ML19198A183

Draft IMC 0609 Appendix a for July 2019 ROP Public Meeting

ML19198A183
Person / Time
Issue date:	07/17/2019
From:	David Aird NRC/NRR/DIRS/IRAB
To:
Aird D, NRR/DIRS, 301-287-0725
References
Download: ML19198A183 (24)

Text

NRC INSPECTION MANUAL APOB INSPECTION MANUAL CHAPTER 0609 APPENDIX A THE SIGNIFICANCE DETERMINATION PROCESS FOR FINDINGS AT-POWER

Table of Contents 0609A-01 PURPOSE ............................................................................................................. 1 0609A-02 BACKGROUND ..................................................................................................... 1 0609A-03 GUIDANCE ........................................................................................................... 1 0609A-04 SCREENING ..................................................................................................... 222 04.01 Initiating Events (Exhibit 1) ................................................................................ 333 04.02 Mitigating Systems (Exhibit 2) ........................................................................... 333 04.03 Barrier Integrity (Exhibit 3) ................................................................................. 776 0609A-05 DETAILED RISK EVALUATION ........................................................................ 776 List of Exhibits Exhibit 1 - Initiating Events Screening Questions Exhibit 2 - Mitigating Systems Screening Questions Exhibit 3 - Barrier Integrity Screening Questions Exhibit 4 - External Events Screening Questions Issue Date: DRAFT i 0609 Appendix A

0609A-01 1.0APPLICABILITYPURPOSE The Significance Determination Process (SDP) described in this Appendix is designed to provide the staff and management with a simplified framework and associated guidance for use in screening at-power findings. This Appendix, aids the user in determining if a finding has a very low safety significance (screens to Green) or directsing the user to other applicable SDP appendices, and or to performrming a detailed risk evaluation.

This SDP is applicable to at-power findings within the Initiating Events, Mitigatingon Systems, and Barrier Integrity cornerstones.

2.0 ENTRY CONDITIONS The SDP described in this appendix is implemented by direction from Inspection Manual Chapter (IMC) 0609, Attachment 4, Initial Characterization of Findings.

0609A-030609A-02

3.0BACKGROUND

Over the years, maintaining the pre-solved tables and risk-informed notebooks from IMC 0609, Appendix A proved to be a challenging task. As plants implemented equipment modifications and associated revisions to the plant risk model, the accuracy of the pre-solved tables and risk-informed notebooks began to degrade. Instead of separately maintaining and updating the plant plant-specific pre-solved tables and risk-informed notebooks, the agency decided to transition to a software-based system called SAPHIRE (Systems Analysis Programs for Hands-on Integrated Reliability Evaluations). Using SAPHIRE a user can perform analyses on a regularly maintained site-specific Standardized Plant Assessment Risk (SPAR) model.

Updating site-specific SPAR models provides an efficient and effective infrastructure that facilitates risk model fidelity. For legacy, reference, and knowledge transfer purposes, the pre-solved tables, risk-informed notebooks, and associated ROP guidance documents will behave been archived.

In the transition from the pre-solved tables and risk-informed notebooks to SAPHIRE and the site-specific SPAR models, it is important to note process differences. The pre-solved tables and risk-informed notebooks, by process, provided a second layer of screening and an estimation of the risk impact of the finding. In lieu of the pre-solved tables and risk-informed notebooks, the SDP Workspace, a module within each SPAR model, was developed. The SDP Workspace performs a delta CDF calculation similar in many respects to the risk estimate performed by use of the risk-informed notebooks. However, use of SDP workspace is no longer intended to provide a prescriptive additional layer of screening beyond that which is outlined in Section 5.0, Screening, of this appendix. Rather, the SDP workspace is one of many tools the inspection staff and SRAs can utilize to support a detailed risk evaluation (see Section 6.0, Detailed Risk Evaluation, for more details).

0609A-040609A-03 4.0SCREENING AND DETAILED RISK EVALUATION This appendix is divided into two functional parts. The first part is a screening tool that uses a series of logic questions to determine whether or not the finding can be characterized as having very low safety significance (i.e., Green) and preclude a more detailed risk evaluation. The Issue Date: DRAFT 1 0609 Appendix A

second part provides guidance in determining the risk significance of a finding that did not screen to Green in part one.

0609A-050609A-04 5.0SCREENING The screening questions are categorized by cornerstone, . As such, there is one set of screening questions for Initiating Events, one for Mitigating Systems, and one for Barrier Integrity (Exhibits 1, 2, and 3 respectively). If more than one cornerstone is affected, the screening questions in all the affected cornerstones apply. In addition, under each cornerstone the screening questions are categorized into sub-sections, so a finding and associated degraded condition might be applicable to more than one subsection. Typically, the inspection staff completes the screening process with support from the regional SRAs, as needed. The screening questions cover a wide range of instances and scenarios, but are not intended to be all inclusive. Therefore, if the inspection staff and/or SRA do not agree with the screening results, other risk tools (e.g., the SDP Workspace) and guidance provided in Section 6.0, Detailed Risk Evaluation, can be used to confirm or challenge the screening results. The screening process also directs the user to other applicable SDP appendices as needed (similar to Table 3 of IMC 0609, Attachment 4).

The screening logic questions are designed to systematically determine whether a degraded condition(s) resulting from a finding is of very low safety significance (i.e., Green) or not. If all the logic questions under the applicable cornerstone(s) do not apply, then the finding is screened as Green and the risk evaluation is complete (assuming that there are no unique technical considerations that need to be assessedthe inspectors do not have any technical reservations with the screening results). Basically, the logic questions under a specific cornerstone are linked by a logical AND in that all the logic questions are required to be not applicable to the degraded condition(s) in order to screen as Green. Conversely, if any one of the logic questions under a specific cornerstone is applicable to the degraded condition(s), the finding cannot be screened as Green and further risk evaluation is warranted. In this case, the logic questions are linked by a logical OR in that only one of the logic questions is required to be applicable to the degraded condition to preclude screening the finding to Green.

In applying the SDP screening questions, inspectors are evaluating the degraded condition in the plant, for which the performance deficiency has been determined to be a proximate cause.

In defining the degraded plant condition, inspectors will need to use their engineering judgment, which should be applied in a reasonable and realistic manner, consistent with previous similar findings, and in a reasonable and realistic manner. Inspectors are not required to have proof of assumptions used in the SDP but must have a reasonable technical basis. See IMC 0308, for additional information on the basis of the SDP.

The duration of a plant degraded condition, i.e., the exposure time, is often an important assumption in the SDP and is specifically used to assess the Mitigating Systems screening questions. The exposure time is the duration or time period that the failed or degraded SSC is reasonably known to have existed. The exposure time used in the SDP may not be equivalent to that used for reportability or operability. Inspectors should consult with an SRA if there are questions about determining the exposure time for a finding. The exposure time is often evaluated against the duration of the Technical Specification (TS) allowed outage times, as these periods are generally known to represent configurations of very low risk significance.

Issue Date: DRAFT 2 0609 Appendix A

Also note that as a risk-informed tool, the at-power SDP is focused on initiating events, mitigating system functions, and barrier integrity functions used in probabilistic risk assessments (PRAs), which may differ from design basis transients and accidents as discussed in the Updated Final Safety Analysis Report (UFSAR).

04.01 Initiating Events (Exhibit 1)

The Initiating Events screening questions are categorized into five sub-sections titled Loss of Coolant Accident (LOCA) Initiators, Transient Initiators, Support System Initiators, Steam Generator Tube Rupture (SGTR), and External Event Initiators. Below is additional guidance to support answering the screening questions for each sub-section:

a. LOCA Initiators - Considers small, medium, and large LOCA initiating events. For SDP purposes, a small LOCA is defined as a steam or liquid break in the reactor coolant system (RCS), other than a SGTR, that exceeds the ability to makeup using normal charging (PWR) or control rod drive (BWR) pump flow. Normal makeup flow may include control room actions to start a standby pump or minimize letdown flow, if appropriate for the situation.

b. Transient Initiators - A transient initiator is an event that results in a reactor trip or scram. Some examples of transients are loss of main feedwater, loss of condenser heat sink, and loss of offsite power (LOOP) events.

c. Support System Initiators - A support system initiator involves a degraded condition of a support system that either causes an initiating event or increases the likelihood of an initiating event AND causes a degraded condition with an increase in the likelihood of a failure of one or more mitigating SSCs. Support systems include SSCs needed to start, operate, or control a front-line system, where the front-line system fulfills a critical safety function. Support system initiating events are a subcategory of initiating events where the failure not only causes a loss or challenge to a safety function, but also adversely affects one or more systems needed to respond to shutdown the reactor. Support system initiatingThese events not only trigger sequences of events that challenge plant control and safety systems whose failure could potentially lead to core damage or large early release, they also fail all or part of those systems used for mitigation. Examples of support system initiators include loss of service water, loss of vital AC/DC power buses, loss of cooling water and loss of instrument air events. Site-specific support system initiators can be identified in the Plant Risk Information eBook (PRIB).

d. SGTR - No additional guidance

e. External Event Initiators - In the Initiating Events cornerstone, the external events of interest are limited to fire and internal flooding. Other external events, in the context of the Initiating Events cornerstone, are not applicable because the licensee does not have control over these events (e.g., tornado, hurricane). However, the licensee does have control over the systems used to mitigate an external event and that is covered in the Mitigating Systems section (Exhibit 2).

04.02 Mitigating Systems (Exhibit 2)

Issue Date: DRAFT 3 0609 Appendix A

The Mitigating Systems screening questions are categorized into four five sub-sections titled Mitigating Systems, Structures, Components (SSCs) and PRA Functionality (except Reactivity Control Systems), ); External Event Mitigatingon Systems (Seismic/Fire/Flood/Severe Weather Protection Degraded), ); Reactivity ControlReactor Protection Systems, ; and Fire Brigade; and Flexible Coping Strategies (FLEX).

Below is additional guidance to support answering the screening questions for each sub-section:

a. Mitigating SSCs and PRA Functionality (except Reactivity Control Systems) - For the purposes of this subsection, the SSCs (and their associated functions) of concern are those that provide a risk significant or risk relevant mitigating function in response to an initiating event, i.e., the PRA function. Normally those SSCs that are in the risk model provide a risk significant or risk relevant function; however, that is not always the case (e.g., some SSCs are not modeled explicitly). There are several ways to determine whether an SSC provides a risk significant or risk relevant mitigating function and below are some sources of information to support this determination:

1) Plant Risk Information eBook (PRIB), (Table 6) - Table 6 lists systems/functions that are included in the SPAR model. It also provides specific success criteria given a particular initiating event. See PRIB definition in Section 6.0, Detailed Risk Evaluation..

2) PRIB, (Table 7) - Table 7 lists the components included in the SPAR model with their associated risk importance measures.

3) SDP Workspace - The SDP workspace contains risk significant and risk relevant SSCs derived from the site-specific SPAR model.

4) UFSAR - Although the systems/functions described in the UFSAR might be different than the systems/functions modeled in the SPAR, the licensed design bases for systems/functions can provide useful information in determining safety significance.

5) Licensee Risk Insights - If provided, risk insights from the licensee risk model (e.g., importance measures, dominant sequences, delta CDF calculations, etc.)

and risk/safety significant SSCs from their maintenance rule program can be a good source of risk information.

PRA function refers to the ways in which the SSC can be used in a PRA to prevent an initiating event from resulting in core damage. An SSC may have more or different PRA functions than those functions for which it is credited in the design or licensing basis.

For example, the design function of the core spray system may be limited to mitigation of large loss of coolant accidents (LOCAs). As such, the accident analysis may define a certain flowrate required to mitigate that accident. However, the core spray system can be credited in a PRA to provide coolant injection in any scenarios in which coolant injection is needed and pressure can be reduced such that the system can operate.

Thus, the PRA function of the core spray system is not limited to the mitigation of large LOCAs and the system may be able to perform some of its other PRA functions without meeting its design flowrate.

A key concept in assessing whether an SSC can perform its PRA function is mission time. A 24 -hour mission time is standard in PRA applications and should be considered in SDP screening as a general rule. The 24-hr mission time used for the purposes of SDP may be different than the time the SSC is required to operate as Issue Date: DRAFT 4 0609 Appendix A

stated in the accident analysis or design basis for the SSC. Inspectors should consult with an SRA for unique situations, or questions about mission time.

When the screening questions refer to a TS allowed outage time (AOT), the AOT is being used to assess the impact of the exposure time during which the SSC could not perform its PRA function. Although TS AOTs were not necessarily derived from risk evaluations, operating experience has shown that an SSC that cannot function for less than its AOT is generally not risk significant. Therefore, a detailed risk evaluation only needs to be performed when the SSC could not function for a period of time greater than that defined in the AOT. For single train systems or single trains within a multi-train system, the period of the AOT is used. For loss of function for two separate TS systems, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is used to determine if a detailed risk evaluation is warranted. For risk-significant, non-TS SSCs, 143 days is used. For plants that have adopted TSTF-505 and implemented risk-informed completion times (RICTs), the frontstop AOT should be used for screening purposes. RICTs may not be applied in retrospect after a degraded condition occurs.

The screening question that refers to loss of system and/or function generally applies to single train systems, or system/function as defined in the PRIB. A system/function is modeled in the PRA but may not have a precise SSC definition. Examples include the recovery of offsite power after a LOOP event, feed and bleed in a PWR plant after AFW system failures, or various plant cross-tie capabilities.

b. External Event Mitigatingon Systems (Seismic/Fire/Flood/Severe Weather Protection Degraded) - No additional guidance

c. Reactivity Control Systems - Reactor Protection System (RPS) - The main focus of the screening question is to screen findings that result in a minor functional degradation of RPS (e.g., one automatic trip from one instrument) but there are several redundant trips that provide the same function (e.g., three other automatic functional trips). If there is a significant functional degradation to RPS, a detailed risk evaluation is warranted. The determination of what a significant or minor functional degradation of RPS should be based on reasonable technical judgment of the inspectors, SRA, and management.

d. Fire Brigade - No additional guidance

e. Flexible Coping Strategies (FLEX) - Following the earthquake and tsunami at the Fukushima Dai-ichi nuclear power plant in March 2011, the NRC issued Order EA 049, which requires licensees to develop a three-phase approach for mitigating the consequences of an extended loss of all alternating current power (ELAP) following a beyond-design-basis external event (BDBEE). The initial phase (Phase 1) requires the use of existing, installed plant equipment and resources to maintain or restore the three key functions of core cooling, containment, and spent fuel pool cooling capabilities. The transition phase (Phase 2) requires providing sufficient, portable, onsite equipment and consumables to maintain or restore the three key functions until they can be accomplished with resources brought from off site. The final phase (Phase 3) requires obtaining sufficient offsite resources to sustain the three key functions indefinitely. The guidance in NEI 12-06 provides one possible approach for licensees to satisfy the requirements of Order EA-12-049. Allowed out of service time for FLEX equipment differs depending on which revision of NEI 12-06 the licensee implemented. This information can be found in the licensees FLEX implementation plan.

Issue Date: DRAFT 5 0609 Appendix A

The NRC also issued NRC Order EA-12-050, which required licensees to install a reliable hardened containment venting system (HCVS) for Mark I and Mark II containments. Order EA-12-050 was later rescinded and replaced by Order EA-13-109 to address containment integrity and release of radioactive materials during severe accident conditions. Order EA-13-109 rescinds Order EA-12-050 and requires licensees to upgrade or replace the reliable hardened vents required by EA-12-050 with a containment venting system designed and installed to remain functional during severe accident conditions. The guidance in NEI 13-02, as endorsed in JLD-ISG-2013-02, provides one possible approach for licensees to satisfy the requirements of Order EA-13-109.

Finally, the NRC issued Order EA-12-051, which requires licensees to provide safety enhancements in the form of reliable spent fuel pool instrumentation for BDBEEs. The guidance in NEI 12-02, as endorsed in JLD-ISG-2012-03, provides one possible approach for licensees to satisfy the requirements of Order EA-12-051.

After implementation of SRM-SECY-16-0142, Orders EA-12-051 and EA-12-049 will be codified in 10 CFR 50.155. The screening questions will continue to apply in accordance with the requirements of 10 CFR 50.155.

For the purposes of this SDP section, a complete loss of function means having less than the minimum amount of equipment required to perform a function (i.e. less than N sets available for use) as indicated in the licensees Final Integrated Plan (FIP). The complete loss criteria is applied on a per hazard basis, meaning that if less than the required amount of equipment used for mitigating a specific hazard is available, then there is a complete loss of function for that specific hazard. A partial loss of function means having less than the minimum amount of equipment required to maintain defense-in-depth of the mitigating strategies (i.e. less than N+1 sets) available for use.

This screening section is intended for use in assessing inspection findings that are associated with equipment, procedures, training, and other programmatic aspects used specifically for satisfying the requirements of Orders EA-12-049, EA-12-051, and EA-13-109. In the event that the equipment serves another function, a different and more limiting SDP tool will be used. For example, if the performance deficiency concerns installed plant equipment that is credited for Phase 1 mitigating strategies (Order EA-12-049), but is also credited for use under normal operating conditions or used to mitigate other transients or accidents (e.g. reactor core isolation cooling pump, turbine-driven auxiliary feedwater pump), the more limiting SDP (e.g., IMC 0609, Appendices A, G, and H) would be used to assess the significance of the issue. This applies to all equipment, procedures, training, and other programmatic aspects that are not credited for the sole purpose of satisfying the requirements of Orders EA-12-049, EA-12-051, and/or EA-13-109. For inspection findings associated with Order EA-12-049, this section is used to screen findings related to all aspects of Phase 1 and Phase 2 mitigating strategies. For findings related to Phase 3 mitigating strategies, this section only applies to that portion of the licensees mitigating strategies that occur after the licensee accepts the delivered equipment at the site from the National Safer Response Centers (NSRC).

Issue Date: DRAFT 6 0609 Appendix A

04.03 Barrier Integrity (Exhibit 3)

The Barrier Integrity screening questions are categorized into four five sub-sections titled Fuel Cladding Integrity, Reactor Coolant System (RCS) Boundary, Reactor Containment, Control Room/Auxiliary/Reactor Building or Spent Fuel Pool Building, and Spent Fuel Pool. Below is additional guidance to support answering the screening questions for each sub-section:

a. Fuel Cladding Integrity - The purpose of this section is to screen findings to Green that do not challenge fuel cladding integrity. For the purposes of this SDP, issues that meet any of the following three criteria represent a challenge to fuel cladding integrity and require further evaluation: (1) placed the plant in an unanalyzed condition, (2) adversely impacted any fundamental assumptions regarding fuel failure used in the accident analysis (such as fuel failure temperature or oxidation rate), or (3) resulted in reactor coolant activity exceeding TS limits.

b. Reactor Coolant System (RCS) Boundary - All issues which address potential violations of regulatory requirements for protection of the reactor pressure vessel against fracture (e.g., pressure-temperature limits, pressurized thermal shock (PTS)) are addressed under the barrier integrity cornerstone and should be reviewed by the applicable technical group in NRR (NRR/DMLR/MVIB). Violations of RPV fracture toughness requirements must be evaluated in accordance with the ASME Code,Section XI, Appendix E, Evaluation of Unanticipated Operating Events which provides deterministic acceptance criteria for evaluating the impact of the out-of-limit condition on the structural integrity of the RPV to determine whether the plant is acceptable for continued operation. All other RCS boundary issues (i.e., leakage) are evaluated under the initiating events cornerstone.

a.c. Reactor Containment - No additional guidance b.d. Control Room/Auxiliary/Reactor Building or Spent Fuel Pool Building - No additional guidance c.e. Spent Fuel Pool - No additional guidance 0609A-060609A-05 6.0DETAILED RISK EVALUATION The inspection staff and regional SRAs should coordinate efforts, using their specific skills, training, and qualifications, to arrive at an appropriate risk evaluation given the specific circumstances associated with the risk impact of the degraded condition(s) that resulted from the finding. Typically, inspectors develop the finding and the associated functional impact on the equipment and gather plant information to support the detailed risk evaluation. Then the inspectors and SRA collaborate to develop appropriate input assumptions while the SRA normally performs the detailed risk evaluation for greater than Green findings using the SPAR model, the RASP handbooks, and other risk information as necessary. When the internal events detailed risk evaluation results are greater than or equal to 1.0E-7, the finding should be evaluated for external event risk contribution. Any internal events results that are less than 1.0E-7 can be evaluated for external event risk contribution at the discretion of the regional Issue Date: DRAFT 7 0609 Appendix A

SRA.1 If an inspector uses the SDP Workspace to perform a detailed risk evaluation, a regional SRA should must review the results to determine if any additional analyses need to be performed.

If more than one cornerstone is affected by the finding and associated degraded condition(s),

the risk evaluation of the finding should take into account all of the associated degraded condition(s) from all of the affected cornerstones. However, for the purposes of the power reactor assessment program, the cornerstone which captures the majority fraction of the overall risk evaluation should be identified as the affected cornerstone. The risk tools and guidance available to the staff to perform the detailed risk evaluation are discussed below:

NOTE: The risk tools (e.g., SDP Workspace) and guidance to support the SDP are designed to have users engaged in the process and avoid a blackbox approach in determining the risk significance of deficient licensee performance. Users need to be aware of the limitations and specific capabilities of each risk tool and associated guidance to preclude misapplication.

SAPHIRE and SPAR Models:

1) SDP Workspace - The SDP Workspace provides the user with a change in core damage frequency (delta CDF), and change in large early release frequency (and delta LERF) calculation with a comprehensive report of results. This tool only accounts for risk associated with internal events (i.e., does not account for external event risk contributions) and cannot be adjusted to change the model (e.g., recovery actions, common cause failure).

2) Event Condition Assessment - A workspace that is used by the SRA that allows the analyst more flexibility in adjusting basic events.

3) General Analysis - A workspace that is used by the SRA that allows more flexibility in adjusting both basic events and model logic.

4) Specific SPAR Model Changes - The SRA can alter the SPAR model logic and create a set of changed basic events to reflect the degraded condition(s) and/or event. This approach provides the most flexibility in performing a delta CDF calculation.

5) Plant Risk Information eBook (PRIB) - The PRIB is a summary document associated with the site-specific SPAR model that provides a variety of risk insights.

1 Until operating experience is gained for AP1000 plants, the finding should be evaluated for external event risk contribution when the internal events detailed risk evaluation results are greater than or equal to 1.0E-8.

Issue Date: DRAFT 8 0609 Appendix A

Changes to SAPHIRE and SPAR Models:

Identified Errors or Discrepancies - Identified errors or discrepancies with SAPHIRE or the site-specific SPAR model should be discussed and vetted by the inspection staff and SRA and then reported to Idaho National Laboratory (INL) via the SAPHIRE webpage at https://saphire.inl.gov/. On the SAPHIRE webpage there is one module to request changes to SAPHIRE (i.e., software) and a separate module to request changes to the SPAR models (which includes changes to the PRIB).

Timely SDP Evaluations - To support the SDP timeliness goal, an SRA may make changes to the SPAR model of record, as appropriate, based on information from the inspectors and/or the licensee, to accurately reflect the risk significance of the finding. The SRA should consult with INL on SPAR model changes. These changes must be documented in the associated inspection report and/or SERP package. The SRA should subsequently review the model changes made to determine if those model changes should be incorporated into the plant SPAR model of record.

Guidance Documents:

1) RASP Handbooks - Volumes 1 (Internal Events), 2 (External Events), and Volume 4 (Shutdown) - These handbooks provide standardized risk guidance and best practices to support determinations across a variety of NRC programs (SDP, Accident Sequence Precursor (ASP), and Management Directive (MD) 8.3, Event Evaluation).

2) NUREGs - There are many NUREGs that can provide useful information when performing a detailed risk evaluation (e.g., initiating event and failure data, common cause failure modeling techniques).

END Issue Date: DRAFT 9 0609 Appendix A

Exhibit 1 - Initiating Events Screening Questions A. Loss of Coolant Accident (LOCA) Initiators

1. After a reasonable assessment of degradation, could the finding result in exceeding the reactor coolant system (RCS) leak rate for a small LOCA (leakage in excess of normal makeup)?

a. If YES Stop. Go to Detailed Risk Evaluation section.

b. If NO, continue.

2. After a reasonable assessment of degradation, could the finding have likely affected other systems used to mitigate a LOCA, resulting in a total loss of their function (e.g.,

Interfacing System LOCA)?

a. If YES Stop. Go to Detailed Risk Evaluation section.

b. If NO, screen as Green.

B. Transient Initiators Did the finding cause a reactor trip AND the loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition (e.g., loss of condenser, loss of feedwater)? Other events include high high-energy line- breaks, internal flooding, and fire.

a. If YES Stop. Go to Detailed Risk Evaluation section.

b. If NO, screen as Green.

C. Support System Initiators

1. Did the degraded condition result in the complete or partial loss of a support system (e.g., component cooling water, service water, instrument air, AC power, DC power)?

Did the finding involve the complete or partial loss of a support system that contributes toincreases the likelihood of, or causes, an initiating event AND affected the loss of mitigation equipment? Examples of support system initiators are loss of offsite power (LOOP), loss of a DC bus, loss of an AC bus, loss of component cooling water (LCCW),

loss of service water (LOSW), and loss of instrument air (LOIA).

a. If YES Stop. Go to Detailed Risk Evaluation section.

b. If NO, screen as Greencontinue.

Issue Date: DRAFT Ex1 - 1 0609 Appendix A

2. Did the degraded condition increase the likelihood of a complete loss of a support system that would result in a plant trip?

a. If YES Stop. Go to Detailed Risk Evaluation section.

b. If NO, screen as Green.

D. Steam Generator Tube Rupture

1. Does the finding involve a degraded steam generator tube condition where one tube cannot sustain 3 three times the differential pressure across a tube during normal full power, steady state operation (3PNO)?

a. If YES Stop. Go to IMC 0609, Appendix J.

b. If NO, continue.

2. Does one or more SGs violate accident leakage performance criterion (i.e., involve degradation that would exceed the accident leakage performance criterion under design basis accident conditions)?.

a. If YES Stop. Go to Detailed Risk Evaluation section and refer to IMC 0609, Appendix J as applicable.

b. If NO, screen as Green.

E. External Event Initiators Does the finding impact the frequency of a fire or internal flooding initiating event?

a. If YES Stop. Go to Detailed Risk Evaluation section.

b. If NO, screen as Green.

Issue Date: DRAFT Ex1 - 2 0609 Appendix A

Exhibit 2 - Mitigating Systems Screening Questions A. Mitigating SSCs and PRA Functionality (except Reactivity Control Systems - see section C below)

1. If the finding is a deficiency affecting the design or qualification of a mitigating SSC, does the SSC maintain its operability or PRA functionality?

a. If YES Screen as Green.

b. If NO, continue.

2. Does the finding degraded condition represent a loss of the PRA function of a single train TS system (such as HPCI/HPCS) for greater than its Tech SpecTS allowed outage time OR the loss of system and/or function as defined in the PRIB for greater than 24 ?

hours?

a. If YES Stop. Go to Detailed Risk Evaluation section.

b. If NO, continue.

3. Does the degraded condition represent a loss of the PRA function of one train of a multi-train TS system for greater than its TS allowed outage time?

a. If YES Stop. Go to Detailed Risk Evaluation section.

b. If NO, continue.

3.4. Does the finding degraded condition represent an actual loss of the PRA function of at least a single Train for > its twice the period allowed by TSTech Spec Allowed Outage Time OR two separate safety TS systems out-of-service for > its Tech Spec Allowed Outage Timegreater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />?

a. If YES Stop. Go to Detailed Risk Evaluation section.

b. If NO, continue.

5. Does the degraded condition represent a loss of a PRA system and/or function as defined in the PRIB or the licensees PRA (such as recovery of offsite power or the ability to feed and bleed) for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />?

a. If YES Stop. Go to Detailed Risk Evaluation section.

b. If NO, continue.

Issue Date: DRAFT Ex2 - 1 0609 Appendix A

4.6. Does the finding degraded condition represent an actuala loss of the PRA function of one or more non-Tech SpecTS trains of equipment designated as high safetyrisk--

significant in accordance with the licensees maintenance rule program for >greater than 24 hrs143 days?

a. If YES Stop. Go to Detailed Risk Evaluation section.

b. If NO, screen as Green.

B. External Event Mitigatingon Systems (Seismic/Fire/Flood/Severe Weather Protection Degraded)

Does the finding involve the loss or degradation of equipment or function specifically designed to mitigate a seismic, flooding, or severe weather initiating event (e.g., seismic snubbers, flooding barriers, tornado doors) for greater than 14 days?

a. If YES Go to Exhibit 4.

b. If NO, screen as Green.

C. Reactivity ControlReactor Protection Systems (RPS)

Did the finding affect a single reactor protection system (RPS) trip signal to initiate a reactor scram AND the function of other redundant trips or diverse methods of reactor shutdown (e.g., other automatic RPS trips, alternate rod insertion, or manual reactor trip capacity)?

a. If YES Stop. Go to Detailed Risk Evaluation section.

b. If NO, screen as Green, continue.

D. Fire Brigade

1. Does the finding involve fire brigade training, and qualifications, drill performance, requirements, or brigade staffing?

a. If YES check if one or more of the following appliesy:

The finding did would not have significantly affected the ability of the fire brigades to respond to a fire.

The overall time duration (exposure time) that the Fire Brigade was understaffed was short (< 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />).

b. If at least one of the above is checked screen as Green.

c. If NO, continue.

Issue Date: DRAFT Ex2 - 2 0609 Appendix A

2. Does the finding involve the response time of the fire brigade to a fire?

a. If YES check if one or more of the following apply:

The fire brigades response time was mitigated by other defense-in-depth elements, such as area combustible loading limits were not exceeded, installed fire detection systems were functional, and alternate means of safe shutdown were not impacted.

The finding involved risk-significant fire areas that had automatic suppression systems.

The licensee had adequate fFire pProtection compensatory actions in place.

b. If at least one of the above is checked screen as Green.

c. If NO, continue.

3. Does the finding involve fire extinguishers, fire hoses, or fire hose stations?

a. If YES check if one or more of the following apply:

There was no degraded fire barrier and the fire scenario did not require the use of water to extinguish the fire.

The missing fire extinguisher or fire hose was missing for a short time and other extinguishers or hose stations were in the vicinity.

b. If at least one of the above is checked screen as Green.

c. If none of the boxes under D.1.a, D.2.a, or D.3.a are checked Stop. Go to IMC 0609, Appendix M.

E. Flexible Coping Strategies (FLEX)

1. Is the inspection finding associated with equipment, training, procedures, and/or other programmatic aspects credited for the sole purpose of satisfying the requirements of Orders EA-12-051 (Spent Fuel Pool Instrumentation) and/or EA-13-109 (Containment Venting) (i.e., not credited for satisfying EA-12-049 as well)?

a. If YES Screen as Green.

b. If NO, continue.

Issue Date: DRAFT Ex2 - 3 0609 Appendix A

2. Does the inspection finding involve a failure, unavailability, or degradation of equipment credited for use in satisfying the requirements of Order EA-12-049 that would result in a complete or partial loss of the ability to maintain or restore core cooling or containment capabilities for an exposure period greater than the out of service time allowed in the licensees FLEX implementation plan (varies based on which revision of NEI 12-06 the licensee implemented)?

a. If YES Stop. Go to Detailed Risk Evaluation section.

b. If NO, continue.

3. Does the inspection finding involve deficient procedure(s), training, and/or other programmatic aspects credited for satisfying the requirements of Order EA-12-049 that would result in a complete or partial loss of the ability to maintain or restore core cooling or containment capabilities for an exposure period greater than the out of service time allowed in the licensees FLEX implementation plan (varies based on which revision of NEI 12-06 the licensee implemented)?

a. If YES Stop. Go to Detailed Risk Evaluation section.

b. If NO, screen as Green.

Issue Date: DRAFT Ex2 - 4 0609 Appendix A

Exhibit 3 - Barrier Integrity Screening Questions A. Fuel Cladding Integrity

1. Did the finding involve control manipulations that unintentionally added positive reactivity that challenged fuel cladding integrity (e.g., inadvertent boron dilution, cold water injection, two or more inadvertent control rod movements, recirculation pump speed control)?

a. If YES, Stop. Go to IMC 0609, Appendix M.

b. If NO, continue.

2. Did the finding result in a mismanagement of reactivity by operator(s) that challenged fuel cladding integrity (e.g., reactor power exceeding the licensed power limit, inability to anticipate and control changes in reactivity during crew operations)?

a. If YES, Stop. Go to IMC 0609, Appendix M.

b. If NO, continue.

3. Did the finding result in the mismanagement of the foreign material exclusion or reactor coolant chemistry control program that resulted in extensive degradation ofchallenged fuel cladding integrity (e.g., loose parts, material controls)?

a. If YES, Stop. Go to IMC 0609, Appendix M.

b. If NO, screen as Green.

A.B. Reactor Coolant System (RCS) Boundary (e.g., pressurized thermal shock issues)

Does the finding involve potential non-compliance with regulatory requirements for protection of the reactor pressure vessel against fracture (e.g., pressure-temperature limits or pressurized thermal shock issues)?

a. If YES Stop. Go to Detailed Risk Evaluation section and consult the appropriate technical branch in NRR (NRR/DMLR/MVIB).

b. If NO, screen as Green.

Issue Date: DRAFT Ex3 - 1 0609 Appendix A

C. Reactor Containment:

1. Does the finding represent an actual open pathway in the physical integrity of reactor containment (valves, airlocks, etc), failure of containment isolation system (logic and instrumentation), failure of containment pressure control equipment (including SSCs credited for compliance with Order EA-13-109), and failure of containment heat removal components, or failure of the plants severe accident mitigation features (AP1000)?

a. If YES Stop. Go to IMC 0609, Appendix H.

b. If NO, continue.

2. Does the finding involve an actual reduction in function of hydrogen igniters in the reactor containment?

a. If YES Stop. Go to IMC 0609, Appendix H.

b. If NO, screen as Green.

D. Control Room, Auxiliary, Reactor, or Spent Fuel Pool Building:

1. Does the finding only represent a degradation of the radiological barrier function provided for the control room, or auxiliary building, or spent fuel pool, or SBGT system (BWR), or EGTS system (PWR ice condenser)?

a. If YES Stop. Screen as Green.

b. If NO, continue.

2. Does the finding represent a degradation of the barrier function of the control room against smoke or a toxic atmosphere?

a. If YES Stop. Go to Detailed Risk Evaluation section.

b. If NO, screen as Green.

E. Spent Fuel Pool (SFP)

1. Does the finding adversely affect decay heat removal capabilities from the spent fuel pool causing the pool temperature to exceed the maximum analyzed temperature limit specified in the site-specific licensing basis?

a. If YES Stop. Go to IMC 0609, Appendix M.

b. If NO, continue.

Issue Date: DRAFT Ex3 - 2 0609 Appendix A

2. Does the finding result from fuel handling errors, dropped fuel assembly, dropped storage cask, or crane operations over the SFP that caused mechanical damage to fuel clad AND a detectible release of radionuclides?

a. If YES Stop. Go to IMC 0609, Appendix M (refer to IMC 0609, Appendix C as applicable).

b. If NO, continue.

3. Does the finding result in a loss of spent fuel pool water inventory decreasing below the minimum analyzed level limit specified in the site-specific licensing basis?

a. If YES Stop. Go to IMC 0609, Appendix M.

b. If NO, continue.

4. Does the finding affect the SFP neutron absorber, fuel bundle misplacement (i.e., fuel loading pattern error) or soluble Boron concentration (PWRs only)?

a. If YES Stop. Go to IMC 0609, Appendix M.

b. If NO, screen as Green.

Issue Date: DRAFT Ex3 - 3 0609 Appendix A

Exhibit 4 - External Events Screening Questions

1. If the equipment or safety function is assumed to be completely failed or unavailable, are ANY of the following three statements TRUE? The loss of this equipment or function by itself during the external initiating event it was intended to mitigate:

would cause a plant trip or an initiating event would degrade two or more trains of a multi-train system or function; would degrade one or more trains of a system that supports a risk significant system or function.

a. If YES Stop. Go to Detailed Risk Evaluation section.

b. If NO, Continue.

2. Does the finding involve the total loss of any safety PRA function, identified by the licensee through a PRA, IPEEE, or similar analysis, that contributes to external event initiated core damage accident sequences (i.e., initiated by a seismic, flooding, or severe weather event)?

a. If YES Stop. Go to Detailed Risk Evaluation section.

b. If NO, screen as Green.

Issue Date: DRAFT Ex4-1 0609 Appendix A

ATTACHMENT 1 Revision History for IMC 0609 Appendix A Comment Resolution Accession Description of and Closed Feedback Commitment Number Training Required Form Accession Tracking Description of Change Issue Date and Completion Number (Pre-Number Change Notice Date Decisional, Non-Public Information) 04/21/00 Initial issue CN 00-007 12/28/00 Revised to incorporate changes based on inspector CN 00-029 feedback. Enhancements generated by IIPB and SPSB risk analysts based on initial implementation experience to date have also been added. A significant change is the credit given for operator actions in step 2.3 of the document. Clarification changes have also been made to the phase 1 screening worksheets. Phase 2 worksheets are in the process of being updated to include plant and site specific information. This document is an integral part of the Significant Determination Process for reactor inspection findings for At-Power operations and will be used by resident and region-based inspectors as well as by SRAs.

02/05/01 Revised to correct formatting problems with charts and CN 01-003 tables, and to make minor editorial changes.

03/18/02 Revised: 1) to correct identified problems with the CN 02-009 appendix, 2) to incorporate the rules for using the site specific risk-informed inspection notebook, 3) to simplify the process of accounting for external initiators in characterizing the risk significant inspection findings, and 4) to provide guidance on evaluating concurrent inspection findings.

Issue Date: DRAFT Att1-1 0609 Appendix A

Comment Resolution Accession Description of and Closed Feedback Commitment Number Training Required Form Accession Tracking Description of Change Issue Date and Completion Number (Pre-Number Change Notice Date Decisional, Non-Public Information)

ML042600558 Multiple editorial changes to enhance user friendliness N/A 09/10/04 of the document. For example, re-format action steps, CN 04-023 provided additional examples, added the reference to Appendix J for steam generator issues.

ML043560116 Corrected two errors on page 4 of the worksheet, under N/A 12/01/04 MS cornerstone for screening issues and under BI CN 04-027 cornerstone guidance for question 3 for screening to Green.

ML052790196 Enhanced guidance to help meet timeliness N/A 11/22/05 requirements for finalizing the SDP for inspection CN 05-030 findings.

ML063470288 Incorporate references to the site-specific inspection 1. Training has ML070720624 03/23/07 notebooks and associated Pre-Solved Tables; In been provided to CN 07-011 Attachment 2, update the site specific risk-informed the SRAs at last inspection notebooks usage rules; Attachment 3, two SRA provide user guidance for screening of external events counterpart risk contributions. meetings, and the SRAs have provided training to the region based and resident inspectors (10/2006)

2. Formalized training will be introduced through the P-111 course (FY 2008)

Issue Date: DRAFT Att1-2 0609 Appendix A

Comment Resolution Accession Description of and Closed Feedback Commitment Number Training Required Form Accession Tracking Description of Change Issue Date and Completion Number (Pre-Number Change Notice Date Decisional, Non-Public Information)

ML063060377 Removed the Phase 1 Initial Screening and N/A ML073460588 01/10/08 Characterization of Findings process to create the new CN 08-002 IMC 0609, Attachment 4. Added clarification statement to Step 2.1.2 and Usage Rule 1.1 that the maximum exposure time used in SDP is limited to one year.

ML101400574 Updated the guidance to reflect the transition from the Senior Reactor ML12142A091 06/19/12 pre-solved tables and risk-informed notebooks to Analysts and CN 12-010 SAPHIRE and the site-specific SPAR models. Moved headquarters staff Closed FBF:

the Initiating Events, Mitigating Systems, and Barrier provided detailed 0609.04-1458 Integrity screening questions from IMC 0609, instructor-led ML12171A225 Attachment 4 to this appendix. Incorporated feedback training to resident 0609A-1575 from ROPFFs 0609.04-1458 and 0609A-1575. This is a inspectors, region ML12171A231 complete reissue. based inspectors, and other regional staff.

June 2012 MLXXXXXXX Made draft publicly available to discuss at the July 31, N/A N/A 7/XX/19 2019 ROP monthly public meeting.

Issue Date: DRAFT Att1-3 0609 Appendix A

Comment Resolution Accession Description of and Closed Feedback Commitment Number Training Required Form Accession Tracking Description of Change Issue Date and Completion Number (Pre-Number Change Notice Date Decisional, Non-Public Information)

ML19011A338 Updated guidance to direct users to contact NRR for ML19014A063 Date TBD issues with pressure-temperature limits (ROPFF 0609A-CN 2070), moved some of the reactivity control questions to Closed ROPFFs the barrier integrity cornerstone exhibit to align with IMC 0609A-2070, 0612 (ROPFF 0609A-2134), revised the fire brigade ML19014A104 and support system initiator questions for clarity 0609A-2134 (ROPFFs 0609A-2167 and 2311), added a question ML19014A205 regarding fuel cladding integrity, separated and revised 0609A-2167 the mitigating systems questions to account for single ML19014A106 train systems and PRA functions (ROPFFs 0609A-2260 0609A-2260 and 2318), and incorporated FLEX questions from IMC ML19014A107 0609 Appendix O. 0609A-2311 ML19014A108 This revision incorporated feedback from ROPFFs 0609A-2318 0609A-2070, 2134, 2167, 2260, 2311, and 2318. ML19014A109 Issue Date: DRAFT Att1-4 0609 Appendix A