ML041450405: Difference between revisions

From kanterella
Jump to navigation Jump to search
(Created page by program invented by StriderTol)
 
(StriderTol Bot change)
 
(2 intermediate revisions by the same user not shown)
Line 3: Line 3:
| issue date = 05/24/2004
| issue date = 05/24/2004
| title = Nuclear Regulatory Commission (NRC) Comments on the Final Draft of NEI 00-04, 10 CFR 50.69 SSC Categorization Guidance Dated April 2004
| title = Nuclear Regulatory Commission (NRC) Comments on the Final Draft of NEI 00-04, 10 CFR 50.69 SSC Categorization Guidance Dated April 2004
| author name = Black S C
| author name = Black S
| author affiliation = NRC/NRR/DSSA
| author affiliation = NRC/NRR/DSSA
| addressee name = Pietrangelo A R
| addressee name = Pietrangelo A
| addressee affiliation = Nuclear Energy Institute (NEI)
| addressee affiliation = Nuclear Energy Institute (NEI)
| docket =  
| docket =  
| license number =  
| license number =  
| contact person = Harrison D G, 415-3587, NRR/DSSA/SPSB
| contact person = Harrison D, 415-3587, NRR/DSSA/SPSB
| document type = Letter
| document type = Letter
| page count = 12
| page count = 12
Line 15: Line 15:


=Text=
=Text=
{{#Wiki_filter:May 24, 2004Mr. Anthony R. Pietrangelo, Senior DirectorRisk Regulation Nuclear Energy Institute Suite 400 1771 I Street Washington DC 20006-3708
{{#Wiki_filter:May 24, 2004 Mr. Anthony R. Pietrangelo, Senior Director Risk Regulation Nuclear Energy Institute Suite 400 1771 I Street Washington DC 20006-3708


==SUBJECT:==
==SUBJECT:==
NUCLEAR REGULATORY COMMISSION (NRC) COMMENTS ON THEFINAL DRAFT OF NEI 00-04, "10 CFR 50.69 SSC CATEGORIZATION GUIDANCE" DATED APRIL 2004
NUCLEAR REGULATORY COMMISSION (NRC) COMMENTS ON THE FINAL DRAFT OF NEI 00-04, 10 CFR 50.69 SSC CATEGORIZATION GUIDANCE DATED APRIL 2004


==Dear Mr. Pietrangelo:==
==Dear Mr. Pietrangelo:==


By letter dated April 14, 2004, (ML041120208), the Nuclear Energy Institute (NEI), submitted tothe NRC the Final Draft of NEI 00-04. The NRC is using this document as the basis for preparation of a regulatory guide (RG 1.201), entitled "Guidelines for Categorizing Structures, Systems and Components in Nuclear Power Plants According to Their Safety Significance," in support of the final rulemaking package for 10 CFR 50.69.Enclosed with this letter are NRC comments on this draft of NEI 00-04. It is our intention towork with you over the next several weeks in resolving these comments prior to issuance of the final rule at the end of June 2004. The NRC also intends to continue to work with you during pilot applications of 10 CFR 50.69 to further improve NEI 00-04 and RG 1.201.Questions about this letter should be directed to Donald Harrison (301-415-3587).Sincerely,/RA/Suzanne C. Black, DirectorDivision of Systems Safety and Analysis Office of Nuclear Reactor Regulation
By letter dated April 14, 2004, (ML041120208), the Nuclear Energy Institute (NEI), submitted to the NRC the Final Draft of NEI 00-04. The NRC is using this document as the basis for preparation of a regulatory guide (RG 1.201), entitled Guidelines for Categorizing Structures, Systems and Components in Nuclear Power Plants According to Their Safety Significance, in support of the final rulemaking package for 10 CFR 50.69.
Enclosed with this letter are NRC comments on this draft of NEI 00-04. It is our intention to work with you over the next several weeks in resolving these comments prior to issuance of the final rule at the end of June 2004. The NRC also intends to continue to work with you during pilot applications of 10 CFR 50.69 to further improve NEI 00-04 and RG 1.201.
Questions about this letter should be directed to Donald Harrison (301-415-3587).
Sincerely,
                                              /RA/
Suzanne C. Black, Director Division of Systems Safety and Analysis Office of Nuclear Reactor Regulation


==Enclosure:==
==Enclosure:==
As stated May 24, 2004Mr. Anthony R. Pietrangelo, Senior DirectorRisk Regulation Nuclear Energy Institute Suite 400 1771 I Street Washington DC 20006-3708
As stated
 
May 24, 2004 Mr. Anthony R. Pietrangelo, Senior Director Risk Regulation Nuclear Energy Institute Suite 400 1771 I Street Washington DC 20006-3708


==SUBJECT:==
==SUBJECT:==
NUCLEAR REGULATORY COMMISSION (NRC) COMMENTS ON THEFINAL DRAFT OF NEI 00-04, "10 CFR 50.69 SSC CATEGORIZATIONGUIDANCE" DATED APRIL 2004
NUCLEAR REGULATORY COMMISSION (NRC) COMMENTS ON THE FINAL DRAFT OF NEI 00-04, 10 CFR 50.69 SSC CATEGORIZATION GUIDANCE DATED APRIL 2004


==Dear Mr. Pietrangelo:==
==Dear Mr. Pietrangelo:==


By letter dated April 14, 2004, (ML041120208), the Nuclear Energy Institute (NEI), submitted tothe NRC the Final Draft of NEI 00-04. The NRC is using this document as the basis for preparation of a regulatory guide (RG 1.201), entitled "Guidelines for Categorizing Structures,Systems and Components in Nuclear Power Plants According to Their Safety Significance," insupport of the final rulemaking package for 10 CFR 50.69.Enclosed with this letter are NRC comments on this draft of NEI 00-04. It is our intention towork with you over the next several weeks in resolving these comments prior to issuance of the final rule at the end of June 2004. The NRC also intends to continue to work with you during pilot applications of 10 CFR 50.69 to further improve NEI 00-04 and RG 1.201.Questions about this letter should be directed to Donald Harrison (301-415-3587).
By letter dated April 14, 2004, (ML041120208), the Nuclear Energy Institute (NEI), submitted to the NRC the Final Draft of NEI 00-04. The NRC is using this document as the basis for preparation of a regulatory guide (RG 1.201), entitled Guidelines for Categorizing Structures, Systems and Components in Nuclear Power Plants According to Their Safety Significance, in support of the final rulemaking package for 10 CFR 50.69.
Sincerely,   /RA/Suzanne C. Black, Director Division of Systems Safety and Analysis Office of Nuclear Reactor Regulation
Enclosed with this letter are NRC comments on this draft of NEI 00-04. It is our intention to work with you over the next several weeks in resolving these comments prior to issuance of the final rule at the end of June 2004. The NRC also intends to continue to work with you during pilot applications of 10 CFR 50.69 to further improve NEI 00-04 and RG 1.201.
Questions about this letter should be directed to Donald Harrison (301-415-3587).
Sincerely,
  /RA/
Suzanne C. Black, Director Division of Systems Safety and Analysis Office of Nuclear Reactor Regulation


==Enclosure:==
==Enclosure:==
As statedDISTRIBUTION:T. ReedE. McKennaM. RubinM. TschiltzM. JohnsonD. HarrisonADAMS Accession# ML041450405Document name: C:\ORPCheckout\FileNET\ML041450405.wpdNRR-106OFFICESPSBSC:SPSBBC:SPSB:DSSADD:DSSANAMEDGHarrison:nxh2MPRubinMDTschiltzSCBlackDATE05/ 20 /0405/20 /0405/21 /0405/ 24 /04OFFICIAL RECORD COPY ATTACHMENTNRC Comments RegardingNEI 00-04 (DRAFT - Final Draft), "10 CFR 50.69 SSC Categorization Guideline"April 2004General Comments1.Other Documents Referenced in the Final Draft of NEI 00-04The Final Draft of NEI 00-04 references numerous other documents, but NRC
As stated DISTRIBUTION:       T. Reed E. McKenna      M. Rubin      M. Tschiltz    M. Johnson D. Harrison ADAMS Accession# ML041450405 Document name: C:\ORPCheckout\FileNET\ML041450405.wpd              NRR-106 OFFICE        SPSB              SC:SPSB          BC:SPSB:DSSA            DD:DSSA NAME      DGHarrison:nxh2        MPRubin              MDTschiltz            SCBlack DATE          05/ 20 /04          05/20 /04            05/21 /04            05/ 24 /04 OFFICIAL RECORD COPY
's endorsement ofthe Final Draft of NEI 00-04 is not an endorsement of these other referenced documents.2.Use of Examples in the Final Draft of NEI 00-04The Final Draft of NEI 00-04 includes examples to supplement the guidance. While appropriatefor illustrating and reinforcing the guidance in the Final Draft of NEI 00-04, the NRC
'sendorsement of the Final Draft of NEI 00-04 is not a determination that the examples are applicable for all licensees. A licensee must ensure that an example is applicable to its particular circumstances before implementing the guidance as described in the example.3.Use of Methods Other Than the Final Draft of NEI 00-04To meet the requirements of
§ 50.69 for categorization of SSCs, licensees may use methodsother than those set forth in the Final Draft of NEI 00-04. The NRC will determine the acceptability of these other methods by evaluating them against the
§ 50.69 rule requirements. 4.Limitations of Types of Analyses Used in Implementing the Final Draft of NEI 00-04In its 1995 Policy Statement on the use of probabilistic risk assessment (PRA), the Commissiondetermined that the use of PRA technology should be increased in all regulatory matters to the extent supported by state-of-the-art PRA methods and data. Implementation of risk-informed regulation is possible because the development and use of a quantitative PRA requires a systematic and integrated evaluation. Development of a technically defensible quantitative PRA also requires sufficient and structured documentation to allow investigations of all aspects of the evaluation. To meet the requirements of
§ 50.69 for categorization of SSCs, licensees mustuse risk evaluations and insights that cover the full spectrum of potential events (i.e., internal and external initiating events) and the range of plant operating modes (i.e., full power, low power, and shutdown operations). The NRC staff believes that current state-of-the-art PRA methods are available to quantitatively address the full spectrum of potential events and the full range of plant operating modes for this type of application. However, the Final Draft of NEI 00-04 allows the use of non-PRA type evaluations (e.g., FIVE, seismic margins analysis, NUMARC 91-06), when PRAs have not been performed, which will result in more conservative categorization in that special treatment requirements will not be allowed to be relaxed from SSCs relied upon in the non-PRA type evaluations. It should be recognized that the degree of relief (i.e., SSCs subject to relaxation of special treatment requirements) that the NRC will accept under 10 CFR 50.69 will be commensurate with the assurance provided by the evaluation. 5.Technical Adequacy Attributes of Analyses Implementing the Final Draft of NEI 00-04The peer review process described in NEI 00-02, as amended to incorporate NRC commentsprovided in the NRC letter to NEI, dated April 2, 2002, and as endorsed in RG 1.200, provides a mechanism for licensees to determine if their internal events PRA meets the attributes required for this application. An alternative to NEI 00-02 is the ASME Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, as amended to incorporate NRC comments and as endorsed in RG 1.200. Both NEI 00-02 and the ASME Standard are endorsed for trial use by the NRC in RG 1.200, with appropriate clarifications and exceptions. These documents currently cover only internal events at full power. There is not currently a similarly endorsed standard for the external events PRA and non-PRA type analyses (e.g., FIVE, seismic margins analysis, NUMARC 91-06) and there is limited guidance provided in Section 3.3 of the Final Draft of NEI 00-04 for determining the technical adequacy attributes required for these types of analyses for this specific application. Industry standards have been or are being prepared for external events (seismic, high winds, and other external events), fire, and low power and shutdown PRAs. Therefore, the NRC staff expects that the applicant or licensee will prepare arguments for why the method employed is adequate to perform the analysis required to support the categorization of SSCs. Applicants or licensees will have to provide arguments supporting the technical adequacy of the external events, other operating modes, and non-PRA type analyses for each plant-specific submittal requesting to implement
§ 50.69. As standardsare developed by the industry and endorsed by the NRC via revisions to RG 1.200 for external events, fires, and low power and shutdown, the NRC expects applicants or licensees to use these standards to demonstrate the technical adequacy of the PRAs addressing these events and operating modes.6.Uncertainty Considerations in the Final Draft of NEI 00-04The NRC staff notes that the Final Draft of NEI 00-04 does not address modeling or datauncertainties explicitly. However, the sensitivity studies performed to support the categorization of SSCs are intended to address some of the major sources of uncertainty (i.e., human error probabilities, common cause failure probabilities, and those items identified during the assessment of PRA technical adequacy). When assessing the potential increase in core damage frequency (CDF) and large early release frequency (LERF) as a result of implementing
 
§ 50.69, the applicant or licensee must address uncertainties consistent with Section 2.2.5 ofRegulatory Guide 1.174.7.Common Cause Failure and Degradation Mechanism Considerations in the FinalDraft of NEI 00-04Mechanisms that could lead to large increases in CDF and LERF are extensive, across systemcommon cause failures (CCFs) and unmitigated degradation. However, for such extensive impacts to occur would require that the mechanisms that lead to failure, in the absence of treatment, were sufficiently rapidly developing or not self-revealing, such that there would be few opportunities for early detection and corrective action. Those aspects of treatment that are necessary to prevent SSC degradation or failure fromknown mechanisms, to the extent that the results of the sensitivity studies are invalidated, should be identified by the applicant or licensee and such aspects of treatment retained. This will require an understanding of what the degradation mechanisms are and what elements of treatment are sufficient to prevent the degradation. As an example of how this would be implemented, the known existence of certain degradation mechanisms affecting pressure boundary SSC integrity would support retaining the current requirements on inspections or examinations or use of the risk-informed ASME Code Cases, as accepted by the NRC regulatory process. As another example, changing levels of treatment on several similar components that might be sensitive to CCF potential would require consideration as to whether the planned monitoring and corrective action program, or other aspects of treatment, would be effective in sufficiently minimizing CCF potential such that the risk sensitivity study results remain valid (i.e., bounding).The appropriate factor to use in the risk sensitivity study to represent the potential reduction inreliability due to the relaxation of special treatment requirements should be determined in concert with the consideration of the potential for (and retained defenses against) cross-system common cause failures and known degradation mechanisms. As part of this determination, the NRC expects licensees to:  (a) demonstrate an understanding of common cause effects and known degradation mechanisms and their potential impact on RISC-3 SSCs; (b) demonstrate an understanding of the programmatic activities that provide defenses against CCFs and failures resulting from known degradation; and (c) to factor this knowledge into both the treatment applied to and the factors used for the RISC-3 SSCs.In addition, the factor used in adjusting the unreliability of RISC-3 SSCs in the risk sensitivitystudy should be set at a level such that an actual increase in unreliability of a RISC-3 SSC would be detected and corrected through the monitoring, corrective action, and feedback processes. The licensee must develop and document an evaluation based on the current unreliability of the SSCs, the number of SSCs, the frequency of the opportunities to identify failures, and the monitoring and corrective action program that will identify the minimum increase in failure rates that can be detected through the monitoring and corrective action program.Specific Comments Section 1The first paragraph (p.1) references Appendix B of NEI 00-04 as an example of a submittal, butthis appendix has been deleted as a result of NRC comments on an earlier draft of NEI 00-04.
Appendix B provided an outline/example of the information to be provided to the NRC for thoseapplicants or licensees implementing
§ 50.69. It is envisioned that a "template" may be createdfor submittals under
§ 50.69, however, at this time a template has not been developed orendorsed by the staff. Thus, applications to implement
§ 50.69 will be evaluated on a plant-specific basis to ensure that they properly implement the categorization process requirements of § 50.69. The first paragraph (p.1) also states that implementation of
§ 50.69 in accordance with the FinalDraft of NEI 00-04 guidelines should involve minimal NRC review. Though the endorsement of  the Final Draft of NEI 00-04 in this regulatory guide will enable an applicant or licensee to havemore assurance that the NRC will find their application acceptable, as opposed to a licensee  developing their own approach, it is incorrect to characterize the NRC review of the applicationsubmitted per
§ 50.69(b)(2)(i) as "minimal."  The NRC will perform an appropriately thoroughreview of each application submitted under
§ 50.69.Section 1.2 et alThe second paragraph of this section (p.3) discusses a third set of equipment referred to as "important-to-safety
" and its relation to safety-related and nonsafety-related equipment. Thisusage is incorrect. Endorsement of this guidance is not an endorsement of this usage of the phrase "important-to-safety
". Though incorrect, in the context of this guidance, the NRC staffinterprets the intent of the usage of this phrase to refer to nonsafety-related SSCs that have been determined to be important. These nonsafety-related SSCs will be categorized as either RISC-2 or RISC-4 as determined by their safety significance per the
§ 50.69 categorizationprocess.The fourth paragraph of this section (p.3) states that the integrated decision-making process
"...blends risk insights, new technical information and operational feedback...
"  The NRC staffinterprets this phrase, and similar such phrases (e.g., Section 1.3 third guiding principle), as meaning that the integrated decision-making process must systematically consider the quantitative and qualitative information available regarding the various modes of plant operation and initiating events, including PRA, quantitative risk results and insights (e.g., CDF, LERF, and importance measures); deterministic, traditional engineering factors and insights (e.g., defense-in-depth, safety margins, containment integrity); and any other pertinent information (e.g.,
industry and plant-specific operational and performance experience, feedback, and corrective actions program) in the categorization of the SSCs.Section 1.3On page 4, the second guiding principle states that deterministic or qualitative informationshould be used if no PRA information exists related to a particular hazard or operating mode.
This principle is not to be interpreted to mean that deterministic or qualitative information should be used only when no PRA information exists. The NRC believes that the integrated decision-making process must systematically consider the quantitative and qualitative information available regarding the various modes of operation and initiating events, including:  PRA, quantitative risk results and insights; deterministic, traditional engineering factors and insights; and any other pertinent information in the categorization of the SSCs.The sixth guiding principle indicates that the attribute(s) that make an SSC safety-significantshould be documented. This is done to ensure that the treatment applied to the SSC is consistent with the safety-significance cause determined in the categorization process. While the NRC staff agrees that the safety-significant attribute(s) need to be documented, the applicant or licensee must also document the justification for SSCs determined to be LSS. In other words, documentation must be available and maintained by the applicant or licensee supporting the categorization of every SSC addressed under
§ 50.69. This is consistent withthe discussion in Section 11.1 of the Final Draft of NEI 00-04.
1NEI 00-04 uses the terminology "high safety significant (HSS)
" to refer to SSCs thatperform safety significant functions. The NRC understands HSS to have the same meaning as


"safety significant
NRC Comments Regarding NEI 00-04 (DRAFT - Final Draft), 10 CFR 50.69 SSC Categorization Guideline April 2004 General Comments
" (i.e., SSCs that are categorized as RISC-1 or RISC-2) as used in
: 1. Other Documents Referenced in the Final Draft of NEI 00-04 The Final Draft of NEI 00-04 references numerous other documents, but NRCs endorsement of the Final Draft of NEI 00-04 is not an endorsement of these other referenced documents.
§ 50.69. Section 1.4The first paragraph (p.4) states that "US nuclear generating plants have attained andmaintained an outstanding safety performance record.
: 2. Use of Examples in the Final Draft of NEI 00-04 The Final Draft of NEI 00-04 includes examples to supplement the guidance. While appropriate for illustrating and reinforcing the guidance in the Final Draft of NEI 00-04, the NRCs endorsement of the Final Draft of NEI 00-04 is not a determination that the examples are applicable for all licensees. A licensee must ensure that an example is applicable to its particular circumstances before implementing the guidance as described in the example.
"  While the NRC does not disagree withthis statement, endorsement of this guidance is not an endorsement of this statement. The third paragraph of this section (p.5) states that the applicant or licensee can determine theappropriate set of equipment to re-categorize under
: 3. Use of Methods Other Than the Final Draft of NEI 00-04 To meet the requirements of § 50.69 for categorization of SSCs, licensees may use methods other than those set forth in the Final Draft of NEI 00-04. The NRC will determine the acceptability of these other methods by evaluating them against the § 50.69 rule requirements.
§ 50.69. The NRC staff agrees thatcategorization under
: 4. Limitations of Types of Analyses Used in Implementing the Final Draft of NEI 00-04 In its 1995 Policy Statement on the use of probabilistic risk assessment (PRA), the Commission determined that the use of PRA technology should be increased in all regulatory matters to the extent supported by state-of-the-art PRA methods and data. Implementation of risk-informed regulation is possible because the development and use of a quantitative PRA requires a systematic and integrated evaluation. Development of a technically defensible quantitative PRA also requires sufficient and structured documentation to allow investigations of all aspects of the evaluation. To meet the requirements of § 50.69 for categorization of SSCs, licensees must use risk evaluations and insights that cover the full spectrum of potential events (i.e., internal and external initiating events) and the range of plant operating modes (i.e., full power, low power, and shutdown operations). The NRC staff believes that current state-of-the-art PRA methods are available to quantitatively address the full spectrum of potential events and the full range of plant operating modes for this type of application. However, the Final Draft of NEI 00-04 allows the use of non-PRA type evaluations (e.g., FIVE, seismic margins analysis, NUMARC 91-06), when PRAs have not been performed, which will result in more conservative categorization in that special treatment requirements will not be allowed to be relaxed from SSCs relied upon in the non-PRA type evaluations. It should be recognized that the degree of relief (i.e., SSCs subject to relaxation of special treatment requirements) that the NRC will accept under 10 CFR 50.69 will be commensurate with the assurance provided by the evaluation.
§ 50.69 can be partially implemented by an applicant or licensee and theimplementation can be phased in over a period of time. However, since the categorization process described in
ATTACHMENT
§ 50.69 and in NEI 00-04 is primarily based on system/structure functions,the categorization process must be implemented for an entire system/structure; not selected components within a system. Section 50.69(c)(1)(v) requires this categorization for entire systems/structures. The primary reason that
: 5. Technical Adequacy Attributes of Analyses Implementing the Final Draft of NEI 00-04 The peer review process described in NEI 00-02, as amended to incorporate NRC comments provided in the NRC letter to NEI, dated April 2, 2002, and as endorsed in RG 1.200, provides a mechanism for licensees to determine if their internal events PRA meets the attributes required for this application. An alternative to NEI 00-02 is the ASME Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, as amended to incorporate NRC comments and as endorsed in RG 1.200. Both NEI 00-02 and the ASME Standard are endorsed for trial use by the NRC in RG 1.200, with appropriate clarifications and exceptions. These documents currently cover only internal events at full power. There is not currently a similarly endorsed standard for the external events PRA and non-PRA type analyses (e.g., FIVE, seismic margins analysis, NUMARC 91-06) and there is limited guidance provided in Section 3.3 of the Final Draft of NEI 00-04 for determining the technical adequacy attributes required for these types of analyses for this specific application. Industry standards have been or are being prepared for external events (seismic, high winds, and other external events), fire, and low power and shutdown PRAs. Therefore, the NRC staff expects that the applicant or licensee will prepare arguments for why the method employed is adequate to perform the analysis required to support the categorization of SSCs. Applicants or licensees will have to provide arguments supporting the technical adequacy of the external events, other operating modes, and non-PRA type analyses for each plant-specific submittal requesting to implement § 50.69. As standards are developed by the industry and endorsed by the NRC via revisions to RG 1.200 for external events, fires, and low power and shutdown, the NRC expects applicants or licensees to use these standards to demonstrate the technical adequacy of the PRAs addressing these events and operating modes.
§ 50.69 requires the categorization to beperformed for entire systems and structures is to ensure that all the functions (which are primarily a system-level attribute) for a given SSC within a given system or structure are appropriately considered for each SSC in determining its safety significance. The system boundary definitions should be consistent with the PRA used in categorizing the SSCs and careful consideration should be given by the licensee to ensure all important functions are captured for SSCs, especially those that are common to multiple systems (e.g., tank discharge valve that feeds to multiple systems). The methodology for determining systems boundaries is left to the licensee recognizing these important constraints (i.e., drawing system boundaries in such a way as to break apart a system when viewed from a system functional standpoint would not meet this requirement).Section 1.5In the first paragraph (p.5) it is stated that the IDP cannot re-categorize an SSC identified ashigh safety significant (HSS) 1 by the plant-specific risk analysis. This could be interpreted toconflict with the allowance to use the integrated importance assessment. To avoid confusion, and consistent with Figure 1-2, the NRC interprets this statement in this context as meaning the IDP cannot re-categorize an SSC that is identified as HSS as an outcome of the risk characterization portion of the process, which includes the assessments from the plant-specific probabilistic risk analyses (PRAs) of internal events, external events, and non-power operations and the integrated importance assessment.A major part of the rationale for the integrated assessment is to address the potentialconservatisms that are more typical in the PRAs for the external events and non-power operations. It is possible that an SSC that is not significant for external events and non-power operations, but is for internal events, could be determined in the integrated assessment to not be significant due to the high CDF or LERF estimates from the conservative analyses. To avoid the conservative PRA approaches from masking the significance of an SSC from the more  realistic internal events PRA, SSCs identified as HSS by the internal events assessment shouldbe retained as HSS and not be allowed to be re-categorized by the IDP, even if the integrated assessment indicates a potentially lower significance.For example, if an SSC is determined by a PRA approach to be HSS for seismic, but isdetermined to be low safety significant (LSS) for all other events and operating modes, and seismic events are such a small contributor to total risk that the integrated assessment indicates the SSC is LSS, then all this information, including the results of the individual sensitivity studies, is provided to the IDP and the IDP can determine and document the final categorization for the SSC. A part of the IDP considerations in making the final categorization determinations should include the relative conservatisms in the analyses that support the various significance determinations. However, if an SSC is determined to be HSS from the internal events assessment, but is determined to be LSS for all other events and operating modes, and due to the conservative nature of the other analyses the internal events is a small contributor to total risk such that the integrated assessment indicates the SSC is LSS, then the SSC should still be designated to be HSS due to the internal events analyses and IDP will not be allowed to re-categorize the SSC.In the second paragraph (p.5) it is stated that the IDP cannot re-categorize an SSC identified asHSS by the plant-specific risk analysis, but the context of this paragraph is the defense-in-depth characterization portion of the process; not the risk characterization portion. Consistent with Figure 1-2, the NRC interprets this statement in this context as meaning the IDP cannot re-categorize an SSC that is identified as HSS as an outcome of the defense-in-depth characterization portion of the process.Section 1.5, Section 5, & Section 5.3The NRC notes that there are numerous SSCs that are not explicitly modeled in a seismic PRA,but are screened out due to their designed seismic robustness. Many of these SSCs are inherently safety significant for seismic events. In addition to using the results of a seismic PRA in determining the significance of an SSC for seismic events, the applicant or licensee should either designate those SSCs that were screened out of the PRA due to their seismic robustness as safety significant or establish the robustness (i.e., seismic capacity) of these SSCs as a design aspect if any screened out SSC is designated as LSS. This information should also be provided to the IDP for consideration in determining the final categorization of the SSC.Section 3.3On page 20, for the full power internal events PRA, in addition to providing a high levelsummary of the results of the peer review, the applicant or licensee should provide a summary of the findings of the self-assessment performed per RG 1.200.Section 5The first decision block in Figure 5-1 (p.26) refers to prevention or mitigation of core damage. This phrase could be misunderstood to not include important safety considerations related to containment performance or releases (i.e., LERF). To be consistent with the intent of the safety  significance categorization process and the associated text in Section 5, this first decision blockshould be understood to include the prevention or mitigation of severe accidents.Section 5.1In the discussion of the Internal Event Assessment (pp. 29-34), the NEI guidance states thatthe safety significant attributes are identified by the component failure mode that contributes significantly to the importance of the SSC. It should be recognized that there may be multiple component failure modes that contribute significantly to the importance of an SSC; especially if no individual failure mode alone exceeds the screening criteria, but a number of failure modes collectively exceed the screening criteria. In these cases, the guidance should not be inferred to limit the identification of safety significant attributes based on a single highest contributing failure mode, but should include all significantly contributing failure modes.Section 5.4 (& Section 1.5)Figure 5-6 (p.40) addresses approaches that rely on the identification of safe shutdown paths. However, if the evaluation of an external event is performed using a screening approach, then the logic presented in Figure 5-4 would be more appropriate than the current Figure 5-6. In this approach, if an SSC participates in an unscreened scenario or is credited in the screening of the scenario (i.e., failure to credit the SSC would result in the scenario being unscreened), then that SSC would be considered safety significant. The evaluation of other external events needs to recognize the different approaches and implement the proper logic for the specific approach.Section 6.2In this section (p.47), the guidance presents containment isolation criteria to support theassessment of defense-in-depth. The NRC notes that 10 CFR 50.69(b)(1)(x) establishes the governing criteria for which containment isolation valves and penetrations are within the scope of 10 CFR 50.69. The NRC believes that the first criteria listed for containment bypass (p.47) needs to alsoinclude mitigation of an ISLOCA event as well as the initiation and isolation of these events.
: 6. Uncertainty Considerations in the Final Draft of NEI 00-04 The NRC staff notes that the Final Draft of NEI 00-04 does not address modeling or data uncertainties explicitly. However, the sensitivity studies performed to support the categorization of SSCs are intended to address some of the major sources of uncertainty (i.e., human error probabilities, common cause failure probabilities, and those items identified during the assessment of PRA technical adequacy). When assessing the potential increase in core damage frequency (CDF) and large early release frequency (LERF) as a result of implementing
This is especially true if an event tree/fault tree logic approach is utilized to address ISLOCA events.Section 7.2The second bullet of the second set of bullets on page 50 states that if the SSC is categorizedas low safety significant based on the internal events, but potentially high safety significant because of external events or shutdown risks, then the integral assessment should be relied upon. This may be misinterpreted to mean that the non-internal events results should be disregarded and not considered. All the information should be provided to the IDP for consideration, including the individual and integral assessment results; consistent with the example worksheet provided as Figure 7-2. Under these circumstances, if the integral assessment indicates that the SSC is candidate low safety significant, the IDP should consider those aspects that indicate the SSC is safety significant and then make a determination of the appropriate category and document its rationale. Section 8The factor used in the risk sensitivity study to represent the potential increase in unreliability ofRISC-3 SSCs due to relaxation of special treatment requirements must be set at a level such that an actual increase in unreliability of a RISC-3 SSC would be detected and corrected through the monitoring, corrective action, and feedback processes. The example for implementation (7 th paragraph in this section on page 53) is overly simplistic and technically notacceptable. An acceptable process would need to have a focused cause analysis when a RISC-3 SSC failed to determine if its failure was due to the reduction in treatment and/or an indication of a potential common cause failure or degradation mechanism. If there is indication that one of these factors is the cause of the failure, then the applicant or licensee should have a process for immediately expanding testing to similar SSCs to demonstrate their functionality and for entering a corrective action to the treatment and/or categorization processes. Likewise, if the expected number of failures, based on plant experience and reliability values used in the PRA, of a group of RISC-3 SSCs is exceeded over the evaluation interval, then a similar process should be implemented to determine the cause of the higher than expected failure rate and corrective action should be initiated to the treatment and/or categorization processes. The description of such an approach might more appropriately belong as a subsection of Chapter 11 or as its own chapter dealing with implementation (i.e., monitoring, detecting, corrective action, and feedback).Until a technically defensible approach is provided in a revision of the NEI 00-04 guidelines, theNRC will review the applicant
§ 50.69, the applicant or licensee must address uncertainties consistent with Section 2.2.5 of Regulatory Guide 1.174.
's or licensee
: 7. Common Cause Failure and Degradation Mechanism Considerations in the Final Draft of NEI 00-04 Mechanisms that could lead to large increases in CDF and LERF are extensive, across system common cause failures (CCFs) and unmitigated degradation. However, for such extensive impacts to occur would require that the mechanisms that lead to failure, in the absence of treatment, were sufficiently rapidly developing or not self-revealing, such that there would be few opportunities for early detection and corrective action.
's approach and process as part of the applicationrequesting to implement
Those aspects of treatment that are necessary to prevent SSC degradation or failure from known mechanisms, to the extent that the results of the sensitivity studies are invalidated, should be identified by the applicant or licensee and such aspects of treatment retained. This will require an understanding of what the degradation mechanisms are and what elements of treatment are sufficient to prevent the degradation. As an example of how this would be implemented, the known existence of certain degradation mechanisms affecting pressure boundary SSC integrity would support retaining the current requirements on inspections or examinations or use of the risk-informed ASME Code Cases, as accepted by the NRC regulatory process. As another example, changing levels of treatment on several similar components that might be sensitive to CCF potential would require consideration as to whether the planned monitoring and corrective action program, or other aspects of treatment, would be effective in sufficiently minimizing CCF potential such that the risk sensitivity study results remain valid (i.e., bounding).
§ 50.69. Thus, the applicant
The appropriate factor to use in the risk sensitivity study to represent the potential reduction in reliability due to the relaxation of special treatment requirements should be determined in concert with the consideration of the potential for (and retained defenses against) cross-system common cause failures and known degradation mechanisms. As part of this determination, the NRC expects licensees to: (a) demonstrate an understanding of common cause effects and known degradation mechanisms and their potential impact on RISC-3 SSCs; (b) demonstrate an understanding of the programmatic activities that provide defenses against CCFs and failures resulting from known degradation; and (c) to factor this knowledge into both the treatment applied to and the factors used for the RISC-3 SSCs.
's or licensee
In addition, the factor used in adjusting the unreliability of RISC-3 SSCs in the risk sensitivity study should be set at a level such that an actual increase in unreliability of a RISC-3 SSC would be detected and corrected through the monitoring, corrective action, and feedback processes. The licensee must develop and document an evaluation based on the current unreliability of the SSCs, the number of SSCs, the frequency of the opportunities to identify failures, and the monitoring and corrective action program that will identify the minimum increase in failure rates that can be detected through the monitoring and corrective action program.
's application will need todescribe their approach and process for monitoring, detecting, and correcting increases in unreliability of RISC-3 SSCs prior to reaching a level that could invalidate the categorization process results as required by 10 CFR 50.69(c)(1)(iv) and (e)(3).Section 9.2Under the review of risk information (pp. 57-58), the licensee
Specific Comments Section 1 The first paragraph (p.1) references Appendix B of NEI 00-04 as an example of a submittal, but this appendix has been deleted as a result of NRC comments on an earlier draft of NEI 00-04.
's or applicant
Appendix B provided an outline/example of the information to be provided to the NRC for those applicants or licensees implementing § 50.69. It is envisioned that a template may be created for submittals under § 50.69, however, at this time a template has not been developed or endorsed by the staff. Thus, applications to implement § 50.69 will be evaluated on a plant-specific basis to ensure that they properly implement the categorization process requirements of § 50.69.
's considerationsshould be supplemented with the following additional considerations: In the third bullet, the IDP should also consider spatial effects as well as direct, shouldspecifically consider the failure of the SSC on its safety significant function, and should not be limited to only those aspects not modeled in the PRA. Thus, the third bullet could be reworded as follows: 
The first paragraph (p.1) also states that implementation of § 50.69 in accordance with the Final Draft of NEI 00-04 guidelines should involve minimal NRC review. Though the endorsement of the Final Draft of NEI 00-04 in this regulatory guide will enable an applicant or licensee to have more assurance that the NRC will find their application acceptable, as opposed to a licensee developing their own approach, it is incorrect to characterize the NRC review of the application submitted per § 50.69(b)(2)(i) as minimal. The NRC will perform an appropriately thorough review of each application submitted under § 50.69.
"Failure of the SSC will not fail a safety significant function and failure of thefunction/SSC will not directly or indirectly (e.g., spatial effects) fail another safety significant function/SSC, including those that are assumed to be inherently reliable (e.g., piping and tanks) and those that may not be explicitly modeled in the PRA (e.g., room cooling systems and instrumentation and control systems).
Section 1.2 et al The second paragraph of this section (p.3) discusses a third set of equipment referred to as important-to-safety and its relation to safety-related and nonsafety-related equipment. This usage is incorrect. Endorsement of this guidance is not an endorsement of this usage of the phrase important-to-safety. Though incorrect, in the context of this guidance, the NRC staff interprets the intent of the usage of this phrase to refer to nonsafety-related SSCs that have been determined to be important. These nonsafety-related SSCs will be categorized as either RISC-2 or RISC-4 as determined by their safety significance per the § 50.69 categorization process.
"In the fourth bullet, the IDP should also consider functions/SSCs that are necessary forsignificant operator action required to mitigate accidents and transients, regardless if they are in the PRA or not. Thus, the fourth bullet could be reworded as follows: 
The fourth paragraph of this section (p.3) states that the integrated decision-making process
"The function/SSC is notnecessary for significant operator actions required to mitigate an accident and transient, including those credited in the PRA, including instrumentation and other equipment.
...blends risk insights, new technical information and operational feedback... The NRC staff interprets this phrase, and similar such phrases (e.g., Section 1.3 third guiding principle), as meaning that the integrated decision-making process must systematically consider the quantitative and qualitative information available regarding the various modes of plant operation and initiating events, including PRA, quantitative risk results and insights (e.g., CDF, LERF, and importance measures); deterministic, traditional engineering factors and insights (e.g., defense-in-depth, safety margins, containment integrity); and any other pertinent information (e.g.,
"  In the fifth bullet, the IDP should also consider functions/SSCs associated with monitoring post-accident conditions. Thus, the fourth bullet could be reworded as follows: 
industry and plant-specific operational and performance experience, feedback, and corrective actions program) in the categorization of the SSCs.
"The function/SSC isnot necessary for significant operator actions to assure long term containment integrity, monitoring post-accident conditions, or offsite emergency planning activities, including instrumentation and other equipment.
Section 1.3 On page 4, the second guiding principle states that deterministic or qualitative information should be used if no PRA information exists related to a particular hazard or operating mode.
"The staff believes that in addition to the five considerations listed, the IDP should also considerthe following items:Failure of the function/SSC will not prevent or adversely affect the plant
This principle is not to be interpreted to mean that deterministic or qualitative information should be used only when no PRA information exists. The NRC believes that the integrated decision-making process must systematically consider the quantitative and qualitative information available regarding the various modes of operation and initiating events, including: PRA, quantitative risk results and insights; deterministic, traditional engineering factors and insights; and any other pertinent information in the categorization of the SSCs.
's capability to reachor maintain safe shutdown conditions and is not significant to safety during mode changes or shutdown.The function/SSC does not act as a barrier to fission product release during severeaccidents.The function/SSC does not support a significant mitigating or diagnosis function foraccidents and transients.Failure of the function/SSC will not result in releases of radioactive material that would resultin the implementation of off-site emergency response and protective actions.Section 10.2The specific considerations that permit an LSS determination of an SSC in a safety-significantfunctional flow path must not be limited to just active failure modes, but must consider all potential failure modes for the subject SSC.The NRC staff does not endorse the examples provided under the specific considerations (pp.60-61) that permit an LSS determination of an SSC in a safety-significant functional flow path.
The sixth guiding principle indicates that the attribute(s) that make an SSC safety-significant should be documented. This is done to ensure that the treatment applied to the SSC is consistent with the safety-significance cause determined in the categorization process. While the NRC staff agrees that the safety-significant attribute(s) need to be documented, the applicant or licensee must also document the justification for SSCs determined to be LSS. In other words, documentation must be available and maintained by the applicant or licensee supporting the categorization of every SSC addressed under § 50.69. This is consistent with the discussion in Section 11.1 of the Final Draft of NEI 00-04.
The specific conditions and criteria must be justified and documented for the specific SSCs under consideration.Section 11.1In addressing regulatory commitments associated with special treatment requirements listed in
Section 1.4 The first paragraph (p.4) states that US nuclear generating plants have attained and maintained an outstanding safety performance record. While the NRC does not disagree with this statement, endorsement of this guidance is not an endorsement of this statement.
§ 50.69(b)(1) for RISC-3 SSCs, the Final Draft of NEI 00-04 specifies that licensees shouldensure that any design-related commitments for RISC-3 SSCs continue to be maintained. The NRC staff interprets this guidance as applying to any commitments related to the design-basis functionality of RISC-3 SSCs.Section 11.2No specific change control process is established within 10 CFR 50.69 governing changes tothe NRC approved categorization process. As part of its approval of the license amendment submittal, the NRC will establish a license condition that governs changes to the categorization   process. If a licensee or applicant wishes to change their categorization process, and thechange is outside the bounds of the NRC
The third paragraph of this section (p.5) states that the applicant or licensee can determine the appropriate set of equipment to re-categorize under § 50.69. The NRC staff agrees that categorization under § 50.69 can be partially implemented by an applicant or licensee and the implementation can be phased in over a period of time. However, since the categorization process described in § 50.69 and in NEI 00-04 is primarily based on system/structure functions, the categorization process must be implemented for an entire system/structure; not selected components within a system. Section 50.69(c)(1)(v) requires this categorization for entire systems/structures. The primary reason that § 50.69 requires the categorization to be performed for entire systems and structures is to ensure that all the functions (which are primarily a system-level attribute) for a given SSC within a given system or structure are appropriately considered for each SSC in determining its safety significance. The system boundary definitions should be consistent with the PRA used in categorizing the SSCs and careful consideration should be given by the licensee to ensure all important functions are captured for SSCs, especially those that are common to multiple systems (e.g., tank discharge valve that feeds to multiple systems). The methodology for determining systems boundaries is left to the licensee recognizing these important constraints (i.e., drawing system boundaries in such a way as to break apart a system when viewed from a system functional standpoint would not meet this requirement).
's license condition, then the licensee or applicant willneed to seek NRC approval of the revised categorization process. Section 12NEI 00-04 identifies a number of reviews that are to be performed following revisions orupdates to the PRA as part of a review of the SSC categorization. The NRC believes that the results of the risk sensitivity study, as described in Chapter 8, must be confirmed to still be acceptable following each revision or update of the PRA to ensure that the categorization process is maintained valid. If the risk sensitivity study results indicate a greater than small cumulative risk increase from implementation of
Section 1.5 In the first paragraph (p.5) it is stated that the IDP cannot re-categorize an SSC identified as high safety significant (HSS)1 by the plant-specific risk analysis. This could be interpreted to conflict with the allowance to use the integrated importance assessment. To avoid confusion, and consistent with Figure 1-2, the NRC interprets this statement in this context as meaning the IDP cannot re-categorize an SSC that is identified as HSS as an outcome of the risk characterization portion of the process, which includes the assessments from the plant-specific probabilistic risk analyses (PRAs) of internal events, external events, and non-power operations and the integrated importance assessment.
§ 50.69, then the categorization and/ortreatment of SSCs must be revised until an acceptably small risk increase is determined.}}
A major part of the rationale for the integrated assessment is to address the potential conservatisms that are more typical in the PRAs for the external events and non-power operations. It is possible that an SSC that is not significant for external events and non-power operations, but is for internal events, could be determined in the integrated assessment to not be significant due to the high CDF or LERF estimates from the conservative analyses. To avoid the conservative PRA approaches from masking the significance of an SSC from the more 1
NEI 00-04 uses the terminology high safety significant (HSS) to refer to SSCs that perform safety significant functions. The NRC understands HSS to have the same meaning as safety significant (i.e., SSCs that are categorized as RISC-1 or RISC-2) as used in § 50.69.
realistic internal events PRA, SSCs identified as HSS by the internal events assessment should be retained as HSS and not be allowed to be re-categorized by the IDP, even if the integrated assessment indicates a potentially lower significance.
For example, if an SSC is determined by a PRA approach to be HSS for seismic, but is determined to be low safety significant (LSS) for all other events and operating modes, and seismic events are such a small contributor to total risk that the integrated assessment indicates the SSC is LSS, then all this information, including the results of the individual sensitivity studies, is provided to the IDP and the IDP can determine and document the final categorization for the SSC. A part of the IDP considerations in making the final categorization determinations should include the relative conservatisms in the analyses that support the various significance determinations. However, if an SSC is determined to be HSS from the internal events assessment, but is determined to be LSS for all other events and operating modes, and due to the conservative nature of the other analyses the internal events is a small contributor to total risk such that the integrated assessment indicates the SSC is LSS, then the SSC should still be designated to be HSS due to the internal events analyses and IDP will not be allowed to re-categorize the SSC.
In the second paragraph (p.5) it is stated that the IDP cannot re-categorize an SSC identified as HSS by the plant-specific risk analysis, but the context of this paragraph is the defense-in-depth characterization portion of the process; not the risk characterization portion. Consistent with Figure 1-2, the NRC interprets this statement in this context as meaning the IDP cannot re-categorize an SSC that is identified as HSS as an outcome of the defense-in-depth characterization portion of the process.
Section 1.5, Section 5, & Section 5.3 The NRC notes that there are numerous SSCs that are not explicitly modeled in a seismic PRA, but are screened out due to their designed seismic robustness. Many of these SSCs are inherently safety significant for seismic events. In addition to using the results of a seismic PRA in determining the significance of an SSC for seismic events, the applicant or licensee should either designate those SSCs that were screened out of the PRA due to their seismic robustness as safety significant or establish the robustness (i.e., seismic capacity) of these SSCs as a design aspect if any screened out SSC is designated as LSS. This information should also be provided to the IDP for consideration in determining the final categorization of the SSC.
Section 3.3 On page 20, for the full power internal events PRA, in addition to providing a high level summary of the results of the peer review, the applicant or licensee should provide a summary of the findings of the self-assessment performed per RG 1.200.
Section 5 The first decision block in Figure 5-1 (p.26) refers to prevention or mitigation of core damage.
This phrase could be misunderstood to not include important safety considerations related to containment performance or releases (i.e., LERF). To be consistent with the intent of the safety significance categorization process and the associated text in Section 5, this first decision block should be understood to include the prevention or mitigation of severe accidents.
Section 5.1 In the discussion of the Internal Event Assessment (pp. 29-34), the NEI guidance states that the safety significant attributes are identified by the component failure mode that contributes significantly to the importance of the SSC. It should be recognized that there may be multiple component failure modes that contribute significantly to the importance of an SSC; especially if no individual failure mode alone exceeds the screening criteria, but a number of failure modes collectively exceed the screening criteria. In these cases, the guidance should not be inferred to limit the identification of safety significant attributes based on a single highest contributing failure mode, but should include all significantly contributing failure modes.
Section 5.4 (& Section 1.5)
Figure 5-6 (p.40) addresses approaches that rely on the identification of safe shutdown paths.
However, if the evaluation of an external event is performed using a screening approach, then the logic presented in Figure 5-4 would be more appropriate than the current Figure 5-6. In this approach, if an SSC participates in an unscreened scenario or is credited in the screening of the scenario (i.e., failure to credit the SSC would result in the scenario being unscreened), then that SSC would be considered safety significant. The evaluation of other external events needs to recognize the different approaches and implement the proper logic for the specific approach.
Section 6.2 In this section (p.47), the guidance presents containment isolation criteria to support the assessment of defense-in-depth. The NRC notes that 10 CFR 50.69(b)(1)(x) establishes the governing criteria for which containment isolation valves and penetrations are within the scope of 10 CFR 50.69.
The NRC believes that the first criteria listed for containment bypass (p.47) needs to also include mitigation of an ISLOCA event as well as the initiation and isolation of these events.
This is especially true if an event tree/fault tree logic approach is utilized to address ISLOCA events.
Section 7.2 The second bullet of the second set of bullets on page 50 states that if the SSC is categorized as low safety significant based on the internal events, but potentially high safety significant because of external events or shutdown risks, then the integral assessment should be relied upon. This may be misinterpreted to mean that the non-internal events results should be disregarded and not considered. All the information should be provided to the IDP for consideration, including the individual and integral assessment results; consistent with the example worksheet provided as Figure 7-2. Under these circumstances, if the integral assessment indicates that the SSC is candidate low safety significant, the IDP should consider those aspects that indicate the SSC is safety significant and then make a determination of the appropriate category and document its rationale.
Section 8 The factor used in the risk sensitivity study to represent the potential increase in unreliability of RISC-3 SSCs due to relaxation of special treatment requirements must be set at a level such that an actual increase in unreliability of a RISC-3 SSC would be detected and corrected through the monitoring, corrective action, and feedback processes. The example for implementation (7th paragraph in this section on page 53) is overly simplistic and technically not acceptable. An acceptable process would need to have a focused cause analysis when a RISC-3 SSC failed to determine if its failure was due to the reduction in treatment and/or an indication of a potential common cause failure or degradation mechanism. If there is indication that one of these factors is the cause of the failure, then the applicant or licensee should have a process for immediately expanding testing to similar SSCs to demonstrate their functionality and for entering a corrective action to the treatment and/or categorization processes. Likewise, if the expected number of failures, based on plant experience and reliability values used in the PRA, of a group of RISC-3 SSCs is exceeded over the evaluation interval, then a similar process should be implemented to determine the cause of the higher than expected failure rate and corrective action should be initiated to the treatment and/or categorization processes. The description of such an approach might more appropriately belong as a subsection of Chapter 11 or as its own chapter dealing with implementation (i.e., monitoring, detecting, corrective action, and feedback).
Until a technically defensible approach is provided in a revision of the NEI 00-04 guidelines, the NRC will review the applicants or licensees approach and process as part of the application requesting to implement § 50.69. Thus, the applicants or licensees application will need to describe their approach and process for monitoring, detecting, and correcting increases in unreliability of RISC-3 SSCs prior to reaching a level that could invalidate the categorization process results as required by 10 CFR 50.69(c)(1)(iv) and (e)(3).
Section 9.2 Under the review of risk information (pp. 57-58), the licensees or applicants considerations should be supplemented with the following additional considerations:
In the third bullet, the IDP should also consider spatial effects as well as direct, should specifically consider the failure of the SSC on its safety significant function, and should not be limited to only those aspects not modeled in the PRA. Thus, the third bullet could be reworded as follows: Failure of the SSC will not fail a safety significant function and failure of the function/SSC will not directly or indirectly (e.g., spatial effects) fail another safety significant function/SSC, including those that are assumed to be inherently reliable (e.g., piping and tanks) and those that may not be explicitly modeled in the PRA (e.g., room cooling systems and instrumentation and control systems).
In the fourth bullet, the IDP should also consider functions/SSCs that are necessary for significant operator action required to mitigate accidents and transients, regardless if they are in the PRA or not. Thus, the fourth bullet could be reworded as follows: The function/SSC is not necessary for significant operator actions required to mitigate an accident and transient, including those credited in the PRA, including instrumentation and other equipment.
In the fifth bullet, the IDP should also consider functions/SSCs associated with monitoring post-accident conditions. Thus, the fourth bullet could be reworded as follows: The function/SSC is not necessary for significant operator actions to assure long term containment integrity, monitoring post-accident conditions, or offsite emergency planning activities, including instrumentation and other equipment.
The staff believes that in addition to the five considerations listed, the IDP should also consider the following items:
 Failure of the function/SSC will not prevent or adversely affect the plants capability to reach or maintain safe shutdown conditions and is not significant to safety during mode changes or shutdown.
 The function/SSC does not act as a barrier to fission product release during severe accidents.
 The function/SSC does not support a significant mitigating or diagnosis function for accidents and transients.
 Failure of the function/SSC will not result in releases of radioactive material that would result in the implementation of off-site emergency response and protective actions.
Section 10.2 The specific considerations that permit an LSS determination of an SSC in a safety-significant functional flow path must not be limited to just active failure modes, but must consider all potential failure modes for the subject SSC.
The NRC staff does not endorse the examples provided under the specific considerations (pp.
60-61) that permit an LSS determination of an SSC in a safety-significant functional flow path.
The specific conditions and criteria must be justified and documented for the specific SSCs under consideration.
Section 11.1 In addressing regulatory commitments associated with special treatment requirements listed in
§ 50.69(b)(1) for RISC-3 SSCs, the Final Draft of NEI 00-04 specifies that licensees should ensure that any design-related commitments for RISC-3 SSCs continue to be maintained. The NRC staff interprets this guidance as applying to any commitments related to the design-basis functionality of RISC-3 SSCs.
Section 11.2 No specific change control process is established within 10 CFR 50.69 governing changes to the NRC approved categorization process. As part of its approval of the license amendment submittal, the NRC will establish a license condition that governs changes to the categorization process. If a licensee or applicant wishes to change their categorization process, and the change is outside the bounds of the NRCs license condition, then the licensee or applicant will need to seek NRC approval of the revised categorization process.
Section 12 NEI 00-04 identifies a number of reviews that are to be performed following revisions or updates to the PRA as part of a review of the SSC categorization. The NRC believes that the results of the risk sensitivity study, as described in Chapter 8, must be confirmed to still be acceptable following each revision or update of the PRA to ensure that the categorization process is maintained valid. If the risk sensitivity study results indicate a greater than small cumulative risk increase from implementation of § 50.69, then the categorization and/or treatment of SSCs must be revised until an acceptably small risk increase is determined.
                                                  }}

Latest revision as of 20:45, 17 March 2020

Nuclear Regulatory Commission (NRC) Comments on the Final Draft of NEI 00-04, 10 CFR 50.69 SSC Categorization Guidance Dated April 2004
ML041450405
Person / Time
Issue date: 05/24/2004
From: Black S
Division of Systems Safety and Analysis
To: Pietrangelo A
Nuclear Energy Institute
Harrison D, 415-3587, NRR/DSSA/SPSB
References
Download: ML041450405 (12)


Text

May 24, 2004 Mr. Anthony R. Pietrangelo, Senior Director Risk Regulation Nuclear Energy Institute Suite 400 1771 I Street Washington DC 20006-3708

SUBJECT:

NUCLEAR REGULATORY COMMISSION (NRC) COMMENTS ON THE FINAL DRAFT OF NEI 00-04, 10 CFR 50.69 SSC CATEGORIZATION GUIDANCE DATED APRIL 2004

Dear Mr. Pietrangelo:

By letter dated April 14, 2004, (ML041120208), the Nuclear Energy Institute (NEI), submitted to the NRC the Final Draft of NEI 00-04. The NRC is using this document as the basis for preparation of a regulatory guide (RG 1.201), entitled Guidelines for Categorizing Structures, Systems and Components in Nuclear Power Plants According to Their Safety Significance, in support of the final rulemaking package for 10 CFR 50.69.

Enclosed with this letter are NRC comments on this draft of NEI 00-04. It is our intention to work with you over the next several weeks in resolving these comments prior to issuance of the final rule at the end of June 2004. The NRC also intends to continue to work with you during pilot applications of 10 CFR 50.69 to further improve NEI 00-04 and RG 1.201.

Questions about this letter should be directed to Donald Harrison (301-415-3587).

Sincerely,

/RA/

Suzanne C. Black, Director Division of Systems Safety and Analysis Office of Nuclear Reactor Regulation

Enclosure:

As stated

May 24, 2004 Mr. Anthony R. Pietrangelo, Senior Director Risk Regulation Nuclear Energy Institute Suite 400 1771 I Street Washington DC 20006-3708

SUBJECT:

NUCLEAR REGULATORY COMMISSION (NRC) COMMENTS ON THE FINAL DRAFT OF NEI 00-04, 10 CFR 50.69 SSC CATEGORIZATION GUIDANCE DATED APRIL 2004

Dear Mr. Pietrangelo:

By letter dated April 14, 2004, (ML041120208), the Nuclear Energy Institute (NEI), submitted to the NRC the Final Draft of NEI 00-04. The NRC is using this document as the basis for preparation of a regulatory guide (RG 1.201), entitled Guidelines for Categorizing Structures, Systems and Components in Nuclear Power Plants According to Their Safety Significance, in support of the final rulemaking package for 10 CFR 50.69.

Enclosed with this letter are NRC comments on this draft of NEI 00-04. It is our intention to work with you over the next several weeks in resolving these comments prior to issuance of the final rule at the end of June 2004. The NRC also intends to continue to work with you during pilot applications of 10 CFR 50.69 to further improve NEI 00-04 and RG 1.201.

Questions about this letter should be directed to Donald Harrison (301-415-3587).

Sincerely,

/RA/

Suzanne C. Black, Director Division of Systems Safety and Analysis Office of Nuclear Reactor Regulation

Enclosure:

As stated DISTRIBUTION: T. Reed E. McKenna M. Rubin M. Tschiltz M. Johnson D. Harrison ADAMS Accession# ML041450405 Document name: C:\ORPCheckout\FileNET\ML041450405.wpd NRR-106 OFFICE SPSB SC:SPSB BC:SPSB:DSSA DD:DSSA NAME DGHarrison:nxh2 MPRubin MDTschiltz SCBlack DATE 05/ 20 /04 05/20 /04 05/21 /04 05/ 24 /04 OFFICIAL RECORD COPY

NRC Comments Regarding NEI 00-04 (DRAFT - Final Draft), 10 CFR 50.69 SSC Categorization Guideline April 2004 General Comments

1. Other Documents Referenced in the Final Draft of NEI 00-04 The Final Draft of NEI 00-04 references numerous other documents, but NRCs endorsement of the Final Draft of NEI 00-04 is not an endorsement of these other referenced documents.
2. Use of Examples in the Final Draft of NEI 00-04 The Final Draft of NEI 00-04 includes examples to supplement the guidance. While appropriate for illustrating and reinforcing the guidance in the Final Draft of NEI 00-04, the NRCs endorsement of the Final Draft of NEI 00-04 is not a determination that the examples are applicable for all licensees. A licensee must ensure that an example is applicable to its particular circumstances before implementing the guidance as described in the example.
3. Use of Methods Other Than the Final Draft of NEI 00-04 To meet the requirements of § 50.69 for categorization of SSCs, licensees may use methods other than those set forth in the Final Draft of NEI 00-04. The NRC will determine the acceptability of these other methods by evaluating them against the § 50.69 rule requirements.
4. Limitations of Types of Analyses Used in Implementing the Final Draft of NEI 00-04 In its 1995 Policy Statement on the use of probabilistic risk assessment (PRA), the Commission determined that the use of PRA technology should be increased in all regulatory matters to the extent supported by state-of-the-art PRA methods and data. Implementation of risk-informed regulation is possible because the development and use of a quantitative PRA requires a systematic and integrated evaluation. Development of a technically defensible quantitative PRA also requires sufficient and structured documentation to allow investigations of all aspects of the evaluation. To meet the requirements of § 50.69 for categorization of SSCs, licensees must use risk evaluations and insights that cover the full spectrum of potential events (i.e., internal and external initiating events) and the range of plant operating modes (i.e., full power, low power, and shutdown operations). The NRC staff believes that current state-of-the-art PRA methods are available to quantitatively address the full spectrum of potential events and the full range of plant operating modes for this type of application. However, the Final Draft of NEI 00-04 allows the use of non-PRA type evaluations (e.g., FIVE, seismic margins analysis, NUMARC 91-06), when PRAs have not been performed, which will result in more conservative categorization in that special treatment requirements will not be allowed to be relaxed from SSCs relied upon in the non-PRA type evaluations. It should be recognized that the degree of relief (i.e., SSCs subject to relaxation of special treatment requirements) that the NRC will accept under 10 CFR 50.69 will be commensurate with the assurance provided by the evaluation.

ATTACHMENT

5. Technical Adequacy Attributes of Analyses Implementing the Final Draft of NEI 00-04 The peer review process described in NEI 00-02, as amended to incorporate NRC comments provided in the NRC letter to NEI, dated April 2, 2002, and as endorsed in RG 1.200, provides a mechanism for licensees to determine if their internal events PRA meets the attributes required for this application. An alternative to NEI 00-02 is the ASME Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, as amended to incorporate NRC comments and as endorsed in RG 1.200. Both NEI 00-02 and the ASME Standard are endorsed for trial use by the NRC in RG 1.200, with appropriate clarifications and exceptions. These documents currently cover only internal events at full power. There is not currently a similarly endorsed standard for the external events PRA and non-PRA type analyses (e.g., FIVE, seismic margins analysis, NUMARC 91-06) and there is limited guidance provided in Section 3.3 of the Final Draft of NEI 00-04 for determining the technical adequacy attributes required for these types of analyses for this specific application. Industry standards have been or are being prepared for external events (seismic, high winds, and other external events), fire, and low power and shutdown PRAs. Therefore, the NRC staff expects that the applicant or licensee will prepare arguments for why the method employed is adequate to perform the analysis required to support the categorization of SSCs. Applicants or licensees will have to provide arguments supporting the technical adequacy of the external events, other operating modes, and non-PRA type analyses for each plant-specific submittal requesting to implement § 50.69. As standards are developed by the industry and endorsed by the NRC via revisions to RG 1.200 for external events, fires, and low power and shutdown, the NRC expects applicants or licensees to use these standards to demonstrate the technical adequacy of the PRAs addressing these events and operating modes.
6. Uncertainty Considerations in the Final Draft of NEI 00-04 The NRC staff notes that the Final Draft of NEI 00-04 does not address modeling or data uncertainties explicitly. However, the sensitivity studies performed to support the categorization of SSCs are intended to address some of the major sources of uncertainty (i.e., human error probabilities, common cause failure probabilities, and those items identified during the assessment of PRA technical adequacy). When assessing the potential increase in core damage frequency (CDF) and large early release frequency (LERF) as a result of implementing

§ 50.69, the applicant or licensee must address uncertainties consistent with Section 2.2.5 of Regulatory Guide 1.174.

7. Common Cause Failure and Degradation Mechanism Considerations in the Final Draft of NEI 00-04 Mechanisms that could lead to large increases in CDF and LERF are extensive, across system common cause failures (CCFs) and unmitigated degradation. However, for such extensive impacts to occur would require that the mechanisms that lead to failure, in the absence of treatment, were sufficiently rapidly developing or not self-revealing, such that there would be few opportunities for early detection and corrective action.

Those aspects of treatment that are necessary to prevent SSC degradation or failure from known mechanisms, to the extent that the results of the sensitivity studies are invalidated, should be identified by the applicant or licensee and such aspects of treatment retained. This will require an understanding of what the degradation mechanisms are and what elements of treatment are sufficient to prevent the degradation. As an example of how this would be implemented, the known existence of certain degradation mechanisms affecting pressure boundary SSC integrity would support retaining the current requirements on inspections or examinations or use of the risk-informed ASME Code Cases, as accepted by the NRC regulatory process. As another example, changing levels of treatment on several similar components that might be sensitive to CCF potential would require consideration as to whether the planned monitoring and corrective action program, or other aspects of treatment, would be effective in sufficiently minimizing CCF potential such that the risk sensitivity study results remain valid (i.e., bounding).

The appropriate factor to use in the risk sensitivity study to represent the potential reduction in reliability due to the relaxation of special treatment requirements should be determined in concert with the consideration of the potential for (and retained defenses against) cross-system common cause failures and known degradation mechanisms. As part of this determination, the NRC expects licensees to: (a) demonstrate an understanding of common cause effects and known degradation mechanisms and their potential impact on RISC-3 SSCs; (b) demonstrate an understanding of the programmatic activities that provide defenses against CCFs and failures resulting from known degradation; and (c) to factor this knowledge into both the treatment applied to and the factors used for the RISC-3 SSCs.

In addition, the factor used in adjusting the unreliability of RISC-3 SSCs in the risk sensitivity study should be set at a level such that an actual increase in unreliability of a RISC-3 SSC would be detected and corrected through the monitoring, corrective action, and feedback processes. The licensee must develop and document an evaluation based on the current unreliability of the SSCs, the number of SSCs, the frequency of the opportunities to identify failures, and the monitoring and corrective action program that will identify the minimum increase in failure rates that can be detected through the monitoring and corrective action program.

Specific Comments Section 1 The first paragraph (p.1) references Appendix B of NEI 00-04 as an example of a submittal, but this appendix has been deleted as a result of NRC comments on an earlier draft of NEI 00-04.

Appendix B provided an outline/example of the information to be provided to the NRC for those applicants or licensees implementing § 50.69. It is envisioned that a template may be created for submittals under § 50.69, however, at this time a template has not been developed or endorsed by the staff. Thus, applications to implement § 50.69 will be evaluated on a plant-specific basis to ensure that they properly implement the categorization process requirements of § 50.69.

The first paragraph (p.1) also states that implementation of § 50.69 in accordance with the Final Draft of NEI 00-04 guidelines should involve minimal NRC review. Though the endorsement of the Final Draft of NEI 00-04 in this regulatory guide will enable an applicant or licensee to have more assurance that the NRC will find their application acceptable, as opposed to a licensee developing their own approach, it is incorrect to characterize the NRC review of the application submitted per § 50.69(b)(2)(i) as minimal. The NRC will perform an appropriately thorough review of each application submitted under § 50.69.

Section 1.2 et al The second paragraph of this section (p.3) discusses a third set of equipment referred to as important-to-safety and its relation to safety-related and nonsafety-related equipment. This usage is incorrect. Endorsement of this guidance is not an endorsement of this usage of the phrase important-to-safety. Though incorrect, in the context of this guidance, the NRC staff interprets the intent of the usage of this phrase to refer to nonsafety-related SSCs that have been determined to be important. These nonsafety-related SSCs will be categorized as either RISC-2 or RISC-4 as determined by their safety significance per the § 50.69 categorization process.

The fourth paragraph of this section (p.3) states that the integrated decision-making process

...blends risk insights, new technical information and operational feedback... The NRC staff interprets this phrase, and similar such phrases (e.g., Section 1.3 third guiding principle), as meaning that the integrated decision-making process must systematically consider the quantitative and qualitative information available regarding the various modes of plant operation and initiating events, including PRA, quantitative risk results and insights (e.g., CDF, LERF, and importance measures); deterministic, traditional engineering factors and insights (e.g., defense-in-depth, safety margins, containment integrity); and any other pertinent information (e.g.,

industry and plant-specific operational and performance experience, feedback, and corrective actions program) in the categorization of the SSCs.

Section 1.3 On page 4, the second guiding principle states that deterministic or qualitative information should be used if no PRA information exists related to a particular hazard or operating mode.

This principle is not to be interpreted to mean that deterministic or qualitative information should be used only when no PRA information exists. The NRC believes that the integrated decision-making process must systematically consider the quantitative and qualitative information available regarding the various modes of operation and initiating events, including: PRA, quantitative risk results and insights; deterministic, traditional engineering factors and insights; and any other pertinent information in the categorization of the SSCs.

The sixth guiding principle indicates that the attribute(s) that make an SSC safety-significant should be documented. This is done to ensure that the treatment applied to the SSC is consistent with the safety-significance cause determined in the categorization process. While the NRC staff agrees that the safety-significant attribute(s) need to be documented, the applicant or licensee must also document the justification for SSCs determined to be LSS. In other words, documentation must be available and maintained by the applicant or licensee supporting the categorization of every SSC addressed under § 50.69. This is consistent with the discussion in Section 11.1 of the Final Draft of NEI 00-04.

Section 1.4 The first paragraph (p.4) states that US nuclear generating plants have attained and maintained an outstanding safety performance record. While the NRC does not disagree with this statement, endorsement of this guidance is not an endorsement of this statement.

The third paragraph of this section (p.5) states that the applicant or licensee can determine the appropriate set of equipment to re-categorize under § 50.69. The NRC staff agrees that categorization under § 50.69 can be partially implemented by an applicant or licensee and the implementation can be phased in over a period of time. However, since the categorization process described in § 50.69 and in NEI 00-04 is primarily based on system/structure functions, the categorization process must be implemented for an entire system/structure; not selected components within a system. Section 50.69(c)(1)(v) requires this categorization for entire systems/structures. The primary reason that § 50.69 requires the categorization to be performed for entire systems and structures is to ensure that all the functions (which are primarily a system-level attribute) for a given SSC within a given system or structure are appropriately considered for each SSC in determining its safety significance. The system boundary definitions should be consistent with the PRA used in categorizing the SSCs and careful consideration should be given by the licensee to ensure all important functions are captured for SSCs, especially those that are common to multiple systems (e.g., tank discharge valve that feeds to multiple systems). The methodology for determining systems boundaries is left to the licensee recognizing these important constraints (i.e., drawing system boundaries in such a way as to break apart a system when viewed from a system functional standpoint would not meet this requirement).

Section 1.5 In the first paragraph (p.5) it is stated that the IDP cannot re-categorize an SSC identified as high safety significant (HSS)1 by the plant-specific risk analysis. This could be interpreted to conflict with the allowance to use the integrated importance assessment. To avoid confusion, and consistent with Figure 1-2, the NRC interprets this statement in this context as meaning the IDP cannot re-categorize an SSC that is identified as HSS as an outcome of the risk characterization portion of the process, which includes the assessments from the plant-specific probabilistic risk analyses (PRAs) of internal events, external events, and non-power operations and the integrated importance assessment.

A major part of the rationale for the integrated assessment is to address the potential conservatisms that are more typical in the PRAs for the external events and non-power operations. It is possible that an SSC that is not significant for external events and non-power operations, but is for internal events, could be determined in the integrated assessment to not be significant due to the high CDF or LERF estimates from the conservative analyses. To avoid the conservative PRA approaches from masking the significance of an SSC from the more 1

NEI 00-04 uses the terminology high safety significant (HSS) to refer to SSCs that perform safety significant functions. The NRC understands HSS to have the same meaning as safety significant (i.e., SSCs that are categorized as RISC-1 or RISC-2) as used in § 50.69.

realistic internal events PRA, SSCs identified as HSS by the internal events assessment should be retained as HSS and not be allowed to be re-categorized by the IDP, even if the integrated assessment indicates a potentially lower significance.

For example, if an SSC is determined by a PRA approach to be HSS for seismic, but is determined to be low safety significant (LSS) for all other events and operating modes, and seismic events are such a small contributor to total risk that the integrated assessment indicates the SSC is LSS, then all this information, including the results of the individual sensitivity studies, is provided to the IDP and the IDP can determine and document the final categorization for the SSC. A part of the IDP considerations in making the final categorization determinations should include the relative conservatisms in the analyses that support the various significance determinations. However, if an SSC is determined to be HSS from the internal events assessment, but is determined to be LSS for all other events and operating modes, and due to the conservative nature of the other analyses the internal events is a small contributor to total risk such that the integrated assessment indicates the SSC is LSS, then the SSC should still be designated to be HSS due to the internal events analyses and IDP will not be allowed to re-categorize the SSC.

In the second paragraph (p.5) it is stated that the IDP cannot re-categorize an SSC identified as HSS by the plant-specific risk analysis, but the context of this paragraph is the defense-in-depth characterization portion of the process; not the risk characterization portion. Consistent with Figure 1-2, the NRC interprets this statement in this context as meaning the IDP cannot re-categorize an SSC that is identified as HSS as an outcome of the defense-in-depth characterization portion of the process.

Section 1.5, Section 5, & Section 5.3 The NRC notes that there are numerous SSCs that are not explicitly modeled in a seismic PRA, but are screened out due to their designed seismic robustness. Many of these SSCs are inherently safety significant for seismic events. In addition to using the results of a seismic PRA in determining the significance of an SSC for seismic events, the applicant or licensee should either designate those SSCs that were screened out of the PRA due to their seismic robustness as safety significant or establish the robustness (i.e., seismic capacity) of these SSCs as a design aspect if any screened out SSC is designated as LSS. This information should also be provided to the IDP for consideration in determining the final categorization of the SSC.

Section 3.3 On page 20, for the full power internal events PRA, in addition to providing a high level summary of the results of the peer review, the applicant or licensee should provide a summary of the findings of the self-assessment performed per RG 1.200.

Section 5 The first decision block in Figure 5-1 (p.26) refers to prevention or mitigation of core damage.

This phrase could be misunderstood to not include important safety considerations related to containment performance or releases (i.e., LERF). To be consistent with the intent of the safety significance categorization process and the associated text in Section 5, this first decision block should be understood to include the prevention or mitigation of severe accidents.

Section 5.1 In the discussion of the Internal Event Assessment (pp. 29-34), the NEI guidance states that the safety significant attributes are identified by the component failure mode that contributes significantly to the importance of the SSC. It should be recognized that there may be multiple component failure modes that contribute significantly to the importance of an SSC; especially if no individual failure mode alone exceeds the screening criteria, but a number of failure modes collectively exceed the screening criteria. In these cases, the guidance should not be inferred to limit the identification of safety significant attributes based on a single highest contributing failure mode, but should include all significantly contributing failure modes.

Section 5.4 (& Section 1.5)

Figure 5-6 (p.40) addresses approaches that rely on the identification of safe shutdown paths.

However, if the evaluation of an external event is performed using a screening approach, then the logic presented in Figure 5-4 would be more appropriate than the current Figure 5-6. In this approach, if an SSC participates in an unscreened scenario or is credited in the screening of the scenario (i.e., failure to credit the SSC would result in the scenario being unscreened), then that SSC would be considered safety significant. The evaluation of other external events needs to recognize the different approaches and implement the proper logic for the specific approach.

Section 6.2 In this section (p.47), the guidance presents containment isolation criteria to support the assessment of defense-in-depth. The NRC notes that 10 CFR 50.69(b)(1)(x) establishes the governing criteria for which containment isolation valves and penetrations are within the scope of 10 CFR 50.69.

The NRC believes that the first criteria listed for containment bypass (p.47) needs to also include mitigation of an ISLOCA event as well as the initiation and isolation of these events.

This is especially true if an event tree/fault tree logic approach is utilized to address ISLOCA events.

Section 7.2 The second bullet of the second set of bullets on page 50 states that if the SSC is categorized as low safety significant based on the internal events, but potentially high safety significant because of external events or shutdown risks, then the integral assessment should be relied upon. This may be misinterpreted to mean that the non-internal events results should be disregarded and not considered. All the information should be provided to the IDP for consideration, including the individual and integral assessment results; consistent with the example worksheet provided as Figure 7-2. Under these circumstances, if the integral assessment indicates that the SSC is candidate low safety significant, the IDP should consider those aspects that indicate the SSC is safety significant and then make a determination of the appropriate category and document its rationale.

Section 8 The factor used in the risk sensitivity study to represent the potential increase in unreliability of RISC-3 SSCs due to relaxation of special treatment requirements must be set at a level such that an actual increase in unreliability of a RISC-3 SSC would be detected and corrected through the monitoring, corrective action, and feedback processes. The example for implementation (7th paragraph in this section on page 53) is overly simplistic and technically not acceptable. An acceptable process would need to have a focused cause analysis when a RISC-3 SSC failed to determine if its failure was due to the reduction in treatment and/or an indication of a potential common cause failure or degradation mechanism. If there is indication that one of these factors is the cause of the failure, then the applicant or licensee should have a process for immediately expanding testing to similar SSCs to demonstrate their functionality and for entering a corrective action to the treatment and/or categorization processes. Likewise, if the expected number of failures, based on plant experience and reliability values used in the PRA, of a group of RISC-3 SSCs is exceeded over the evaluation interval, then a similar process should be implemented to determine the cause of the higher than expected failure rate and corrective action should be initiated to the treatment and/or categorization processes. The description of such an approach might more appropriately belong as a subsection of Chapter 11 or as its own chapter dealing with implementation (i.e., monitoring, detecting, corrective action, and feedback).

Until a technically defensible approach is provided in a revision of the NEI 00-04 guidelines, the NRC will review the applicants or licensees approach and process as part of the application requesting to implement § 50.69. Thus, the applicants or licensees application will need to describe their approach and process for monitoring, detecting, and correcting increases in unreliability of RISC-3 SSCs prior to reaching a level that could invalidate the categorization process results as required by 10 CFR 50.69(c)(1)(iv) and (e)(3).

Section 9.2 Under the review of risk information (pp. 57-58), the licensees or applicants considerations should be supplemented with the following additional considerations:

In the third bullet, the IDP should also consider spatial effects as well as direct, should specifically consider the failure of the SSC on its safety significant function, and should not be limited to only those aspects not modeled in the PRA. Thus, the third bullet could be reworded as follows: Failure of the SSC will not fail a safety significant function and failure of the function/SSC will not directly or indirectly (e.g., spatial effects) fail another safety significant function/SSC, including those that are assumed to be inherently reliable (e.g., piping and tanks) and those that may not be explicitly modeled in the PRA (e.g., room cooling systems and instrumentation and control systems).

In the fourth bullet, the IDP should also consider functions/SSCs that are necessary for significant operator action required to mitigate accidents and transients, regardless if they are in the PRA or not. Thus, the fourth bullet could be reworded as follows: The function/SSC is not necessary for significant operator actions required to mitigate an accident and transient, including those credited in the PRA, including instrumentation and other equipment.

In the fifth bullet, the IDP should also consider functions/SSCs associated with monitoring post-accident conditions. Thus, the fourth bullet could be reworded as follows: The function/SSC is not necessary for significant operator actions to assure long term containment integrity, monitoring post-accident conditions, or offsite emergency planning activities, including instrumentation and other equipment.

The staff believes that in addition to the five considerations listed, the IDP should also consider the following items:

 Failure of the function/SSC will not prevent or adversely affect the plants capability to reach or maintain safe shutdown conditions and is not significant to safety during mode changes or shutdown.

 The function/SSC does not act as a barrier to fission product release during severe accidents.

 The function/SSC does not support a significant mitigating or diagnosis function for accidents and transients.

 Failure of the function/SSC will not result in releases of radioactive material that would result in the implementation of off-site emergency response and protective actions.

Section 10.2 The specific considerations that permit an LSS determination of an SSC in a safety-significant functional flow path must not be limited to just active failure modes, but must consider all potential failure modes for the subject SSC.

The NRC staff does not endorse the examples provided under the specific considerations (pp.

60-61) that permit an LSS determination of an SSC in a safety-significant functional flow path.

The specific conditions and criteria must be justified and documented for the specific SSCs under consideration.

Section 11.1 In addressing regulatory commitments associated with special treatment requirements listed in

§ 50.69(b)(1) for RISC-3 SSCs, the Final Draft of NEI 00-04 specifies that licensees should ensure that any design-related commitments for RISC-3 SSCs continue to be maintained. The NRC staff interprets this guidance as applying to any commitments related to the design-basis functionality of RISC-3 SSCs.

Section 11.2 No specific change control process is established within 10 CFR 50.69 governing changes to the NRC approved categorization process. As part of its approval of the license amendment submittal, the NRC will establish a license condition that governs changes to the categorization process. If a licensee or applicant wishes to change their categorization process, and the change is outside the bounds of the NRCs license condition, then the licensee or applicant will need to seek NRC approval of the revised categorization process.

Section 12 NEI 00-04 identifies a number of reviews that are to be performed following revisions or updates to the PRA as part of a review of the SSC categorization. The NRC believes that the results of the risk sensitivity study, as described in Chapter 8, must be confirmed to still be acceptable following each revision or update of the PRA to ensure that the categorization process is maintained valid. If the risk sensitivity study results indicate a greater than small cumulative risk increase from implementation of § 50.69, then the categorization and/or treatment of SSCs must be revised until an acceptably small risk increase is determined.