ML041340087

SECY-04-0109 - Attachment 6 - Regulatory Guide 1.201, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to Their Safety Significance

ML041340087
Person / Time
Issue date:	06/30/2004
From:	Harrison D Office of Nuclear Reactor Regulation
To:
Reed T, NRC/NRR/DRIP/RPRP, 415-1462
Shared Package
ML041170141	List: ML041340087
References
RIN 3150-AG42, WITS 199900061, WITS 200000111 RG-1.201, SECY-04-0109
Download: ML041340087 (13)

Text

U.S. NUCLEAR REGULATORY COMMISSION OFFICE OF NUCLEAR REACTOR REGULATION June 2004 Division 1 RG 1.201 REGULATORY GUIDE

Contact:

Donald Harrison (301) 415-3587 REGULATORY GUIDE 1.201 FOR TRIAL USE GUIDELINES FOR CATEGORIZING STRUCTURES, SYSTEMS, AND COMPONENTS IN NUCLEAR POWER PLANTS ACCORDING TO THEIR SAFETY SIGNIFICANCE A. INTRODUCTION The U.S. Nuclear Regulatory Commission (NRC) has promulgated a regulation, § 50.69, to permit power reactor licensees and applicants for licenses to implement an alternative regulatory framework with respect to special treatment, where special treatment refers to those requirements that provide increased assurance beyond normal industrial practices that structures, systems, and components (SSCs) perform their design basis functions. Under this framework, licensees using a risk-informed process for categorizing SSCs according to their safety significance can remove SSCs of low safety significance from the scope of certain identified special treatment requirements.

The genesis of this framework stems from Option 2 of SECY-98-300, Options for Risk-Informed Revisions to 10 CFR Part 50 - Domestic Licensing of Production and Utilization Facilities, dated December 23, 1998. In this SECY, the NRC staff recommended that risk-informed approaches to the application of special treatment requirements be developed to reduce unnecessary regulatory burden of SSCs of low safety significance by removing them from the scope of special treatment requirements. The Commission subsequently approved the NRC staffs rulemaking plan and issuance of an Advanced Notice of Proposed Rulemaking (ANPR) as outlined in SECY-99-256, Rulemaking Plan for Risk-Informing Special Treatment Requirements, dated October 29, 1999.

The ANPR was published in the Federal Register (65 FR 11488) on March 3, 2000. In the rulemaking plan, the NRC proposed to create a new section within Part 50, referred to as § 50.69, to contain these alternative requirements.

This regulatory guide describes a method acceptable to the NRC staff for complying with the requirements of § 50.69 with respect to the categorization of SSCs that are considered in risk-informing special treatment requirements. Regulatory guides are issued to describe and make available to the public such information as methods acceptable to the NRC staff for implementing specific parts of the NRC's regulations, to explain techniques used by the staff in evaluating specific problems or postulated accidents, and to provide guidance to applicants. Regulatory guides are not substitutes for regulations and compliance with regulatory guides is not required.

1

The draft of this guide, Draft Regulatory Guide DG-1121, was issued for public review and comment as part of the § 50.69 rulemaking package in May 2003. Public comments were received and addressed in developing the current regulatory guide. However, there remain a few technical interpretation/implementation issues with specific aspects of the guidance that are best resolved by testing the guide against actual applications. Therefore, this regulatory guide is being issued for trial use. This regulatory guide does not establish any final staff positions, and may be revised in response to experience with its use. As such, this trial regulatory guide does not establish a staff position for purposes of the Backfit Rule, § 50.109, and any changes to this regulatory guide prior to staff adoption in final form will not be considered to be backfits as defined in § 50.109(a)(1). This will ensure that the lessons learned from regulatory review of pilot applications and follow-on applications are adequately addressed in this document and that the guidance is sufficient to enhance regulatory stability in the review, approval, and implementation in the use of PRAs and their results in the risk informed categorization process required by

§ 50.69.

The information collections contained in this regulatory guide are covered by the requirements of 10 CFR Part 50, which were approved by the Office of Management and Budget, approval number 3150-0011. The NRC may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number.

B. DISCUSSION This regulatory guide provides interim guidance for categorizing SSCs in accordance with their safety significance under § 50.69, using the process described in the Final Draft of Nuclear Energy Institute (NEI) 00-04, 10 CFR 50.69 SSC Categorization Guideline, dated April 2004.

The categorization process determines the safety significance of SSCs and places them into one of four risk-informed safety class (RISC) categories. The safety significance of SSCs is determined by an integrated decision-making process, which incorporates both risk and traditional engineering insights. The safety functions of SSCs include both the design-basis functions (deriving from the safety-related definition) and functions credited for severe accidents.

Treatment requirements are then commensurately applied for the categorized SSCs to maintain their functionality.

Figure 1 provides a conceptual understanding of the new risk-informed SSC categorization scheme. The figure depicts the current safety-related versus nonsafety-related SSC categorization scheme with an overlay of the new safety-significance categorization. In the traditional deterministic approach, SSCs were generally categorized as either safety-related (as defined in § 50.2) or nonsafety-related. This division is shown by the vertical line in the figure.

Risk insights, including consideration of severe accidents, can be used to identify SSCs as being either safety significant or low safety significant (shown by the horizontal line). This results in SSCs being grouped into one of four categories as represented by the four boxes in Figure 1.

2

Figure 1. 10 CFR 50.69 RISC Categories RISC-1 SSCs are safety-related SSCs that the risk-informed categorization process determines to be significant contributors to plant safety. Licensees must continue to ensure that RISC-1 SSCs perform their safety-significant functions consistent with the categorization process, including those safety-significant functions that go beyond the functions defined as safety-related for which credit is taken in the categorization process.

RISC-2 SSCs are SSCs that are not defined as safety-related, but the risk-informed categorization process determines them to be significant contributors to plant safety. It is recognized that some RISC-2 SSCs may not have existing special treatment requirements. As a result, the focus for RISC-2 SSCs is on the safety-significant functions for which credit is taken in the categorization process.

The third category defines those SSCs that are safety-related SSCs that a risk-informed categorization process determines are not significant contributors to plant safety on an individual basis. These SSCs are termed RISC-3 SSCs. Special treatment requirements are removed for RISC-3 SSCs and replaced with high-level requirements. These high-level requirements are intended to provide sufficient regulatory treatment such that these SSCs are still expected to perform their safety-related functions under design basis conditions, albeit at a reduced level of assurance when compared to the current special treatment requirements. The proposed rule, however, does not allow these RISC-3 SSCs to be removed from the facility or to have their functional capability lost.

Finally, there are SSCs that are not identified as safety-related that a risk-informed categorization process determines are not significant contributors to plant safety. These SSCs are termed RISC-4 SSCs. The proposed § 50.69 rule does not impose alternative treatment requirements for these RISC-4 SSCs. However, as with the RISC-3 SSCs, changes to the design bases of RISC-4 SSCs must be made in accordance with current applicable design change control requirements(if any), such as § 50.59.

3

This regulatory guide contains specific instructions and cautions in the use of the categorization process. The guidance is limited to that presented in Section C of this regulatory guide.

C. REGULATORY POSITION This regulatory guide is being developed to provide interim guidance for trial use of the process and criteria for determining the safety significance of SSCs under § 50.69 using the categorization process described in the Final Draft of NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline, dated April 2004.

1. Other Documents Referenced in the Final Draft of NEI 00-04 The Final Draft of NEI 00-04 references numerous other documents, but NRCs endorsement of the Final Draft of NEI 00-04 is not an endorsement of these other referenced documents.

2. Use of Examples in the Final Draft of NEI 00-04 The Final Draft of NEI 00-04 includes examples to supplement the guidance. While appropriate for illustrating and reinforcing the guidance in the Final Draft of NEI 00-04, the NRCs endorsement of the Final Draft of NEI 00-04 is not a determination that the examples are applicable for all licensees. A licensee must ensure that an example is applicable to its particular circumstances before implementing the guidance as described in the example.

3. Use of Methods Other Than the Final Draft of NEI 00-04 To meet the requirements of § 50.69 for categorization of SSCs, licensees may use methods other than those set forth in the Final Draft of NEI 00-04. The NRC will determine the acceptability of these other methods by evaluating them against the § 50.69 rule requirements.

4. Limitations of Types of Analyses Used in Implementing the Final Draft of NEI 00-04 In its 1995 Policy Statement on the use of probabilistic risk assessment (PRA), the Commission determined that the use of PRA technology should be increased in all regulatory matters to the extent supported by state-of-the-art PRA methods and data. Implementation of risk-informed regulation is possible because the development and use of a quantitative PRA requires a systematic and integrated evaluation. Development of a technically defensible quantitative PRA also requires sufficient and structured documentation to allow investigations of all aspects of the evaluation. To meet the requirements of § 50.69 for categorization of SSCs, licensees must use risk evaluations and insights that cover the full spectrum of potential events (i.e., internal and external initiating events) and the range of plant operating modes (i.e., full power, low power, and shutdown operations). The NRC staff believes that current state-of-the-art PRA methods are available to quantitatively address the full spectrum of potential events and the full range of plant operating modes for this type of application. However, the Final Draft of NEI 00-04 allows the use of non-PRA type evaluations (e.g., FIVE, seismic margins analysis, NUMARC 91-06), when PRAs have not been performed, which will result in more conservative categorization in that special treatment requirements will not be allowed to be relaxed from SSCs relied upon in the non-PRA type evaluations. It should be recognized that the degree of relief (i.e., SSCs subject to relaxation of special treatment requirements) that the NRC will accept under § 50.69 will be commensurate with the assurance provided by the evaluation.

4

5. Technical Adequacy Attributes of Analyses Implementing the Final Draft of NEI 00-04 The peer review process described in NEI 00-02, as amended to incorporate NRC comments provided in the NRC letter to NEI, dated April 2, 2002 and as endorsed in RG 1.200, provides a mechanism for licensees to determine if their internal events PRA meets the attributes required for this application. An alternative to NEI 00-02 is the ASME Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, as amended to incorporate NRC comments and as endorsed in RG 1.200. Both NEI 00-02 and the ASME Standard are endorsed for trial use by the NRC in RG 1.200, with appropriate clarifications and exceptions. These documents currently cover only internal events at full power. There is not currently a similarly endorsed standard for the external events PRA and non-PRA type analyses (e.g., FIVE, seismic margins analysis, NUMARC 91-06) and there is limited guidance provided in Section 3.3 of the Final Draft of NEI 00-04 for determining the technical adequacy attributes required for these types of analyses for this specific application. Industry standards have been or are being prepared for external events (seismic, high winds, and other external events), fire, and low power and shutdown PRAs. Therefore, the NRC staff expects that the applicant or licensee will prepare arguments for why the method employed is adequate to perform the analysis required to support the categorization of SSCs. Applicants or licensees will have to provide arguments supporting the technical adequacy of the external events, other operating modes, and non-PRA type analyses for each plant-specific submittal requesting to implement § 50.69. As standards are developed by the industry and endorsed by the NRC via revisions to RG 1.200 for external events, fires, and low power and shutdown, the NRC expects applicants or licensees to use these standards to demonstrate the technical adequacy of the PRAs addressing these events and operating modes.

6. Uncertainty Considerations in the Final Draft of NEI 00-04 The NRC staff notes that the Final Draft of NEI 00-04 does not address modeling or data uncertainties explicitly. However, the sensitivity studies performed to support the categorization of SSCs are intended to address some of the major sources of uncertainty (i.e., human error probabilities, common cause failure probabilities, and those items identified during the assessment of PRA technical adequacy). When assessing the potential increase in core damage frequency (CDF) and large early release frequency (LERF) as a result of implementing

§ 50.69, the applicant or licensee must address uncertainties consistent with Section 2.2.5 of Regulatory Guide 1.174.

7. Common Cause Failure and Degradation Mechanism Considerations in the Final Draft of NEI 00-04 Mechanisms that could lead to large increases in CDF and LERF are extensive, across system common cause failures (CCFs) and unmitigated degradation. However, for such extensive impacts to occur would require that the mechanisms that lead to failure, in the absence of treatment, were sufficiently rapidly developing or not self-revealing, such that there would be few opportunities for early detection and corrective action.

Those aspects of treatment that are necessary to prevent SSC degradation or failure from known mechanisms, to the extent that the results of the sensitivity studies are invalidated, should be identified by the applicant or licensee and such aspects of treatment retained. This will require an understanding of what the degradation mechanisms are and what elements of treatment are sufficient to prevent the degradation. As an example of how this would be 5

implemented, the known existence of certain degradation mechanisms affecting pressure boundary SSC integrity would support retaining the current requirements on inspections or examinations or use of the risk-informed ASME Code Cases, as accepted by the NRC regulatory process. As another example, changing levels of treatment on several similar components that might be sensitive to CCF potential would require consideration as to whether the planned monitoring and corrective action program, or other aspects of treatment, would be effective in sufficiently minimizing CCF potential such that the risk sensitivity study results remain valid (i.e., bounding).

The appropriate factor to use in the risk sensitivity study to represent the potential reduction in reliability due to the relaxation of special treatment requirements should be determined in concert with the consideration of the potential for (and retained defenses against) cross-system common cause failures and known degradation mechanisms. As part of this determination, the NRC expects licensees to: (a) demonstrate an understanding of common cause effects and known degradation mechanisms and their potential impact on RISC-3 SSCs; (b) demonstrate an understanding of the programmatic activities that provide defenses against CCFs and failures resulting from known degradation; and (c) to factor this knowledge into both the treatment applied to and the factors used for the RISC-3 SSCs.

In addition, the factor used in adjusting the unreliability of RISC-3 SSCs in the risk sensitivity study should be set at a level such that an actual increase in unreliability of a RISC-3 SSC would be detected and corrected through the monitoring, corrective action, and feedback processes. The licensee must develop and document an evaluation based on the current unreliability of the SSCs, the number of SSCs, the frequency of the opportunities to identify failures, and the monitoring and corrective action program that will identify the minimum increase in failure rates that can be detected through the monitoring and corrective action program.

8. NRC Endorsement of the Final Draft of NEI 00-04; Specific Limitations and Conditions The Final Draft of NEI 00-04 provides an approach that is acceptable to the NRC staff in meeting the categorization requirements in § 50.69, subject to the above position statements and the following specific clarifications, limitations, and conditions.

Section 1 The first paragraph (p.1) references Appendix B of NEI 00-04 as an example of a submittal, but this appendix has been deleted as a result of NRC comments on an earlier draft of NEI 00-04.

Appendix B provided an outline/example of the information to be provided to the NRC for those applicants or licensees implementing § 50.69. It is envisioned that a template may be created for submittals under § 50.69, however, at this time a template has not been developed or endorsed by the staff. Thus, applications to implement § 50.69 will be evaluated on a plant-specific basis to ensure that they properly implement the categorization process requirements of § 50.69.

The first paragraph (p.1) also states that implementation of § 50.69 in accordance with the Final Draft of NEI 00-04 guidelines should involve minimal NRC review. Though the endorsement of the Final Draft of NEI 00-04 in this regulatory guide will enable an applicant or licensee to have more assurance that the NRC will find their application acceptable, as opposed to a licensee developing their own approach, it is incorrect to characterize the NRC review of the application 6

submitted per § 50.69(b)(2)(i) as minimal. The NRC will perform an appropriately thorough review of each application submitted under § 50.69.

Section 1.2 The second paragraph of this section (p.3) discusses a third set of equipment referred to as important-to-safety and its relation to safety-related and nonsafety-related equipment. This usage is incorrect. Endorsement of this guidance is not an endorsement of this usage of the phrase important-to-safety for regulatory purposes. Though incorrect, in the context of this guidance, the NRC interprets the intent of the usage of this phrase to refer to nonsafety-related SSCs that have been determined to be important. These nonsafety-related SSCs would be categorized as either RISC-2 or RISC-4 based on their determined safety significance per the

§ 50.69 categorization process.

The fourth paragraph of this section (p.3) states that the integrated decision-making process

...blends risk insights, new technical information and operational feedback... The NRC staff interprets this phrase, and similar such phrases (e.g., Section 1.3 third guiding principle), as meaning that the integrated decision-making process must systematically consider the quantitative and qualitative information available regarding the various modes of plant operation and initiating events, including PRA, quantitative risk results and insights (e.g., CDF, LERF, and importance measures); deterministic, traditional engineering factors and insights (e.g., defense-in-depth, safety margins, containment integrity); and any other pertinent information (e.g.,

industry and plant-specific operational and performance experience, feedback, and corrective actions program) in the categorization of the SSCs.

Section 1.3 On page 4, the second guiding principle states that deterministic or qualitative information should be used if no PRA information exists related to a particular hazard or operating mode.

This principle is not to be interpreted to mean that deterministic or qualitative information should be used only when no PRA information exists. The NRC believes that the integrated decision-making process must systematically consider the quantitative and qualitative information available regarding the various modes of operation and initiating events, including: PRA, quantitative risk results and insights; deterministic, traditional engineering factors and insights; and any other pertinent information in the categorization of the SSCs.

The sixth guiding principle indicates that the attribute(s) that make an SSC safety-significant should be documented. This is done to ensure that the treatment applied to the SSC is consistent with the safety-significance cause determined in the categorization process. While the NRC staff agrees that the safety-significant attribute(s) need to be documented, the applicant or licensee must also document the justification for SSCs determined to be LSS. In other words, documentation must be available and maintained by the applicant or licensee supporting the categorization of every SSC addressed under § 50.69. This is consistent with the discussion in Section 11.1 of the Final Draft of NEI 00-04.

Section 1.4 The first paragraph (p.4) states that US nuclear generating plants have attained and maintained an outstanding safety performance record. While the NRC does not disagree with this statement, endorsement of this guidance is not an endorsement of this statement.

7

The third paragraph of this section (p.5) states that the applicant or licensee can determine the appropriate set of equipment to re-categorize under § 50.69. The NRC staff agrees that categorization under § 50.69 can be partially implemented by an applicant or licensee and the implementation can be phased in over a period of time. However, since the categorization process described in § 50.69 and in NEI 00-04 is primarily based on system/structure functions, the categorization process must be implemented for an entire system/structure; not selected components within a system. Section 50.69(c)(1)(v) requires this categorization for entire systems/structures. The primary reason that § 50.69 requires the categorization to be performed for entire systems and structures is to ensure that all the functions (which are primarily a system-level attribute) for a given SSC within a given system or structure are appropriately considered for each SSC in determining its safety significance. The system boundary definitions should be consistent with the PRA used in categorizing the SSCs and careful consideration should be given by the licensee to ensure all important functions are captured for SSCs, especially those that are common to multiple systems (e.g., tank discharge valve that feeds to multiple systems). The methodology for determining systems boundaries is left to the licensee recognizing these important constraints (i.e., drawing system boundaries in such a way as to break apart a system when viewed from a system functional standpoint would not meet this requirement).

Section 1.5 In the first paragraph (p.5) it is stated that the IDP cannot re-categorize an SSC identified as high safety significant (HSS)1 by the plant-specific risk analysis. This could be interpreted to conflict with the allowance to use the integrated importance assessment. To avoid confusion, and consistent with Figure 1-2, the NRC interprets this statement in this context as meaning the IDP cannot re-categorize an SSC that is identified as HSS as an outcome of the risk characterization portion of the process, which includes the assessments from the plant-specific probabilistic risk analyses (PRAs) of internal events, external events, and non-power operations and the integrated importance assessment.

A major part of the rationale for the integrated assessment is to address the potential conservatisms that are more typical in the PRAs for the external events and non-power operations. It is possible that an SSC that is not significant for external events and non-power operations, but is for internal events, could be determined in the integrated assessment to not be significant due to the high CDF or LERF estimates from the conservative analyses. To avoid the conservative PRA approaches from masking the significance of an SSC from the more realistic internal events PRA, SSCs identified as HSS by the internal events assessment should be retained as HSS and not be allowed to be re-categorized by the IDP, even if the integrated assessment indicates a potentially lower significance.

For example, if an SSC is determined by a PRA approach to be HSS for seismic, but is determined to be low safety significant (LSS) for all other events and operating modes, and seismic events are such a small contributor to total risk that the integrated assessment indicates the SSC is LSS, then all this information, including the results of the individual sensitivity studies, is provided to the IDP and the IDP can determine and document the final 1

NEI 00-04 uses the terminology high safety significant (HSS) to refer to SSCs that perform safety significant functions. The NRC understands HSS to have the same meaning as safety significant (i.e., SSCs that are categorized as RISC-1 or RISC-2) as used in § 50.69.

8

categorization for the SSC. A part of the IDP considerations in making the final categorization determinations should include the relative conservatisms in the analyses that support the various significance determinations. However, if an SSC is determined to be HSS from the internal events assessment, but is determined to be LSS for all other events and operating modes, and due to the conservative nature of the other analyses the internal events is a small contributor to total risk such that the integrated assessment indicates the SSC is LSS, then the SSC should still be designated to be HSS due to the internal events analyses and IDP will not be allowed to re-categorize the SSC.

In the second paragraph (p.5) it is stated that the IDP cannot re-categorize an SSC identified as HSS by the plant-specific risk analysis, but the context of this paragraph is the defense-in-depth characterization portion of the process; not the risk characterization portion. Consistent with Figure 1-2, the NRC interprets this statement in this context as meaning the IDP cannot re-categorize an SSC that is identified as HSS as an outcome of the defense-in-depth characterization portion of the process.

Section 1.5, Section 5, & Section 5.3 The NRC notes that there are numerous SSCs that are not explicitly modeled in a seismic PRA, but are screened out due to their designed seismic robustness. Many of these SSCs are inherently safety significant for seismic events. In addition to using the results of a seismic PRA in determining the significance of an SSC for seismic events, the applicant or licensee should either designate those SSCs that were screened out of the PRA due to their seismic robustness as safety significant or establish the robustness (i.e., seismic capacity) of these SSCs as a design aspect if any screened out SSC is designated as LSS. This information should also be provided to the IDP for consideration in determining the final categorization of the SSC.

Section 3.3 On page 20, for the full power internal events PRA, in addition to providing a high level summary of the results of the peer review, the applicant or licensee should provide a summary of the findings of the self-assessment performed per RG 1.200.

Section 5 The first decision block in Figure 5-1 (p.26) refers to prevention or mitigation of core damage.

This phrase could be misunderstood to not include important safety considerations related to containment performance or releases (i.e., LERF). To be consistent with the intent of the safety significance categorization process and the associated text in Section 5, this first decision block should be understood to include the prevention or mitigation of severe accidents.

Section 5.1 In the discussion of the Internal Event Assessment (pp. 29-34), the NEI guidance states that the safety significant attributes are identified by the component failure mode that contributes significantly to the importance of the SSC. It should be recognized that there may be multiple component failure modes that contribute significantly to the importance of an SSC; especially if no individual failure mode alone exceeds the screening criteria, but a number of failure modes collectively exceed the screening criteria. In these cases, the guidance should not be inferred 9

to limit the identification of safety significant attributes based on a single highest contributing failure mode, but should include all significantly contributing failure modes.

Section 5.4 (& Section 1.5)

Figure 5-6 (p.40) addresses approaches that rely on the identification of safe shutdown paths.

However, if the evaluation of an external event is performed using a screening approach, then the logic presented in Figure 5-4 would be more appropriate than the current Figure 5-6. In this approach, if an SSC participates in an unscreened scenario or is credited in the screening of the scenario (i.e., failure to credit the SSC would result in the scenario being unscreened), then that SSC would be considered safety significant. The evaluation of other external events needs to recognize the different approaches and implement the proper logic for the specific approach.

Section 6.2 In this section (p.47), the guidance presents containment isolation criteria to support the assessment of defense-in-depth. The NRC notes that § 50.69(b)(1)(x) establishes the governing criteria for which containment isolation valves and penetrations are within the scope of § 50.69.

The NRC believes that the first criteria listed for containment bypass (p.47) needs to also include mitigation of an ISLOCA event as well as the initiation and isolation of these events.

This is especially true if an event tree/fault tree logic approach is utilized to address ISLOCA events.

Section 7.2 The second bullet of the second set of bullets on page 50 states that if the SSC is categorized as low safety significant based on the internal events, but potentially high safety significant because of external events or shutdown risks, then the integral assessment should be relied upon. This may be misinterpreted to mean that the non-internal events results should be disregarded and not considered. All the information should be provided to the IDP for consideration, including the individual and integral assessment results; consistent with the example worksheet provided as Figure 7-2. Under these circumstances, if the integral assessment indicates that the SSC is candidate low safety significant, the IDP should consider those aspects that indicate the SSC is safety significant and then make a determination of the appropriate category and document its rationale.

Section 8 The factor used in the risk sensitivity study to represent the potential increase in unreliability of RISC-3 SSCs due to relaxation of special treatment requirements must be set at a level such that an actual increase in unreliability of a RISC-3 SSC would be detected and corrected through the monitoring, corrective action, and feedback processes. The example for implementation (7th paragraph in this section on page 53) is overly simplistic and technically not acceptable. An acceptable process would need to have a focused cause analysis when a RISC-3 SSC failed to determine if its failure was due to the reduction in treatment and/or an indication of a potential common cause failure or degradation mechanism. If there is indication that one of these factors is the cause of the failure, then the applicant or licensee should have a process for immediately expanding testing to similar SSCs to demonstrate their functionality 10

and for initiating a corrective action to the treatment and/or categorization processes. Likewise, if the expected number of failures, based on plant experience and reliability values used in the PRA, of a group of RISC-3 SSCs is exceeded over the evaluation interval, then a similar process should be implemented to determine the cause of the higher than expected failure rate and corrective action should be initiated to the treatment and/or categorization processes. The description of such an approach might more appropriately belong as a subsection of Chapter 11 or as its own chapter dealing with implementation (i.e., monitoring, detecting, corrective action, and feedback).

Until a technically defensible approach is provided in a revision of the NEI 00-04 guidelines, the NRC will review the applicants or licensees approach and process as part of the application requesting to implement § 50.69. Thus, the applicants or licensees application will need to describe their approach and process for monitoring, detecting, and correcting increases in unreliability of RISC-3 SSCs prior to reaching a level that could invalidate the categorization process results as required by § 50.69(c)(1)(iv) and (e)(3).

Section 9.2 Under the review of risk information (pp. 57-58), the licensees or applicants considerations should be supplemented with the following additional considerations:

In the third bullet, the IDP should also consider spatial effects as well as direct, should specifically consider the failure of the SSC on its safety significant function, and should not be limited to only those aspects not modeled in the PRA.

In the fourth bullet, the IDP should also consider functions/SSCs that are necessary for significant operator action required to mitigate accidents and transients, regardless if they are in the PRA or not.

In the fifth bullet, the IDP should also consider functions/SSCs associated with monitoring post-accident conditions.

The staff believes that in addition to the five considerations listed, the IDP should also consider the following items:

 Failure of the function/SSC will not prevent or adversely affect the plants capability to reach or maintain safe shutdown conditions and is not significant to safety during mode changes or shutdown.

 The function/SSC does not act as a barrier to fission product release during severe accidents.

 The function/SSC does not support a significant mitigating or diagnosis function for accidents and transients.

 Failure of the function/SSC will not result in releases of radioactive material that would result in the implementation of off-site emergency response and protective actions Section 10.2 11

The specific considerations that permit an LSS determination of an SSC in a safety-significant functional flow path must not be limited to just active failure modes, but must consider all potential failure modes for the subject SSC.

The NRC staff does not endorse the examples provided under the specific considerations (pp.60-61) that permit an LSS determination of an SSC in a safety-significant functional flow path. The specific conditions and criteria must be justified and documented for the specific SSCs under consideration.

Section 11.1 In addressing regulatory commitments associated with special treatment requirements listed in

§ 50.69(b)(1) for RISC-3 SSCs, NEI 00-04 specifies that licensees should ensure that any design related commitments for RISC-3 SSCs continue to be maintained. The NRC staff interprets this guidance as applying to any commitment related to the design basis functionality of RISC-3 SSCs.

Section 11.2 No specific change control process is established within § 50.69 governing changes to the NRC approved categorization process. As part of its approval of the license amendment submittal, the NRC will establish a license condition that governs changes to the categorization process.

If a licensee or applicant wishes to change their categorization process, and the change is outside the bounds of the NRC's license condition, then the licensee or applicant will need to seek NRC approval of the revised categorization process.

Section 12 NEI 00-04 identifies a number of reviews that are to be performed following revisions or updates to the PRA as part of a review of the SSC categorization. The NRC believes that the results of the risk sensitivity study, as described in Chapter 8, must be confirmed to still be acceptable following each revision or update of the PRA to ensure that the categorization process is maintained valid. If the risk sensitivity study results indicate a greater than small cumulative risk increase from implementation of § 50.69, then the categorization and/or treatment of SSCs must be revised until an acceptably small risk increase is determined.

D. IMPLEMENTATION The purpose of this section is to provide information to applicants and licensees regarding the NRC staffs plans for using this regulatory guide. No backfitting is intended or approved in connection with the issuance of this guide.

The draft guide (DG-1121) was released to encourage public participation in the development of this regulatory guide. Except in those cases in which an applicant or licensee proposes an acceptable alternative method for complying with the specified portions of the NRCs regulations, the methods to be described in the active guide reflecting public comments will be used in the evaluation of licensee compliance with the requirements of § 50.69 for the categorization of SSCs.

Value/Impact Statement 12

A separate Value/Impact Statement was not prepared for this regulatory guide. The Value/Impact Statement that was prepared as part of the Regulatory Analysis for the rulemaking is still applicable.

13