ML022270004

NRC Comments on Draft Revision C of NEI 00-04, 10 CFR 50.69 SSC Catergorization Guidance.

ML022270004
Person / Time
Issue date:	08/14/2002
From:	Mckenna E NRC/NRR/DRIP/RPRP
To:	Pietrangelo A Nuclear Energy Institute
References
-nr, NEI-00-004 Rev. C Draft
Download: ML022270004 (19)

Text

Mr. Anthony R. Pietrangelo, Director August 14, 2002 Risk and Performance-Based Regulation Nuclear Energy Institute Suite 400 1771 I Street Washington DC 20006-3708

SUBJECT:

NRC COMMENTS ON DRAFT REVISION C OF NEI 00-04, 10 CFR 50.69 SSC CATEGORIZATION GUIDANCE

Dear Mr. Pietrangelo:

By letter dated June 28, 2002 (ML021910534), the Nuclear Energy Institute (NEI), submitted to the NRC draft revision C of NEI 00-04. As discussed during our July 10, 2002, meeting, the NRC has used this document as the basis for preparation of a draft regulatory guide to be entitled DG-1121 Guidelines for categorizing structures, systems and components in nuclear power plants according to their safety significance.

Enclosed with this letter are NRC comments on NEI 00-04 that we are in the process of reflecting in the draft regulatory guide for the proposed rule. We will be meeting with the Advisory Committee on Reactor Safeguards on September 13, 2002, to discuss the proposed rule and our draft regulatory guide. It is our intention to work with you over the next several months to reach resolution on these issues such that final regulatory guidance is ready when the final rule package for 10 CFR 50.69 is completed.

Questions about this letter should be directed to Donald Harrison (301-415-3587).

Sincerely,

/RA KSWest Acting for/

Christopher I. Grimes, Program Director Policy and Rulemaking Program Division of Regulatory Improvement Programs Office of Nuclear Reactor Regulation

Enclosure:

As stated

Mr. Anthony R. Pietrangelo, Director August 14, 2002 Risk and Performance-Based Regulation Nuclear Energy Institute Suite 400 1771 I Street Washington DC 20006-3708

SUBJECT:

NRC COMMENTS ON DRAFT REVISION C OF NEI 00-04, 10 CFR 50.69 SSC CATEGORIZATION GUIDANCE

Dear Mr. Pietrangelo:

By letter dated June 28, 2002 (ML021910534), the Nuclear Energy Institute (NEI), submitted to the NRC draft revision C of NEI 00-04. As discussed during our July 10, 2002, meeting, the NRC has used this document as the basis for preparation of a draft regulatory guide to be entitled DG-1121 Guidelines for categorizing structures, systems and components in nuclear power plants according to their safety significance.

Enclosed with this letter are NRC comments on NEI 00-04 that we are in the process of reflecting in the draft regulatory guide for the proposed rule. We will be meeting with the Advisory Committee on Reactor Safeguards on September 13, 2002, to discuss the proposed rule and our draft regulatory guide. It is our intention to work with you over the next several months to reach resolution on these issues such that final regulatory guidance is ready when the final rule package for 10 CFR 50.69 is completed.

Questions about this letter should be directed to Donald Harrison (301-415-3587).

Sincerely,

/RA KSWest Acting for/

Christopher I. Grimes, Program Director Policy and Rulemaking Program Division of Regulatory Improvement Programs Office of Nuclear Reactor Regulation

Enclosure:

As stated DISTRIBUTION: Public C. Grimes S. West T. Reed E. McKenna M. Rubin D. Harrison M. Cheok, RES ML02 Document name: G:\RPRP\RIP50\neo04revCcomments.wpd OFFICE RPRP SC:RPRP SC:SPSB PD:RPRP NAME E. McKenna S. West M. Rubin C. Grimes/RA KSWest Acting for/

DATE 08/13/02 08/13/02 08/14/02 08/14/02 OFFICIAL RECORD COPY

NRC Staff Comments Revision C of NEI 00-04 10 CFR 50.69 SSC Categorization Guideline A. Quality Attributes of Analyses Implementing Draft Revision C of NEI 00-04 Draft Revision C of NEI 00-04 states in Section 3.3 that the Option 2 categorization process is a Grade 3 application per the NEI 00-02 peer review process. Through NEI 00-02, as amended to incorporate NRC comments provided in the NRC letter to NEI, dated April 2, 2002, there is a mechanism for licensees to determine if their internal events probabilistic risk assessment (PRA) meets the attributes required for this application. An alternative to NEI 00-02 may be the ASME Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, if and when endorsed by the NRC staff. The NRC endorsement of this ASME standard is currently under development as DG-1122. These documents cover internal events at full power only.

Draft Revision C of NEI 00-04 does not address the application-specific quality/adequacy required of the external events PRA and non-PRA type analyses (e.g., FIVE, seismic margins analysis, NUMARC 91-06) and there is no industry guidance for determining the quality/adequacy attributes required for these types of analyses for this specific application.

Industry standards are being prepared for external events (seismic, high winds, and other external events), fire, and low power and shutdown PRAs, although with the exception of the external events standard, they are not expected to be completed in the near future. Therefore, the NRC staff expects that the applicant will prepare arguments for why the method employed is adequate to perform the analysis required to support the categorization of structures, systems and components (SSC). Until such time that these standards are available, these arguments supporting the quality and adequacy of the external events and non-PRA type analyses for each plant-specific submittal requesting to implement 10 CFR 50.69 will have to be evaluated on a case-by-case basis. To facilitate these reviews, the NRC staff recommends that the industry develop guidance as to the expected quality attributes of the external events PRA and non-PRA type analyses that are required for use in the Option 2 categorization process.

B. Determination of Potential Risk Increase with non-PRA methods In Draft Revision C of NEI 00-04, the final step in the allocation of SSCs into the different RISC categories is to show that the reduction in treatment of low safety significant (LSS) SSCs will not result in a significant increase in risk. This is done by performing the risk sensitivity study, discussed in Section 8, based on increasing the failure probabilities of those SSCs for which treatment is proposed to be relaxed. This risk sensitivity study is a very important part of the categorization process. The choice of the factor to use in increasing the failure probabilities of LSS SSCs with reduced treatment must be based either on some reasonable expectation that it is bounding or that it is such that the change in unreliability that it represents will be detected and corrected by the monitoring, corrective action, and feedback processes. The NRC staff recommends that the industry develop a method to determine the appropriate factor to be used in the risk sensitivity study and provide the appropriate guidance for implementing the monitoring, feedback, and corrective action processes to ensure that potential performance degradations will not invalidate the factor used in the risk sensitivity study.

Further, when non-PRA methods are used, it is necessary for the licensee to demonstrate that the impact on CDF and LERF due to changes in treatment of LSS SSCs is acceptably small.

The NRC staff recommends that the industry develop a method, or methods, to demonstrate that this is the case.

ENCLOSURE

C. Limitations of Types of Analyses Used in Implementing Draft Revision C of NEI 00-04 In its 1995 Policy Statement on the use of probabilistic risk assessment (PRA), the Commission determined that the use of PRA technology should be increased in all regulatory matters to the extent supported by state-of-the-art PRA methods and data. Implementation of risk-informed regulation is possible because the development and use of a quantitative PRA requires a systematic and integrated evaluation. Development of a technically defensible quantitative PRA also requires sufficient and structured documentation to allow investigations of all aspects of the evaluation. To meet the requirements of 10 CFR 50.69 for categorization of SSCs, licensees must use risk evaluations and insights that cover the full spectrum of potential events (i.e., internal and external initiating events) and the range of plant operating modes (i.e., full power, low power, and shutdown operations). The NRC staff believes that current state-of-the-art PRA methods are available to quantitatively address the full spectrum of potential events and the full range of plant operating modes for this type of application and thus, it is desirable for licensees to use such broad-scope PRAs. However, Draft Revision C of NEI 00-04 allows the use of non-PRA type evaluations (e.g., FIVE, seismic margins analysis, NUMARC 91-06),

when PRAs have not been performed. It should be recognized that the degree of relief that can be expected will be commensurate with the assurance provided by the evaluation.

D. Uncertainty Considerations in Draft Revision C of NEI 00-04 The NRC staff notes that Draft Revision C of NEI 00-04 does not address modeling or data uncertainties explicitly. However, the sensitivity studies performed to support the categorization of SSCs using PRA models are intended to address the major sources of uncertainty identified (i.e., human error probabilities, common cause failure probabilities, and those items identified during the assessment of PRA adequacy). When assessing the potential increase in core damage frequency (CDF) and large early release frequency (LERF), uncertainties should be addressed as discussed in Section 2.2.5 of Regulatory Guide 1.174. The NRC staff also notes that there are potentially large differences in the levels of uncertainty in the modeling and data for the PRA models for the various types of events. This limits the ability of the licensee to perform the integral assessment proposed in Section 5.5 of Draft Revision C of NEI 00-04. It is for this reason that the NRC staff believes that it is appropriate to use the most conservative categorization over all the contributors taken individually.

E. Specific Comments on Draft Revision C of NEI 00-04

1. Section 1.2 The fourth paragraph of this section states that the integrated decision-making process

...blends risk insights, new technical information and operational feedback... The NRC staff interprets this phrase, and similar such phrases (e.g., Section 1.3 third guiding principle), as meaning that the integrated decision-making process must systematically consider the quantitative and qualitative information available regarding the various modes of plant operation and initiating events, including PRA, quantitative risk results and insights (e.g., CDF, LERF, and importance measures); deterministic, traditional engineering factors and insights (e.g., defense-in-depth, safety margins, containment integrity); and any other pertinent information (e.g.,

industry and plant-specific operational and performance experience, feedback, and corrective actions program) in the categorization of the SSCs.

2

2. Section 1.3 The second guiding principle states that deterministic or qualitative information should be used if no PRA information exists related to a particular hazard or operating mode. This principle is not to be interpreted to mean that deterministic or qualitative information should be used only when no PRA information exists. The NRC believes that the integrated decision-making process must systematically consider the quantitative and qualitative information available regarding the various modes of operation and initiating events, including: PRA, quantitative risk results and insights; deterministic, traditional engineering factors and insights; and any other pertinent information in the categorization of the SSCs.

The fifth guiding principle uses the term original categorization. The NRC staff interpretation of this phrase is that it is a reference to the original, default categorization of each SSC. The NRC concludes that the original categorization of safety-related SSCs is RISC-1, non-safety-related important-to-safety SSCs is RISC-2, and other non-safety-related SSCs is RISC-4 and that a risk-informed basis must be provided through an integrated decision-making process for any other risk category to be assigned to these SSCs.

The sixth guiding principle indicates that the attribute(s) that make a SSC safety-significant should be documented. While the NRC staff agrees that the safety-significant attribute(s) need to be documented, the licensee must also document the justification for SSCs determined to be LSS. In other words, documentation must be available and maintained by the licensee supporting the categorization of every SSC addressed by the licensee under 10 CFR 50.69.

3. Section 1.4 The third paragraph of this section states that the licensee can determine the appropriate set of equipment to recategorize under 10 CFR 50.69. The NRC staff agrees that categorization under 10 CFR 50.69 can be partially implemented by a licensee and the implementation can be phased in over a period of time. However, since the categorization process described in 10 CFR 50.69 and in NEI 00-04 is primarily based on system/structure functions, the categorization process must be implemented on a system/structure-basis; not selected components within a system. This is supported by the fact that system boundaries are to be defined under the System Engineering Assessment step of the categorization process outlined in Section 2.

4. Section 2 In this section and throughout NEI 00-04, reference is often made to a licensees PRA. This phrase is commonly used by industry when referring strictly to a licensees internal events Level I PRA. The NRC staff interprets the intent of this phrase in NEI 00-04, when not explicitly (or by context) limited to a specific analysis, to refer to the spectrum of analyses covering the range of initiating events (e.g., internal events and external events), analysis types (e.g., PRA, margins-type analyses, simplified risk analyses, and hazard screening assessments), and operating modes (i.e., full power and low power/shutdown).

3

Although it is clear from the text of Section 2, NEI should clarify the intent of Figure 2-1 that the Detailed Engineering Review of HSS Components is an optional task and is not an essential or required part of the risk-informed categorization process.

5. Section 3.2 The NRC staff is currently preparing a Regulatory Guide (RG) and associated Standard Review Plan (SRP) chapter to address the issue of PRA quality. These documents will address the use of NEI 00-02, which when finalized, is expected to contain a licensee self-assessment process, that complements the peer review criteria with those of the ASME PRA standard not addressed in NEI 00-02. The NRC staff expects the final version of NEI 00-04 to reference these documents as an appropriate way to ensure and document the acceptability of the underlying PRA for the purposes of categorization.

Reference is made to the development and use of industry consensus standards on PRA, which is assumed by the NRC staff to be a reference to the development of a standard that is currently underway for external events PRA. As this standard is still under development and has not been formally reviewed and endorsed by the NRC, the statements in NEI 00-04 are not to be taken to be an endorsement of this standard by the NRC.

The NRC staff notes that Draft Revision C of NEI 00-04 does not address modeling or data uncertainties explicitly. However, the sensitivity studies performed to support the categorization of SSCs using PRA models are intended to address the major sources of uncertainty identified (i.e., human error probabilities, common cause failure probabilities, and those items identified during the assessment of PRA adequacy). When assessing the potential increase in core damage frequency (CDF) and large early release frequency (LERF), uncertainties should be addressed as discussed in Section 2.2.5 of Regulatory Guide 1.174. The NRC staff also notes that there are potentially large differences in the levels of uncertainty in the modeling and data for the PRA models for the various types of events. This limits the ability of the licensee to perform the integral assessment proposed in Section 5.5 of Draft Revision C of NEI 00-04. It is for this reason that the NRC staff believes that it is appropriate to use the most conservative categorization over all the contributors taken individually.

6. Section 3.3 NEI 00-04 states that the Option 2 categorization process is a Grade 3 application per the NEI 00-02 peer review process. This can be demonstrated for the internal events PRA, as described in NEI 00-02, as amended to incorporate NRC comments provided in the NRC letter to NEI dated April 2, 2002. Therefore, the licensee must provide sufficient justification for the adequacy of their PRA for this application and must address any technical elements that do not meet the required grade for this application (i.e., receive a grade of 1 or 2 on individual technical elements) and the significant peer review Facts and Observations (i.e., Categories A or B). Further, the NRC believes that a higher grade for PRA quality cannot be achieved by sensitivity studies, though sensitivity studies can be used to explore the impacts of modeling uncertainties on the categorization. The NRC staff notes that these sensitivity studies must also be evaluated in the Component Safety Significance Assessment step (Chapter 5) as the additional applicable sensitivity studies identified in the characterization of PRA adequacy in Tables 5-2, 5-3, 5-4, and 5-5.

4

In addition to demonstrating that the internal events PRA input to fire, seismic, and shutdown PRAs is technically acceptable, it is also necessary to demonstrate the technical acceptability of those elements dealing with the initiating event and specific mitigating features (e.g., initiating event frequencies, fire detection and suppression systems, etc.). Since no NRC-endorsed standards exist for these elements, the licensee must describe the licensees approach and justify its acceptability for these elements.

NEI 00-04 does not identify the need for licensees to address the adequacy of any non-PRA types of analyses, such as a margins-type study, used in the categorization process. The licensees must explicitly address and document in their plant-specific submittal to the NRC, the adequacy of these non-PRA types of analyses and ensure that they appropriately reflect the as-built, as-operated plant and that any new information (e.g., new seismic hazard information, cable routing credited in fire analysis) does not invalidate their results.

7. Section 4 The NRC has not yet formally endorsed ASME Code Case N-658. The NRC staff review of the ASME Code Cases is expected to be completed prior to promulgating 10 CFR 50.69. The NRC staff notes that staff positions on the ASME Code Cases are provided in regulatory guides referenced in 10 CFR 50.55a. If and when endorsed by the NRC, the ASME risk-informed Code Cases on categorization and treatment will satisfy the applicable portions of the proposed 10 CFR 50.69. However, at this time, the licensee cannot assume that using this method will be acceptable to the NRC. NEI 00-04 does not provide a description of a methodology for categorization that addresses the passive pressure boundary (i.e., pressure retention capability) for the purpose of exempting SSCs from special treatment requirements in sufficient detail for the staff to endorse. Therefore, the endorsement of NEI 00-04 does not adopt any method to categorize the safety significance of the passive pressure boundary of SSCs. Until such a methodology is endorsed by the NRC, to support the categorization of SSCs, the licensee is required to describe in their plant-specific submittal requesting to implement 10 CFR 50.69, their methodology for addressing the passive pressure boundary of SSCs.

8. Section 5 The first decision block in Figure 5-1 refers to prevention or mitigation of core damage. To be consistent with the intent of the safety significance categorization process, this first decision block should be broader in scope and includes the prevention or mitigation of severe accidents.

Further, the logic presented in Figure 5-1 presumes that a negative response to this first decision block means that the follow-on blocks do not need to be addressed. The NRC staff cannot be assured that this screening will eliminate SSCs that are only of low safety significance, especially as currently phrased. Even if a negative response results for this block, the rest of the logic must still be addressed. In essence, NRC would eliminate this initial screening of the system/structure.

In Figures 5-2 through 5-7, SSCs having a Risk Achievement Worth (RAW) greater than 2 or a Fussell-Vesely (FV) importance measure greater than 0.005 either on the basis of the base model or sensitivity studies are identified as candidate safety significant. Further, throughout this section reference is made that if the external event is a small fraction of the internal events 5

CDF, then safety significance of SSCs considered in the external events PRA can be considered to be LSS from that perspective. The NRC concludes that if a SSC is classified as safety significant, it cannot be reclassified as LSS by an integral risk consideration. Though the IDP may raise a candidate LSS SSC to safety-significant, the IDP cannot lower a safety-significant SSC to LSS. If a SSC is determined to be safety-significant by any of the analyses supporting the risk-informed categorization process, including the appropriate sensitivity studies, then the SSC is safety-significant.

Risk Achievement Worth (RAW) is an assessment of the safety significance (i.e., the margin it provides in preventing core damage) of an SSC, whether it be evaluated for a single SSC or a group of SSCs. The RAW value provides the factor that the CDF or LERF increases when the SSC enters a failed state or, for a group of SSCs, when a common cause failure (CCF) degradation mechanism manifests itself to the point that multiple SSCs are in a failed state.

NEI 00-04 excludes the RAW of the CCF probability associated with a SSC from the importance measure calculations. The NRC believes it is appropriate to include the RAW of the CCF probability to assess the RAW associated with a component since the CCF contribution is a distinct contribution resulting from a specific failure mechanism not represented in the other basic events. The consequences of common cause events are of concern and as such, the risks from these types of events need to be fully assessed. NUREG/CR-5485, Guidelines on Modeling Common-Cause Failures in Probabilistic Risk Assessment, notes that more than 2,500 common cause events involving the majority of significant PRA SSCs are documented in the NRC common cause data base. If a CCF is modeled in the PRA, a plausible CCF mechanism has been identified that could cause the simultaneous failure of more than one nominally identical SSC. If there are no plausible mechanisms known (because of diversity or reliance on only passive functions) that could cause a simultaneous failure of more than one SSC, no CCF is modeled in the PRA. If a CCF is modeled in the PRA, the RAW associated with that CCF must be included in the safety-significance determination of the affected SSCs.

Section 5 discusses a number of sensitivity studies in Tables 5-2, 5-3, 5-4, and 5-5 where the unavailability of types of PRA events (e.g., human errors, CCFs, and maintenance unavailabilities) are simultaneously modified and the importance measures of the SSCs recalculated. These studies are performed to ensure that assumptions in these types of analyses are not masking SSC importance. The NRC finds the identified sensitivity studies reasonable and they are to be used in the categorization of SSCs. Therefore, if based on any of these sensitivity studies, an SSC is identified as being safety significant, then this basis must be documented and the SSC must be considered safety significant. SSCs must be categorized according to the highest safety-significance determined, including these sensitivity study results and the results of any other pertinent considerations (e.g., defense-in-depth, shutdown risks, etc.).

9. Section 5.1 The NRC has not formally endorsed ASME Code Cases N-577 and N-578. The NRC staff review of the ASME Code Cases is expected to be completed prior to promulgating 10 CFR 50.69. The NRC staff notes that staff positions on the ASME Code Cases are provided in regulatory guides referenced in 10 CFR 50.55a. If and when endorsed by the NRC, the ASME risk-informed Code Cases on categorization and treatment will satisfy the applicable portions of the proposed 10 CFR 50.69. However, at this time, a licensee cannot assume that using the 6

methods described in these code cases will be acceptable. The NRC has endorsed WCAP-14572 and EPRI TR-112657, which include guidance for the categorization of piping segments, but not individual SSCs, for the purpose of reducing the number of inservice inspections on piping welds. NEI 00-04 does not provide a description of a methodology for categorization that addresses the passive pressure boundary (i.e., pressure retention capability) for the purpose of exempting SSCs from special treatment requirements in sufficient detail for the staff to endorse.

Therefore, the endorsement of NEI 00-04 does not adopt any method to categorize the safety significance of the passive pressure boundary of SSCs. Until such a methodology is endorsed by the NRC, to support the categorization of SSCs, the licensee is required to describe in their plant-specific submittal requesting to implement 10 CFR 50.69, their methodology for addressing the passive pressure boundary of SSCs.

NEI 00-04 defines relevant failure modes as ... those that are expected to be affected by the special treatment requirements being evaluated. As it cannot be determined precisely what specific failure modes might or might not be impacted due to the reduction in the applicable special treatment requirements for low safety-significant SSCs, the licensee must consider all the failure modes for the SSC identified in the PRA in making its Fussell-Vesely importance determination. This is consistent with the example provided in Table 5-1.

The intent and implications of the discussion of using the component failure mode or dominant failure mode in the identification of safety significant attributes is ambiguous and open to multiple interpretations. The NRC staff expects NEI to clarify how the safety significant attributes may be used by licensees within the scope of 10 CFR 50.69.

NEI 00-04 states that SSCs that have high failure probabilities are usually indicative of screening values. However, high failure probabilities can also be due to a number of other factors, including a lack of any testing of the SSC or an actually poor performing SSC. The NRC concludes that categorization results must not be overturned for SSCs simply because they have a high failure probability in the PRA, but rather, the licensee should first examine and determine the cause of the high value and then revise the model, as necessary.

10. Section 5.2 It is the NRC staffs interpretation of the discussion in the third paragraph of this section to mean that fire barriers would not be included within the scope of risk-informed treatment (i.e.

would not be categorized) unless they are explicitly evaluated in the fire risk analyses.

11. Sections 5.2 and 5.3 NEI 00-04 recognizes in these sections that the vulnerability-type evaluation (e.g., FIVE) and margins-type analysis (e.g., seismic margins analysis) are somewhat limited in being able to support the identification of LSS SSCs. It is further stated that the approach for these types of analyses is conservative since SSCs are determined to be safety significant essentially if they are identified in these analyses. For the FIVE analysis, SSCs are safety significant if they participate in the scenario or are credited in the screening of the scenario. For the seismic margins analysis, SSCs are safety significant if they are credited in the safe shutdown path.

The licensees, as part of their submittal to the NRC requesting to implement 10 CFR 50.69, must demonstrate the adequacy of these types of analyses for this application and ensure that 7

they will provide conservative results. If a licensee wants to gain the full benefit from the proposed 10 CFR 50.69 in reducing treatment of SSCs, the licensee should consider performing a fire and/or seismic PRA, which would provide greater ability to identify SSCs that could potentially be categorized as LSS.

12. Section 5.4 As the evaluation of other external events typically is a screening approach, NRC believes that a logic similar to Figure 5-4 might be more appropriate than the current Figure 5-6. Thus, if a SSC participates in an unscreened scenario or is credited in the screening of the scenario, then that SSC would be considered safety significant.

13. Section 5.5 NUMARC 91-06 is stated in NEI 00-04 as an attempt to ensure that the plant has an appropriate complement of systems available at all times. The NRC staff is not sure that the use of NUMARC 91-06, as described in NEI 00-04 and as implemented through the plant-specific Outage Risk Management Guidelines, will provide conservative categorization results.

Therefore, as part of the licensees submittal requesting to implement 10 CFR 50.69, the licensee must demonstrate the adequacy of its approach to addressing shutdown risk for this application and ensure that the approach will provide conservative results. If this approach is used, any (not just the primary) SSCs identified in the plant-specific Outage Risk Management Guideline must be considered safety significant. Further, if a licensee wants to gain the full benefit from the proposed 10 CFR 50.69 in reducing treatment of SSCs, the licensee should consider performing a shutdown PRA, which would provide greater ability to identify SSCs that could potentially be categorized as LSS.

14. Section 6.1 The NRC staff agrees that when an SSC is determined to be LSS, it is appropriate to confirm that adequate defense-in-depth is preserved. However, it is not clear how Figure 6-1 is to be interpreted in this process. The NRC staff interpretation is that the figure is intended to address defense-in-depth at the critical safety function level (i.e., the figure should be used for each critical safety function and the top line identifies what system(s) is(are) available in addition to the system of which the SSC is a part). The row is to be chosen commensurate with the highest frequency initiating event for which failure of the critical safety function would lead to core damage or a large release. Further, in a risk-informed framework, defense-in-depth must be applied to all potential initiating events. Consequently, the defense-in-depth evaluation must include all initiating events credible enough to be postulated in the PRA; not just design basis events. For example, initiating events such as loss of service water cooling system should be included. Further, the estimated plant-specific initiating event frequencies for all the initiating events must be compared to the ranges identified in Figure 6-1 and each plant-specific initiating event placed in the appropriate frequency range.

NEI 00-04 does not provide guidance on the use of the proposed defense-in-depth methodology in sufficient detail for the staff to review and endorse this method. For example, it is not clear if the methodology requires that all trains/systems credited in the defense-in-depth analysis (i.e., those considered in the header row) should be considered safety-significant or 8

allow all of them to be LSS. Therefore, as part of a licensees submittal requesting to implement 10 CFR 50.69, the licensee must provide the methodology for addressing defense-in-depth, which the staff will review to ensure that it properly reflects the intent of 10 CFR 50.69.

15. Section 6.2 The NRC concludes that the containment and its related systems are important in the preservation of the defense-in-depth philosophy in terms of both large early and large late releases. Therefore, as part of meeting the defense-in-depth principle, a licensee must demonstrate that the function of the containment as a barrier, including fission product retention and removal, is not significantly degraded when SSCs that support the functions are determined to be LSS. The concepts used to address defense-in-depth for functions required to prevent core damage may also be useful in addressing issues related to those SSCs that are required to preserve long-term containment integrity. One way to do this would be to show that these SSCs are not relied on to prevent late containment failure during core damage accidents.

An alternative method would be to demonstrate that a potential decrease in reliability of low safety-significant SSCs that support the containment function does not have a significant impact on the estimated late containment failure probability. In essence, what the NRC staff expects is a plant-specific understanding of the effects of containment systems on large late releases and the credit given to these systems in maintaining the conditional probability for these releases. A licensee or applicant can qualitatively argue that an SSC is not relied upon to prevent large late containment failure and is thus low safety significant from this standpoint.

However, if an SSC plays a role in supporting the containment function in terms of large late releases and if the licensee wants to categorize these SSCs as LSS (e.g., because of available redundant systems or trains or because its failure is dominated by factors not related to the SSC), then sensitivity studies must be performed to show that the effects on (i.e., change in) the late containment failure probability is small (i.e., less than a 10 percent increase from the base value) and that the factors such as common cause failures or other dependencies are not important. Where a licensee categorizes containment isolation valves or penetrations as LSS, the licensee will need to address the impact of the proposed change in treatment on a case-by-case basis to ensure that the defense-in-depth principle continues to be satisfied.

The NRC believes that the first criteria listed for containment bypass needs to also include mitigation of an ISLOCA event as well as the initiation and isolation of these events.

16. Section 7.1 NEI 00-04 states that the safety significance of a system function is determined by the highest RAW or the highest FV of the SSCs in the flow path that are modeled in the PRA. The staff notes that the safety-significance of functions derived from the proposed process requires a different definition than the safety-significance of individual SSCs derived from the RAW and FV values. The safety-significance of an SSC derived from the RAW and the FV values reflect the increase in risk associated with a failure of that SSC and the fraction of the CDF or LERF to which the failure of the SSC contributes, respectively. An analogous system function safety significance would reflect the increase in risk associated with a failure of that system function and the fraction of risk to which the failure the system function contributes. Most system functions are, however, performed by two or more nominally independent trains and the failure of any one train will not lead to failure of the function. Failure of any individual SSC will, with 9

few exceptions, only fail one train and not the system function. The RAW and the FV associated with the failure of all system trains will be higher, and in most cases much higher, than those associated with individual SSC failures. Consequently, the safety-significance of functions derived from the PRA by this process is different and must be clearly differentiated from the safety-significance of individual SSCs. An explanation of the difference must be included in the training provided to the IDP.

The staff notes that the safety-significance of a CCF event that simultaneously fails nominally redundant trains in a system will generally provide a measure of system function safety-significance consistent with SSC safety-significance. Therefore, the RAW of CCF events must also be considered in this assessment Because of the potential confusion between a system safety function (e.g., high pressure injection from the high pressure injection system) and the train-level system safety function (e.g., high pressure injection from one high pressure injection train) there are a number of guidelines within the report that are ambiguous. For example, the discussion of the IDP process in this section includes several questions based on whether the failure of the SSC will fail a function. Until the NEI 00-04 guidance is further clarified, the definition of function that results in the highest safety-significance assignment for an SSC must be used.

17. Section 7.2 The second bullet on page 37 states that if the SSC is low based on the internal events, but potentially high because of external events, then the integral assessment should be relied on.

This is too strong a statement. The NRC concludes that though the IDP may raise a candidate LSS SSC to safety-significant, the IDP cannot lower a safety-significant SSC to LSS. If a SSC is determined to be safety-significant by any of the analyses supporting the risk-informed categorization process, including the appropriate sensitivity studies, then the SSC is safety-significant. Only through a thorough recategorization effort, which would involve going through the entire process and considerations at the same level of rigor and depth as the original categorization, can a SSC be recategorized lower than its initial categorization.

The third bullet states that if the SSC was found to be safety significant based on sensitivity studies, this should be communicated to the IDP, along with the base and integral significance for each hazard. The SSCs must be categorized according to the highest safety-significance determined in the categorization process, including these sensitivity studies and the results of any other pertinent considerations (e.g., defense-in-depth, shutdown risks, etc.).

The NRC staff notes that Figure 7-1 is overly simplistic and does not convey the proper level of detailed narrative expected in the documentation of categorization of SSCs. The NRC staff expects the final version of NEI 00-04 to contain a more detailed and comprehensive example of the risk-informed SSC assessment worksheet.

18. Section 8 The final step in the allocation of SSCs into the different RISC categories is to show that the reduction in treatment of RISC-3 SSCs will not result in a significant increase in risk. This is done by performing the risk sensitivity study based on increasing the failure probabilities of 10

those SSCs for which treatment is to be relaxed. This risk sensitivity study is a very important part of the categorization process. The choice of the factor to use to increase the failure probabilities of RISC-3 components must be based either on some reasonable expectation that it is bounding or that it is such that the change in unreliability it represents will be detected by the monitoring and corrective action program.

To develop a reasonable bounding estimate of the increase in failure probability, the licensee would need to assess the impact that a change in treatment as a result of removal of special treatment requirements might have on the reliability of SSCs. The result of this assessment would be a characterization of the potential impact, which could be qualitative or quantitative.

This characterization would need to address the relationship between the elements of treatment being relaxed and their role in maintaining defenses against failure or degradation from known mechanisms. There must be a documented evaluation that provides the development of the quantitative increase in failure probability from the characterization of the impact of the change in treatment. If it is not possible to quantitatively develop a reasonable estimate of the change in reliability, a justified conservative value may be used. The estimate of the change in reliability or the conservative value is used to form the basis for the risk sensitivity study that is performed to show that there is no more than a small net increase in risk associated with implementation of 10 CFR 50.69.

The values in NEI 00-04 of two to five are discussed in the document as representing the nominal range between the mean and the 95th percentile values in typical distributions used to characterize current failure rates. The uncertainty in the current failure rates has been developed from the observation of the current population of components (almost all of which are subjected to special treatment requirements) and are developed to characterize the current population. The staff notes that there is no justification provided that selecting the poor performers of the current population will bound the reliability of components after exemption of special treatment requirements.

One mechanism that could lead to large increases in CDF/LERF is extensive, across system common cause failures (CCFs). However, for such extensive CCFs to occur would require that the mechanisms that lead to failure, in the absence of treatment, were sufficiently rapidly developing or not self-revealing, such that there would be few opportunities for early detection and corrective action. Thus, when characterizing the effects of reduced treatment on SSC reliability, the applicant or licensee must consider potential effects of common-cause interaction susceptibility, including cross-system interactions, and potential impacts from known degradation mechanisms.

It is expected that those aspects of treatment that are necessary to prevent SSC degradation or failure from known mechanisms to the extent that the results of the sensitivity studies are invalidated will be identified by the licensee and such aspects of treatment will be retained. This will require an understanding of what the degradation mechanisms are and what elements of treatment are sufficient to prevent the degradation. As an example of how this would be implemented, the known existence of certain degradation mechanisms affecting pressure boundary SSC integrity might support retaining the current requirements on inspections or examinations or use of the risk-informed ASME Code Cases, as accepted by the NRC regulatory process. An alternative might be to relax certain elements of treatment, but retain those that were assessed to be the most effective in negating the degradation mechanisms.

11

As another example, changing levels of treatment on several similar components that might be sensitive to CCF potential would require consideration as to whether the planned monitoring and corrective action program, or other aspects of treatment, would be effective in sufficiently minimizing CCF potential such that the sensitivity studies remain bounding.

In summary, if this approach is adopted, the determination of the appropriate factor (or factors) to use in the risk sensitivity study must be determined in concert with the consideration of planned changes in treatment. As part of this evaluation, the NRC expects licensees to: (a) demonstrate an understanding of common cause effects and degradation mechanisms and their potential impact on RISC-3 SSCs; (b) demonstrate an understanding of the programmatic activities that provide defenses against CCFs and failures resulting from degradation; and (c) to factor this knowledge into both the treatment applied to and the reliability assumptions made for the RISC-3 SSCs.

An alternative approach is to set the increase in unreliability at such a level that the increase would be detected through the corrective action and feedback processes. When this approach is used, the licensee must develop, document, and submit a quantitative evaluation based on the current unreliability of the SSCs, the number of SSCs, the frequency of the opportunities to identify failures, and the monitoring and corrective action program that will identify the minimum increase in failure rates that can be detected through monitoring and the corrective action program.

When non-PRA studies are used to address certain risk contributors (e.g., seismic initiators or fires) this approach is not directly applicable. In this case, it is necessary for the licensee to provide an argument as to why the impact on CDF and LERF from adopting the non-PRA approach is not significant.

19. Section 9 Under the sub-heading Review of Safety Significant Functions, it is stated SSCs which have high failure probabilities (usually indicative of screening values) and meet the screening criteria solely on the basis of Fussell-Vesely importance may have been identified as candidate safety significant. There is no action associated with this statement. The NRC finds that an acceptable approach to dealing with the issue of SSCs categorized as safety significant solely on the basis of an artificially high failure probability is to first revise the model, if appropriate, to use the proper value and then to recategorize the SSC. Only through a thorough recategorization effort, which would involve going through the entire process and considerations at the same level of rigor and depth as the original categorization, can a SSC be recategorized lower than its initial categorization.

20. Section 9.2 Under the Review Defense-In-Depth Implications subsection, the NRC staff does not agree that low safety significance can be assigned if any one of the criteria listed is true. For the IDP qualitative evaluation to determine the impact of relaxing requirements on SSC reliability and performance, historical data must show that the failure mode is unlikely to occur and either the failure mode can be detected in a timely fashion or there is condition monitoring that provides a leading indicator. Further, the NRC staff interprets this evaluation and criteria to be applicable 12

to both subsections, Review of Risk Information and Review Defense-In-Depth Implications.

In addition to recommending staggered testing, inspection and/or calibration of equipment as strategies for reducing the potential for common cause failures and/or detection of failures, the licensee could take the strategy of not reducing treatment for those SSCs with the potential for common cause failures.

The IDP may want to use the following to check whether the SSC is reflected appropriately, and for SSCs not explicitly modeled, by considering whether the SSC has an impact on the plants capability to:

(i) Prevent or mitigate accident conditions, (ii) Reach and/or maintain safe shutdown conditions, (iii) Preserve the reactor coolant system pressure boundary integrity, (iv) Maintain containment integrity, or (v) Allow monitoring of post-accident conditions.

21. Section 10.2 For licensees that perform the optional step, Detailed Engineering Review of HSS Components, the same depth and rigor must be used in categorizing at the individual component level as was used for categorizing at the system functional level. Thus, if a SSC is determined by the categorization process to be safety significant then it cannot be recategorized LSS without re-performing the entire categorization process at the component level. However, if the component is not determined to be safety significant by the detailed component level categorization process, then the following factors must be considered in determining if the SSC can be categorized LSS in addition to the identified NEI 00-04 considerations:

 Safety function being satisfied by SSC operation

 Level of redundancy existing at the plant to fulfill the SSCs function

 Ability to recover from a failure of the SSC

 Performance history of the SSC

 Use of the SSC in the Emergency Operating Procedures or Severe Accident Management Guidelines Further, the licensee or applicant, through the IDP, must document the basis for the classification of an SSC based on the above considerations, including the development of a SSC level categorization worksheet similar to that developed for the system-level results in Section 7.

For SSCs not modeled explicitly in the PRA, the IDP could use the following guidance to determine if recategorization is warranted to determine if low safety significance is appropriate based on traditional engineering analyses and insights, operational experience, and information 13

from licensing basis documents and design basis accident analyses. The IDP could assess the safety significance of these SSCs by determining if:

(i) Failure of the SSC will significantly increase the frequency of an initiating event, including those initiating events originally screened out in the PRA.

(ii) Failure of the SSC will compromise the integrity of the reactor coolant pressure boundary. It is expected that a sufficiently robust categorization process would result in the reactor coolant pressure boundary being categorized as RISC-1.

(iii) Failure of the SSC will fail a safety significant function, including SSCs that are assumed to be inherently reliable in the PRA (e.g., piping and tanks) and those that may not be explicitly modeled (e.g., room cooling systems, and instrumentation and control systems). For example, it is expected for pressurized water reactors (PWRs) that a sufficiently robust categorization process would categorize high energy ASME Section III Class 2 piping of the main steam and feedwater systems as RISC-1.

(iv) The SSC supports important operator actions required to mitigate an accident, including the operator actions taken credit for in the PRA.

(v) Failure of the SSC will result in failure of safety significant SSCs (e.g., through spatial interactions or through functional reliance on another SSC).

(vi) Failure of the SSC will impact the plants capability to reach and/or maintain safe shutdown conditions.

(vii) The SSC is one of a redundant set that can be justifiably identified as a common cause failure group.

(viii) The SSC is a part of a system that acts as a barrier to fission product release during severe accidents. It is expected that a sufficiently robust categorization process would result in fission product barriers (e.g., the containment shell or liner) being categorized as safety significant.

(ix) The SSC is depended upon in the Emergency Operating Procedures or the Severe Accident Management Guidelines.

(x) Failure of the SSC will result in unintentional releases of radioactive material in excess of 10 CFR Part 100 guidelines even in the absence of severe accident conditions.

(xi) The SSC is relied upon to control or to mitigate the consequences of transients and accidents.

If none of the above eleven conditions is true, the IDP could use a qualitative evaluation process to determine the impact of relaxing requirements on SSC reliability and performance.

This evaluation includes identifying the functions being supported by operation of the SSC, the relationship between the SSCs failure modes and the functions being supported, the SSC failure modes for which the failure rate may increase, and the SSC failure modes for which 14

detection could become or are more difficult. The IDP could then justify low safety significance of the SSC by demonstrating the following:

 The reclassification is consistent with the defense-in-depth philosophy.

 Operating experience indicates that active degradation mechanisms (e.g., for piping flow accelerated corrosion or microbiologically-induced corrosion) for passive and active SSCs are not present, relaxing the treatment requirements will have minimal impact on SSC performance and reliability, and degradation in the ability of the SSC to perform its safety functions will be detected in a timely fashion

 Relaxing the requirements will have a minimal impact on the expected onsite occupational or offsite doses from transients and accidents that do not contribute to CDF or LERF.

The specific considerations that permit a LSS determination of an SSC in a safety-significant functional flow path must not be limited to just active failure modes, but must consider all potential failure modes for the subject SSC.

The NRC staff does not generically endorse the examples provided under the specific considerations that permit a LSS determination of an SSC in a safety-significant functional flow path. The specific conditions and criteria must be justified and documented for the specific SSCs under consideration. For example, a 1-inch diameter line off a small diameter pipe might create a large enough diversion path that would impair the system from meeting its safety-significant function. Thus, such a criteria would not be appropriate in determining that the SSC is LSS.

22. Sections 11.1 and 11.2 This section discusses the expansion of the licensees design/configuration change control process to provide reasonable assurance that the safety-significant beyond design basis functions under 10 CFR 50.69 will be satisfied following a facility change. The NRC staff agrees with the need for the licensees implementing 10 CFR 50.69 to expand their design/configuration change control process, as above, but also requires that this expansion include an evaluation to ensure that the categorized SSCs, considering both their design basis and beyond design basis functions, also are maintained within the assumptions of the categorization process (i.e., reliability of LSS SSCs is maintained within the potential reduction in reliability assumed in the risk sensitivity study of Section 8 of NEI 00-04 and the reliability of safety-significant SSCs is maintained in accordance with their reliability assumed in the analysis) and must encompass more than just the PRA, but also must address the deterministic, traditional engineering (e.g., defense-in-depth), non-PRA type analyses (e.g.,

seismic margins), and operating modes considerations (e.g., shutdown) of the SSC categorizations under 10 CFR 50.69.

23. Section 11.2 NEI 00-04 states that licensees will commit to updating their PRA based on the ASME PRA Standard. As stated in (draft) 10 CFR 50.69, in a timely manner and no later than every 36 15

months, the licensee must review changes to the plant, operational practices, applicable industry operational experience, and as appropriate, update their PRA and SSC categorization.

NEI 00-04 states that changes to NRC commitments associated with any RISC SSC category should be controlled through NEI 99-04, Revision 1. Since this revision has not been reviewed by the NRC, the statements in NEI 00-04 are not to be taken to be an endorsement of this document by NRC. A licensee must, as part of its submittal requesting to implement 10 CFR 50.69, identify under what conditions they would notify the NRC of changes in RISC SSC categorizations and/or resulting treatment.

24. Section 11.4 The NRC concludes that the categorization process implemented via NEI 00-04 must include a provision that provides assurance that future changes in the SSC categorization caused by PRA model changes or other new information will continue to meet the risk acceptance guidelines in RG 1.174 based on a comparison between the new proposed risk-informed program and the original, deterministic special treatment requirements. Thus, the model used in the risk sensitivity study of Chapter 8 must be verified to be representative of the as-built, as-operated plant and the results of this study verified to be acceptable when compared to the RG 1.174 acceptance guidelines when the PRA model is changed or other new information is made available. This provision must be incorporated into the licensees corrective action and/or feedback processes implemented to comply with 10 CFR 50.69.

NEI 00-04 states that a multi-disciplined station management review committee could take the place of the IDP to make the final determination on changes in SSC categorization after the completion of the categorization of all scheduled SSCs. The NRC staff does not agree with this allowance. Since the IDP is established to provide the full and balanced expertise in determining the final categorization of the SSCs that a licensee categorizes under 10 CFR 50.69, any proposed changes in SSC categories must also be reviewed and accepted by the IDP at the same level of rigor and depth applied to their initial categorization under 10 CFR 50.69.

25. Section 12 The documentation retention time suggested in NEI 00-04 is 5 years after completion of the categorization process or until the plant-specific PRA and, if necessary, SSC categorization is updated. Since this documentation provides the documentation of the methodology and results of the implementation of 10 CFR 50.69 in categorizing SSCs, may be phased in over many years, and may be re-initiated after some period of time after initially completing the process for some selected SSCs, the NRC concludes that this documentation must be retained for the life of the plant.

26. Section 13 The assessment of the impact of later SSC categorizations must encompass more than just the PRA results; this assessment must also address the potential impacts on the deterministic, traditional engineering (e.g., defense-in-depth), non-PRA type analyses (e.g., seismic margins),

and operating modes considerations (e.g., shutdown) of prior SSC categorizations. Further, 16

any proposed changes in prior SSC categorizations must be documented, provided to the IDP, and determined to be appropriate by the IDP before recategorizing the SSC. This is not intended to obviate the need for the licensee to properly implement their corrective action program.

NEI 00-04 identifies a number of reviews that are to be performed following revisions or updates to the PRA as part of a review of the SSC categorization. The NRC believes that the review of the updated PRA must include an independent review of the PRA update to ensure that it properly reflects the as-built, as-operated plant. In addition, the results of the risk sensitivity study of Chapter 8 must be confirmed to still be acceptable.

27. Appendix B This appendix provides an outline/example of the information to be provided to the NRC for those licensees implementing 10 CFR 50.69. Based on the resolution of other comments presented above, some aspects of this outline may need to be further enhanced or expanded.

Therefore, at this time, the NRC staff cannot endorse that this outline contains the requisite level of information to satisfy the requirements of 10 CFR 50.69. Licensee submittals will be evaluated on a plant-specific basis to ensure that they properly implement the categorization process requirements of 10 CFR 50.69.

17