ML12017A054

Draft Regulatory Guide DG-1287, (Proposed Revision 2 to Regulatory Guide 1.777, Dated May 2011) an Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications

ML12017A054
Person / Time
Issue date:	05/31/2012
From:	NRC/RES/DRA/PRB
To:
Gilbertson A, RES/DRA/PRB
Shared Package
ML12013A102	List: ML12017A054 ML12017A059
References
DG-1287 RG-1.777, Rev 2
Download: ML12017A054 (38)

Text

U.S. NUCLEAR REGULATORY COMMISSION May 2012 OFFICE OF NUCLEAR REGULATORY RESEARCH Division 1 DRAFT REGULATORY GUIDE

Contact:

A. Gilbertson (301) 251-7592 DRAFT REGULATORY GUIDE DG-1287 (Proposed Revision 2 to Regulatory Guide 1.177, dated May 2011)

AN APPROACH FOR PLANT-SPECIFIC, RISK-INFORMED DECISIONMAKING: TECHNICAL SPECIFICATIONS A. INTRODUCTION The US Nuclear Regulatory Commissions (NRCs) policy statement on probabilistic risk assessment (PRA) (Ref. 1) encourages greater use of this analysis technique to improve safety decisionmaking and improve regulatory efficiency. The NRC staffs Risk-Informed and Performance-Based Plan (RPP) formerly known as the PRA Implementation Plan (Ref. 2) describes current or planned activities to expand use of this analytical method. One activity under way in response to the policy statement is the use of PRA in support of decisions to modify an individual plants technical specifications (TS).

License amendment requests for TS changes that are consistent with currently approved staff positions (e.g., regulatory guides, standard review plans, branch technical positions, or the Standard Technical Specifications (STS) (Refs. 3-7)) are normally evaluated by the staff using traditional engineering analyses. A licensee would not be expected to submit risk information in support of the proposed change. Licensee-initiated TS change requests that go beyond current staff positions may be evaluated by the staff using traditional engineering analyses as well as the risk-informed approach set forth in this regulatory guide. A licensee may be requested to submit supplemental risk information if such information is not provided in the original submittal by the licensee. If risk information on the proposed TS change is not provided to the staff, the staff will review the information provided by the licensee to determine whether the application can be approved based upon the information provided using traditional methods and will either approve or reject the application based upon the review.

The guidance provided within this guide does not preclude other approaches for requesting changes to the TS. Rather, this regulatory guide is intended to improve consistency in regulatory decisions when the results of risk analyses are used to help justify TS changes.

This regulatory guide is being issued in draft form to involve the public in the early stages of the development of a regulatory position in this area. It has not received final staff review or approval and does not represent an official NRC final staff position.

Public comments are being solicited on this draft guide (including any implementation schedule) and its associated regulatory analysis or value/impact statement. Comments should be accompanied by appropriate supporting data. Written comments may be submitted to the Rules, Announcements, and Directives Branch, Office of Administration, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; submitted through the NRCs interactive rulemaking Web page at http://www.nrc.gov; or faxed to (301) 492-3446. Copies of comments received may be examined at the NRCs Public Document Room, 11555 Rockville Pike, Rockville, MD. Comments will be most helpful if received by June 29, 2012.

Electronic copies of this draft regulatory guide are available through the NRCs interactive rulemaking Web page (see above); the NRCs public Web site under Draft Regulatory Guides in the Regulatory Guides document collection of the NRC Library at http://www.nrc.gov/reading-rm/doc-collections/; and the NRCs Agencywide Documents Access and Management System (ADAMS) at http://www.nrc.gov/reading-rm/adams.html, under Accession No. ML12017A054. The regulatory analysis may be found in ADAMS under Accession No. ML12017A059.

The NRC issues regulatory guides to describe to the public methods that the staff considers acceptable for use in implementing specific parts of the agency=s regulations, to explain techniques that the staff uses in evaluating specific problems or postulated accidents, and to provide guidance to applicants. Regulatory guides are not substitutes for regulations and compliance with them is not required.

This regulatory guide contains information collection requirements covered by 10 CFR Part 50 and 10 CFR Part 52 that the Office of Management and Budget (OMB) approved under OMB control number 3150 0011 and 3150-0151, respectively. The NRC may neither conduct nor sponsor, and a person is not required to respond to, an information collection request or requirement unless the requesting document displays a currently valid OMB control number. This regulatory guide is a rule as designated in the Congressional Review Act (5 U.S.C. 801-808). However, OMB has not found it to be a major rule as designated in the Congressional Review Act.

Harmonization with International Standards The International Atomic Energy Agency (IAEA) has established a series of safety guides and standards constituting a high level of safety for protecting people and the environment. IAEA safety guides present international good practices and increasingly reflects best practices to help users striving to achieve high levels of safety. Pertinent to this regulatory guide, IAEA Safety Guide SSG-3, Development and Application of Level 1 Probabilistic Safety Assessment for Nuclear Power Plants Specific Safety Guide, issued April 2010, and SSG-4, Development and Application of Level 2 Probabilistic Safety Assessment for Nuclear Power Plants Specific Safety Guide, issued May 2010 address probabilistic risk assessment concepts. The safety guides provide recommendations for performing or managing a probabilistic safety assessment project for nuclear power plants and using it to support safe design and operation. This regulatory guide discusses some of the same principles with respect to making changes to a plants technical specifications.

B. DISCUSSION Reason for Change (or Issue)

The NRC staff is revising this guide to update the defense-in-depth language using precise language to assure the defense-in-depth philosophy is interpreted and implemented consistently.

Background

Section 182a of the Atomic Energy Act of 1954, as amended, requires that applicants for nuclear power plant operating licenses state the following:

[S]uch technical specifications, including information of the amount, kind, and source of special nuclear material required, the place of the use, the specific characteristics of the facility, and such other information as the Commission may, by rule or regulation, deem necessary in order to enable it to find that the utilization...of special nuclear material will be in accord with the common defense and security and will provide adequate protection to the health and safety of the public. Such technical specifications shall be a part of any license issued.

In Title 10 of the Code of Federal Regulations (10 CFR) Section 50.36, Technical Specifications, the Commission established its regulatory requirements related to the content of TS. In doing this, the Commission emphasized matters related to the prevention of accidents and the mitigation DG-1287, Page 2

of accident consequences; the Commission noted that applicants were expected to incorporate into their TS those items that are directly related to maintaining the integrity of the physical barriers designed to contain radioactivity (Ref. 8). Pursuant to 10 CFR 50.36, TS for operating nuclear power reactors are required to include items in the following categories: (1) safety limits, limiting safety system settings, and limiting control settings, (2) limiting conditions for operation, (3) surveillance requirements, (4) design features, and (5) administrative controls.

Since the mid-1980s, the NRC has been reviewing and granting improvements to TS based, at least in part, on PRA insights. Some of these improvements have been proposed by the nuclear steam supply system (NSSS) owners groups to apply to an entire class of plants. Many others have been proposed by individual licensees. Typically, the proposed improvements involved a relaxation of one or more completion times (CTs) or surveillance frequencies (SFs) in the TS.1 In its Final Policy Statement on Technical Specification Improvements for Nuclear Power Reactors, dated July 22, 1993 (Ref. 9), the Commission stated that it:

expects that licensees, in preparing their Technical Specification related submittals, will utilize any plant-specific PSA or risk survey and any available literature on risk insights and PSAs. Similarly, the NRC staff will also employ risk insights and PSAs in evaluating Technical Specifications related submittals. Further, as a part of the Commissions ongoing program of improving Technical Specifications, it will continue to consider methods to make better use of risk and reliability information for defining future generic Technical Specification requirements.

The Commission reiterated this point when it issued the revision to 10 CFR 50.36 in July 1995 (Ref. 10).

In August 1995, the NRC adopted the policy statement, including the following regarding the expanded use of PRA (Ref. 1):

• The use of PRA technology should be increased in all regulatory matters to the extent supported by the state-of-the-art in PRA methods and data and in a manner that complements the NRCs deterministic approach and supports the NRCs traditional defense-in-depth philosophy.

• PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and importance measures) should be used in regulatory matters, where practical within the bounds of the state-of-the-art, to reduce unnecessary conservatism associated with current regulatory requirements, regulatory guides, license commitments, and staff practices. Where appropriate, PRA should be used to support the proposal for additional regulatory requirements in accordance with 10 CFR 50.109 (Backfit Rule). Appropriate procedures for including PRA in the process for changing regulatory requirements should be developed and followed.

It is, of course, understood that the intent of this policy is that existing rules and regulations shall be complied with unless these rules and regulations are revised.

1 The improved STSs (Refs. 3-7) (NUREGs-1430-1434) use the terminology completion time and surveillance frequency in place of allowed outage time and surveillance test interval.

DG-1287, Page 3

• PRA evaluations in support of regulatory decisions should be as realistic as practicable and appropriate supporting data should be publicly available for review.

• The Commissions safety goals for nuclear power plants and subsidiary numerical objectives are to be used with appropriate consideration of uncertainties in making regulatory judgments on need for proposing and backfitting new generic requirements on nuclear power plant licensees.

In its approval of the policy statement, the Commission articulated its expectation that implementation of the policy statement will improve the regulatory process in three areas: (1) foremost, through safety decisionmaking enhanced by the use of PRA insights, (2) through more efficient use of agency resources, and (3) through a reduction in unnecessary burdens on licensees.

Purpose of this Regulatory Guide This regulatory guide describes methods acceptable to the NRC staff for assessing the nature and impact of proposed TS changes by considering engineering issues and applying risk insights. Licensees submitting risk information (whether on their own initiative or at the request of the staff) should address each of the principles of risk-informed regulation discussed in this regulatory guide. Licensees should identify how chosen approaches and methods (whether they are quantitative or qualitative, traditional or probabilistic), data, and criteria for considering risk are appropriate for making the necessary decision.

This regulatory guide provides the staffs recommendations for utilizing risk information to evaluate changes to nuclear power plant TS CTs and SFs in order to assess the impact of such proposed changes on the risk associated with plant operation. The guidance provided here does not preclude other approaches for requesting TS changes. Rather, this regulatory guide is intended to improve consistency in regulatory decisions related to TS changes in which the results of risk analyses are used to help justify the change. As such, this regulatory guide, the use of which is voluntary, provides guidance concerning an approach that the NRC has determined to be acceptable for analyzing issues associated with proposed changes to a plants TS and for assessing the impact of such proposed changes on the risk associated with plant design and operation. Additional or revised guidance might be provided for new reactors (e.g.,

advanced light-water reactors) licensed under 10 CFR Part 52, "Licenses, Certifications, and Approvals for Nuclear Power Plants.

Other types of TS changes that follow the principles outlined in this regulatory guide may be proposed and will be considered on their own merit.

Scope of this Regulatory Guide This regulatory guide describes an acceptable approach for assessing the nature and impact of proposed TS changes in CTs and SFs by considering engineering issues and applying risk insights.

Assessments should consider relevant safety margins and defense-in-depth attributes, including considering success criteria as well as equipment functionality, reliability, and availability. This guide also provides guidelines for evaluating such information.

This regulatory guide also describes acceptable TS change implementation strategies and performance monitoring plans that will help to ensure that assumptions and analyses supporting the change are verified.

DG-1287, Page 4

This regulatory guide indicates an acceptable level of documentation that will enable the staff to reach a finding that the licensee has performed a sufficiently complete and scrutable TS change analysis and that the results of the engineering evaluations support the licensees request for the TS change.

Risk-informed TS submittals may address either permanent changes to TS requirements or one-time only changes. Once approved, permanent changes apply to all future occurrences. A one-time only change to a TS requirement is requested for a particular condition and for a specified period, typically for a CT. This regulatory guide provides guidance for both permanent and one-time only CT changes to TS.

Relationship to Other Guidance Documents Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis (Ref. 11), describes a general approach to risk-informed regulatory decisionmaking and discusses specific topics common to all risk-informed regulatory applications. This regulatory guide provides guidance specifically for risk-informed TS changes consistent with but more detailed than the generally applicable guidance given in Regulatory Guide 1.174.

Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities (Ref. 12), describes one acceptable approach for determining whether the technical adequacy of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the results, such that the PRA can be used in regulatory decisionmaking for light water reactors.

Risk-Informed Philosophy In its approval of the policy statement on the use of PRA methods in nuclear regulatory activities, the Commission stated its expectation that the use of PRA technology should be increased in all regulatory matters...in a manner that complements the NRCs deterministic approach and supports the NRCs traditional defense-in-depth philosophy (Ref. 1). The use of risk insights in licensee submittals requesting TS changes will assist the staff in the disposition of such licensee proposals.

The NRC staff has defined an acceptable approach to analyzing and evaluating proposed TS changes. This approach supports the NRCs desire to base its decisions on the results of traditional engineering evaluations, supported by insights (derived from the use of PRA methods) about the risk significance of the proposed changes. Decisions concerning proposed changes are expected to be reached in an integrated fashion, considering traditional engineering and risk information, and may be based on qualitative factors as well as quantitative analyses and information.

In implementing risk-informed decisionmaking, TS changes are expected to meet a set of key principles. Some of these principles are written in terms typically used in traditional engineering decisions (e.g., defense-in-depth). Although written in these terms, it should be understood that risk analysis techniques can be, and are encouraged to be, used to help ensure and show that these principles are met. These principles include the following:

1. The proposed change meets the current regulations unless it is explicitly related to a requested exemption. Applicable rules and regulations that form the regulatory basis for TS are discussed in Regulatory Position 2.1 of this regulatory guide.

DG-1287, Page 5

2. The proposed change is consistent with the defense-in-depth philosophy. The guidance contained in Regulatory Position 2.2.1 of this regulatory guide applies the various aspects of maintaining defense-in-depth to the subject of changes in TS.

3. The proposed change maintains sufficient safety margins. The guidance contained in Regulatory Position 2.2.2 of this regulatory guide applies various aspects of maintaining sufficient safety margin to the subject of changes to TS.

4. When proposed changes result in an increase in core damage frequency (CDF) or risk, the increases should be small and consistent with the intent of the Commissions Safety Goal Policy Statement. Regulatory Position 2.3 of this regulatory guide provides guidance for meeting this principle.

5. The impact of the proposed change should be monitored using performance measurement strategies. The three-tiered implementation approach discussed in Regulatory Position 3.1 and Maintenance Rule (i.e., 10 CFR 50.65, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants) control discussed in Regulatory Position 3.2 provide guidance in meeting this principle.

Regulatory Guide 1.174 provides additional information regarding the staffs expectations with respect to implementation of these principles. Each of these principles should be considered in the risk-informed, integrated decisionmaking process, as illustrated in Figure 1.

Figure 1 Principles of risk-informed integrated decisionmaking Figure 2 Principal elements of risk-informed, plant-specific decisionmaking DG-1287, Page 6

A Four-Element Approach to Integrated Decisionmaking for Risk-Informed TS Changes Given the principles of risk-informed decisionmaking discussed above, licensees are expected to follow a certain evaluation approach and the acceptance guidelines that follow from those principles in implementing these principles. The staff has identified a four-element approach to evaluating proposed changes to a plants design, operations, and other activities that require NRC approval (illustrated in Figure 2), as described in Regulatory Guide 1.174 (Ref. 11). Those detailed discussions regarding the evaluation approach and acceptance guidelines are not repeated here; instead, specific application of the four-element approach for risk-informed changes to TS is discussed.

Element 1: Define the Proposed Change The licensee needs to identify explicitly the particular TS that the proposed change affects and identify available engineering studies (e.g., topical reports), methods, codes, and PRA studies related to the proposed change. The licensee should also determine how the affected systems, components, or parameters are modeled in the PRA and should identify all elements of the PRA that the change impacts.

This information should be used collectively to provide a description of the TS change and to outline the method of analysis. The licensee should describe the proposed change and how it meets the objectives of the Commissions PRA Policy Statement, including enhanced decisionmaking, more efficient use of resources, and reduction of unnecessary burden. Regulatory Position 1 of this regulatory guide describes Element 1 in more detail.

Element 2: Perform Engineering Analysis The licensee should examine the proposed TS change to verify that it meets existing applicable rules and regulations. In addition, the licensee should determine how the change impacts defense-in-depth aspects of the plants design and operation and should determine the adequacy of safety margins following the proposed change. The licensee should consider how plant and industry operating experience relates to the proposed change, and whether potential compensatory measures could be taken to offset any negative impact from the proposed change.

The licensee should also perform risk-informed evaluations of the proposed change to determine the impact on plant risk. The evaluation should explicitly consider the specific plant equipment affected by the proposed TS changes and the effects of the proposed change on the functionality, reliability, and availability of the affected equipment. The necessary scope and level of detail of the analysis depends upon the particular systems and functions that are affected, and it is recognized that there will be cases for which a qualitative, rather than quantitative, risk analysis is acceptable.

The licensee should provide the rationale that supports the acceptability of the proposed changes by integrating probabilistic insights with traditional considerations to arrive at a final determination of risk. The determination should consider continued conformance to applicable rules and regulations, the adequacy of the traditional engineering evaluation of the proposed change, and the change in plant risk relative to the acceptance guidelines. All these areas should be adequately addressed before the change is considered acceptable. Specific guidance for an acceptable approach for performing engineering evaluations of changes to TS is found in Regulatory Position 2.

Element 3: Define Implementation and Monitoring Program The licensee should consider implementation and performance monitoring strategies formulated to ensure (1) that no adverse safety degradation occurs because of the changes to the TS and (2) that the engineering evaluation conducted to examine the impact of the proposed changes continues to reflect the DG-1287, Page 7

actual reliability and availability of TS equipment that has been evaluated. This will ensure that the conclusions that have been drawn from the evaluation remain valid. Specific guidance for Element 3 is provided in Regulatory Position 3.

Element 4: Submit Proposed Change The final element involves documenting the analyses and submitting the license amendment request. The NRC will review the submittal according to the NRC regulations governing license amendments (e.g., 10 CFR 50.90, Applications for Amendment of License, Construction Permit, or Early Site Permit, 10 CFR 50.91, Notice for Public Comment; State Consultation, and 10 CFR 50.92, Issuance of Amendment) and Section 16.1, Risk-Informed Decision Making: Technical Specifications of the Standard Review Plan (SRP) (Ref. 13). Guidance on documentation and submittals for risk-informed TS change evaluations is in Regulatory Position 4 of this regulatory guide.

C. STAFF REGULATORY GUIDANCE

1. Element 1: Define the Proposed Changes 1.1 Reason for Proposed Change The reasons for requesting the TS change or changes should be stated in the submittals, along with information that demonstrates that the extent of the change is needed. Generally, acceptable reasons for requesting TS changes fall into one or more of the categories below.

1.1.1 Improvement in Operational Safety The reason for the TS change may be to improve operational safety (i.e., a reduction in the plant risk or a reduction in occupational exposure of plant personnel in complying with the requirements).

1.1.2 Consistency of Risk Basis in Regulatory Requirements The TS changes requested can be supported based on their risk implications. TS requirements can be changed to reflect improved design features in a plant or to reflect equipment reliability improvements that make a previous requirement unnecessarily stringent or ineffective. The TS may also be changed to establish consistently based requirements across the industry or across an industry group.

The licensee must ensure that the risk resulting from the change remains acceptable.

1.1.3 Reduce Unnecessary Burdens A licensee may request the change to reduce unnecessary burdens in complying with current TS requirements based on the operating history of the plant or industry in general. For example, in specific instances, the repair time needed may be longer than the CT defined in the TS. The required surveillance may lead to plant transients, result in unnecessary equipment wear, result in excessive radiation exposure to plant personnel, or place unnecessary administrative burdens on plant personnel that are not justified by the safety significance of the surveillance requirement. In some cases, the change may provide operational flexibility; in those cases, the change might allow an increased allocation of the plant personnels time to more safety-significant aspects.

In some cases, licensees may determine that there is a common need for a TS change among several licensees and that it is beneficial to request the changes as a group rather than individually. Group submittals can be advantageous when the equipment being considered in the change is similar across all DG-1287, Page 8

plants in the group. Plant-specific information with regard to the engineering evaluations described in Regulatory Position 2 must still be provided. However, the group may be able to draw generic conclusions from a compilation of the plant-specific data. In addition, there will be benefits from cross-comparison of the results of the plant-specific evaluations.

2. Element 2: Engineering Evaluation As part of the second element, the licensee should evaluate the proposed TS change with regard to the principles that (1) adequate defense-in-depth is maintained, (2) sufficient safety margins are maintained, and (3) proposed increases in core damage frequency and risk are small and are consistent with the intent of the Commissions Safety Goal Policy Statement.

Licensees are expected to provide strong technical bases for any TS change. The technical bases should be rooted in traditional engineering and system analyses. TS change requests based on PRA results alone should not be submitted for review. TS change requests should give proper attention to the integration of considerations, such as conformance to the STS, generic applicability of the requested change if it is different from the STS, operational constraints, manufacturer recommendations, and practical considerations for test and maintenance. Standard practices used in setting CTs and SFs should be followed (e.g., CTs normally are 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, 7 days, 14 days, and so on, and SFs normally are once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, 7 days, 1 month, 3 months, and so on.) Using such standards greatly simplifies implementation, scheduling, monitoring, and auditing. Logical consistency among the requirements should be maintained, (e.g., CT requirements for multiple trains out of service should not be longer than that for one of the constituent trains).

2.1 Compliance with Current Regulations In evaluating proposed changes to TS, the licensee must ensure that the current regulations, orders, and license conditions are met, consistent with Principle 1 of risk-informed regulation. The NRC regulations at 10 CFR 50.36, Technical Specifications are specific to TS. Additional information with regard to the NRCs TS policies is contained in the agencys final policy statement on technical specification improvements (Ref. 9). These documents define the main elements of TS and provide criteria for items to be included in the TS. The final policy statement and the Statement of Consideration for 10 CFR 50.36 dated July 19, 1995 (Ref. 10), also discuss the use of probabilistic approaches to improve TS. Regulations regarding application for and issuance of license amendments are found in 10 CFR 50.90, 50.91, and 50.92. In addition, the licensee should ensure that any discrepancies between the proposed TS change and licensee commitments are identified and considered in the evaluation.

2.2 Traditional Engineering Considerations 2.2.1 Defense-in-Depth Evaluation The engineering evaluation should evaluate whether the impact of the proposed TS change (individual and cumulative) is consistent with the defense-in-depth philosophy. In this regard, the intent of this principle is to ensure that the philosophy of defense-in-depth is maintained, not to prevent changes in the way defense-in-depth is achieved. Defense-in-depth is an element of the NRCs safety philosophy that employs successive compensatory measures to prevent accidents or mitigate damage if a malfunction, accident, or naturally caused event occurs at a nuclear facility. The defense-in-depth philosophy ensures that safety will not be wholly dependent on any single element of the design, construction, maintenance, or operation of a nuclear facility. The net effect of incorporating defense-in-depth into design, construction, maintenance, and operation is that the facility or system in question tends to be more tolerant of failures and external challenges.

DG-1287, Page 9

Regulatory Position 2.1.1 of Regulatory Guide 1.174 provides guidance on addressing whether a proposed change to the plants licensing basis is consistent with the defense-in-depth philosophy. That guidance applies to proposed changes in the TS and is not repeated here.

2.2.2 Safety Margin The engineering evaluation conducted should assess whether the impact of the proposed TS change is consistent with the principle that sufficient safety margins are maintained (Principle 3). An acceptable set of guidelines for making that assessment are summarized below. Other equivalent decision guidelines are acceptable.

Sufficient safety margins are maintained under the following circumstances:

• Codes and standards (e.g., American Society of Mechanical Engineers (ASME), Institute of Electrical and Electronic Engineers (IEEE)) or alternatives approved for use by the NRC are met, (e.g., the proposed TS CT or SF change is not in conflict with approved codes and standards relevant to the subject system).

• Safety analysis acceptance criteria in the final safety analysis report (FSAR) are met or proposed revisions provide sufficient margin to account for analysis and data uncertainties (e.g., the proposed TS CT or SF change does not adversely affect any assumptions or inputs to the safety analysis, or, if such inputs are affected, justification is provided to ensure sufficient safety margin will continue to exist). For TS CT changes, an assessment should be made of the effect on the FSAR acceptance criteria assuming the plant is in the condition addressed by the proposed CT (i.e., the subject equipment is inoperable) and there are no additional failures. Such an assessment should result in the identification of all situations in which entry into the condition addressed by the proposed CT could result in failure to meet an intended safety function.

2.3 Evaluation of Risk Impact The NRC staff has identified a three-tiered approach for licensees to evaluate the risk associated with proposed TS CT changes. Tier 1 is an evaluation of the impact on plant risk of the proposed TS change as expressed by the change in core damage frequency (CDF), the incremental conditional core damage probability (ICCDP),2 the change in large early release frequency (LERF), and the incremental conditional large early release probability (ICLERP).3 Tier 2 is an identification of potentially high-risk configurations that could exist if equipment, in addition to that associated with the change, were to be taken out of service simultaneously or other risk-significant operational factors, such as concurrent system or equipment testing, were also involved. The objective of this part of the evaluation is to ensure that appropriate restrictions on dominant risk-significant configurations associated with the change are in place. Tier 3 is the establishment of an overall configuration risk management program (CRMP) to ensure that other potentially lower probability, but nonetheless risk-significant, configurations resulting from maintenance and other operational activities are identified and compensated for. If the Tier 2 assessment demonstrates, with reasonable assurance, that there are no risk-significant configurations involving the subject equipment, the application of Tier 3 to the condition addressed by the proposed CT 2

ICCDP = ((conditional CDF with the subject equipment out of service and nominal expected equipment unavailabilities for other equipment permitted to be out of service by the TS) (baseline CDF with nominal expected equipment unavailabilities)) x (total duration of single CT under consideration) 3 ICLERP = ((conditional LERF with the subject equipment out of service and nominal expected equipment unavailabilities for other equipment permitted to be out of service by the TS) (baseline LERF with nominal expected equipment unavailabilities)) x (total duration of single CT under consideration)

DG-1287, Page 10

may not be necessary. Although defense-in-depth is protected to some degree by most current TS, application of the three-tiered approach to risk-informed TS CT changes discussed below provides additional assurance that defense-in-depth will not be significantly impacted by such changes to the licensing basis.

Regulatory Positions 2.3.1 through 2.3.7 and Appendix A to this regulatory guide discuss various issues related to the three-tiered approach. Specifically, Regulatory Positions 2.3.2 through 2.3.5 and Appendix A outline issues associated with Tier 1, and Regulatory Positions 2.3.6 and 2.3.7 outline issues associated with Tiers 2 and 3.

The NRC staff has identified several factors, discussed below, that should be considered in proposals for SF changes. In summary, the licensee should identify the SFs to be evaluated, determine the risk contribution associated with the subject SFs, determine the risk impact from the change to the proposed SF, and perform sensitivity and uncertainty evaluations to address uncertainties associated with the SF evaluations. Regulatory Positions 2.3.1 through 2.3.6 and Appendix A to this regulatory guide provide more detail on risk evaluation for SF changes.

Tier 1: Probabilistic Risk Assessment Capability and Insights In Tier 1, the licensee should assess the impact of the proposed TS change on CDF, ICCDP, LERF, and ICLERP. To support this assessment, two aspects need to be considered: (1) the validity of the PRA and (2) the PRA insights and findings. The licensee should demonstrate that its PRA is valid for assessing the proposed TS changes and identify the impact of the TS change on plant risk.

Tier 2: Avoidance of Risk-Significant Plant Configurations The licensee should provide reasonable assurance that risk-significant plant equipment outage configurations will not occur when specific plant equipment is out of service consistent with the proposed TS change. An effective way to perform such an assessment is to evaluate equipment according to its contribution to plant risk (or safety) while the equipment covered by the proposed CT change is out of service. Evaluation of such combinations of equipment out of service against the Tier 1 ICCDP and ICLERP acceptance guidelines could be one appropriate method of identifying risk-significant configurations. Once plant equipment is so evaluated, an assessment can be made as whether certain enhancements to the TS or procedures are needed to avoid risk-significant plant configurations. In addition, compensatory actions that can mitigate any corresponding increase in risk (e.g., backup equipment, increased surveillance frequency, or upgraded procedures and training) should be identified and evaluated. Any changes made to the plant design or operating procedures as a result of such a risk evaluation (e.g., required backup equipment, increased surveillance frequency, or upgraded procedures and training required before certain plant system configurations can be entered) should be incorporated into the analyses utilized for TS changes as described under Tier 1 above.

Tier 3: Risk-Informed Configuration Risk Management The licensee program for compliance with 10 CFR 50.65(a)(4) ensures that the risk impact of out-of-service equipment is appropriately assessed and managed. To support TS changes, a viable program would be one able to uncover risk-significant plant equipment outage configurations in a timely manner during normal plant operation. This can be accomplished by evaluating the impact on plant risk of, for example, equipment unavailability, operational activities like testing or load dispatching, or weather conditions. The need for this third tier stems from the difficulty of DG-1287, Page 11

identifying all possible risk-significant configurations under Tier 2 that will ever be encountered over extended periods of plant operation.

2.3.1 Technical Adequacy of the PRA The technical adequacy of the PRA must be compatible with the safety implications of the TS change being requested and the role that the PRA plays in justifying that change. That is, the more the potential change in risk or the greater the uncertainty in that risk from the requested TS change, or both, the more rigor that must go into ensuring the technical adequacy of the PRA. This applies to Tier 1 (above), and it also applies to Tier 2 and Tier 3 to the extent that a PRA model is used.

Regulatory Guide 1.200 describes one acceptable approach for determining whether the technical adequacy of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the results such that the PRA can be used in regulatory decisionmaking for light-water reactors. Other approaches may also be acceptable, but may increase the scope of the staff review or result in a lower priority based on the availability of staff resources.

The ASME/American Nuclear Society (ASME/ANS) PRA standard4 provides technical supporting requirements in terms of three Capability Categories. The intent of the delineation of the Capability Categories within the Supporting Requirements is generally that the degree of scope and level of detail, the degree of plant specificity, and the degree of realism increase from Capability Category I to Capability Category III. In general, the staff anticipates that current good practice, i.e., Capability Category II of the ASME/ANS standard, is the level of detail that is adequate for the majority of applications5. However, for some applications, Capability Category I may be sufficient for some requirements, whereas for other applications it may be necessary to achieve Capability Category III for specific requirements.

2.3.2 Scope of the Probabilistic Risk Assessment for Technical Specification Change Evaluations The scope and the level of PRA necessary to fully support the evaluation of a TS change depend on the type of TS change being sought. The scope and level of analysis required is discussed below for a variety of cases. However, in some cases, a PRA of sufficient scope may not be available. This will have to be compensated for by qualitative arguments, bounding analyses, or compensatory measures.

As a minimum, evaluations of CDF and LERF should be performed to support any risk-informed changes to TS. The scope of the analysis should include all hazard groups (i.e., internal events, internal flood, internal fires, seismic events, high winds, transportation events, and other external hazards) unless it can be shown that the contribution from specific hazard groups does not affect the decision. When the risk associated with a particular hazard group or operating mode would affect the decision being made, it is the Commissions policy that, if a staff-endorsed PRA standard exists for that hazard group or operating mode, then the risk will be assessed using a PRA that meets that standard. For more detail, refer to Section 2.3.1 and 2.5 of Regulatory Guide 1.174 (Ref. 11).

When changes to the requirements for systems needed for decay heat removal are considered, an appropriate assessment of shutdown risk should also be considered. Examples of such systems are 4

These references for RG 1.200 and the ASME/ANS PRA standard are intended to refer to the revision of the ASME/ANS PRA standard that is endorsed in the current revision of RG 1.200.

5 Regulatory Guide 1.200 defines current good practice as those practices that are generally accepted throughout the industry and have been shown to be technically acceptable in documented analyses or engineering assessments.

DG-1287, Page 12

auxiliary feedwater, residual heat removal, emergency diesel generator, and service water. In addition, when CTs are being modified to facilitate online maintenance (i.e., transferring scheduled preventive maintenance (PM) from shutdown to power operation), the impact on the shutdown modes should also be evaluated. When available, using both power operation and shutdown models, a comparative evaluation may be presented to decide the appropriate condition for scheduling maintenance based on risk evaluations. In some cases, a semi-quantitative analysis of shutdown risk may be adequate (e.g., fault tree analysis or failure modes and effects analysis).

When CTs are being modified in anticipation of the need for additional time for corrective maintenance, an assessment of transition risk (the risk of transitioning from power operation to the mode required by the current TS in question) that could be incurred under the current, shorter CT may be desirable, if the initial calculated risk increase is near or somewhat above the acceptance guidelines. In addition, TS changes to requirements for a controlled shutdown (i.e., the time allocated to transit through hot standby to hot shutdown to cold shutdown or to the final state that should be reached) should be evaluated, if possible, using a model for the transition risk covering these periods or at least a qualitative evaluation of the transition risk.

2.3.3 Probabilistic Risk Assessment Modeling 2.3.3.1 Detail Needed for Technical Specification Changes To evaluate a TS change, specific systems or components involved in the change should be modeled in the PRA. The model should also be able to treat the alignments of components during periods when testing and maintenance are being carried out. Typically, limiting conditions for operations (LCOs) and surveillance requirements relate to the system trains or components that are modeled in the system fault trees of a PRA. System fault trees should be sufficiently detailed to specifically include all the components for which surveillance tests and maintenance are performed and are to be evaluated.

• For CT evaluations, system train-level models are adequate as long as all components belonging to the train are clearly identified (i.e., all those components that could cause the train to fail).

• For evaluating SFs, individual component-level models are necessary.

Since PRAs typically model the plant at the individual component level, they may be directly used to analyze both CTs and SFs.

Component unavailability models should include contributions from random failure, CCF, test downtime, and maintenance downtime.

• Changes to the component unavailability model for test downtime and maintenance downtime should be based on a realistic estimate of expected surveillance and maintenance practices after the TS change is approved and implemented (e.g., how often the CT is expected to be entered for preplanned maintenance or surveillance).

• The component unavailability model for test downtime and maintenance downtime should be based on plant-specific or industry-wide operating experience, or both, as appropriate.

• The component unavailability model should have the flexibility to separate contributions from test and maintenance downtime. For evaluating a CT, the contribution from maintenance downtime can be equated to zero to delete maintenance activities, if desired. For a SF evaluation, the contribution from test downtime determines a contribution to risk from carrying out the test.

DG-1287, Page 13

• Additional details in terms of separating the failure rate contributions into cyclic demand-related and standby time-related contributions can be incorporated, if justifiable, for evaluating surveillance requirements.

The CCF contributions should be modeled so that they can be modified to reflect the condition in which one or more of the components is unavailable. It should be noted, however, that CCF modeling of components is not only dependent on the number of remaining inservice components, but is also dependent on the reason components were removed from service (i.e., whether for preventive or corrective maintenance). For appropriate configuration risk management and control, preventive and corrective maintenance activities need to be considered, and licensees should, therefore, have the ability to address the subtle difference that exists between maintenance activities (see Section A-1.3.2 of Appendix A to this guide for details).

To account for the effects of test placements for redundant components in relation to each other (e.g., staggered or sequential test strategy), time-dependent models and additional evaluations using specialized codes may be used, if available.

If the PRA does not model the system for which the TS change is being requested, specialized analyses may be necessary when requesting changes to the TS for these systems. Examples of these situations follow:

• When a system is modeled in the event tree, but a detailed fault tree model is not provided (direct estimate of system unavailability from experience data or expert judgment is used), the TS evaluation can proceed in one of two ways:

(1) A separate fault tree can be developed for the system for TS evaluation and used to complement the existing PRA model without directly modifying the PRA (e.g., detailed separate fault tree modeling of the reactor protection system combined with the existing PRA model).

(2) A bounding evaluation can be conducted based on the impact of system failures that are modeled in the PRA event trees, that is, failure of any component in the system can be assumed to cause system failure.

• When a separate fault tree is developed, specific TS requirements within the system can be changed and changes in the system unavailability can be measured, which can then be used in the PRA model to obtain the corresponding Level 1 and Level 2 and 3 measures, as appropriate.

Such evaluations can be considered similarly as those evaluations made directly using PRA models, but should satisfy the following conditions:

(1) Failures within the system should not affect any other system or component failure.

(2) The effect of system failure should not influence any initiating event frequency (or it should have a minimal or negligible effect).

(3) The system should not share components with another system.

• When bounding evaluations are performed assuming any failure in the system as a system failure, the calculated risk impacts for TS changes are expected to be overestimated. The corresponding changes that may be acceptable will also be fewer than those that could have been justified using a detailed model. When considering the incorporation of non-PRA factors, this perspective DG-1287, Page 14

should be kept, while at the same time considering the lack of a detailed model. Here also, the above three conditions discussed for the previous case apply.

In some cases, since the risk-informed evaluation will be limited and some misestimation of the risk may have been incorporated, non risk-related engineering considerations gain importance in the overall decision. In such cases, arguments for the change also must be for small increments from current requirements.

2.3.3.2 Modeling of Initiating Events Some initiating events resulting from support system failure (e.g., service water, component cooling water, instrument air) are modeled explicitly in the logic model (i.e., fault tree models are developed in the PRA). Any TS change for these systems will affect the corresponding initiating event frequency as well as the system unavailability and availability of other supported systems. The effect of TS changes on these initiating event frequencies should be considered.

Some test and maintenance activities can contribute to some transients. Initiating event frequencies used in the PRA do not typically separate out this contribution, but such a separation may be needed during TS change evaluations. For example, the effect of test-caused transients may be evaluated in determining a SF. Initiating event frequencies from conduct of the test (i.e., test-caused transients) could then be modeled separately to evaluate the risk contribution from test-caused transients. Data needs for estimating initiating event frequencies from test-caused transients are discussed in Section A-2 of the appendix to this guide.

2.3.3.3 Screening Criteria The main qualitative consideration regarding the screening of sequences in TS change evaluations is the inclusion of sequences directly affected by the TS change that would have been truncated by frequency-based screening alone. For example, if the TS change involves accumulators in a pressurized water reactor (PWR), qualitative considerations imply that sequences that contain the accumulators should be included, even if these sequences do not meet the frequency criteria. Excluding these sequences would result in an underestimate of the risk impact of the TS changes.

2.3.3.4 Truncation Limits Truncation levels should be used appropriately to ensure that significant underestimation, caused by truncation of cutsets, does not occur as discussed below. Additional precautions relevant to the cutset manipulation method of analysis are needed to avoid truncation errors in calculating risk measures.

When failure or outage of a single component is considered, as in the case of a CT or SF risk evaluation, the truncation levels in evaluating R1 and R0 are of concern. (R1 is the increased CDF, with the component assumed to be inoperable (or equivalently the component unavailability set to true), and R0 is the reduced CDF, with the component assumed to be operable (or equivalently, the component unavailability set to false)). If the component in question appears in the cutsets near the truncation limit (e.g., all appearances are in cutsets within a factor of 10 of the truncation limit), it may be necessary to reduce the truncation limit. If R1 is marginally larger than the base case value, then one order of additional cutsets should be generated to ensure that any underestimation did not take place.

When risk from plant configurations involving multiple components is being considered, a cutset with a relatively small frequency can become a significant contributor to the CDF. This is because more than one of the affected components may appear in the same minimal cutset, and the unavailability (increased by the TS change) of more than one of these components could cause a significant increase in DG-1287, Page 15

the cutsets frequency. For such cases, truncation levels have to be reduced by a larger amount than would be the case for the case of single components. Particular care should be taken if the evaluation of R1 is based on requantification of pre-solved cutsets, as the events related to the component of concern may not even appear in the cutsets.

2.3.4 Assumptions in Completion Time and Surveillance Frequency Evaluations Using PRAs to evaluate TS changes requires consideration of a number of assumptions made within the PRA that can have a significant influence on the ultimate acceptability of the proposed changes. Such assumptions should be discussed in the submittal requesting the TS changes.

Assumptions that CT change evaluations should consider include the following:

1. If CT risk evaluations are performed using only the PRA for power operation (i.e., to calculate the risk associated with (1) the equipment being unavailable during power operation for the duration of the CT and (2) any change in the CT), the risk associated with shutting the plant down because of exceeding the CT is not considered. In most cases, this risk has not been considered or, if considered, is assumed to further justify the requested change. If the risk evaluation is marginal or exceeds the guidelines for a proposed CT increase and the systems involve those needed for shutdown (e.g., residual heat removal systems, service water systems, auxiliary feedwater systems), the licensee may want to perform comparative risk evaluations of continued power operation versus plant shutdown.

2. When calculating the risk impacts (i.e., a change in CDF or LERF caused by CT changes), the change in average CDF should be estimated using the mean outage times (or an appropriate surrogate) for the current and proposed CTs. If a licensee chooses to use the zero maintenance state as the base case (i.e., the case in which no equipment is unavailable because of maintenance), an explanation stating so should be part of the submittal. Usually, data for outage times correspond to the current CT, but not to the proposed CT. Different assumptions are made to estimate the outage time corresponding to the proposed CT. Assumptions concerning changes in maintenance practices under the extended CT regime should be discussed and their impact on the results of the analysis characterized.

3. When the risk impact of a CT change is evaluated, the yearly risk impact that is calculated takes into account the outage frequency. A CT extension may imply that the maintenance of the component is improved, which may reduce the components failure rate, and consequently, reduce the frequency of outages needed for correcting degradations or failure. Again, there are no experience data for the extended CT; therefore, the assumption should be made that both the frequency of outage for corrective maintenance and the components failure rate remain the same.

Here, the beneficial aspect of maintenance is not quantified and this may give a slightly higher estimate of the yearly CT risk measure for the proposed CT.

4. Often, CT extensions are requested to facilitate online (or at-power) preventive maintenance of safety-system components. The frequency and duration of the extension may be estimated and the risk impact from the resulting unavailability of such equipment can be calculated.

5. When CTs of multiple safety system trains are extended, the likelihood of simultaneous outages of multiple components increases (resulting from combinations of failures, testing, and maintenances) because the increased duration increases the probability of the individual events that constitute the simultaneous multiple outages; hence, overlapping of routinely scheduled activities and random failures becomes more likely. The impact of such occurrences on the DG-1287, Page 16

average plant risk (e.g., CDF) is small, but the conditional risk can be large. This issue is addressed as part of the implementation considerations (see Regulatory Positions 2.3.7).

SF evaluations should consider the following assumptions:

1. Surveillance tests usually are assumed to detect failures that have occurred in the standby period.

The component failure rate, , represents these failures in the formulation of component unavailability. The test-limited risk is normally estimated by assuming that a surveillance test of a component detects the failures, and that after the test, the components unavailability resets to zero or false in the Boolean expression. A few component failures, depending on a components design and the test performed, may not be detected by a routine surveillance test.

Usually, their contribution to risk is considered negligible.

2. Regular surveillance testing of a component, as performed for safety system components, is considered to influence its performance. Generally, for most components, the increase of a surveillance interval beyond a certain value may reduce the components performance (i.e.,

increase the failure rate). Experience data are not available to assess the SF values beyond which the component failure rate, , increases. If, in a risk-informed evaluation of surveillance requirements, the failure rate is assumed to remain the same (i.e., unaffected by a change in the SF), this assumption implies that the SFs are not being changed beyond the value at which may be affected. Care should be taken not to reduce the SFs beyond such values using risk-informed analyses only.

3. The timing of surveillance tests for redundant components relative to each other (i.e., the test strategy used) has an impact on the risk measures calculated. Staggered or sequential test strategies are commonly used. The risk impacts of adopting different test strategies (e.g.,

sequential versus staggered) should be evaluated to determine whether there is an impact on the evaluation of the change being considered (Ref. 14).

4. Notwithstanding the beneficial aspects of testing to detect failures that occur in a standby period, a number of adverse effects may be associated with the test, including downtime to conduct the test, errors of restoration after the test, test-caused transients, and test-caused wear of the equipment. Downtime and errors of restoration are usually modeled in a PRA, unless they are negligible. Test-caused transients and wear of the equipment are applicable to a few tests, but they are not generally modeled separately in a PRA. However, they can be evaluated using PRA models supplemented with additional data and analysis. Methods are available to quantitatively address these aspects (Ref. 15); however, qualitative arguments can also be presented to support the reduction of a SF. If the adverse impact of testing is considered significant, such cases should be addressed quantitatively.

2.3.5 Sensitivity and Uncertainty Analyses Relating to Assumptions in Technical Specification Change Evaluations As in any risk-informed study, risk-informed analyses of TS changes can be affected by numerous uncertainties regarding the assumptions made during the PRA models development and application.

Sensitivity analyses may be necessary to address the important assumptions in the submittal made with respect to TS change analyses. They may include, as appropriate, the following:

DG-1287, Page 17

• the impact of variation in repair/maintenance policy because of CT changes (e.g., scheduling a PM of longer duration at power),

• the impact of variation in assumed mean downtimes or frequencies,

• the effect of separating the cyclic demand vs. standby time-related contribution to the components unavailability in deciding changes to an SF, and

• the effect of details regarding how CCFs are modeled in the PRA.

Previous sensitivity analyses performed for risk-informed TS changes have shown that the risk resulting from TS CT changes is relatively insensitive to uncertainties (compared, for example, to the effect on risk from uncertainties in assumptions regarding plant design changes or regarding significant changes to plant operating procedures). This is because the uncertainties associated with CT changes tend to similarly affect the base case (i.e., before the change) and the changed case (i.e., with the change in place). That is, the risks result from similar causes in both cases (i.e., no new initiating transients or subsequent failure modes are likely to have been introduced by relatively minor CT changes). CT changes subject the plant to a variation in its exposure to the same type of risk, and the PRA model is able to predict, with relative surety based on data from operating experience, how much that risk will change based on that changed exposure. Similar results are expected for SF changes. Licensees are expected to justify any deviations from these expectations.

The effects of multiple outages may become significant during relatively large increases in CTs or SFs. In those cases, however, the Tier 2 and Tier 3 aspects of TS changes (i.e., configuration monitoring, risk predictions, and configuration control based on the risk predictions) are expected to be robust and will be relied upon to control the resulting potential for significant risk increases. Therefore, the Tier 2 and Tier 3 aspects of such TS changes should be justified as robust and adequate to control the resulting potential for significant risk increases.

NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making (Ref. 16) provides additional guidance regarding the treatment of uncertainties.

2.3.6 Use of Compensatory Measures in Technical Specification Change Evaluations Consistent with the key principle that changes to TS should result in only small increases in the risk to the public health and safety (Principle 4, as described in Part B of this regulatory guide), and as part of proposed TS change evaluations, certain compensatory measures (discussed below) that balance the calculated risk increase caused by the changes may be considered. This consideration should be made in light of the acceptance guidelines given in Regulatory Guide 1.174 (Ref. 11). Note that these considerations may be part of Tier 2 or Tier 3 programs.

When the licensee wishes to reduce the risk increase resulting from a proposed change even though the individual change is judged by the licensee to meet the acceptance guidelines, the licensee might consider taking compensatory measures such as those suggested below. If compensatory measures are considered as part of the analysis of the change, they should be included in the overall application for the TS change. However, over-reliance on programmatic activities such as compensatory measures associated with the change in the licensing basis should be avoided. Compensatory measures included in the submittal for a TS change should be measures for which the licensee is not already taking credit. Any such compensatory measures would become part of the licensing basis if the TS change were approved.

The following are examples of compensatory measures:

• adding a test of a redundant train before initiating a scheduled maintenance activity as part of a CT extension application, DG-1287, Page 18

• limiting simultaneous testing and maintenance of redundant or diverse systems as part of a CT extension application,

• incorporating a staggered test strategy as part of the SF reduction application,

• improving test and maintenance procedures to reduce test-and maintenance-related errors,

• improving operating procedures and operator training to reduce the impact of human errors, and

• improving system designs, which reduces overall system unavailability and plant risk.

When compensatory measures are part of the TS change evaluation, the risk impact of these measures should be considered and presented, either quantitatively or qualitatively. When a quantitative evaluation is used, the total impact of these measures should be evaluated by comparison to the small guideline (Principle 4, as described in Part B of this regulatory guide). This includes (1) evaluation of the proposed TS changes without the compensatory measures, (2) evaluation of the proposed TS changes with the compensatory measures, and (3) specific discussion of how each of the compensatory measures is credited in the PRA model or during the evaluation process.

2.3.7 Contemporaneous Configuration Control Consistent with the key principle that changes to TS result in small increases in the risk to public health and safety (Principle 4), certain configuration controls need to be utilized. The need for the controls discussed below is described at the beginning of Regulatory Position 2.3 in the discussion regarding Tier 3.

2.3.7.1 Configuration Risk Management Program Licensees should describe their capability to perform a contemporaneous assessment of the overall impact on the safety of proposed plant configurations before performing and during performance of maintenance activities that remove equipment from service. Licensees should explain how these tools or other processes will be used to ensure that risk-significant plant configurations will not be entered and that appropriate actions will be taken when unforeseen events put the plant in a risk-significant configuration.

2.3.7.2 Key Components of the Configuration Risk Management Program The licensee should ensure that the CRMP contains the key components contained in the following paragraphs.

Key Component 1: Implementation of Configuration Risk Management Program The intent of the CRMP is to implement 10 CFR 50.65(a)(4) (part of the Maintenance Rule) with respect to online maintenance for risk-informed TS, with the following additions and clarifications:

1. The scope of structures, systems, and components (SSCs) to be included in the CRMP is all SSCs modeled in the licensees plant PRA, in addition to all SSCs considered high safety significant per Revision 2 of Regulatory Guide 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants (Ref. 17) that are not modeled in the PRA.

2. The CRMP assessment tool is PRA informed and may be in the form of a risk matrix, an online assessment, or a direct PRA assessment.

3. The CRMP will be invoked as follows:

DG-1287, Page 19

• For preplanned entrance into the plant configuration described by a TS action with a risk-informed CT, a risk assessment, including, at a minimum, a search for risk-significant configurations, will be performed before entering the action.

• For unplanned entrance into the plant configuration described by a TS action with a risk-informed CT, a similar assessment will be performed in a time frame defined by the plants Corrective Action Program (Criteria XVI of Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, to 10 CFR Part 50).

• When, in the plant configuration described by a TS action with a risk-informed CT, additional SSCs become inoperable or nonfunctional, a risk assessment, including, at a minimum, a search for risk-significant configurations, will be performed in a timeframe defined by the plants Corrective Action Program (Criteria XVI of Appendix B to 10 CFR Part 50).

4. Tier 2 commitments apply only for planned maintenance, but should be evaluated as part of the Tier 3 assessment for unplanned occurrences.

Key Component 2: Control and Use of the Configuration Risk Management Program Assessment Tool

1. Plant modifications and procedure changes will be monitored, assessed, and dispositioned as follows:

• Evaluation of changes in plant configuration or PRA model features will be dispositioned by implementing PRA model changes or by the qualitative assessment of the impact of the changes on the CRMP assessment tool. This qualitative assessment recognizes that changes to the PRA take time to implement and that changes can be effectively compensated for without compromising the ability to make sound engineering judgments.

• Limitations of the CRMP assessment tool are identified and understood for each specific CT extension.

2. Procedures exist for the control and application of CRMP assessment tools, including a description of the process when the plant configuration of concern is outside the scope of the CRMP assessment tool.

Key Component 3: Level 1 Risk-Informed Assessment The CRMP assessment tool utilizes at least a Level 1, at-power, internal events PRA model. The CRMP assessment may use any combination of quantitative and qualitative input. CRMP assessments can include reference to a risk matrix, preexisting calculations, or new PRA analyses.

1. Quantitative assessments should be performed whenever necessary for sound decisionmaking.

2. When quantitative assessments are not necessary for sound decisionmaking, qualitative assessments can be performed. Qualitative assessments should consider applicable existing insights from previous quantitative assessments.

DG-1287, Page 20

Key Component 4: Level 2 Issues and External Hazards The licensee should treat external hazards and Level 2 issues either qualitatively or quantitatively, or both.

2.4 Acceptance Guidelines for Technical Specification Changes The guidelines discussed in Sections 2.4 and 2.5 of Regulatory Guide 1.174 (Ref. 11) are applicable to permanent TS CT and SF change requests. Risk-acceptance guidelines are presented in those sections as a function of the result of the licensees risk analysis in terms of total CDF predicted for the plant and the change in CDF and LERF predicted for the TS changes requested by the licensee. TS submittals for changes to CTs should also be evaluated against the risk acceptance guidelines presented herein, in addition to those in Regulatory Guide 1.174. Application of all the risk acceptance guidelines to individual proposals for TS changes will be done in a manner consistent with the fundamental principle that changes to TS result in small increases in the risk to the health and safety of the public (Principle 4, as described in Part B of this regulatory guide).

TS change evaluations may involve some small increase in risk as quantified by PRA models. It is usually argued that such a small increase is offset by the many beneficial effects of the change that are not modeled by the PRA. The role of numerical guidelines is to ensure that the increase in risk is small and to provide a quantitative basis for the risk increase based on aspects of the TS change that are modeled or quantified.

The numerical guidelines used to decide an acceptable TS change are taken into account along with other traditional considerations, operating experience, lessons learned from previous changes, and practical considerations associated with test and maintenance practices. The final acceptability of the proposed change should be based on all these considerations and not solely on the use of PRA results compared to numerical acceptance guidelines.

As discussed previously, the numerical guidelines are used to ensure that any increase in risk is within acceptable limits; traditional considerations are used to ensure that the change satisfies rules and regulations that are in effect; practical considerations judge the acceptability of implementing the change; and lessons learned from past experience ensure that mistakes are not repeated.

Using the risk measures discussed in this regulatory guide, the change in risk should be calculated for permanent TS changes and compared against the numeric guidelines referenced in Regulatory Guide 1.174, and for CT changes, against the numerical guidelines presented below. In calculating the risk impact of the changed case, additional changes to be implemented as part of the change can be credited.

For example, in seeking a SF change, if the test strategy is also to be changed, the effect of this should also be incorporated in the risk evaluation.

TS conditions addressed by CTs are entered infrequently and are temporary by their very nature.

However, TS do not typically restrict the frequency of entry into conditions addressed by CTs. Therefore, the following TS acceptance guidelines specific to permanent CT changes are provided for evaluating the risk associated with the revised CT, in addition to those acceptance guidelines given in Regulatory Guide 1.174 (Ref. 11):

DG-1287, Page 21

1. The licensee has demonstrated that the TS CT change has only a small quantitative impact on plant risk. An ICCDP of less than 1.0x10-6 and an ICLERP of less than 1.0x10-7 are considered small for a single TS condition entry6 (Tier 1).

2. The licensee has demonstrated that there are appropriate restrictions on dominant risk-significant configurations associated with the change (Tier 2).

3. The licensee has implemented a risk-informed plant configuration control program. The licensee has implemented procedures to utilize, maintain, and control such a program (Tier 3).

For one-time only changes to TS CTs, the frequency of entry into the CT may be known, and the configuration of the plant SSCs may be established. Further, there is no permanent change to the plant CDF or LERF, and hence the risk guidelines of Regulatory Guide 1.174 (Ref. 11) cannot be applied directly. The following TS acceptance guidelines specific to one-time only CT changes are provided for evaluating the risk associated with the revised CT:

1. The licensee has demonstrated that implementation of the one-time only TS CT change impact on plant risk is acceptable (Tier 1):

• ICCDP of less than 1.0x10-6 and an ICLERP of less than 1.0x10-7 [6], or

• ICCDP of less than 1.0x10-5 and an ICLERP of less than 1.0x10-6 with effective compensatory measures implemented to reduce the sources of increased risk7.

2. The licensee has demonstrated that there are appropriate restrictions on dominant risk-significant configurations associated with the change (Tier 2).

3. The licensee has implemented a risk-informed plant configuration control program. The licensee has implemented procedures to utilize, maintain, and control such a program (Tier 3).

In the context of the integrated decisionmaking, the acceptance guidelines should not be interpreted as being overly prescriptive. They are intended to provide an indication, in numerical terms, of what is considered acceptable. As such, the numerical values above are approximate values that provide an indication of the changes that are generally acceptable. Furthermore, the state of knowledge, or epistemic, uncertainties associated with PRA calculations preclude a definitive decision with respect to the acceptance of the proposed change based purely on the numerical results. The intent in comparing the PRA results with the acceptance guidelines is to demonstrate with reasonable assurance that Principle 4 is being met. This decision must be based on a full understanding of the contributors to the PRA results and the impacts of the uncertainties, both those that are explicitly accounted for in the results and those that are not.

There may be situations in which a nonquantitative assessment of risk (either alone or accompanied by quantitative assessment) is sufficient to justify TS changes. The licensee is expected to 6

The ICCDP and ICLERP acceptance guidelines of 1.0x10-6 and 1.0x10-7 respectively are established for consistency with the ICDP and ILERP limits of Section 11 in NUMARC 93-01, Industry Guidelines for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants applicable for maintenance activities involving normal work controls. The NRC has endorsed the guidelines of Section 11 of NUMARC 93-01 in Regulatory Guide 1.182 (Ref. 18).

7 For one-time only CT changes, the ICCDP and ICLERP acceptance guidelines of 1.0x10-5 and 1.0x10-6 are established for compatibility with the ICDP and ILERP limits of Section 11 in NUMARC 93-01, which is applicable for voluntary maintenance activities requiring risk management actions.

DG-1287, Page 22

use judgment on the acceptability (to support regulatory decisionmaking) of the risk argument being considered, including the appropriate blend of quantitative and qualitative assessments.

2.5 Comparison of Risk of Available Alternatives In some cases, in support of a TS change, available alternatives are compared to justify the TS change. For changes in TS CTs, such cases primarily involve comparing the risk of shutting down with the risk of continuing power operation, given that the plant is not meeting one or more TS LCOs. Such comparisons can be used to justify that the increase in at-power risk associated with the TS change is offset by the averting of some transition or shutdown risk.

In the case of a SF change, the beneficial and adverse impacts can be similarly compared. The modified SF should be chosen so that the benefit of testing is at least equal to, or greater than, the adverse effects of testing. For example, if the calibration of relays in the reactor protection system causes plant transients, the risk from the test-caused transients is then estimated and compared with the test-limited risk of a reduced SF.

In using such guidelines, the following considerations apply:

1. The uncertainty associated with the two measures being compared can differ and should be considered in deciding on an acceptable change.

2. When the risk measures associated with all alternatives are unacceptably large, ways to reduce the risk should be explored instead of only extending the TS requirement. That is, a large risk from one of the alternatives should not be the justification for TS relaxation without giving appropriate attention to risk-reduction options. If the risk from test-caused transients is large, attention may then be given to exploring changes in test procedures to reduce such risk, rather than only reducing the SF. However, a combination of the two also may be appropriate.

3. Element 3: Define Implementation and Monitoring Program 3.1 Three-Tiered Implementation Approach As described in Regulatory Position 2.3, the licensee is to use a three-tiered approach in implementing the proposed TS CT changes. Application of the three-tiered approach is in keeping with the fundamental principle that the proposed change is consistent with the defense-in-depth philosophy.

Application of the three-tiered approach provides assurance that defense-in-depth will not be significantly impacted by the proposed change.

3.2 Maintenance Rule Control To ensure that extension of a TS CT or reduction of a TS SF does not degrade operational safety over time, the licensee should ensure, as part of its Maintenance Rule program (10 CFR 50.65), that when equipment does not meet its performance criteria, the evaluation required under the Maintenance Rule includes prior related TS changes in its scope. If the licensee concludes that the performance or condition of TS equipment affected by a TS change does not meet established performance criteria, appropriate corrective action should be taken, in accordance with the Maintenance Rule. Such corrective action could include consideration of another TS change to shorten the revised CT or increase the revised SF, or imposition of a more restrictive administrative limit, if the licensee determines this to be an important factor in reversing the negative trend.

DG-1287, Page 23

4. Element 4: Documentation and Submittal The evaluations performed to justify the proposed TS changes should be documented and included in the license amendment request submittal. Specifically, documentation to support risk-informed TS change requests should include the following:

• a description of the TS changes being proposed and the reasons for seeking the changes,

• a description of the process used to arrive at the proposed changes,

• traditional engineering evaluations performed,

• changes made to the PRA for use in the TS change evaluation,

• review of the applicability and technical adequacy of the PRA models for TS evaluations,

• discussion of the risk measures used in evaluating the changes,

• data developed and used in addition to the plants PRA database,

• summary of the risk measures calculated including intermediate results,

• sensitivity and uncertainty analyses performed,

• summary of the risk impacts of the proposed changes and any compensating actions proposed,

• a tabulation of the outage configurations that could threaten the integrity of the safety functions of the subject equipment and that are, or will be, prohibited by TS or plant procedures (Tier 2),

• a description of the capability to perform a contemporaneous assessment of the overall impact on safety of proposed plant configurations, including an explanation of how these tools will be used to ensure that risk-significant plant configurations will not be entered and that appropriate actions will be taken when unforeseen events put the plant in a risk-significant configuration (Tier 3),

• a marked up copy of the relevant TS and bases including adequate information to provide the technical basis for the revised CT or SF, and

• all other documentation required to be submitted with a license amendment request.

D. IMPLEMENTATION The purpose of this section is to provide information on how applicants and licensees8 may use this guide and information regarding the NRCs plans for using this regulatory guide. In addition, it describes how the NRC staff complies with the Backfit Rule (10 CFR 50.109) and any applicable finality provisions in 10 CFR Part 52.

Use by Applicants and Licensees Applicants and licensees may voluntarily 9use the guidance in this document to demonstrate compliance with the underlying NRC regulations. Methods or solutions that differ from those described in this regulatory guide may be deemed acceptable if they provide sufficient basis and information for the NRC staff to verify that the proposed alternative demonstrates compliance with the appropriate NRC regulations. Current licensees may continue to use guidance the NRC found acceptable for complying with the identified regulations as long as their current licensing basis remains unchanged. <NOTE: If there is a current regulatory guide that is acceptable, then INSERT: The acceptable guidance may be a previous version of this regulatory guide.>

8 In this section, licensees refers to licensees of nuclear power plants under 10 CFR Parts 50 and 52; and the term applicants, refers to applicants for licenses and permits for (or relating to) nuclear power plants under 10 CFR Parts 50 and 52, and applicants for standard design approvals and standard design certifications under 10 CFR Part 52.

9 In this section, voluntary and voluntarily means that the licensee is seeking the action of its own accord, without the force of a legally binding requirement or an NRC representation of further licensing or enforcement action.

DG-1287, Page 24

Licensees may use the information in this regulatory guide for actions which do not require NRC review and approval such as changes to a facility design under 10 CFR 50.59. Licensees may use the information in this regulatory guide or applicable parts to resolve regulatory or inspection issues.

Use by NRC Staff During regulatory discussions on plant specific operational issues, the staff may discuss with licensees various actions consistent with staff positions in this regulatory guide, as one acceptable means of meeting the underlying NRC regulatory requirement. Such discussions would not ordinarily be considered backfitting even if prior versions of this regulatory guide are part of the licensing basis of the facility. However, unless this regulatory guide is part of the licensing basis for a facility, the staff may not represent to the licensee that the licensees failure to comply with the positions in this regulatory guide constitutes a violation.

If an existing licensee voluntarily seeks a license amendment or change and (1) the NRC staffs consideration of the request involves a regulatory issue directly relevant to this new or revised regulatory guide and (2) the specific subject matter of this regulatory guide is an essential consideration in the staffs determination of the acceptability of the licensees request, then the staff may request that the licensee either follow the guidance in this regulatory guide or provide an equivalent alternative process that demonstrates compliance with the underlying NRC regulatory requirements. This is not considered backfitting as defined in 10 CFR 50.109(a)(1) or a violation of any of the issue finality provisions in 10 CFR Part 52.

The NRC staff does not intend or approve any imposition or backfitting of the guidance in this regulatory guide. The NRC staff does not expect any existing licensee to use or commit to using the guidance in this regulatory guide, unless the licensee makes a change to its licensing basis. The NRC staff does not expect or plan to request licensees to voluntarily adopt this regulatory guide to resolve a generic regulatory issue. The NRC staff does not expect or plan to initiate NRC regulatory action which would require the use of this regulatory guide. Examples of such unplanned NRC regulatory actions include issuance of an order requiring the use of the regulatory guide, requests for information under 10 CFR 50.54(f) as to whether a licensee intends to commit to use of this regulatory guide, generic communication, or promulgation of a rule requiring the use of this regulatory guide without further backfit consideration.

Additionally, an existing applicant may be required to adhere to new rules, orders, or guidance if 10 CFR 50.109(a)(3) applies.

If a licensee believes that the NRC is either using this regulatory guide or requesting or requiring the licensee to implement the methods or processes in this regulatory guide in a manner inconsistent with the discussion in this Implementation section, then the licensee may file a backfit appeal with the NRC in accordance with the guidance in NUREG-1409 and NRC Management Directive 8.4.

DG-1287, Page 25

REFERENCES1

1. 60 FR 42622, Use of Probabilistic Risk Assessment Methods in Nuclear Activities: Final Policy Statement, Federal Register, Volume 60, p. 42622, Washington, DC, August 16, 1995.

2. SECY-11-0151, Annual Update of the Risk-Informed and Performance-Based Plan, U.S.

Nuclear Regulatory Commission, October 27, 2011 (ML112620701).

3. NUREG-1430, Standard Technical Specifications, Babcock and Wilcox Plants, Revision 4, April, 2012.

4. NUREG-1431, Standard Technical Specifications, Westinghouse Plants, Revision 4, April, 2012.

5. NUREG-1432, Standard Technical Specifications, Combustion Engineering Plants, Revision 4, April, 2012.

6. NUREG-1433, Standard Technical Specifications, General Electric Plants, BWR/4, Revision 4, April, 2012.

7. NUREG-1434, Standard Technical Specifications, General Electric Plants, BWR/6, Revision 4, April, 2012.

8. 33 FR 18612, Technical Specifications for Facility Licensees; Safety Analyses Reports, Federal Register, Volume 33, Washington, DC, December 17, 1968.

9. 58 FR 39132, Final Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors, Federal Register, Volume 58, Washington, DC, July 22, 1993.

10. 60 FR 36953, Technical Specifications, Federal Register, Volume 60, Number 138, Washington, DC, July 19, 1995.

11. Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, U.S. Nuclear Regulatory Commission, Washington, DC.

12. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, U.S. Nuclear Regulatory Commission, Washington, DC.

13. NUREG-0800, Section 16.1, Risk-Informed Decisionmaking: Technical Specifications.

14. P.K. Samanta and I.S. Kim, Handbook of Methods for Risk-Based Analyses of Technical Specifications, NUREG/CR-6141, December 1994.

1 Publicly available NRC published documents such as Regulations, Regulatory Guides, NUREGs, and Generic Letters listed herein are available electronically through the Electronic Reading room on the NRCs public Web site at:

http://www.nrc.gov/reading-rm/doc-collections/. Copies are also available for inspection or copying for a fee from the NRCs Public Document Room (PDR) at 11555 Rockville Pike, Rockville, MD; the mailing address is USNRC PDR, Washington, DC 20555; telephone 301-415-4737 or (800) 397-4209; fax (301) 415-3548; and e-mail PDR.Resource@nrc.gov.

DG-1287, Page 26

15. I.S. Kim et al., Quantitative Evaluation of Surveillance Test Intervals Including Test-Caused Risks, NUREG/CR-5775, February 1992.

16. NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Volume 1, March 2009.

17. Regulatory Guide 1.160, Rev. 2, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, U.S. Nuclear Regulatory Commission, Washington, DC.

18. Regulatory Guide 1.182, Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants, U.S. Nuclear Regulatory Commission, Washington, DC.

DG-1287, Page 27

APPENDIX A CONSIDERATIONS AND DATA NEEDS FOR TECHNICAL SPECIFICATION CHANGE RISK EVALUATIONS A-1. Other Considerations in Technical Specification Change Risk Evaluations A-1.1 Risk Measures for Technical Specification Changes to Completion Times and Surveillance Frequencies In this section, a list of the risk-informed measures used in Completion Time (CT) and Surveillance Frequency (SF) evaluations is presented1. A more detailed discussion of these measures can be found in NUREG/CR-6141, Handbook of Methods for Risk-Based Analyses of Technical Specifications (Ref. 1).

The measures applicable for CT evaluations include the following:

• conditional risk given the limiting condition of operation (LCO),

• incremental conditional core damage probability (ICCDP) , and

• yearly CT risk.

When comparing the risk of shutting down with the risk of continuing power operation for a given LCO, the following are the applicable measures:

• risk of continued power operation for a given downtime, similar to ICCDP, and

• risk of shutting down the plant for the same downtime.

The following measures are applicable for SF evaluations:

• test-limited risk, and

• test-caused risk.

Similar to the CT evaluations, the risk contributions associated with preventive maintenance (PM) include the following:

• single PM risk, and

• yearly PM risk.

The risk associated with simultaneous outages of multiple components, called configuration risk, is calculated as part of CT changes. The three-tier approach discussed in Regulatory Position 2.3 of Regulatory Guide 1.177 includes calculations of risks associated with multiple components that may be taken down together. The following applicable measures are similar to the CT measures stated above:

• conditional risk (e.g., increase in core damage frequency (CDF)) caused by the configuration, and

• increase in risk (e.g., core damage probability, which is obtained by multiplying the increase in CDF by the duration of the configuration for the occurrence of a given configuration).

1 The improved Standard Technical Specifications (NUREGs-1430-1434) use the terminology completion time and surveillance frequency in place of allowed outage time and surveillance test interval.

Appendix A to DG-1287, Page A-1

If different measures are used, the licensee should provide adequate discussions of them in the submittal.

A-1.2 Measures for Multiple Technical Specification Changes When multiple technical specification (TS) changes are being considered, the combined impact of the changes should be considered in addition to the individual impacts. The considerations related to the calculation of total impacts are discussed in the following sections.

A-1.2.1 Measures That Can Be Combined for Multiple Technical Specification Changes When considering risk contributions from several CTs, the risk measures can be combined according to the following guidelines:

• The ICCDPs from several CTs do not generally interact nor do they accumulate to give a total contribution because the single CT risks are conditional risks per event, and the downtime events for the different CTs are different events. The only time that ICCDPs should be considered simultaneously is when multiple components can be down at the same time, constituting the same event. Such a case is referred to as a downed configuration, or simply a configuration. The risk contribution associated with a configuration is referred to as the configuration risk and is evaluated separately as a multiple component downtime. Conducting maintenance on several components is a principal cause of potentially high configuration risks.

• Yearly CT risk contributions from several CTs can interact and should be accumulated to give the total yearly contribution from all the CTs being considered. When the CTs do not interact (i.e.,

when the downed components are not in the same minimal cutest) the yearly CT risk contribution from several CTs is the sum of the individual yearly CT risk contributions. When the CTs do interact (i.e., when two or more of the downed components are in the same minimal cutest) interaction of the CT risk contributions should be considered.

• When calculating the test-limited risk for changes in multiple SFs, the total test-limited risk should be properly evaluated. Simple addition of individual test-limited risks will not provide the combined test-limited risk. In a simple addition, the total test-limited risk contribution is underestimated because the interacting terms are neglected.

A-1.2.2 Total Impact of Multiple Changes When multiple changes are requested, the total collective risk impact from all the changes should be evaluated. For example, for a group of CT and SF changes, this includes the total impact of all the requested:

• CT changes,

• SF changes, and

• CT and SF changes.

If multiple changes are made, the impact of each change is assessed individually; as a check, the plant probabilistic risk assessment (PRA) should be used to quantify the total impact.

Appendix A to DG-1287, Page A-2

A-1.3 Quantification of Risk Measures A-1.3.1 Alternative Ways of Calculating Technical Specification Change Risk Measures In calculating the measures discussed for evaluating TS changes, two specific risk levels are discussed, which should be quantified using a PRA. Focusing on the CDF level, they are R1, the increased risk level (e.g., CDF) with the component assumed down or equivalent component unavailability set to true, and R0, the reduced CDF with the component assumed up; that is, the component unavailability is set to false.

A-1.3.1.1. Using Probabilistic Risk Assessment To Obtain Completion Time, Preventive Maintenance, and Configuration Risk Contributions R1 can be calculated by setting the component-down event to a true state in the PRA. Similarly, R0 can be calculated by setting the component-down event to a false state in the PRA. The component-down event in the PRA is the event describing that the component is down for repair or maintenance. If the component-down event is included in the existing minimal cutsets, these minimal cutsets can be used to determine R1 and R0 provided the minimal cutsets sufficiently cover the contribution of the down event. The existing minimal cutsets are sufficient if those containing the down event are not all near the truncation limit (i.e., are not all within a factor of 10 of the truncation limit). Alternatively, the minimal cutsets are sufficient if those containing the down event have a non-negligible contribution (i.e., a contribution greater than or equal to 1 percent). If the existing minimal cutsets are sufficient, the increased risk level R1 can be determined by setting the component-down unavailability to 1 and deleting larger minimal cutsets that contain smaller minimal cutsets (i.e., those absorbed by the smaller minimal cutsets). If any minimal cutsets contain complementary events, they also should be removed if they are inconsistent with the component being down. The reduced risk level R0 can be determined analogously by setting the down unavailability to zero.

If the component-down event is not contained in the existing minimal cutsets, or if there is a question on the coverage of the existing minimal cutsets, the minimal cutsets should be regenerated. R1 is determined by setting the down-component event in the PRA models to a true state. The truncation limit of the minimal cutset can be reduced by at least a factor of 10 to give added assurance of sufficient coverage. The minimal cutsets that are generated using the reduced truncation limit can then be used to determine R1 by setting the down unavailability at zero.

Contributions from common-cause failures (CCFs) need special attention when calculating the increased risk level R1. If the component is down because of a failure, the common-cause contributions involving the component should be divided by the probability of the component being down because of failure since the component is given to be down. If the component is down because it is being brought down for maintenance, the CCF contributions involving the component should be modified to remove the component and to only include failures of the remaining components (also see Regulatory Position 2.3.1 of Regulatory Guide 1.177).

If other components are reconfigured while the component is down, these reconfigurations can be incorporated in estimating R1 or R, using the PRA. If other components are tested before repair or if maintenance is carried out on the downed components, the conduct of these tests and their outcomes also can be modeled. If other components are more frequently tested when the component is down for the conditions addressed by the CT, this increased frequency of testing also can be incorporated. These modeling details are sometimes neglected in the PRA because of their apparently small contribution.

However, when isolating the CT risk contributions and in justifying modified CTs, these details can become significant.

Appendix A to DG-1287, Page A-3

A-1.3.1.2. Use of Probabilistic Risk Assessment Minimal Cutsets When It Is Appropriate As indicated, a PRA computes the yearly CT risk contribution to the yearly CDF. Basically, the yearly CT risk contribution is the sum of the minimal cutset contributions containing the component-downed unavailability (typically for maintenance) qm, qm = f d where f is the downtime frequency and d is the downtime associated with the CT. The downtime d usually is estimated as an average downtime associated with the CT. If the minimal cutsets sufficiently cover the downed unavailability, those that contain the downed unavailability, qm, can be summed to give the yearly CT risk contribution, Ry.

A-1.3.1.3. Using the Probabilistic Risk Assessment To Determine the Test-Limited Risk Contribution The PRA can be used to calculate the increase in the risk-level R and to obtain the component unavailability, q, which are the contributing factors in calculating the test-limited risk contribution. The considerations involved in calculating R1 and R0 to obtain R are those discussed above and in the next section.

When the effect of change in SF for one or more components is being evaluated, the PRA can directly calculate the change in the risk measure (e.g., in the CDF). The calculation of PRA results, when changed SFs are included, incorporates interactions among the SFs. The differences between the results (i.e., CDF when the SFs are changed from the baseline CDF) provide the test-limited risk contribution for changing the SFs.

Such a calculation should include appropriately modified contributions of CCFs. The common failure terms modeled as a function of the SF should be modified to reflect the new SF. Typically, CCFs are modeled using a -factor or Multiple Greek Letter model when the CCF of multiple components is a function of the SF. When changing SFs, care should be taken to change this term within the common-cause contribution. The common cause of failing multiple components resulting from human error following a test is not a function of the SF, but may be affected by the test strategy used.

When different test strategies are being evaluated, the human error term should be evaluated.

Specific assumptions that were used in quantifying the human error common cause term should be identified and checked if they apply for the test strategy being analyzed. For example, if the term was developed assuming a sequential test strategy, but a staggered test strategy is being analyzed, the term should be modified to reflect this change. The failure probability from a common-cause human error for a staggered test strategy is expected to be significantly lower than that for the sequential test strategy.

A-1.3.1.4. Using Minimal Cutsets To Calculate Test-Limited Risks The test-limited risk for a component or a set of components also can be determined by identifying those minimal cutsets that contain one or more of the SF contributions. The sum of the relevant minimal cutset contributions is then equal to the test-limited risk. To evaluate changes in the test-limited risks for changes in the SFs, the difference between the minimal cutset contributions with and without the SF changes will be the difference between the test-limited risks. In using the minimal cutsets, one should ensure that the SF contributions are all included in the set of minimal cutsets used. Even though use of the minimal cutsets gives the same results, the above basic description of methods for obtaining the test-limited risks is useful since it shows the basic contributing factors to the SF risk.

Appendix A to DG-1287, Page A-4

A-1.3.1.5. Specific Considerations for Evaluating Multiple Test-Limited Risks When multiple SFs are modified or are defined, the total test-limited risk from the multiple SF changes or definitions should be properly evaluated. Instead of using the PRA to evaluate all the changes in a given run, the individual test-limited risks can be evaluated one at a time, provided that the updated SFs are used for the other relevant components. An iterative procedure can then be used in which individual SFs are successively updated, using the methods described above for individual component SF risk contributors. These one-at-a-time evaluations, or iterative evaluations, are useful if acceptable guidelines on test-limited risks are defined and the SFs are to be selected to satisfy the risk guidelines.

A-1.3.2 Appropriate Calculation of Conditional Core Damage Frequency A-1.3.2.1. Conditional Core Damage Frequency for Failure of a Component To calculate the conditional CDF when a component is failed (typically represented by R1 in this document), the component unavailability is changed to the true or T state. However, the component unavailability may be modeled in terms of many contributors: random failure, maintenance downtime, test downtime, and CCF. The CCF term represents the failure probability of two or more redundant components that include the failed component in question. The CCF term is modeled as a product of multiple terms (e.g., using the -factor model for two redundant components, the CCF term is times the component unavailability from random failures), but may be represented by one parameter.

Consider a component Q in Train A of a safety system and let QLA, QMA, and QTA represent the components unavailability from random failures, maintenance downtimes, and test downtimes, respectively. Also, let QC = QL be the term for CCF of the redundant components in Trains A and B, where QL is numerically equal to QLA and represents QLA or QLB. QLB is the unavailability of a component in Train B from random failure. Usually, the terms QLA, QMA, QTA, and QC will be part of the PRA input data.

To calculate the conditional CDF given that the component is failed, the component unavailability should be represented by the T state. This means that QLA, QMA, and QTA should be changed to the T state and QC should be divided by QLA since the component is down because of failure. In principle, changing one of the three conditions (QLA, QMA, QTA) to the T state should suffice. However, in many cases truncated cutsets are used to calculate the conditional CDF, and changing all three will ensure that the failed state of the component is represented. For this example, QC will be changed to , which represents the conditional failure probability of the redundant component.

When QC represents the failure of more than two components, QC will be converted to the failure probability of the remaining componentsin this case, two components.

A-1.3.2.2. Conditional Core Damage Frequency When a Component is Down (but Not Failed) for Preventive Maintenance To calculate the conditional CDF when a component is taken down for PM (R1 for PM analyses),

the CCF term should be treated differently from that described above for the failure of the component.

Considering the same example as above, the down state of the component is represented by changing QLA, QMA, and QTA to T and by changing QC to QL, which is numerically the same as QLB or QLA. The CCF term is changed to represent the unavailability of the remaining component and not , since the initial component is already down for PM and is not down due to failure. If the redundant component is successfully tested before taking the component down for PM, QC can then be equated to zero for a short-duration PM (i.e., when the duration of the PM is much less than the test interval).

Appendix A to DG-1287, Page A-5

A-1.3.2.3. Conditional Core Damage Frequency When the Component Is Not Down for Maintenance or Is Tested Operable The conditional CDF is reduced when the component is not down for maintenance or when it has just successfully been tested. The calculation of CT and SF risk contributions involves calculating this conditional CDF (R0). For evaluating the CT risk contribution, R0 signifies that the component is not down for test or maintenance, and setting test and maintenance downtime unavailabilities to the false or F state represents this condition. In this example, QMA and QTA should be changed to the F state.

For SF evaluations, R0 signifies that the component is up, which is known from the test and is represented by setting its unavailability to false. In this example, QLA, QMA, and QTA should be changed to the F state. In many cases, the reduction in CDF from the baseline CDF is negligible.

A-1.3.2.4. Conditional Core Damage Frequency When Multiple Components Are Involved To calculate conditional CDFs (R1 and R0) when multiple components are involved, the corresponding terms relating to each of the components should be changed to the T or F state. For each component, the corresponding terms relating to random failures, CCFs, test downtimes, and maintenance downtimes should be converted, as discussed above. When all the components modeled by a common-cause term are failed, this term changes to the T state for calculating R1. Otherwise, it is modeled as discussed above, representing the unavailability of the remaining components. In many PRA computer codes, the CCF term does not retain the specific component designator (e.g., a unique notation identifying the specific component involved may not be part of the name of the CCF term), and the relevant term cannot directly be identified by searching the names of the input parameters of the PRA.

The description of the CCF terms modeled in the PRA may need to be examined to identify the relevant term or the input parameter.

A-1.3.3 Treatment of Common-Cause Failure and Recovery Factors The treatment of CCF in estimating the conditional CDF for CT and SF evaluations was discussed earlier. Appropriate considerations in modifying CCF terms modeled in the PRA (to include the effect of a component being unavailable because of failure, maintenance, or testing and for implementing a staggered test strategy) have been discussed. In addition, since the CCF contributions can be a dominant contributor, sensitivity analyses with respect to these parameters may be appropriate (see Regulatory Position 2.3.5 of Regulatory Guide 1.177). Recovery factors used in the PRA model perhaps should be reviewed to learn whether the component assumed to be down because of failure is credited to be recovered. For example, consider that a TS change for an emergency diesel generator (EDG) is being evaluated, and conditional CDF for the EDG being down is being calculated. Then, if the cutsets used to calculate the conditional CDF take credit for the same EDG being recovered, such recovery factors should be modified. In such cases, no credit should be taken.

A-1.3.4 Calculations of Transition Risk Transition risk is calculated to compare the risk of continuing operation in a given LCO to that of a transition to plant shutdown. Such companions can be used to decide which option is preferable and which other alternatives may be used. Such evaluations particularly apply for systems used to remove decay heat. The following considerations apply in calculating transition risk:

1. Various stages of the shutdown cooling phases and the operators interactions should be modeled to assess the impact on the CDF of shutting down the plant in a LCO.

Appendix A to DG-1287, Page A-6

2. Any initiating event not modeled in the basic PRA, but important during the shutdown phases, should be modeled. Specific examples are those events that challenge the residual heat removal (RHR) system and that can render part of it unavailable. Also, the frequency of initiating events during the transition to shutdown may have to be reassessed since it may differ from that during power operation (e.g., more frequent loss of offsite power or loss of main feedwater during the transition to shutdown).

3. Different recovery paths applicable at various stages of shutdown should be modeled to realistically quantify the risk of shutting down, considering the diminishing levels of decay heat.

4. Available time margins for uncovering the reactor core and heating up the suppression pool (in a boiling water reactor (BWR)) or drying out the steam generator (in a pressurized-water reactor) should be modeled to evaluate specific accident sequences.

A-2. DATA NEEDS FOR TECHNICAL SPECIFICATION CHANGE EVALUATIONS A request for plant-specific TS changes should use plant-specific data and not rely solely on generic data or data from similar plant designs. Usually, TS changes are requested because plant operation indicates that such changes are needed and, accordingly, plant-specific data are expected to be available. For the components or systems for which TS changes are being considered, plant-specific data should be evaluated and assurance should be obtained that the data used are consistent with the plant experience. The use of other than plant-specific data should be justified.

When a generic analysis uses a representative plant model, the use of generic data from similar plants is acceptable. The generic data should bound the specific plants under consideration, not an average plant.

A-2.1 Care in Using Plant-Specific Data When using plant-specific data to update input parameters of the PRA during a TS change evaluation (additional to that used during the latest update of the PRA), care should be taken to ensure that such data are consistently used both for the base case, where existing TS requirements apply, and the change case, where TS changes are incorporated. This provides assurance that the increase in the risk measure obtained is associated with the TS change only and not with the use of plant-specific data in aspects of plant operation.

This situation typically arises when recent plant-specific data are evaluated and reduced values of the parameters are obtained. Use of the reduced values may negate the risk increase from the TS change and may give an erroneous impression that the TS change has reduced the risk. When the base case is also updated, such difficulties are avoided. Sensitivity and uncertainty analyses should also be performed using the same set of input data.

A-2.2 Considerations When Generic Data Are Used When using generic data for the TS parameters in evaluating TS changes, the focus should be on justifying small changes that do not strongly depend on the data parameters. The reasons why generic data are being used and why generic data apply for plant-specific evaluations should be presented. In many cases, because of limited experience, the use of plant-specific data may result in very optimistic values justifying the use of generic data.

Appendix A to DG-1287, Page A-7

A-2.3 Specific Data Needs Basic data needed for a TS change evaluation (using PRA information) for risk-informed regulation are those collected as part of the PRA. Comparative risk calculations for LCO changes require no additional data beyond those in the Full-Power Operations Level 1 and the Low Power/Shutdown Level 1 PRAs. The following sections discuss additional data needs for evaluating changes in TS requirements, such as SFs and CTs.

A-2.3.1 Maintenance Downtime Data Maintenance downtime data should be partitioned into plant-specific unplanned unavailability for unscheduled maintenance and planned unavailability for PM or testing. For this purpose, data are needed on the frequency of events leading to planned and unplanned maintenance (i.e., the number of occurrences of each type of downtime event during a given time period), and the time interval that the component was out of service for each occurrence. These data are also needed for judging whether an adequate CT is being provided to complete a repair. The distribution of downtimes also can be used to estimate the expected risk for a given CT.

The distribution of time for unscheduled maintenance may shift with a change in a CT. For this reason, information about such an influence on the distribution is not expected to be available when the CT change is being evaluated. The average downtime can be assumed to proportionally increase with the increase in the proposed CT for downtimes associated with unscheduled maintenance. For scheduled (preventive) maintenance, the downtime assumed can be representative of plant practices (e.g., one-half of the CT).

A-2.3.2 Maintenance Schedules and Frequency These data include the maintenance scheduling used by the plant for defining the situations in which multiple equipment or system trains may be taken down for PM. These schedules are important to ensure that high risks from components being down simultaneously, implicitly allowed by the TS change, do not occur. The maintenance frequency or frequency of downtime for a component may be from 3 to 10 times higher than the failure frequency. Since CTs can be used for maintenance, the frequency of maintenance should be incorporated in estimating the downtime frequency.

A-2.3.3 Data Relating to Component Testing The following data related to component testing, in addition to those available as part of the PRA study, form part of a TS change evaluation relating to surveillance requirements:

• The evaluation should list the components being tested, any component realigned from the safety position during a test, the duration of the test, and the test frequency recommended by the manufacturer.

• The evaluation should include the efficiency of the test (i.e., the failure modes detected by the test in regard to components, support system interfaces, and so forth). Bounding assumptions can be made if obtaining detailed data or related information is costly.

• The analyses should account for any potential negative effects of surveillance testing (e.g., that may cause the potential for introducing plant transients or that may cause unnecessary wear of the equipment). Preliminary evaluations can be used to determine the need for a more detailed analysis.

Appendix A to DG-1287, Page A-8

• The evaluation should state the test strategy used for the redundant components in a system (i.e.,

whether staggered or sequential testing is performed). The standard PRA quantification assumes that components follow no specific schedule and are randomly placed with regard to one another.

By staggering the test times of components in different trains, the test-limited risk contribution will be reduced for the same SFs as compared to the PRA assumption. Conversely, if the tests are carried out sequentially, the test-limited risk will increase compared to the PRA assumptions.

A-2.3.4 Parameters for Component Unavailability The component unavailabilities used in a PRA contain a number of parameters that are relevant for evaluating TS changes. These parameters should be delineated, as modeled, to facilitate evaluations to be conducted and reviewed by the regulatory authority. The following desirable parameters contribute to the estimated component unavailability:

• component failure rate,

• component test interval,

• maintenance/repair downtime contribution (maintenance frequency, downtime for scheduled and unscheduled maintenance),

• test downtime, if applicable,

• human errors following test or maintenance, if modeled, and

• separation of cyclic-demand versus standby time contribution, if modeled.

A-2.3.5 Separating Demand and Standby Time Contributions to Unavailability Since the test-limited risk (typically defined as RD) is associated with a failure occurring between tests, the standby time-related failure rate should be used in calculating the test-limited risk. The standby time-related failure rate is associated with what can occur while the component is in standby between tests. Test-limited risk contributes to increases in risk associated with longer test intervals caused by the longer time to detect standby-stress failures. The time-related failure rate is expressed in units per time period, such as per hour. For estimating RD, the data needed are the standby stress failure rate of the component and the proposed SF.

The failure probability of a component consists of a time-related contribution (the standby time-related failure rate), and a cyclic, demand-related contribution (the demand stress failure probability).

The latter is the probability contribution associated with failures that are caused by demanding, starting, or cycling the component, which include (but are not necessarily limited to) test-caused transients as discussed below in Section A-2.3.6. Since the test-limited risk, RD, is associated with a failure occurring between tests, the failure rate that should be used in calculating the test-limited risk is the time-related standby stress failure rate. From the total number of failures on demand, the number of failures caused by standby stress and the number of failures from demand stresses can be partitioned by either an engineering analysis of failure causes or by a graphical method based on the relationship between the observed number of failures and the SFs from which the failures came.

The test-caused contribution to risk is primarily composed of Rdown, the risk contribution that is caused by the unavailability of equipment resulting from aligning equipment away from its preferred position/state to conduct a test, when there is no automatic return to the preferred position. The additional data needed for estimating this parameter are the SF and the out-of-service time needed for each test.

Dividing the failure probability into a time-related and cyclic demand-related contribution results in a lower test-limited risk because only part of the components failure rate is treated as time related.

However, treating only part of the failure rate as time related when this is not the case underestimates the Appendix A to DG-1287, Page A-9

test-limited risk; therefore, such a breakdown of the failure rate should be justified through data analysis or engineering analyses.

In addition, sometimes only the failure probability (i.e., the component unavailability, q) may be provided without giving a failure rate. In such a case, the effect of a change in the SF cannot be evaluated unless the component test interval previously used for T is used to convert the unavailability, q, in terms of and T. When the breakdown between time-related and cyclic demand-related contribution is unknown, all failures can be assumed to be time related to obtain the maximum test-limited risk contribution.

In summary, the data required for measuring a change in risk with a change in the SF are a breakdown of the failure probability of the component into its time-related and demand-related components, the proposed SF, and the out-of-service time for surveillance testing for the component.

A-2.3.6 Test-Caused Transients To evaluate and identify the test-caused transients risk (typically defined as RC), transient events should be analyzed and those caused by a test should be identified. In most cases, this requires reading through the description of transients that have occurred and noting those caused by the test. When reduced SFs are allowed, the resulting reduction in test-caused transients per unit time tends to cause decreases in risk because there are fewer adverse effects of testing over that longer test interval (which, however, will be partially or wholly balanced by increases in RD that are caused by the longer time period before detection and correction of failures).

The transient events are obtained from the following plant operating data:

1. Performance indicator reports: These reports list the number of reactor trips and safety system actuations at each plant, the date of the events, and the numbers of the relevant licensee event reports (LERs).

2. LER system: LERs describe reactor trips.

When test-caused transients for a single plant are evaluated, the plant-specific data may be sparse unless the plants operating experience covers a substantial period. When this is the case, more data may be used from the operating experience of other plants of similar vintage (e.g., other BWR/4s) assuming that the likelihood of occurrence of test-caused transients is similar for all the plants in the database. (The performance indicator reports categorize plants according to design classes.) Testing, however, tends to be very plant-specific, so that cross-plant data applicability must be evaluated in detail.

A-2.3.7 Data for Evaluating Transition Risk Data available in a PRA for full-power operation provide the basic information for evaluating the transition risks when a plant is being shut down for an LCO. In addition, the PRA for low-power and shutdown operations, if available, will significantly ease the acquisition of the data necessary for evaluating the risk of shutdown. The low-power and shutdown PRAs typically contain relevant data, such as the durations of shutdown phases and the frequencies of initiators that may occur during shutdown operation (e.g., loss of RHR).

The full-power PRA is available for most operating plants, but the low-power and shutdown PRAs are only available for some plants. Hence, the following is a list of the data needed to evaluate transition risk assuming that only data from a full-power PRA are available:

Appendix A to DG-1287, Page A-10

1. Plant-specific data on shutdown operations: To analyze shutdown phases in detail, plant-specific information may be needed, such as operating and abnormal procedures, shift supervisors log books, or monthly operating reports. From this information, data on timing of the plant shutdown and operational preferences of equipment during plant shutdown can be extracted.

2. Plant-specific traditional data: The evaluation of heatup and recovery scenarios, including estimates of heatup time, requires some design data on the plant, such as the temperature of the ultimate heat sink or the cooling capacity of the RHR system. These data typically are available from the plants final safety analysis report (FSAR).

3. Frequency of transients during controlled shutdown: The LERs for the plant may need to be reviewed in order to evaluate the likelihood of transients during controlled shutdown. The likelihood of a transient during a shutdown may differ from that during power operation (this should be considered).

REFERENCE2

1. P. K. Samanta and I. S. Kim, Handbook of Methods for Risk-Based Analyses of Technical Specifications, NUREG/CR-6141, USNRC, December 1994.

2 Publicly available NRC published documents such as Regulations, Regulatory Guides, NUREGs, and Generic Letters listed herein are available electronically through the Electronic Reading room on the NRCs public Web site at:

http://www.nrc.gov/reading-rm/doc-collections/. Copies are also available for inspection or copying for a fee from the NRCs Public Document Room (PDR) at 11555 Rockville Pike, Rockville, MD; the mailing address is USNRC PDR, Washington, DC 20555; telephone 301-415-4737 or (800) 397-4209; fax (301) 415-3548; and e-mail PDR.Resource@nrc.gov.

Appendix A to DG-1287, Page A-11