engineered control may be scored as a -3 to -4 if it has high reliability. If the staff determines this control is applicable and the required management measures were in place but was not considered by the licensee, then it would be appropriate to assign a score commensurate with the approved ISA methodology. It is prudent for the staff to always err on the side of conservatism when assessing risk not based on the licensees own safety analysis, because the licensee is primarily responsible for safety. However, if the licensee did not apply management measures sufficient to ensure high reliability then it would be appropriate to reduce the score to greater than -3 (e.g. -2). In addition, Table A-10 has the following footnote: Indices less than (more negative than) -1 should not be assigned to IROFS unless the configuration management, auditing, and other management measures are of high quality, because without these measures, the IROFS may be changed or not maintained. If the licensee did not recognize the control (generalizing the criteria because there is no essential difference between a control and an IROFS with the same management measures) in advance and did not apply the appropriate management measures as required by the ISA methodology for the more negative scoring, then the staff should adhere to the Table A-10 footnote such that a score more negative than -1 would not be appropriate.
As another example, a duration index of -1 would be appropriate based on a required monthly surveillance. If the licensee erroneously performed this surveillance only once a year, a duration index of 0 should be applied instead. Using another example, if the number of operations performed increases tenfold, then the frequency at which an administrative control is presumed to fail (which may be expressed as the demand rate
Issue Date: 06/26/25 8
2606 times its probability of failure on demand) will increase proportionately. These examples are only for illustrative purposes and should not be directly applied to future cases because many other factors may need to be considered in accordance with the licensees approved methodology.
It is expected there will be cases in which there is considerable uncertainty as to how much credit, particularly for uncredited controls, is warranted. The staff should be conservative in such cases and is under no obligation to consider anything not considered in the licensees safety analysis. Obtaining the assistance of SRAs and other relevant NRC staff with applicable expertise is encouraged.
- c. Assess the Consequence The staff will assess the consequence associated with the accident sequence (high, intermediate, or low) as identified in the licensees safety basis documentation. For criticality events, the consequence will normally be presumed to be high, unless it occurs in a shielded facility where the shielding is credited as a mitigative IROFS. For radiological, chemical, and fire events, the consequence will be determined in accordance with the licensees ISA methodology, with appropriate consideration given to any mitigative IROFS present. If the potential noncompliance involved the failure or degradation of a mitigative IROFS, the consequence may be increased as a result.
If more than one accident sequence or contingency is impacted, the staff must evaluate each of them in assessing overall safety significance.
If the potential noncompliance occurred at a facility with an ISA but involved an accident sequence or contingency that the licensee did not analyze, the staff should attempt to apply the licensees approved ISA methodology to assess consequence. In so doing, the staff must adhere to any limitations and caveats of the methodology to give the appropriate credit. If this cannot be readily accomplished, or if the potential noncompliance occurred at a facility without an approved ISA, the following table (Table 1) should be used to provide a bounding estimate of consequence:
Issue Date: 06/26/25 9
2606 Table 1: Consequence High Intermediate Low Accidental criticality.
An acute radiological dose of 100 rem or greater, or a chemical exposure that could endanger the life of a worker.
An acute radiological dose of 25 rem or greater, or a chemical exposure that could lead to irreversible or other serious long-lasting health effects to a person outside the controlled area (public).
An intake of 30 mg or greater of uranium in soluble form by any individual located outside the controlled area identified pursuant to 10 CFR 70.61(f).
An acute chemical exposure to an individual from licensed material or hazardous chemicals produced from licensed material that has effects as outlined in 10 CFR 70.61(b)(4).
An acute radiological dose of 25 rem or greater, or a chemical exposure that could lead to irreversible or other serious long-lasting health effects to a worker.
An acute radiological dose of 5 rem or greater, or a chemical exposure that could lead to mild or transient health effects to a member of the public.
A 24-hour averaged release of radioactive material outside the restricted area in concentrations exceeding 5000 times the values in Table 2 of Appendix B to Part 20.
An acute chemical exposure to an individual from licensed material or hazardous chemicals produced from licensed material that has effects as outlined in 10 CFR 70.61(c)(4).
A chronic radiological or chemical exposure due to licensed material or an acute exposure less than intermediate.
- d. Assess the Likelihood The staff will assess the likelihood of the accident sequence or contingency following the potential noncompliance that occurred. As explained in more detail below, the likelihood of interest in assessing safety significance is not the likelihood of a sequence from start to finish, but rather the likelihood starting from the condition following the occurrence of the potential noncompliance (e.g., the conditional likelihood of an accident assuming what actually occurred). Thus, what is pertinent to this assessment is this conditional or residual risk following the occurrence of the potential noncompliance, not the change in risk.
If more than one accident sequence or contingency is impacted, the staff must evaluate each of them in assessing overall safety significance.
If the potential noncompliance occurred at a facility with an ISA, but involved an accident sequence or contingency that was not analyzed, the staff should attempt to apply the licensees approved ISA methodology to assess likelihood. In so doing, the staff must adhere to any limitations and caveats of the methodology. If this cannot be readily
Issue Date: 06/26/25 10 2606 accomplished, or if the potential noncompliance occurred at a facility without an approved ISA, the staff should use Tables 2 through 4 to provide a bounding estimate of likelihood. Tables 2 and 3 are appropriate when an accident sequence can be readily identified, such as an accident sequence that is included in the ISA Summary or involves radiological, chemical, or fire hazards. Table 2 is relevant to situations in which the overall likelihood is assessed quantitatively (including use of a semi-quantitative index method such as in Appendix 3-A of NUREG-1520.) Table 3 involves situations in which the overall likelihood is assessed qualitatively based on the type of control(s) remaining.
Table 4 is appropriate when a contingency can be readily identified, as when the potential noncompliance involved a criticality event that was analyzed only in a criticality safety evaluation or in some other deterministic analysis.1 Table 2 should be used when the accident sequence likelihood, starting from the potential noncompliance that occurred and proceeding all the way to an accident, is quantitatively or semi-quantitatively (e.g., using the index method from NUREG-1520) assessed:
Table 2: Quantitative Likelihood Matrix for Accident Sequences For use when risk is assessed quantitatively or semi-quantitatively (e.g., index method)
Highly Unlikely Unlikely Not Unlikely Less than 10-5 per event per year Between 10-4 and 10-5 per event per year Greater than 10-4 per event per year In determining the residual accident sequence likelihood when applying Table 2, the staff should apply the licensees methods, if practicable. Otherwise, Table 3 may be used.
Typically, each event or IROFS failure is assigned a likelihood score, depending on the type of control, management measures applied, etc. (using the licensees approved ISA methodology). If the events or failures are all independent, they are typically summed to arrive at an overall likelihood score for the accident sequence. It is important that the staffs evaluation adhere to any caveats and limitations in the licensees approved ISA methodology. Guidance on consideration of factors such as failure frequency versus probability, demand rate, failure duration, etc., may be found in NUREG-1520, Chapter 3, Appendices A and B. For example, while a passive engineered IROFS may normally receive an Effectiveness of Protection Index of -3 to -4, this may depend on the level of management measures applied or on other limitations. The staff should therefore ensure that the licensee has rigorously followed its own methodology when the potential noncompliance involves an analyzed sequence. Similarly, the staff should rigorously follow the licensees methodology when assessing an unanalyzed sequence. If the staff is applying the licensees methodology to an unanalyzed sequence, any uncertainty in the assignment of likelihood scores should be done conservatively (e.g., use the more conservative value when there is a range of scores).
1 The qualifier quantitative is meant to describe a method of risk-assessment based on estimating likelihood using quantified frequency and probability values. The term qualitative describes a method that estimates likelihood based on the logical and mathematical structure of a quantitative method, but which assigns likelihood categories based on qualitative criteria rather than quantified values. (The index method lies between these and is considered semi-quantitative.) The term deterministic describes a method that does not consider likelihood but rather conservatively assumes worst-case conditions and bases acceptability on non-probabilistic criteria (e.g., defense-in-depth, double contingency).
Issue Date: 06/26/25 11 2606 In addition to ensuring that the appropriate management measures have been applied, the staff should verify that frequency and probability are correctly distinguished. A different score may be appropriate depending on whether an event or failure warrants a Failure Frequency Index or probability of failure (e.g. Effectiveness of Protection Index).
Besides applying appropriate scores to individual events or failures, the staff should combine the scores correctly. Failure Frequency or Effectiveness of Protection Indices must be combined so as to produce an overall accident sequence likelihood with the proper units of frequency or probability per event per year, to be consistent with Table 2 above. The underlying mathematical details are provided in Chapter 3, Appendix B, Qualitative Criteria for Evaluation of Likelihood, of NUREG-1520, Revision 2. The staff should carefully consider the following three factors, when applicable, which may significantly affect the overall accident sequence likelihood: failure duration, demand rate, and independence.
The staff should use Table 3 to qualitatively evaluate the accident sequence likelihood.
This matrix represents the case where there are, at most, two controls remaining. The rows represent the condition of one control and the columns that of the other:
Table 3: Qualitative Likelihood Matrix for Accident Sequences For use when risk is assessed qualitatively No Control ADM AEC PEC No Control NU NU NU U
ADM NU NU U
HU HU PEC U
HU HU HU ADM = administrative control; AEC = active engineered control; PEC = passive engineered control; HU = highly unlikely; U = unlikely; NU = not unlikely Because Table 3 does not take into consideration detailed frequency and probability information, it is recognized to be somewhat conservative.
Table 4 should be used when a deterministic or defense-in-depth, rather than a probabilistic, analysis is the basis for safety, such as a double contingency analysis performed to demonstrate subcriticality under normal and credible abnormal conditions.
This table assumes that the basis for safety is a double contingency analysis. If double contingency is based on two controls and no information besides the number and type of controls is readily available, the staff may use Table 3 in lieu of Table 4. Otherwise, when additional pertinent information is available, the staff should use Table 4.
Issue Date: 06/26/25 12 2606 Table 4: Likelihood Matrix for Contingencies For use when risk is assessed deterministically (e.g., double contingency analysis)
Description Likelihood Category (A) Two independent changes in process conditions exist before an accident is possible, each of which is protected by one or more of the following:
(1) PEC with all appropriate management measures applied (2) AEC with all appropriate management measures applied (3) Enhanced ADM with supporting equipment under appropriate management measures (4) Simple ADM with substantial safety margin (multiple independent failures are required to exceed subcritical limits)*
(5) External event with a frequency no more than 1 in 100 years
- NOTE: Item (4) cannot be used for both changes in process conditions; it must be combined with (1), (2), (3), or (5).
HU (B) Two independent changes in process conditions exist before an accident is possible. One meets one or more of the criteria under (A) above. The other is protected by one or more of the following:
(1) Simple ADM without substantial safety margin.*
(2) Enabling event expected during lifetime of the facility (3) The natural and credible course of events (per ANSI/ANS-8.1)
(4) External event with a frequency no more than 1 in 10 years
- NOTE: Item (1) cannot be combined with item (4) from (A) above.
U (C) A single change in process conditions exists before an accident is possible, or two changes in process conditions but whose failures are not independent. The change in process conditions or dependent failure is protected by the following:
(1) PEC with all appropriate management measures applied U
(D) Single change in process conditions, including a dependent failure, as described in (C) above, and which is protected by at most one of the following:
(1) AEC with all appropriate management measures applied, (2) An enhanced or simple administrative control, (3) The natural and credible course of events, when justified by experimental measurements and/or physical law, with substantial safety margin (multiple failures are required to exceed subcritical limits),
(4) External event with a frequency no more than 1 in 100 years, or (5) Any event or condition not meeting criteria under (A), (B), or (C) above.
NU
Issue Date: 06/26/25 13 2606 The likelihood determination is the most complex and significant part of determining the overall risk. Whether the staff applies Table 2, 3, or 4 depends mainly on the licensees methodology and on the type and quality of information available. In some cases, it may be desirable to cross-check the result using two or all three of these methods to determine the most reasonable estimate of the residual risk.
2606-07 REFERENCES 07.01 Code of Federal Regulations, Title 10, Part 40, Domestic Licensing of Special Nuclear Material 07.02 Code of Federal Regulations, Title 10, Part 70, Domestic Licensing of Special Nuclear Material 07.03 IMC 0616, Appendix B, Examples of Minor Violations (Agencywide Documents Access and Management System Accession Number ML22241A110) 07.04 Nuclear Regulatory Commission Issuances, Volume 61, January - June 2005 (ML060740251) 07.05 NUREG-1520, Rev. 2, Standard Review Plan (SRP) for Fuel Cycle Facilities License Applications (ML15176A258) 07.06 The Enforcement Policy (ML24205A249) 07.07 The Enforcement Manual (ML24282A998)
END List of Attachments: : Safety Significance Worksheet : Sample Safety Significance Worksheet : Sample Safety Significance Worksheet : Revision of History for IMC 2606
Issue Date: 06/26/25 Att1-1 2606 : Safety Significance Worksheet SAFETY SIGNIFICANCE WORKSHEET LICENSEE: _________ EVENT/NOV No: ________________ DATE: __________
Affected Accident Sequence/Contingency (attach separate worksheet for each):
Designation: _______________
Description:
Analyzed Unanalyzed Consequence:
Type:
Criticality Chemical Fire Radiological Magnitude:
LOW INTERMEDIATE HIGH Actual Potential Mitigated Unmitigated Basis for Unmitigated Consequence:
If mitigated, provide basis below:
- Type: ____
Credit: ______
Description:
Basis:
- Type: ____
Credit: ______
==
Description:==
Basis:
- Type: ____
Credit: ______
==
Description:==
Basis:
- Type: ____
Credit: ______
==
Description:==
Basis:
- Type: ____
Credit: ______
==
Description:==
Basis:
- Types: I = IROFS; C = Credited Control; U = Uncredited Control; O = Other Likelihood:
Not Credible Highly Unlikely Unlikely Not Unlikely Occurred
Issue Date: 06/26/25 Att1-2 2606 Likelihood Assessment Method(s):
- 1: Quantitative For Use with Table 2 of IMC 2606 Basis for Using Method #1: ___________________________________________________
Provide basis for each factor contributing to the quantitative determination:
IEF: ____________
==
Description:==
Basis:
Type: ____
Credit: ______
F/P/DR/DI
==
Description:==
Basis:
Type: ____
Credit: ______
F/P/DR/DI
==
Description:==
Basis:
Type: ____
Credit: ______
F/P/DR/DI
==
Description:==
Basis:
Type: ____
Credit: ______
F/P/DR/DI
==
Description:==
Basis:
Type: ____
Credit: ______
F/P/DR/DI
==
Description:==
Basis:
- Types: I = IROFS; C = Credited Control; U = Uncredited Control; B = Bounding Assumption; E = Enabling Event; O = Other Credit: F = Frequency; P = PFOD; DR = Demand Rate; DI = Duration Index
- 2: Qualitative For Use with Table 3 of IMC 2606 Basis for Using Method #2: ___________________________________________________
First Control Type:
None/ADM/AEC/PEC
==
Description:==
First Control Type:
None/ADM/AEC/PEC
==
Description:==
- 3: Deterministic For Use with Table 4 of IMC 2606 Basis for Using Method #3: ___________________________________________________
Highly Unlikely Based On:
A1/A2/A3/A4/A5 of Table 4 Circle as appropriate Basis:
Unlikely Based On:
B1/B2/B3/B4/C1 of Table 4 Circle as appropriate Basis:
Not Unlikely Based On:
D1/D2/D3/D4/D5 of Table 4 Basis:
Issue Date: 06/26/25 Att1-3 2606 Circle as appropriate Additional Considerations/Comments:
INSTRUCTIONS This Safety Significance Worksheet provides a sample format for summarizing the results of an IMC 2606 safety significance determination. Instructions for completing the form follow.
Affected Accident Sequence/Contingency: A brief description of the accident sequence in sufficient detail to understand the major events (not just the initiating event) should be provided.
If the sequence was analyzed in the licensees ISA, its label/number should be provided under designation. The appropriate box should be checked to indicate whether the sequence was previously analyzed. A separate worksheet should be included for each affected sequence.
The term sequence is used in the instructions for accident sequence or contingency. This longer term reflects that there may be an accident sequence explicitly identified in the licensees ISA, with appropriate IROFS, or there may be a scenario analyzed as part of a double contingency analysis in a licensees criticality safety evaluation, involving IROFS or other criticality controls. The worksheet is intended to be flexible enough to accommodate either approach.
Purpose:
This worksheet may be used to summarize the results of an IMC 2606 evaluation at several stages in the enforcement process.
Consequence: This section indicates the consequence part of the risk assessment. Typically, a fire is not directly a consequence of concern, because it is not directly mentioned in 10 CFR 70.61. However, if a fire can result in a chemical release, radiological dose, or criticality, the applicable box should be checked as well. If the sequence affects more than one area, check all applicable boxes.
Actual consequences are those in which the sequence progressed to completion, such that there was an actual chemical or radiological dose or criticality accident.
Potential consequences are those in which the sequence did not progress to completion and there was no chemical or radiological dose. For criticality, the potential consequence is almost always considered high.
At the time of the revision of this IMC, all fuel facility licensees committed to considering criticality as a high-consequence event. Future facilities that rely on mitigation to reduce the consequence of criticality to less than high still must ensure that nuclear processes will be subcritical under normal and credible abnormal conditions, in accordance with 10 CFR 70.61(d).
For other consequence types, normally the unmitigated consequence should be used since the potential consequence is evaluated assuming all IROFS have failed.
Issue Date: 06/26/25 Att1-4 2606 If it is deemed desirable to perform the IMC 2606 evaluation using mitigated consequences (e.g., when there is unusually high assurance that mitigative barriers will remain in place), this should be indicated by checking the appropriate box. The basis for the mitigated or unmitigated consequence should be provided.
Type: Indicates whether the mitigative feature is an IROFS, credited control (including IROFS on other sequences), uncredited control, or some other feature, such as physical considerations that inherently limit the consequence.
Magnitude: Indicates the mitigated or unmitigated consequence (typically unmitigated),
depending on which box is checked below. This should be based on the licensees approved ISA methodology or the consequence categories in Table 1 of this IMC.
Credit: Typically indicates the risk reduction factor, or factor by which the mitigative feature has reduced the unmitigated consequence. However, the means of conferring credit will be done in accordance with the licensees approved ISA methodology.
For each such mitigative feature, the staff should include a brief description, including an IROFS designation if applicable, and the basis for any credit taken. If no factors apply, leave it blank.
Likelihood: Indicates the likelihood of the sequence at the time of the potential noncompliance or event (conditional likelihood of an accident following the potential noncompliance of event).
Thus, if a licensee has a potential noncompliance that results in loss of a control that changes the likelihood from highly unlikely to unlikely, the unlikely box should be checked.
IMC 2606 describes three distinct likelihood assessment methodsquantitative, qualitative, and deterministic, for use in accordance with Tables 2, 3, and 4 of the text. The staff should use the appropriate method(s) in accordance with the guidance provided in the body of IMC 2606. The choice depends on the method of analysis used by the licensee and information available. The staff should briefly justify the choice of method under basis on the worksheet. Note that it may be advisable to employ more than one of the three methods as an independent check on the results of the safety significance determination. In such cases, the staff should indicate which method was the main one used for the ultimate determination of likelihood.
Method #1: The worksheet is designed to follow the information in Table 2 of IMC 2606. This method is intended to be used when likelihood is assessed quantitatively (including the semi-quantitative index method from NUREG-1520). In applying Method 1, it is important that the likelihood be assessed rigorously in accordance with the licensees approved methodology, including, as appropriate, failure frequency, probability of failure on demand (PFOD), failure duration, and demand rate. Guidance for doing so is provided in Appendix 3-B of NUREG-1520, Qualitative Criteria for Evaluation of Likelihood.
IEF: The Initiating Event Frequency (IEF) is used whenever the initiating event in the sequence did not occur, since this block is intended to indicate the likelihood following the potential noncompliance or event. If the initiating event occurred, its likelihood can no longer be considered in the conditional likelihood of the accident and this line should be left blank. Note that if an IROFS or control failure was associated with the potential noncompliance or event, it may not be the initiating event as identified in the licensees evaluation of the sequence, because in many cases the events do not have to occur in the precise order indicated in the sequence.
Issue Date: 06/26/25 Att1-5 2606 Preventive Features: The type and credit (typically risk reduction factor, or factor by which the event likelihood is reduced) should be specified, including a description that includes the IROFS designation if applicable, as indicated under Consequence above. The risk reduction provided by the preventive feature may be expressed in terms of a failure frequency, a PFOD, a demand rate, or a failure duration. If the licensee used an index method (such as that in NUREG-1520), typically each of these are assigned an index, and all such indices are added up to arrive at the overall likelihood. If no factors apply, leave it blank.
Method #2: This is typically applied when there is insufficient information to assess the risk reduction provided by preventive features (e.g., when the sequence was unanalyzed). Method
- 2 is intended to be a conservative estimation of likelihood based solely on the type of control. It may also be used as check on Method #1. While Table 3 of IMC 2606 only considers those situations where there are two control barriers (which is often the case for criticality sequences),
it may be adapted as follows; If the entire sequence includes two controls, the state of one is indicated in the rows and other in the columns. If one of the two controls has failed, the row or column entitled no control should be used. If the sequence contains three controls and one has failed, then use the table for the remaining controls. If two of the three controls have failed, use the table with no control.
For more controls, if two or more of them can be aggregated as a control system, the system may be treated as a single control for the purpose of applying the table. In such cases, consider two administrative controls as an active engineered control, and any other combination (e.g., an administrative and an active engineered control) as a passive engineered control.
Method #3: This is typically applied when the potential noncompliance or violation involves a double contingency analysis in a criticality safety evaluation rather than one analyzed in the ISA Summary. Such a case may occur when the sequence is inadvertently omitted from the ISA Summary, or when it screened from further consider by being considered not credible. Here the likelihood is determined based on meeting certain deterministic criteria, when there is no information available to estimate the likelihood of the individual contingencies. Staff should indicate the overall likelihood category and the basis, including which paragraph of Table 4 of IMC 2606 applies.
Additional Considerations/Comments: This block is to capture any unique aspect of the potential noncompliance or event that may impact the safety basis. Any additional notes such as whether the potential noncompliance is considered programmatic may also be included.
Issue Date: 06/26/25 Att2-1 2606 : Sample Safety Significance Worksheet The sample below shows the risk assessment of an IROFS failure. The IROFS and the associated accident sequence are included in the licensees ISA. In this example, the staff performed the assessment to determine the change in likelihood upon the failure of one of two credited IROFS.
SAFETY SIGNIFICANCE WORKSHEET LICENSEE: SNM-XX EVENT/NOV No: 16-001 DATE: 01/26/2016 Affected Accident Sequence/Contingency (attach separate worksheet for each):
Designation: SF-105: Operator places more than a double-batch of moderator into glovebox
==
Description:==
Initiating Event Control Initiating Event Frequency Effectiveness of Protection Overall Risk Index Operator places more than a double-batch of moderator into glovebox IROFS 1 -
Operator controls the amount of moderating material
[-2]
IROFS 2 -
Operator controls the amount of fissile mass
[-2]
[-4]
Analyzed Unanalyzed Consequence:
Type:
Criticality Chemical/Fire Radiological Magnitude:
LOW INTERMEDIATE HIGH Actual Potential Mitigated Unmitigated Basis for Unmitigated Consequence:
The licensees ISA did not include IROFS or other safety controls to mitigate the consequences.
If mitigated, provide basis below:
- Type: ____
Credit: ______
==
Description:==
Basis:
- Type: ____
Credit: ______
==
Description:==
Basis:
Issue Date: 06/26/25 Att2-2 2606
- Type: ____
Credit: ______
==
Description:==
Basis:
- Type: ____
Credit: ______
==
Description:==
Basis:
- Type: ____
Credit: ______
==
Description:==
Basis:
- Types: I = IROFS; C = Credited Control; U = Uncredited Control; O = Other Likelihood:
Not Credible Highly Unlikely Unlikely Not Unlikely Occurred Likelihood Assessment Method(s):
- 1: Quantitative For Use with Table 2 of IMC 2606 Basis for Using Method #1: The licensees ISA includes the accident sequence in question and provides information on the IROFS and their quantitative contributions to the accident sequence. This assessment will evaluate the risk after IROFS1 failed.
Provide basis for each factor contributing to the quantitative determination:
IEF: ____________
==
Description:==
Basis:
Type: I Credit: -2 F F/P/DR/DI
==
Description:==
IROFS 2: Operator controls the amount of fissile mass Basis: The licensees ISA states that the probability of failure for this IROFS is 10-2; therefore, it would receive -2 as an IROFS.
Type: ____
Credit: ______
F/P/DR/DI
==
Description:==
Basis:
Type: ____
Credit: ______
F/P/DR/DI
==
Description:==
Basis:
Type: ____
Credit: ______
F/P/DR/DI
==
Description:==
Basis:
Type: ____
Credit: ______
F/P/DR/DI
==
Description:==
Basis:
- Types: I = IROFS; C = Credited Control; U = Uncredited Control; B = Bounding Assumption; E = Enabling Event; O = Other
Issue Date: 06/26/25 Att2-3 2606 Credit: F = Frequency; P = PFOD; DR = Demand Rate; DI = Duration Index Additional Considerations/Comments:
Issue Date: 06/26/25 Att3-1 2606 : Sample Safety Significance Worksheet The sample below shows the risk assessment of an IROFS failure while crediting other safety controls. The IROFS and the associated accident sequence are included in the licensees ISA.
In this example, the staff performed the assessment to determine the change in likelihood upon the failure of one of two credited IROFS while crediting another safety control.
SAFETY SIGNIFICANCE WORKSHEET Affected Accident Sequence/Contingency (attach separate worksheet for each):
Designation: SF-105: Operator places more than a double-batch of moderator into glovebox
==
Description:==
Initiating Event Control Initiating Event Frequency Effectiveness of Protection Overall Risk Index Operator places more than a double-batch of moderator into glovebox IROFS 1 -
Operator controls the amount of moderating material
[-2]
IROFS 2 -
Operator controls the amount of fissile mass
[-2]
[-4]
The licensee provided additional information. Specifically, the licensees analysis of the glovebox showed the worse-case credible limits of mass and moderator to be 10 kg U-235 and 5 kg H2O (H/U 13). The licensee demonstrated these combined amounts to be subcritical with an approved margin of subcriticality. Furthermore, the glovebox is documented in the ISA as a safety control and is credited as an NCS control in that it is designed and maintained to limit reflection, and therefore, prevent criticality.
Analyzed Unanalyzed
Issue Date: 06/26/25 Att3-2 2606 Consequence:
Type:
Criticality Chemical/Fire Radiological Magnitude:
LOW INTERMEDIATE HIGH Actual Potential Mitigated Unmitigated Basis for Unmitigated Consequence:
The licensees ISA did not include IROFS or other safety controls to mitigate the consequences.
If mitigated, provide basis below:
- Type: ____
Credit: ______
==
Description:==
Basis
- Type: ____
Credit: ______
==
Description:==
Basis
- Type: ____
Credit: ______
==
Description:==
Basis
- Type: ____
Credit: ______
==
Description:==
Basis:
- Type: ____
Credit: ______
==
Description:==
Basis:
- Types: I = IROFS; C = Credited Control; U = Uncredited Control; O = Other Likelihood:
Not Credible Highly Unlikely Unlikely Not Unlikely Occurred Likelihood Assessment Method(s):
- 1: Quantitative For Use with Table 2 of IMC 2606 Basis for Using Method #1: The licensees ISA includes the accident sequence in question and provides information on the IROFS and their quantitative contributions to the accident sequence. This assessment will evaluate the risk after IROFS 1 failed and the glovebox size limitation is credited. According to the licensees ISA Summary, both IROFS must fail for the accident sequence to occur. However, the full ISA indicates that the glovebox size must also be exceeded.
Provide basis for each factor contributing to the quantitative determination:
IEF: ____________
==
Description:==
Basis:
Type: I Credit: -2 F F/P/DR/DI
==
Description:==
IROFS 2: Operator controls the amount of fissile mass
Issue Date: 06/26/25 Att3-3 2606 Basis: The licensees ISA states that the probability of failure for this IROFS is 10-2; therefore, it would receive -2 as an IROFS.
Type: C Credit:-2 F F/P/DR/DI
==
Description:==
The size and configuration of the glovebox limits the amount of credible reflection.
Basis: The licensees full ISA cites the criticality analysis and credits the glovebox with limiting reflection, as mass and moderator limits were derived using full water reflection. The glovebox is a passive engineered control on which appropriate management measures have been applied.
Therefore, it would receive -2 as a credited control.
Type: ____
Credit: ______
F/P/DR/DI
==
Description:==
Basis:
Type: ____
Credit: ______
F/P/DR/DI
==
Description:==
Basis:
Type: ____
Credit: ______
F/P/DR/DI
==
Description:==
Basis:
- Types: I = IROFS; C = Credited Control; U = Uncredited Control; B = Bounding Assumption; E = Enabling Event; O = Other Credit: F = Frequency; P = PFOD; DR = Demand Rate; DI = Duration Index Additional Considerations/Comments:
Issue Date: 06/26/25 Att4-1 2606 : Revision History for IMC 2606 Commitment Tracking Number Accession Number Issue Date Change Notice Description of Change Description of Training Required and Completion Date Comment Resolution Closed Feedback Form Accession Number (Pre-Decisional, Non-Public Information)
N/A ML12254A075 09/26/12 CN 12-022 Initial issuance to provide direction assessing change in risk due to a violation at a fuel cycle facility.
N/A ML12254A078 N/A ML16039A302 04/01/16 CN 16-010 Major revision to provide further guidance on accessing significance and add an assessment form.
Revised to clarify the approach to crediting controls.
Specifically, rather than attempting to give partial credit when there are reduced management measures, credit will be given appropriate to the type of control (whether an IROFS or other formally established and documented safety control), taking into account the management measures that were actually applied to it (as opposed to what were required to be applied).
N/A Comments vetted through regional meetings.
N/A ML25129A113 06/26/25 CN 25-021 Revised to implement ADVANCED Act by permitting earlier consideration of risk to increase efficiency.
N/A NA