View source for NRC Inspection Manual 0326, Operability Determinations & Functionality Assessments for Conditions Adverse to Quality of Safety

[[name::Operability Determinations & Funtionality Assessments for Conditions Adverse to Quality of Safety]]

[[Issue date::1/31/2014]]

{{Adams|ML13274A578}}

==0326-01	PURPOSE==

This guidance is provided to NRC inspectors to assist their review of licensee determinations of operability and resolution of degraded or nonconforming conditions.  In addition, many licensees have found this guidance useful in developing their plant-specific operability determination process.  Users of the guidance should be aware that, although it generally reflects existing practice, it may not be directly applicable in every case at every plant.  Therefore, inspectors should discuss significant differences among licensee practices with NRC management to ensure that the guidance is applied in a reasonable and consistent manner.

If, during an inspection, an NRC inspector obtains information reasonably indicating a degraded or nonconforming condition affecting any of the structures, systems, and components ([[SSC|SSC]]s) described in Section 0326-02 (Scope and Applicability), the inspector should promptly inform the appropriate level of licensee management so that the licensee can evaluate the operability or functionality of the [[SSC|SSC]]s.

NRC regulations and the plant-specific operating license, including technical specifications (TSs), establish requirements for [[SSC|SSC]]s to ensure that plant operation does not pose an undue risk to public health and safety.  Although these requirements limit the risk of plant operation, it is not possible to address all conceivable events or plant conditions.

The licensee’s immediate and primary concern should be safe operation of the plant.  When a degraded or nonconforming condition is identified that may pose a threat to public health and safety, whether or not explicitly discussed in regulatory or licensee documents, the plant should be placed in a safe condition.  The TSs require that an [[SSC|SSC]] be operable given the plant condition (operational mode); thus there should be a reasonable expectation that the [[SSC|SSC]] in question is operable while an operability determination is being made, or an appropriate TS action requirement should be entered.  


==0326-02	SCOPE AND APPLICABILITY==

Licensees assess operability and functionality when degraded or nonconforming conditions affecting [[SSC|SSC]]s are identified. 

===02.01	Scope of [[SSC|SSC]]s for Operability Determinations===

The operability determination process is used to assess operability of [[SSC|SSC]]s described in TSs.  The scope of [[SSC|SSC]]s considered within the operability determination process is as follows:

a.	[[SSC|SSC]]s that are required to be operable by TSs in accordance with [[CFR::10 CFR 50.36#|10 CFR 50.36]].  These [[SSC|SSC]]s may perform required support functions for other [[SSC|SSC]]s required to be operable by TSs (e.g., [[system::Emergency Diesel Generator|emergency diesel generator]]s and service water).

b.	[[SSC|SSC]]s that are not explicitly required to be operable by TSs, but that perform required support functions (as specified by the TSs definition of operability) for [[SSC|SSC]]s that are required to be operable by TSs.  [[SSC|SSC]]s may also have design functions that do not perform a necessary and related support function for TSs [[SSC|SSC]]s. These design functions are not within the scope of an operability determination, but may be within the scope of a Functionality Assessment.  For example, (1) Nuclear Service Water supplied to components that do not have a TSs specified safety function or a necessary and related support function and, (2) station battery nonconformance with Station Blackout Rule [[CFR::10 CFR 50.63#|10 CFR 50.63]], Loss of all alternating current power would not necessarily render operating or shutdown [[DC|DC]] Source LCO requirements not met and therefore inoperable.   

===02.02	Scope of [[SSC|SSC]]s for Functionality Assessments===

Functionality assessments should be performed for [[SSC|SSC]]s not described in TSs, but which warrant programmatic controls to ensure that [[SSC|SSC]] availability and reliability are maintained.  In general, these [[SSC|SSC]]s and the related controls are included in programs related to Appendix B to [[CFR::10 CFR 50#|10 CFR Part 50]], “Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants,” and the maintenance rule ([[CFR::10 CFR 50.65#|10 CFR 50.65)]].  Additionally, [[SSC|SSC]]s not described in TSs may warrant functionality assessments within the processes used to address degraded and nonconforming conditions because they perform functions described in the Updated Final Safety Analysis Report ([[UFSAR|UFSAR]]), technical requirements manual, emergency plan, fire protection plan, regulatory commitments, or other elements of the current licensing basis ([[CLB|CLB]]).


==0326-03 DEFINED TERMS==

;03.01	Current Licensing Basis:
The [[CLB|CLB]] is the set of NRC requirements applicable to a specific plant, plus a licensee's docketed and currently effective written commitments for ensuring compliance with, and operation within, applicable NRC requirements and the plant-specific design basis, including all modifications and additions to such commitments over the life of the facility operating license. 

The set of NRC requirements applicable to a specific plant [[CLB|CLB]] include:
:a.	NRC regulations in [[CFR::10 CFR 2#|10 CFR Parts 2]], 19, 20, 21, 26, 30, 40, 50, 51, 54, 55, 70, 72, 73, and 100 and appendices thereto.
:b.	Commission orders.
:c.	License conditions.
:d.	Exemptions.
:e.	Technical specifications.
:f.	Plant-specific design basis information defined in [[CFR::10 CFR 50.2#|10 CFR 50.2]] and documented in the most recent [[UFSAR|UFSAR]] (as required by [[CFR::10 CFR 50.71#|10 CFR 50.71)]].
:g.	Licensee commitments remaining in effect that were made in docketed licensing correspondence (such as licensee responses to NRC bulletins, Licensee Event Reports, generic letters, and enforcement actions).
:h.	Licensee commitments documented in NRC safety evaluations. 

;03.02	Degraded Condition:  A degraded condition is one in which the qualification of an [[SSC|SSC]] or its functional capability is reduced.  Examples of degraded conditions are failures, malfunctions, deficiencies, deviations, and defective material and equipment.  Examples of conditions that can reduce the capability of a system are aging, erosion, corrosion, improper operation, and maintenance.

;03.03	Design Bases:  Design bases information, defined by [[CFR::10 CFR 50.2#|10 CFR 50.2]],  is documented in the [[UFSAR|UFSAR]] as required by [[CFR::10 CFR 50.71#|10 CFR 50.71]].  The design basis of safety-related [[SSC|SSC]]s is established initially during the original plant licensing and relates primarily to the accident prevention or mitigation functions of safety-related [[SSC|SSC]]s.  The design basis of a safety-related [[SSC|SSC]] is a subset of the [[CLB|CLB]].

;03.04	Fully Qualified:  An [[SSC|SSC]] is fully qualified when it conforms to all aspects of its [[CLB|CLB]], including all applicable codes and standards, design criteria, safety analyses assumptions and specifications, and licensing commitments.  An [[SSC|SSC]] is considered ”not fully qualified,” i.e., degraded or nonconforming, when it does not conform to all aspects of its [[CLB|CLB]], including all applicable codes and standards, design criteria, safety analyses assumptions and specifications, and licensing commitments.

The [[SSC|SSC]]s that TS require to be operable are designed and operated, as described in the [[CLB|CLB]], with design margins and engineering margins of safety to ensure, among other things, that some loss of quality does not result in immediate failure to meet a specified safety function.  The [[CLB|CLB]] includes commitments to specific codes and standards, design criteria, and some regulations that also dictate margins.  Many licensees add conservatism so that a partial loss of quality does not affect their commitments for design and operational margin.  Loss of conservatism that is not credited in the [[CLB|CLB]] does not affect operability or functionality. 

;03.05	Functional – Functionality:  Functionality is an attribute of an [[SSC|SSC]](s) that is not controlled by TSs.  An [[SSC|SSC]] not controlled by TSs is functional or has functionality when it is capable of performing its function(s) as set forth in the [[CLB|CLB]].  These [[CLB|CLB]] function(s) may include the capability to perform a necessary and related support function for an [[SSC|SSC]](s) controlled by TSs.

;03.06	Nonconforming Condition:  A nonconforming condition is a condition of an [[SSC|SSC]] that involves a failure to meet the [[CLB|CLB]] or a situation in which quality has been reduced because of factors such as improper design, testing, construction, or modification.  The following are examples of nonconforming conditions:

a.	An [[SSC|SSC]] fails to conform to one or more applicable codes or standards (e.g., the CFR, operating license, TSs, [[UFSAR|UFSAR]], and/or licensee commitments).

b.	An as-built or as-modified [[SSC|SSC]] does not meet the [[CLB|CLB]]. 

c.  Operating experience or engineering reviews identify a design inadequacy.

d.  Documentation required by NRC requirements such as [[CFR::10 CFR 50.49#|10 CFR 50.49]] is unavailable or deficient.

;03.07	Operability Declaration:  An operability declaration is a decision by a senior licensed operator on the operating shift crew that there is a reasonable expectation that an [[SSC|SSC]] can perform its specified safety function.  

;03.08	Operable – Operability:  Improved Standard Technical Specifications ([[STS|STS]]) (NUREGs 1430 through [[NUREG::NUREG-1434|NUREG-1434]]) define “Operable – Operability” as follows:

A system, subsystem, train, component, or device shall be OPERABLE or have OPERABILITY when it is capable of performing its specified safety function(s), and when all necessary attendant instrumentation, controls, normal or emergency electrical power, cooling and seal water, lubrication and other auxiliary equipment that are required for the system, subsystem, train, component, or device to perform its specified safety function(s) are also capable of performing their related support function(s).  (Emphasis added)

Plant-specific TSs that are not based on the improved [[STS|STS]] definition typically defines “Operable – Operability” as follows: 

A system, subsystem, train, component, or device shall be OPERABLE or have OPERABILITY when it is capable of performing its specified function(s), and when all necessary attendant instrumentation, controls, electrical power, cooling or seal water, lubrication and other auxiliary equipment that are required for the system, subsystem, train, component, or device to perform its specified safety function(s) are also capable of performing their related support function(s). (Emphasis added)

As described above, plant-specific TSs may differ from the improved [[STS|STS]] definition of Operable – Operability.  Therefore some judgment is needed in applying the guidance in this inspection manual chapter.  Word differences that exist are not viewed by the NRC to imply a significant difference in application of the plant-specific TSs.   Any problems resulting from inconsistencies between a plant-specific definition of operability and this guidance should be discussed with regional managers, who should discuss the issues with [[NRR|NRR]] if deemed necessary.  In all cases, a licensee’s plant-specific TS definition of Operable – Operability governs.  

When a condition is discovered that calls into question that a “specified safety function”   of [[SSC|SSC]]s required to be operable by TSs may not be met, then an operability determination should be made to determine if the [[SSC|SSC]] “specified safety function” is met.  In order to be considered operable, an [[SSC|SSC]] must be capable of performing the specified safety functions of its design, within the required range of physical conditions, initiation times, and [[Mission time|mission time]]s in the [[CLB|CLB]].  In addition, TS  
operability considerations require that an [[SSC|SSC]] meet all surveillance requirements (as specified in Surveillance Requirement (SR) Applicability [[SR::SR-3.0.1|SR 3.0.1]]).  An [[SSC|SSC]] that does not meet an SR must be declared inoperable because the LCO operability requirement(s) are not met.  For operability determination purposes, the [[Mission time|mission time]] is the duration of [[SSC|SSC]] operation that is credited in the design basis for the [[SSC|SSC]] to perform its specified safety function.  A system is expected to be tested and maintained to perform as designed.  When an [[SSC|SSC]] capability is degraded to a point where it cannot perform with reasonable expectation or reliability, the [[SSC|SSC]] should be judged inoperable, even if at this instantaneous point in time the system could provide the specified safety function. 

;03.09	Reasonable Expectation:  The discovery of a degraded or nonconforming condition may call the operability of one or more [[SSC|SSC]]s into question.  A subsequent determination of operability should be based on the licensee’s “reasonable expectation,” from the evidence collected, that the [[SSC|SSC]]s are operable and that the operability determination will support that expectation.  Reasonable expectation does not mean absolute assurance that the [[SSC|SSC]]s are operable.  The [[SSC|SSC]]s may be considered operable when there is evidence that the possibility of failure of an [[SSC|SSC]] has increased, but not to the point of eroding confidence in the reasonable expectation that the [[SSC|SSC]] remains operable.  The supporting basis for the reasonable expectation of [[SSC|SSC]] operability should provide a high degree of confidence that the [[SSC|SSC]]s remain operable. It should be noted that the standard of “reasonable expectation” is a high standard, and that there is no such thing as an indeterminate state of operability; an [[SSC|SSC]] is either operable or inoperable.  

;03.10	Specified Function/Specified Safety Function:  The definition of operability refers to the capability to perform the “specified function” at non-improved TSs plants or “specified safety function” at improved TSs plants.  The specified function/specified safety function of an [[SSC|SSC]](s) is that specified safety function(s) in the [[CLB|CLB]] for the facility.  

In addition to providing the specified safety function, an [[SSC|SSC]] is expected to perform as designed, tested and maintained.  When system capability is degraded to a point where it cannot perform with reasonable expectation or reliability, the [[SSC|SSC]] should be judged inoperable, even if at this instantaneous point in time the [[SSC|SSC]](s) could provide the specified safety function.

==0326-04	OPERABILITY DETERMINATION PROCESS==

Determinations of operability are appropriate whenever a review, TS surveillance, or other information calls into question the ability of [[SSC|SSC]]s to perform specified safety functions.  The operability determination process is used to assess operability of [[SSC|SSC]]s and their support functions for compliance with TSs when a degraded or nonconforming condition is identified for a specific [[SSC|SSC]] required to be operable by TSs, or when a degraded or nonconforming condition is identified for a necessary and related support function.  [[PRA|PRA]] functional is used to calculate risk-informed extended TSs Completion Times; however, the concept of [[PRA|PRA]] Functional – Functionality does not apply to Operable – Operability determinations.  An [[SSC|SSC]] that is determined to be [[PRA|PRA]] functional could be determined to be TS inoperable.  If an immediate threat to public health and safety is identified, actions should be taken quickly to place the plant in a safe condition in accordance with TS. 

If the inspector has reason to question that action was delayed by the licensee when performing an operability determination for an [[SSC|SSC]] that is potentially degraded or nonconforming, then the inspector should, as appropriate, challenge the cause for delay and the basis for having a reasonable expectation of operability.  The region may, with [[NRR|NRR]] concurrence as appropriate, ask that the licensee explain the perceived delay.

===04.01	Review Activities===

Reviewing the performance of [[SSC|SSC]]s and ensuring their operability is a continual process.  Potential degraded or nonconforming conditions of [[SSC|SSC]]s may be discovered during many activities including:

:a.	Additions to facilities.
:b.	Day-to-day operation of the facility.
:c.	Design modifications to facilities.
:d.	Engineering design reviews, including design basis reconstitution.
:e.	Examinations of records.
:f.	Inservice testing and inspection programs.
:g.	Maintenance activities.  
:h.	NRC inspections. 
:i.	Observations from the control room.
:j.	Operational event reviews.
:k.	Operational experience reports.
:l.	Part 21 notifications.
:m.	Plant walkdowns and tours.
:n.	Plant systems walkdowns.
:o.	Quality assurance activities such as audits and reviews.
:p.	[[SSC|SSC]] performance reviews (including common-cause mode failures).
:q.	Vendor reviews or inspections.

===04.02	Assessing Potential Degraded or Nonconforming Conditions===

When a potential degraded or nonconforming condition is identified, the licensee should take action without delay to confirm if an [[SSC|SSC]] is degraded or nonconforming.  For example, licensees should not wait to complete extensive evaluations before entering the condition into their problem identification/corrective action process.  The time required should be limited to the time necessary to understand the known or expected extent of degradation or nonconforming condition.  In particular, an extended delay to complete an investigation or cause analysis is not appropriate. 

===04.03	Presumption of Operability===

The TSs are organized and implemented on the presumption that systems are operable.  Without information to the contrary, it is reasonable to assume that once a system or component is established as operable it will remain operable.  The previous verification of operability (e.g., surveillance, or operability determination) provides that assurance.  For example, a presumption 
of operability might be appropriate if the record of the results of a test or surveillance is found to be missing but the licensee has other methods to verify that the activity was, in fact, successfully accomplished (e.g., log entries).  

However, it would not be appropriate to presume operability based on the future results of an analysis when there is not a reasonable expectation that the system can perform its specified safety function during the interim.  In other words, both “reasonable expectation of operability” and “presumption of operability” are based largely on specific sets of facts.

TS surveillances are performed periodically to verify that [[SSC|SSC]]s are operable.  TS surveillances assure the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met. Satisfactory performance of TS surveillances is usually considered sufficient to demonstrate operability.  However, if conformance to criteria in the [[CLB|CLB]] that are both necessary and sufficient to establish operability cannot be established with reasonable expectation, then performance of the surveillance requirement may not, by itself, be sufficient to demonstrate operability.  Failure to conform to [[CLB|CLB]] criteria that are not needed to demonstrate operability should be addressed by the appropriate licensee process.  An example of when surveillances would not be sufficient to establish operability is the satisfactory completion of TS surveillance but with results that show a degrading trend and indicate that acceptance criteria might not be met before the next surveillance test.  In this case, the surveillance actually identifies the conditions when the [[SSC|SSC]] will become inoperable and an operability evaluation would be warranted. 

An application for this example is an [[system::Emergency Diesel Generator|emergency diesel generator]] that passes its monthly surveillance test.  However, a licensee evaluation of vibration data recorded on a generator bearing could determine that the [[system::Emergency Diesel Generator|emergency diesel generator]] would not remain operable for its 30-day [[Mission time|mission time]].  In this instance, the [[system::Emergency Diesel Generator|emergency diesel generator]] may be capable of passing several more surveillances with each test lasting only a few hours.  While recording generator vibration data is not a requirement of TSs or an industry code or standard, once the degraded or nonconforming condition is identified, component operability should be immediately assessed. 

===04.04 	Scope of Operability Determinations===

The scope of an operability determination must be sufficient to address the capability of [[SSC|SSC]]s to perform their specified safety functions.  The operability decision may be based on analysis, a test or partial test, experience with operating events, engineering judgment, or a combination of these factors, considering [[SSC|SSC]] functional requirements.  

a.	Operability determinations should include:

:(1)	The [[SSC|SSC]]s affected by the degraded or nonconforming condition.
:(2)	The extent of condition for all similarly affected [[SSC|SSC]]s.
:(3)	The [[CLB|CLB]] requirements or commitments established for the affected [[SSC|SSC]].
:(4)	The specified safety functions performed by the affected [[SSC|SSC]]s.
:(5)	The effect or potential effect of the degraded or nonconforming condition on the affected [[SSC|SSC]]s ability to perform specified safety functions.
:(6)	Whether there is a reasonable expectation of operability, including the basis for the determination and any compensatory measures put in place to establish or restore operability.

b.	The following things should be considered when performing operability determinations:
:(1)	Design basis events are plant-specific, and plant-specific TSs, bases, and safety evaluations may contain plant-specific considerations related to operability.
:(2)	The [[SSC|SSC]] operability requirements are based on safety analysis of specific design basis events for one mode or specified condition of operation and may not be the same for other modes or conditions of operation, so all applicable modes and conditions of operation should be considered.
:(3)	The operability requirements for an [[SSC|SSC]] encompass all necessary support systems (per the TS definition of operability) regardless of whether the TSs explicitly specify operability requirements for the support functions.
:(4)	The occurrence of multiple simultaneous design basis events should be considered only to the extent that they are described in the plant’s [[CLB|CLB]].

===04.05 	Circumstances Warranting Operability Determinations===

Licensees should enter the operability determination process on discovering any of the following circumstances when the operability of any [[SSC|SSC]] described in TSs is called into question. 

Circumstances that require an operability determination: 

:a.	Degraded conditions. 
:b.	Nonconforming conditions. 
:c.	Discovery of an unanalyzed condition. 

See Sections 02.01.b and Appendix C.09 for discussions of the relationship between necessary and related support functions and the operability of [[SSC|SSC]]s described in TSs.

If an [[SSC|SSC]] is clearly inoperable (e.g., loss of motive power or failed TS surveillance), it must be declared inoperable and the operability determination process, per this guidance, need not be entered.  Note that other licensee processes and programs may need to be considered (e.g., corrective action program, availability, maintenance rule, reportablility) when [[SSC|SSC]]s are declared inoperable. 

===04.06 	Timing of Operability Determinations===

Operability should be determined immediately upon discovery that an [[SSC|SSC]] subject to TS is in a degraded or nonconforming condition.  While this determination may be based on limited information, the information should be sufficient to conclude that there is a reasonable expectation that the [[SSC|SSC]] is operable.  If not able to conclude this, the licensee should declare the [[SSC|SSC]] inoperable.  In any case, if the available information is incomplete, the licensee should promptly collect any additional information that is material to the determination (i.e., information that could result in a change to determination), and promptly make an operability determination based on the complete set of information.  If, at any time, information is developed that negates a previous determination that there is a reasonable expectation that the [[SSC|SSC]] is operable, the licensee should declare the [[SSC|SSC]] inoperable.  Appendix C of this manual chapter provides additional guidance on this subject.

====04.06.01 Immediate Determination====

After confirming the circumstances described in Section 04.05, an immediate determination of [[SSC|SSC]] operability should be completed.  The determination should be made without delay and in a controlled manner using the best available information.  Licensees should not postpone the determination until receiving the results of detailed evaluations. (Emphasis added)  If a piece of information material to the determination is missing or unconfirmed, and cannot reasonably be expected to support a determination that the [[SSC|SSC]] is operable, the licensee should declare the [[SSC|SSC]] inoperable.  While the determination is in progress, operators should remain aware of the status of affected [[SSC|SSC]]s.  The immediate determination should document the basis for concluding that a reasonable expectation of operability exists.  When a reasonable expectation of operability does not exist, the [[SSC|SSC]] should be declared inoperable.

====04.06.02 Prompt Determination====

A prompt determination of [[SSC|SSC]] operability is a follow up to an immediate determination of [[SSC|SSC]] operability.  A prompt determination is warranted when additional information, such as supporting analysis, is needed to confirm the immediate determination. 

A prompt determination, when needed, should be done without delay.  Licensees should make continuing progress toward completing the determination.  A reasonable expectation of operability should exist while the prompt determination is being done.

A prompt determination is not always necessary.  For example:

a.	If a component is declared inoperable and taken out of service for repairs, a prompt determination (to generate additional information about the inoperability) is not necessary. 

b.	If sufficient information is available at the time of the immediate determination and new information will not change the outcome, a prompt determination is not necessary.  

There is no explicit time limit for completing a prompt determination.  Nevertheless, timeliness is important and should depend on the safety significance of the issue.  For example, it may be appropriate to make a prompt operability determination within a few hours for situations involving highly safety significant [[SSC|SSC]]s.  Prompt determinations can often be done within 24 hours of discovery even if complete information is not available.  If more time is needed to gather additional information (such as a vendor analyses or calculations) the licensee can evaluate the risk importance of the additional information to decide whether to prolong the operability determination.  TSs completion time is one factor that can be used in determining an appropriate time frame within which a prompt determination should be completed.  However, in all cases a prompt determination should be done consistent with the risk significance of the [[SSC|SSC]].  

===04.07	Documentation===

Operability determinations should be documented in sufficient detail to allow an individual knowledgeable in the technical discipline associated with the condition to understand the basis for the determination.  For straightforward conditions, only the assumptions of the operability determination need be documented, but for complex conditions, detailed calculations may be necessary.  Adequate documentation is necessary to establish a basis to allow for subsequent independent reviews.  Immediate determinations need not be extensively documented; for example, it may be appropriate to accept a checked box.  Plant record systems, such as operator logs or the corrective action program, are often sufficient documentation.
The documentation for prompt determinations should include additional information necessary to support a reasonable expectation that the [[SSC|SSC]] is operable.  Supporting information should be included or appropriately referenced.  This documentation should describe the scope and basis of the determination, which may include items discussed in Section 04.04.

===04.08	Operator Awareness and Responsibilities===
The operating shift crew is responsible for overall control of facility operation.  As part of that responsibility, the operating shift crew must be aware of the operability and functionality of plant [[SSC|SSC]]s and the status of degraded or nonconforming conditions that may affect plant operation.  A senior licensed operator on the operating shift crew with responsibility for plant operations makes the declaration of operability, i.e., “makes the call” on whether an [[SSC|SSC]] described in TSs is operable or inoperable (Section 03.08). 

Plant staff in other organizations (e.g., operations, engineering, and licensing) with expertise in the subject matter and appropriate knowledge of plant operations may prepare operability determinations.  Whoever prepares the evaluation of degraded or nonconforming conditions should inform the licensed operators responsible for operating the plant of the discovery, and the status of evaluations that affect plant operation.

 

==0326-05	FUNCTIONALITY ASSESSMENT ==

===05.01	Functional===

Functionality and operability are similar but separate concepts. Determinations of functionality are appropriate whenever a review, TS surveillance, or other information calls into question the ability of an [[SSC|SSC]] not required to be operable by TSs to perform its [[CLB|CLB]] function(s).  A [[CLB|CLB]] function(s) may also perform a necessary and related support function for a [[SSC|SSC]] controlled by TSs.  While all licensees have a specific operability determination process for making operability determinations for [[SSC|SSC]]s described in TSs, including consideration of necessary and related support functions (Sections 02.01.b and Appendix C.09), most do not have a specific process for evaluating the functionality of [[SSC|SSC]]s not described in TSs.  Refer to Attachment 2, “Scope of an Operability Determination as it Relates to the Scope of a Functionality Assessment.”  Normally, functionality is assessed and documented through other plant processes such as the corrective action process.  It is appropriate to consider safety significance in determining the appropriate depth of a functionality assessment.  Also, the effect of nonfunctional [[SSC|SSC]]s on compliance with other regulatory requirements (e.g., Appendix R, station blackout, [[ATWS|ATWS]], environmental qualification, maintenance rule) should be determined. 

===05.02	Nonfunctional===

If any [[SSC|SSC]]s not described in TSs have been determined to be nonfunctional and it is not a necessary and related support function for an [[SSC|SSC]] described in TSs, then the appropriate corrective actions should be taken.  Note that other licensee processes and programs may need to be considered (e.g., availability, maintenance rule, reportability) when [[SSC|SSC]]s are not functional.  Similarly, if any [[SSC|SSC]]s not in TSs have been determined to be functional, even though a degraded or nonconforming condition is present, then the [[SSC|SSC]]s are considered functional but degraded or nonconforming and the appropriate corrective action should be taken.


==0326-06 	OPERATIONS BASED ON OPERABILITY DETERMINATIONS==

===06.01 	Inoperable===

An [[SSC|SSC]] is considered inoperable and the associated LCO must immediately be declared not met for the following conditions:
:a.	A specified TS requirement is not satisfied.

:b.	A degraded or nonconforming condition results in an [[SSC|SSC]] being unable to perform its specified safety function.  This could be determined immediately upon discovery of the condition, (e.g., a self-revealing event that demonstrates the [[SSC|SSC]] is inoperable), as a result of the immediate operability determination, or as a result of the prompt operability determination.
 

===06.02 	Operable but Degraded or Nonconforming===

If an [[SSC|SSC]] described in TSs is determined to be operable even though a degraded or nonconforming condition is present, the [[SSC|SSC]] is considered “operable but degraded or nonconforming.”  For example, an [[SSC|SSC]] may be operable even though it may not conform to the environmental qualification requirements.

An [[SSC|SSC]] that is determined to be operable but degraded or nonconforming is considered to be in compliance with its TS LCO, and the operability determination is the basis for continued operation.   This is consistent with the plant TSs controlling decisions on plant operations.  The basis for continued operation should be frequently and regularly reviewed until corrective actions are successfully completed.  [[SSC|SSC]]s that have been determined operable through an operability determination remain operable as long as the reasonable expectation of operability established by the operability determination remains valid.

The discovery of an improper or inadequate TS value or required action is considered a degraded or nonconforming condition.  Guidance on correcting plant TSs when they are found to contain nonconservative values or to specify incorrect actions is given in Administrative Letter 98-10, ”Dispositioning of Technical Specifications That Are Insufficient To Assure Plant Safety.”

In some cases a licensee may discover a noncompliance with a regulation.  The noncompliance with the regulation should be treated as a degraded or nonconforming condition, and the operability or functionality of affected [[SSC|SSC]]s assessed.  If the noncompliance is not addressed by the operating license or the TSs (i.e., the noncompliance has no impact on any specified safety function), the licensee should determine if the noncompliance raises an immediate safety issue.  The time taken to complete the corrective action should be commensurate with the safety significance of the noncompliance. (Emphasis added)  Immediate action such as shutting down the plant may not be required, unless otherwise specified by NRC requirements.  The licensee 


should determine if any other NRC requirements apply to the situation (e.g., [[CFR::10 CFR 50 Appendix B#|10 CFR Part 50, Appendix B]], Criterion XVI, ”Corrective Action,” or [[CFR::10 CFR 50.12#|10 CFR 50.12]], “Specific Exemptions”) and take any action required.

===06.03	Operability is Separate from Corrective Action to Restore Full Qualification===

The purpose of an operability determination is to provide a basis for making a timely decision on plant operation when a degraded or nonconforming condition is discovered.  Corrective actions taken to restore full qualification should be addressed through the corrective action process.  The treatment of operability as a separate issue from the restoration of full qualification emphasizes that the operability determination process is focused on safe plant operation and should not be impacted by decisions or actions necessary to plan and implement corrective action (i.e., restore full qualification). 

===06.04	Enforcement Discretion===

Under unique circumstances, a licensee may experience an unanticipated, temporary noncompliance with a TS or license condition that would result in one or more of the following: 

:a. An unnecessary plant [[Transient|transient]]. 

:b. An unnecessary down-power or the shutdown of a reactor without a corresponding health and safety benefit.

:c. The performance of testing, inspection, or system realignment that is inappropriate for the specific plant conditions. 

:d. Unnecessary delays in plant startup without a corresponding health and safety benefit.

:e. The potential for an unexpected plant shutdown during severe weather, a pandemic, other natural phenomena, or a terrorist attack that could exacerbate already degraded electrical grid conditions and could have an adverse impact on the overall public health and safety or common defense and security.

If there is time to obtain an amendment, a licensee should seek to obtain it before taking action that is not in compliance with license conditions, TSs or the [[CLB|CLB]], except in certain emergency situations when [[CFR::10 CFR 50.54#x|10 CFR 50.54(x)]] and (y) apply.  If there is not sufficient time to obtain a license amendment, licensees may seek enforcement discretion from the NRC.  Guidance applicable to these limited circumstances is provided in NRC [[Inspection Manual Chapter::NRC Inspection Manual 0410|Inspection Manual Chapter 0410]], “Notices of Enforcement Discretion.“


==0326-07	CORRECTIVE ACTION==

===07.01	The Current Licensing Basis and [[CFR::10 CFR 50#|10 CFR Part 50]], Appendix B===

When licensing a plant, the NRC reviews the design information submitted by a license applicant to assure that the plant meets NRC rules and regulations (i.e., the licensing basis).  The NRC issues a license authorizing the licensee to operate and maintain the plant in accordance with NRC rules and regulations, the conditions of the license, and plant TSs.  Licensee operation and maintenance of the plant in accordance with the license, and any changes to the license, ensure that the basis for NRC approval of the plant design remains valid.

The NRC has established various processes for making changes to the plant design in a controlled manner.  Changes to the license and TSs can be made by license amendments.  Licensees may make changes to a facility in accordance with [[CFR::10 CFR 50.59#|10 CFR 50.59]].  For significant conditions adverse to quality, licensees are required by Criterion XVI of [[CFR::10 CFR 50 Appendix B#|10 CFR Part 50, Appendix B]], to promptly identify and correct the conditions and take action to prevent recurrence.  When resolving degraded or nonconforming conditions through corrective action, licensees may make changes to a facility in accordance with the appropriate change control process.  

The NRC has also established requirements for plant operation during maintenance in accordance with the [[CLB|CLB]].  For degraded or nonconforming conditions of [[SSC|SSC]]s described in TSs, the license and TSs normally specify the required actions to meet NRC requirements.  For maintenance, [[CFR::10 CFR 50.65#|10 CFR 50.65]] may also specify additional requirements for [[SSC|SSC]]s, including risk assessments, enhanced monitoring, and repair and/or replacement activities.  If a change is risk-significant, a review of potential contingency plans for entering an increased risk profile should be done as well as a review of ongoing and planned maintenance activities.

NRC is also kept informed of operational events and plant operation issues by compliance with the reporting requirements in the TSs, [[CFR::10 CFR 50.72#|10 CFR 50.72]], 50.73, 50.9(b), [[CFR::10 CFR 21#|10 CFR Part 21]], and other parts of the CFR.

Collectively, these requirements are a process for ensuring that licensees either continue to operate in accordance with their plant’s [[CLB|CLB]], or place their plants in a safe condition and take prompt corrective action.  Both the operability determination process and corrective actions for degraded or nonconforming conditions are intended to be consistent with the process for ensuring that licensees continue to operate the facility in accordance with the [[CLB|CLB]].

===07.02	Timing of Corrective Actions===

The licensee should establish a schedule for completing a corrective action when an [[SSC|SSC]] is determined to be degraded or nonconforming.  Licensees should address any degraded or nonconforming condition in a time frame commensurate with the safety significance of the condition, even though [[CFR::10 CFR 50 Appendix B#|10 CFR Part 50, Appendix B]], Criterion XVI, “Corrective Action,” applies only to activities that affect the safety-related functions of [[SSC|SSC]]s.

In determining whether the licensee is making reasonable efforts to complete corrective actions promptly, the NRC will consider safety significance, the effects on operability, the significance of the degradation, and what is necessary to implement the corrective action.  The NRC may also consider the time needed for design, review, approval, or procurement of the repair or modification; the availability of specialized equipment to perform the repair or modification; and whether the plant must be in hot or cold shutdown to implement the actions.  If the licensee does not resolve the degraded or nonconforming condition at the first available opportunity or does not appropriately justify a longer completion schedule, the staff would conclude that corrective action has not been timely and would consider taking enforcement action.  Factors that should be considered are (1) the identified cause, including contributing factors and proposed corrective actions, (2) existing conditions and compensatory measures, including the acceptability of the schedule for repair and replacement activities, (3) the basis for why the repair or replacement activities will not be accomplished prior to restart after a planned outage (e.g., additional time is needed to prepare a design/modification package or to procure necessary components), and (4) review and approval of the schedule by appropriate site management and/or oversight organizations.
 

===07.03 	Compensatory Measures===

When evaluating the effect of a degraded or nonconforming condition on an SSC’s capability to perform any of its specified safety functions, a licensee may decide to implement compensatory measures as an interim action until final corrective action to resolve the condition is completed.  Reliance on compensatory measures is an important consideration in establishing the time frame for completing corrective action.

Compensatory measures may be used to:

a.	Maintain or enhance an operable but degraded or nonconforming SSC’s capability to perform its specified safety functions, or as the next logical step in support of corrective maintenance or to compensate for the degraded or nonconforming condition.  Implementing compensatory measures for [[SSC|SSC]]s that have been determined to be degraded or nonconforming may restore plant operating margins.

b.	Restore inoperable [[SSC|SSC]]s to an operable but degraded or nonconforming status.  In general, these measures should have minimal impact on the operators or plant operations, should be relatively simple to implement, and should be documented with a prompt operability determination.

The NRC expects that conditions calling for compensatory measures to restore [[SSC|SSC]] operability will be more quickly resolved than conditions that do not rely on compensatory measures to restore operability.  The reason is that reliance on compensatory measures to restore [[SSC|SSC]] operability suggests a greater degree of degradation or nonconformance.  Similarly, the NRC expects that conditions calling for compensatory measures to restore operability, where the compensatory measures substitute manual operator actions for automatic actions to perform a specified safety function, will be resolved expeditiously.  Appendix C.05 contains guidance on the temporary use of manual actions instead of automatic actions to support operability determinations.

The licensee should evaluate the technical acceptability and effectiveness of a compensatory measure with respect to the degraded or nonconforming condition and the affected [[SSC|SSC]]s.  The evaluation should also consider the effects of the compensatory measure on other aspects of the facility.  For example, a licensee may plan to close a valve as a compensatory measure to isolate a leak.  Although this action temporarily resolves the degraded condition, it may also affect flow distribution to other components or systems, complicate operator responses to normal or off-normal conditions, or have other effects that should be reviewed.

Additionally, if a compensatory measure involves a temporary facility or procedure change, [[CFR::10 CFR 50.59#|10 CFR 50.59]] should be applied to the temporary change with the intent to determine whether the temporary change/compensatory measure itself (not the degraded or nonconforming condition) impacts other aspects of the facility or procedures described in the [[UFSAR|UFSAR]].  In considering whether a temporary facility or procedure change impacts other aspects of the facility, a licensee should apply [[CFR::10 CFR 50.59#|10 CFR 50.59]], paying particular attention to ancillary aspects of the temporary change that result from actions taken to directly compensate for the degraded condition.  
Licensees may use the guidance in [[NEI::NEI 96-07|NEI 96-07]], Revision 1, “Guidelines for Implementing [[CFR::10 CFR 50.59#|10 CFR 50.59]],” which is endorsed by [[Regulatory Guide::Regulatory Guide 1.187|Regulatory Guide 1.187]], “Guidance for Implementation of [[CFR::10 CFR 50.59#|10 CFR 50.59]], Changes, Tests, and Experiments.”

===07.04	Final Corrective Action===

A licensee's range of corrective action may involve (1) full restoration to the [[UFSAR|UFSAR]] described condition, (2) a change to the licensing basis to accept the as-found condition as is, or (3) some modification of the facility or [[CLB|CLB]] other than restoration to the condition as described in the [[UFSAR|UFSAR]].

If corrective action is taken to restore the degraded or nonconforming [[SSC|SSC]] to the [[UFSAR|UFSAR]] described condition, no [[CFR::10 CFR 50.59#|10 CFR 50.59]] screening evaluation is required.  The [[CFR::10 CFR 50.59#|10 CFR 50.59]] process applies when the final resolution of the degraded or nonconforming condition differs from the established [[UFSAR|UFSAR]] description or analysis.  At this point, the licensee plans to make a change to the facility or procedures as described in the [[UFSAR|UFSAR]].  The proposed change is now subject to the review process established by [[CFR::10 CFR 50.59#|10 CFR 50.59]].  A change can be safe but still require NRC approval under the rule.  The proposed final resolution may require staff review and approval (via amendment) without affecting the continued operation of the plant because interim operation is governed by the processes for determining operability and taking corrective action ([[CFR::10 CFR 50 Appendix B#|10 CFR Part 50, Appendix B]]).

In two situations, the identification of a final resolution or final corrective action requires a [[CFR::10 CFR 50.59#|10 CFR 50.59]] review, unless another regulation applies (e.g., [[CFR::10 CFR 50.55a#|10 CFR 50.55a]]):  (1) when a licensee decides the final corrective action is to change its facility or procedures to something other than full restoration to the UFSAR-described condition and (2) when a licensee decides to change its licensing basis, as described in the [[UFSAR|UFSAR]], to accept the degraded or nonconforming condition as its revised licensing basis.  Both situations are discussed in greater detail below.

In both situations, the potential need to obtain NRC approval for a change does not affect the licensee's authority to operate the plant.  The licensee may make mode changes, restart from outages, etc., with degraded or nonconforming conditions provided that operations in these conditions do not violate the TSs or the license.  The basis for this authority to continue to operate is that the TSs contains the specific characteristics and conditions of operation necessary to avoid an abnormal situation or event that might give rise to an immediate threat to public health and safety. 

====07.04.01   Change to Facility or Procedures in Lieu of Full Restoration====

In this situation, the licensee’s proposed final resolution of the degraded or nonconforming condition includes other changes to the facility or procedures to cope with the uncorrected or only partially corrected degraded or nonconforming condition.  Rather than fully correcting the degraded or nonconforming condition, the licensee decides to restore capability or margin by making another change.  In this case, the licensee must evaluate the change from the UFSAR-described condition to the final condition in which the licensee proposes to operate its facility.  If the [[CFR::10 CFR 50.59#|10 CFR 50.59]] screening and/or evaluation concludes that a change to the TSs is involved or the change meets any of the evaluation criteria specified in the rule for prior NRC  
approval, a license amendment must be requested, and the corrective action process is not complete until the approval is received or some other resolution occurs.

====07.04.02   Change to the Current Licensing Basis to Accept an As-Found Condition====

In the other situation, the licensee proposes to change the [[CLB|CLB]] to accept the as-found nonconforming condition.  In this case, the [[CFR::10 CFR 50.59#|10 CFR 50.59]] review covers the change from the UFSAR-described condition to the existing condition in which the licensee plans to remain (i.e., the licensee will exit the corrective action process by revising its licensing basis to document acceptance of the condition).  If the [[CFR::10 CFR 50.59#|10 CFR 50.59]] screening and/or evaluation concludes that a change to the TSs is involved or the change meets any of the evaluation criteria specified in the rule for prior NRC approval, a license amendment must be requested and the corrective action process is not complete until the approval is received or some other resolution occurs.  To resolve the degraded or nonconforming condition without restoring the affected [[SSC|SSC]] to its [[CLB|CLB]],  a licensee may need to obtain an exemption from [[CFR::10 CFR 50#|10 CFR Part 50]] in accordance with 10  CFR 50.12 or relief from a design code in accordance with [[CFR::10 CFR 50.55a#|10 CFR 50.55a]].  The use of [[CFR::10 CFR 50.59#|10 CFR 50.59]], 50.12, or 50.55a does not relieve the licensee of the responsibility to comply with [[CFR::10 CFR 50 Appendix B#|10 CFR Part 50, Appendix B]], Criterion XVI, ”Corrective Action,” for significant conditions adverse to quality to determine the root cause, to examine other affected systems, to take action to prevent recurrence, and to report the original condition, as appropriate.


END

 
 
=Appendix A SURVEILLANCES=

==A.01	Operability during Technical Specification Surveillances==

If performance of TSs surveillances requires that [[SSC|SSC]]s required to be operable by the TSs be rendered incapable of performing their specified safety function, the [[SSC|SSC]]s are inoperable.  The LCO must immediately be declared not met.  Upon completion of the surveillance, the licensee should verify restoration to operable status of at least the parts of the [[SSC|SSC]]s or system features that were altered to accomplish the surveillance.

TSs permits use of action statements to perform surveillance testing for several reasons.  One reason is that the time needed to perform most surveillance tests is usually only a small fraction of the completion time for the required action.  Another reason is that the safety benefits (increased level of assurance of reliability and verification of operability) of meeting surveillance requirements more than compensates for the safety risk for operating the facility when a TS LCO is not met.

==A.02	System Configuration during Surveillance and Operability Testing==

It is preferable that TS surveillances be performed in the same configuration and conditions representative of those the system must be in to perform its specified safety function.  However, testing in other configurations or conditions may be required if testing in the specified safety function configuration would result in unjustifiable safety concerns or [[Transient|transient]]s.  In this case, the surveillance requirement acceptance criteria in the TSs for the test condition should be based on an extrapolation from the test condition to the condition in which the specified safety function is performed.  Operability is based on meeting the acceptance criteria specified in the TSs.  The system configuration for TS surveillance requirements is usually prescribed, and the acceptance criteria are based on the prescribed configuration.  

Test failures should be examined to determine the cause and correct the problem before resumption of testing.  Repetitive testing to achieve acceptable test results without identifying the root cause or correction of a problem in a previous test is not acceptable as a means to establish or verify operability and may constitute ”preconditioning.”

==A.03	Missed Technical Specification Surveillance==

When a TSs surveillance is missed, the TSs for a [[Missed surveillance|missed surveillance]] should be followed.  For most plants [[STS|STS]] [[SR::SR-3.0.3|SR 3.0.3]] or the equivalent applies.   

[[generic letter::NRC Generic Letter 87-09|NRC Generic Letter 87-09]], “Sections 3.0 and 4.0 of the Standard Technical Specifications ([[STS|STS]]) of the Applicability of Limiting Conditions for Operation and Surveillance Requirements,” dated June 4, 1987, contains a TS allowance which gives the licensee time to perform a [[Missed surveillance|missed surveillance]].  

Subsequent to [[generic letter::NRC Generic Letter 87-09|Generic Letter 87-09]], Technical Specifications Task Force Traveler 358, Revision 6, “Missed Surveillance Requirements,” provided model TSs for risk informed options for delaying [[Missed surveillance|missed surveillance]]s. 
[[SR::SR-3.0.3|SR 3.0.3]] may not be applied when a licensee discovers that a TSs surveillance has never been performed.  In cases where a specified safety function or a necessary and related support function required for operability has never been performed, then a reasonable expectation of operability does not exist.  However, [[SR::SR-3.0.3|SR 3.0.3]] would apply should the licensee determine that a TSs surveillance had been demonstrated outside of routine surveillances, e.g., for post-maintenance testing, or for testing resulting from normal or off-normal plant operations.

END
 
=Appendix B MAINTENANCE=

==B.01	Assessment and Management of Risk during Maintenance==

After discovering a degraded or nonconforming condition, a licensee usually does corrective maintenance to restore an [[SSC|SSC]] to meet all aspects of the plant’s [[CLB|CLB]].  The TSs and/or risk assessment should be used to determine the appropriate time frame to complete the maintenance or take other action.  The maintenance rule, [[CFR::10 CFR 50.65#|10 CFR 50.65]], provides requirements for monitoring the effectiveness of maintenance at nuclear power plants.  The underlying objective is to help maintain plant safety by trending the performance and condition of [[SSC|SSC]]s within the scope of the rule in terms of reliability and availability and by using the data to predict the future performance and condition of the [[SSC|SSC]]s and to assess the effectiveness of maintenance.  Specifically, [[CFR::10 CFR 50.65#a3|10 CFR 50.65(a)(3)]] requires licensees to appropriately balance the objective of preventing failures of [[SSC|SSC]]s through maintenance (i.e., reliability) against the objective of maximizing availability of [[SSC|SSC]]s by monitoring or preventive maintenance.  Additionally, [[CFR::10 CFR 50.65#a4|10 CFR 50.65(a)(4)]] requires that licensees perform risk assessments before maintenance activities involving [[SSC|SSC]]s within the scope of paragraph (a)(4) and manage any resulting increases in overall plant risk. 

The risk assessment performed by the licensee per [[CFR::10 CFR 50.65#a4|10 CFR 50.65(a)(4)]] should reflect the unavailability of the affected [[SSC|SSC]]s during the performance of maintenance.  In addition, the assessment should also consider the unavailability of any degraded or nonconforming [[SSC|SSC]]s determined to be inoperable or nonfunctional.  Performing the [[CFR::10 CFR 50.65#a4|10 CFR 50.65(a)(4)]] risk assessment, however, does not exempt  the licensee from complying with its license (including TSs) and other applicable regulations.

Maintenance activities may also require compensatory measures to allow the maintenance to be performed and/or to reduce risk.  Compensatory measures for maintenance should be assessed consistent with [[NUMARC::NUMARC 93-01|NUMARC 93-01]], Section 11, as endorsed by NRC regulatory guides.  Certain compensatory measures may involve temporary procedures or facility alterations to allow the maintenance to be performed or to reduce risk.  Examples are jumpered terminals, lifted leads, and temporary blocks, bypasses, or scaffolding.  Temporary alterations for maintenance should be reviewed under [[CFR::10 CFR 50.59#|10 CFR 50.59]], as applicable, consistent with [[NEI::NEI 96-07|NEI 96-07]], which is endorsed by NRC [[Regulatory Guide::Regulatory Guide 1.187|Regulatory Guide 1.187]].

The planned removal of hazard barriers for maintenance is considered a temporary facility alteration.  Additional guidance on hazard barriers is provided in Regulatory Issue Summary ([[RIS|RIS]]) 2001-009, “Control of Hazard Barriers,” dated April, 2, 2001.  In all cases, licensees must continue to comply with the plant TSs, particularly the operability provisions applicable to the protected [[SSC|SSC]]s.  [[Regulatory Issue Summary::RIS 2001-09|RIS 2001-09]] states that the operability guidance in the NRC Inspection Manual can be used to evaluate the operability of protected equipment.

==B.02	Operability during Maintenance==

During maintenance (preventive, predictive, or corrective), [[SSC|SSC]]s may be removed from service and rendered incapable of performing their functions.  For [[SSC|SSC]]s described in TSs, such [[SSC|SSC]]s  
are clearly inoperable.  The maintenance activity and any TSs required actions are expected to be finished within the allowed completion times.  A licensee may take [[SSC|SSC]]s out of service to perform maintenance during power operation of the plant, but the [[SSC|SSC]] must meet the requirements of [[CFR::10 CFR 50.65#|10 CFR 50.65]] as well as the TS requirements.  This is true for maintenance activities under all modes of plant operation.  The licensee also may need to reestablish operability for systems or components that are rendered inoperable by [[SSC|SSC]]s undergoing maintenance. 

==B.03	Operable vs. Available==

Operable – Operability is defined in Section 1.1 of the Standard Technical Specifications (see Definition 03.08).  Both the maintenance rule and the performance indicator ([[PI|PI]]) process use the word "availability" relative to the functions being monitored by the maintenance rule and the [[PI|PI]] process.  The difference between "operability" and "availability" lies in the function being reviewed; to understand the differences the inspector should review supporting documents for the maintenance rule and the [[PI|PI]] process ([[NEI::NEI 99-02|NEI 99-02]], “Regulatory Assessment Performance Indicator Guidelines”) including [[Regulatory Guide::Regulatory Guide 1.160|Regulatory Guide 1.160]], “Monitoring the Effectiveness of Maintenance at Nuclear Power Plants,” and [[Regulatory Guide::Regulatory Guide 1.182|Regulatory Guide 1.182]], “Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants.”

==B.04	Reduced Reliability as a Degraded or Nonconforming Condition==

Reliability is a measure of the reasonable expectation of the ability of an [[SSC|SSC]] to perform its function(s) described by the [[CLB|CLB]].  The reliability is initially based on design verification, quality assurance, production testing, and acceptance processes.  In service, reliability is based on operating experience (i.e., the [[SSC|SSC]] successfully performs its specified safety function or necessary and related support function on demand).  Reliability is often expressed in numbers of successes for a given number of demands. 

When an [[SSC|SSC]] experiences multiple failures, especially repetitive failures (i.e., failures for the same or a similar cause) such as those addressed in licensees’ maintenance rule programs, and when the failures exceed the number of expected failures based on operating experience, the reliability of the affected [[SSC|SSC]] is reduced.  

An [[SSC|SSC]] that has been identified as having reduced reliability should be considered degraded or nonconforming and should be evaluated to determine whether the [[SSC|SSC]] is operable.  Non-TS [[SSC|SSC]]s with reduced reliability should be similarly treated as described in this document.  When an SSC’s capability or reliability is degraded to the point where there is no longer a reasonable expectation that it can perform its specified safety function, the [[SSC|SSC]] should be judged inoperable.  A reliability reduction that calls into question the ability of an [[SSC|SSC]] to perform its specified safety function requires an operability determination.  

Various factors may contribute to reduced reliability.  Aging of [[SSC|SSC]]s is a factor of increasing importance and it should be addressed as discussed in Section 0326-04 of this document.

Note also that reduced reliability may affect the validity of underlying assumptions in one or more of the programs that use reliability information.  The plant’s probabilistic risk assessment ([[PRA|PRA]])  
uses assumed or default values for [[SSC|SSC]] failure rates, another expression of reliability, in fault-tree analysis.  Therefore, significant or persistent changes in the reliability of [[SSC|SSC]]s modeled in the [[PRA|PRA]] may need to be evaluated to determine the need to update the [[PRA|PRA]] and [[PRA|PRA]] derivatives such as risk assessment tools to reflect the actual risk environment. [[Regulatory Guide::Regulatory Guide 1.200|Regulatory Guide 1.200]], “An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities” provides the NRC position on frequency for updating [[PRA|PRA]] reliability and unavailability data. 

END

 
=Appendix C SPECIFIC OPERABILITY ISSUES=

==C.01	Relationship between the General Design Criteria (GDC) and the Technical Specifications==

The GDC, or a plant-specific equivalent  as incorporated into the [[CLB|CLB]], have an important relationship to the operability requirements of the TS.  Comprehending this relationship is critical to understanding how licensees should address nonconformance with [[CLB|CLB]] design requirements.  Some facilities were licensed before the GDC were codified in 10 CFR.  As a result the applicability of the GDC varies among facilities.  In all cases, the plant-specific current licensing basis governs.  

The GDC and the TSs differ from each other in that the GDC specify requirements for the design of nuclear power reactors, whereas the TSs specifies requirements for the operation of nuclear power reactors.  As such, the GDC cover a broad category of [[SSC|SSC]]s that are important to safety, including those [[SSC|SSC]]s that are covered by TS.  Failure to meet GDC, as described in the licensing basis (e.g., nonconformance with the [[CLB|CLB]] for protection against flooding, seismic events, tornadoes) should be treated as a nonconforming condition and is an entry point for an operability determination if the nonconforming condition calls into question the ability of [[SSC|SSC]]s to perform their specified safety function(s) or necessary and related support function(s).  If the licensee determination concludes that the TS [[SSC|SSC]] is nonconforming but operable or the necessary and related support function is nonconforming but functional, it would be appropriate to address the nonconforming condition through the licensee’s corrective action program.  However, if the licensee’s evaluation concludes that the TS [[SSC|SSC]] is inoperable, then the licensee must enter its TS and follow the applicable required actions.

===The GDC Correspond Both Directly and Indirectly to TSs Operational Requirements ===

Design requirements, such as GDC or similar requirements, are typically included in the licensing basis for every nuclear power plant.  The GDC, according to Appendix A to [[CFR::10 CFR 50#|10 CFR Part 50]], “establish the necessary design, fabrication, construction, testing, and performance requirements for structures, systems, and components important to safety.”  As such, the GDC cover a broad category of [[SSC|SSC]]s that are important to safety, including those [[SSC|SSC]]s that are covered by TS.  The safety analysis report describes the design capability of the facility to meet the GDC (or a plant-specific equivalent).  The staff safety evaluation report documents the acceptability of safety analysis report analyses.  The analyses and evaluation included in the safety analysis serve as the basis for TS issued with the operating license.  The TS limiting conditions for operation, according to [[CFR::10 CFR 50.36#c2i|10 CFR 50.36(c)(2)(i)]], “are the lowest functional capability or performance levels of equipment required for safe operation of the facility.”  Section 182 of the [[Atomic Energy Act of 1954|Atomic Energy Act of 1954]], as amended and as implemented by [[CFR::10 CFR 50.36#|10 CFR 50.36]], requires that those design features of the facility that, if altered or modified, would have a significant effect on safety, be included in the TS.  Thus, TS are intended to ensure that the most safety significant design features of a plant, as determined by the safety analysis, maintain their capability to perform their  
safety functions, i.e., that [[SSC|SSC]]s are capable of performing their specified safety functions or necessary and related support functions. 

Required actions and completion times of the TSs illustrate the relationship between the GDC and the TSs.  For example, the GDC may require redundancy of function for safety systems.  This is normally accomplished by incorporating at least two redundant trains into the design of the safety systems.  The TSs typically allows a facility to continue to operate for a specified time with only one train of a two-train safety system operable.  In that case, the GDC are met because the system design provides the necessary redundancy.  The TSs permit the operation of the system with only a single train based on an evaluation of the protection provided by the unique system lineup for the specified period.  Not all GDC that are included in the [[CLB|CLB]] are explicitly identified in TS.  However, those that are not explicitly identified may still need to be considered when either determining or establishing the basis for operability of TS [[SSC|SSC]]s. 

==C.02	Single Failures==

A single failure is defined as follows in [[CFR::10 CFR 50 Appendix A#|10 CFR Part 50, Appendix A]], “General Design Criteria for Nuclear Power Plants. 

A single failure means an occurrence which results in the loss of capability of a component to perform its intended safety functions.  Multiple failures resulting from a single occurrence are considered to be a single failure.

Appendix A contains GDC for [[SSC|SSC]]s that perform major safety functions.  Many of the GDC, for example [[General design criterion::GDC 17|GDC 17]], 21, 34, 35, 38, 41, and 44, contain a statement similar to the following:

Suitable redundancy in components and features and suitable interconnections, leak detection, isolation and containment capabilities shall be provided to assure that for onsite electrical power system operation (assuming offsite power is not available) and for offsite electrical power system operation (assuming onsite power is not available) the system safety function can be accomplished assuming a single failure.

Therefore, if these provisions are incorporated into the licensing basis the capability to withstand a single failure in fluid or electrical systems becomes a plant-specific design requirement ensuring that a single failure does not result in a loss of the capability of the system to perform its specified safety function or necessary and related functions.  Where the licensing basis does not require redundancy, the single failure guidance herein does not apply.  A single [[SSC|SSC]] cannot deliver redundant functions.

Any nonconformance with a GDC incorporated in the licensing basis by which the capability of an [[SSC|SSC]] to withstand a single failure is compromised should be treated as a degraded or nonconforming condition.  As with any degraded or nonconforming condition, the technical guidance in this document is applicable. 
 

==C.03	Treatment of Consequential Failures in Operability Determinations==

A consequential failure is a failure of an [[SSC|SSC]] caused by a postulated accident within the design basis.  For example, if during a loss-of-coolant accident (a design basis event) a broken pipe whips and incapacitates a pump such that it cannot function; such a pump failure is called a consequential failure because the pump fails as a result of the design basis event itself.  In general, facility design takes into consideration any consequential failures that are deemed credible.  In this case, the broken pump cannot be credited in the safety analysis for loss of coolant accident mitigation.

When an [[SSC|SSC]] is found to be degraded or nonconforming, the operability determination should assess credible consequential failures previously considered in the design (i.e., the [[SSC|SSC]] failures that are the direct consequence of a design basis event for which the degraded or nonconforming [[SSC|SSC]] needs to function).  Where a consequential failure (i.e., considering the degraded or nonconforming condition) would cause the loss of a specified safety function, the affected [[SSC|SSC]] is inoperable.  Such situations are most likely discovered during design basis reconstitution studies, or when new credible failure modes are identified.

==C.04	Use of Alternative Analytical Methods in Operability Determinations==

When performing operability determinations, licensees sometimes use analytical methods or computer codes different from those originally used in the calculations supporting the plant design.  This practice involves applying “engineering judgment” to determine if an [[SSC|SSC]] remains capable of performing its specified safety function during the corrective action period.  The use of alternative methods is not subject to [[CFR::10 CFR 50.59#|10 CFR 50.59]] unless the methods are used in the final corrective action.  Section 50.59 is applicable upon implementation of the corrective action.

Although the use of alternative and normally more recent methods or computer codes may raise complex plant-specific issues, their use may be useful and acceptable in operability determinations.  Therefore, the inspector should consult with the region and [[NRR|NRR]] when reviewing such determinations.  The use of alternative methods should generally be handled as follows:

a.	Occasionally, a regulation or license condition may specify the name of the analytic method for a particular application.  In such instances, the application of the alternative analysis must be consistent with the TSs, license condition, or regulation.  For example, the methods used to determine limits placed in the core operating limits report (COLR) may be specified in TSs.  An evaluation of an [[SSC|SSC]] performance capability may be determined with a non-COLR method, but the limits in the COLR must continue to comply with the technical specification. 

b.	The use of any analytical method must be technically appropriate to characterize the [[SSC|SSC]]s involved, the nature of the degraded or nonconforming condition, and specific facility design.  General considerations for establishing this adequacy include:
 

(1)	If the analytic method in question is described in the [[CLB|CLB]], the licensee should evaluate the situation-specific application of this method, including the differences between the CLB-described analyses and the proposed application in support of the operability determination process.

(2)	Utilizing a new method because it has been approved for use at a similar facility does not alone constitute adequate justification.

(3)	The method should produce results consistent with the applicable acceptance criteria in the [[CLB|CLB]].  For example, if the current performance levels are expressed in terms of [[Rem|Rem]], the method cannot generate results expressed in [[TEDE|TEDE]].

(4)	If the analytic method is not currently described in the [[CLB|CLB]], the models employed must be capable of properly characterizing the SSC’s performance.  This includes modeling of the effect of the degraded or nonconforming condition. 

(5)	Acceptable alternative methods such as the use of “best estimate” codes, methods, and techniques.  In these cases, the evaluation should ensure that the SSC’s performance is not over-predicted by performing a benchmark comparison of the non-CLB analysis methods to the applicable [[CLB|CLB]] analysis methods.

(6)	The use of the software should be controlled in accordance with the licensee’s quality assurance program, as applicable.  This includes the availability of reviewers qualified to verify results.

==C.05 Use of Temporary Manual Action in Place of Automatic Action in Support of Operability==

Automatic action is frequently provided as a design feature specific to each [[SSC|SSC]] to ensure that specified safety functions will be accomplished.  Limiting safety system settings for nuclear reactors are defined in [[CFR::10 CFR 50.36#|10 CFR Part 50.36]], “Technical Specifications,” as settings for automatic protective devices related to those variables having significant safety functions.  Where a limiting safety system setting is specified for a variable on which a safety limit has been placed, the setting must be so chosen that automatic protective action will correct the abnormal situation before a safety limit is exceeded. Accordingly, it is not appropriate to consider [[SSC|SSC]]s operable by taking credit for manual action in place of automatic action for protection of safety limits. This does not forbid operator action to put the plant in a safe condition, but operator action cannot be a substitute for automatic safety limit protection. Refer to compensatory measures discussion in Section 07.03.

Credit for manual initiation of a specified safety function should be established as part of the licensing review of a facility. Although the licensing of specific facility designs includes consideration of automatic and manual action in the performance of specified safety functions, not all combinations of circumstances have been reviewed from an operability standpoint.

For situations where substitution of manual action for automatic action is proposed for an operability determination, the evaluation of manual action must focus on the physical differences between automatic and manual action and the ability of the manual action to accomplish the specified safety function or functions.  The physical differences to be considered include the ability to recognize input signals for action, ready access to or recognition of setpoints, design nuances that may complicate subsequent manual operation (such as auto-reset, repositioning on temperature or pressure), timing required for automatic action, minimum staffing requirements, and emergency operating procedures written for the automatic mode of operation. The licensee should have written procedures in place and personnel should be trained on the procedures before any manual action is substituted for the loss of an automatic action.

The assignment of a dedicated operator for a manual action requires written procedures and full consideration of all pertinent differences. The consideration of a manual action in remote areas must include the abilities of the assigned personnel and how much time is needed to reach the area, training of personnel to accomplish the task, and occupational hazards such as radiation, temperature, chemical, sound, or visibility hazards. One reasonable test of the reliability and effectiveness of a manual action may be the approval of the manual action for the same function at a similar facility. Nevertheless, a manual action is expected to be a temporary measure and to promptly end when the automatic action is corrected in accordance with [[CFR::10 CFR 50 Appendix B#|10 CFR Part 50, Appendix B]], and the licensee’s corrective action program.

==C.06 	Use of Probabilistic Risk Assessment in Operability Decisions==

Probabilistic risk assessment is a valuable tool for evaluating accident scenarios because it can consider the probabilities of occurrence of accidents or external events.  Nevertheless, the definition of operability is that the [[SSC|SSC]] must be capable of performing its specified safety function or functions, which inherently assumes that the event occurs and that the safety function or functions can be performed.  Therefore, the use of [[PRA|PRA]] or probabilities of occurrence of accidents or external events is not consistent with the assumption that the event occurs, and is not acceptable for making operability decisions.  Refer to timing of operability determinations in Section 04.06.

However, [[PRA|PRA]] may provide valid and useful supporting information on the timeliness of a prompt operability decision and a corrective action.  [[PRA|PRA]] is also useful for determining the safety significance of [[SSC|SSC]]s.  The safety significance, whether determined by [[PRA|PRA]] or other analyses, is a factor in making decisions about the timeliness of operability determinations. 

==C.07 	Environmental Qualification==

When a licensee identifies a degraded or nonconforming condition that affects compliance with [[CFR::10 CFR 50.49#|10 CFR 50.49]], (i.e., a licensee does not have an adequate basis to establish qualification), the licensee is expected to apply the guidance of this manual chapter.  The licensee may use the criteria of Section 04.04 to establish a reasonable expectation that [[SSC|SSC]]s will perform their specified safety functions.  In this connection, it must also be shown that subsequent failure of the equipment, if likely under accident conditions, will not result in a consequential failure as discussed in Section C.03.   
 

==C.08 	Technical Specification Operability vs. [[ASME|ASME]] [[OM|OM]] Code Criteria==

The TSs normally applies to the overall performance of plant systems, but sometimes contains limiting values for the performance of certain components.  The limiting values are specified to ensure that the design basis and safety analysis are satisfied.  The values (e.g., pump flow rate, valve closure time, valve leakage rate, safety/relief valve set point pressure) are criteria that can be used to verify operability.  If the values are not met at any time, the system must be declared inoperable, the LCO must be declared not met, and the applicable conditions must be entered.

The [[ASME|ASME]] Operation and Maintenance of Nuclear Power Plants ([[OM|OM]]) Code establishes the requirements for preservice and inservice testing and the examination of certain components to assess their operational readiness.  [[ASME|ASME]] [[OM|OM]] Code acceptance criteria for inservice testing ([[IST|IST]]) include “required action ranges” or limiting values for certain component performance parameters.  These required action ranges or limiting values, defined by the [[ASME|ASME]] [[OM|OM]] Code as component performance parameters, may be more limiting than the TS values (which are accident analysis limits).  Position 8 in Attachment 1 to Generic Letter 89 04, “Guidance on Developing Acceptable Inservice Testing Programs,” defines the starting point for the completion time in TS actions for [[ASME|ASME]] pump and valve testing.  When performance data fall outside the required action range, regardless of whether the limit is equal to the TSs limit or more restrictive, the pump or valve must be declared inoperable immediately (the word “inoperative” is used in the text of the [[ASME|ASME]] Code, i.e., the pump or valve is both “inoperative” and inoperable) and the LCO must be declared not met and the applicable conditions must be entered.  

When the required action range is more limiting than its corresponding TS, the corrective action need not be limited to replacement or repair; it could be an analysis to demonstrate that the specific performance degradation does not impair operability and that the pump or valve will still fulfill its specified safety function(s), such as delivering the required flow.  A new required action range may be established after such analysis, allowing a new operability determination.

The NRC does not accept durations specified by the [[ASME|ASME]] [[OM|OM]] Code for analyzing test results as a reason for postponing entry into a TS action statement.  As soon as data are recognized as being within the required action range for pumps or as exceeding the limiting-value full-stroke time for valves, the associated component must be declared inoperable, and if subject to the TSs, the completion time specified in the action statement must be started at the time the component was declared inoperable.  For inoperable pumps and valves that are part of an [[ASME|ASME]] [[IST|IST]] program but not subject to TSs, the action should be consistent with the safety significance of the issue and the functions served by the affected system or systems. 

Recalibrating test instruments and then repeating pump or valve tests are acceptable as an alternative to repair or replacement, but cannot be done before declaring the pump or valve inoperable.  However, if during a test it is obvious that a test instrument is malfunctioning, the test may be halted and the instruments promptly recalibrated or replaced.  During a test, anomalous data with no clear indication of the cause must be attributed to the pump or valve under test.  In that case, a prompt determination of operability is appropriate with follow-on corrective action as necessary. 

==C.09 	Support System Operability==

The definition of operability assumes that an [[SSC|SSC]] described in TSs can perform its specified safety function when all necessary support systems are capable of performing their related support functions.  Each licensee must understand which support systems are necessary to ensure operability of supported TS systems.

In some cases, the licensee could use “engineering judgment” in determining whether a support system that is not described in TSs is necessary and is, therefore, required to be capable of performing its related support function.  The licensee may need to apply engineering principals in the final analysis of the basis for the decision.  For example, a ventilation system may be required in the summer to ensure that [[SSC|SSC]]s can perform their specified safety functions, but may not be required in the winter.  Similarly, the electrical power supply for heat tracing may be required in the winter to ensure that [[SSC|SSC]]s can perform their specified safety functions, but may not be required in the summer.  In all such cases, the licensee should periodically review the basis for determining that a support system is not required to ensure (a) that the conclusion remains valid, and (b) that there is timely restoration of the support system (the review may be done as part of the corrective action program).  As an alternative to restoration, the licensee may modify the support function (as it would make any other change to the facility) by following the [[CFR::10 CFR 50.59#|10 CFR 50.59]] change process and updating the [[UFSAR|UFSAR]].

Upon discovery of a support system that is not capable of performing its related support function(s), the most important consideration is the possibility of having lost all capability to perform a specified safety function.  Upon declaring a support or supported system inoperable in one train, the required actions in the TSs should be implemented.  The licensee must verify that the facility has not lost the complete capability to perform the specified safety function.  The word "verify" as used here, covers examining logs or other information to determine if required features are out of service for maintenance or other reasons.  The TSs may contain specific requirements or allowances regarding support systems.  In all cases, a licensee’s plant-specific TSs is governing.

==C.10 	Piping and Pipe Support Requirements==

Piping and pipe supports found to be degraded or nonconforming and that support [[SSC|SSC]]s described in TSs should be subject to an operability determination.  To assist licensees in the determination, the following criteria are provided to address various components, including piping, supports, support plates, and anchor bolts.  Inspection and Enforcement (IE) [[NRC bulletin::NRC Bulletin 79-14|Bulletin 79-14]], “Seismic Analyses for As-Built Safety-Related Piping Systems,” including Supplements 1 and 2, provides additional guidance.

Specific operability criteria for concrete anchor bolts and pipe supports are given in IE [[NRC bulletin::NRC Bulletin 79-02|Bulletin 79-02]], “Pipe Support Base Plate Designs Using Concrete Expansion Anchor Bolts” (see Revision 1, Supplement 1, and Revision 2).  The criteria for evaluating the operability of seismic design piping supports and anchor bolts relating to [[NRC bulletin::NRC Bulletin 79-02|Bulletins 79-02]] and 79-14 are described in internal NRC memos dated July 16, 1979 ([[ADAMS|ADAMS]] Accession No. [[document::ML993430206|ML 993430206]]), and August 7, 1979 ([[ADAMS|ADAMS]] Legacy Library Accession No. 9010180274).  When a degradation or  
nonconformance associated with piping or pipe supports is discovered, the licensee should use the criteria in Appendix F of Section III of the [[ASME|ASME]] Boiler and Pressure Vessel Code for operability determinations.  The licensee should continue to use these criteria until [[CLB|CLB]] criteria can be satisfied (normally the next refueling outage).  For [[SSC|SSC]]s that do not meet the above criteria but are otherwise determined to be operable, licensees should treat the [[SSC|SSC]]s as if inoperable until NRC approval is obtained to use any additional criteria or evaluation methods to determine operability.  Where a piping support is determined to be inoperable, the licensee should determine the operability of the associated piping system.

==C.11	Flaw Evaluation==

In accordance with Title 10 of the Code of Federal Regulations (10 CFR) 50.55a(g), structural integrity must be maintained in conformance with American Society of Mechanical Engineers ([[ASME|ASME]]) Code Section XI for those parts of a system that are subject to [[ASME|ASME]] Code requirements.  [[CFR::10 CFR 50.55a#g4|10 CFR 50.55a(g)(4)]] further requires, “Throughout the service life of a boiling or pressurized water-cooled nuclear power facility, components (including supports) which are classified as [[ASME|ASME]] Code Class 1, Class 2, and Class 3 must meet the requirements, except design and access provisions and preservice examination requirements, set forth in Section XI...”  

[[ASME Section XI]] is generally written for preservice and inservice weld examinations and any identified flaws.  [[ASME Section XI]], Article [[IWA 3000]] contains weld examination flaw acceptance standards.  If flaws are found in components for which [[ASME|ASME]] Section XI has no acceptance standards, then the construction code is to be used to establish the acceptance standards.  This is supported by Sub-article [[IWA 3100]](b) which states Aif acceptance standards for a particular component, Examination Category, or examination method are not specified in this Division [Division 1] then flaws that exceed the acceptance standards for materials and welds specified in the Section III Edition applicable to the construction of the component shall be evaluated to determine disposition

The [[ASME Code]] contains requirements describing acceptable means of performing preservice and inservice inspection of welds and certain other locations in piping, vessels, and other pressure boundary components.  For preservice and inservice inspections, the [[ASME|ASME]] Code also specifies acceptable flaw sizes based on the material type, location, and service of the system within which the flaw is discovered.  If the flaw exceeds these specified acceptable flaw sizes, the [[ASME|ASME]] Code describes an alternate method by which a calculation may be performed to evaluate the acceptability of the flaw.  While [[ASME Section XI]] does not specifically provide flaw acceptance standards for components other than those specified in Table IWX-2500-1, its methods and standards may be applied to other components when appropriate as determined by the licensee.

When [[ASME Class 1]] components do not meet [[ASME|ASME]] Code or construction code acceptance standards, the requirements of an NRC endorsed [[ASME Code Case]], or an NRC approved alternative, then an immediate operability determination cannot conclude a reasonable expectation of operability exists and the components are inoperable.  Satisfaction of Code acceptance standards is the minimum necessary for operability of Class 1 pressure boundary components because of the importance of the safety function being performed. 

When [[ASME Class 2]] or Class 3 components do not meet [[ASME Code]] or construction code acceptance standards, the requirements of an NRC endorsed [[ASME|ASME]] Code Case, or an NRC approved alternative, then a licensee must make a determination of whether the degraded or nonconforming condition results in a TS-required [[SSC|SSC]] or a TS-required support [[SCC|SCC]] being inoperable.  In order to determine the component is operable under an immediate operability determination, the degradation mechanism must be readily apparent.  To be readily apparent, the degradation mechanism must be discernible from visual examination (such as external corrosion or wear), or there must be substantial operating experience with the identified degradation mechanism in the affected system.  In addition, detailed non destructive examination data may be necessary to determine a component is operable under an immediate operability determination.  If detailed non-destructive examination is necessary and the examination cannot be completed within the time frame normally expected for an immediate operability determination, the component should be declared inoperable and the appropriate TS action statement entered.  As outlined under defined terms, Section 03.09, Reasonable 

Expectation, there is no indeterminate state of operability.  An [[SSC|SSC]] is either operable or inoperable.  Through-wall leakage and the methods to evaluate through-wall leakage are further addressed in Section C.12.

The NRC staff accepts [[ASME Code Case N-5131]],”Evaluation Criteria for Temporary Acceptance of Flaws in Moderate Energy Class 2 or 3 piping [[Section XI]], Division 1” as an acceptable alternative to the [[ASME|ASME]] Code requirements for evaluating the structural integrity for flaws identified in moderate-energy piping.  [[Regulatory Guide::Regulatory Guide 1.147|Regulatory Guide (RG) 1.147]], “Inservice Inspection Code Case Acceptability, [[ASME Section XI]], Division 1” endorses code cases, some with conditions.  Refer to [[Regulatory Guide::Regulatory Guide 1.147|RG 1.147]] for the latest revision accepted by the NRC.  At the time of this writing, [[Regulatory Guide::Regulatory Guide 1.147|RG 1.147]] endorses Code Case N-5131 with the following conditions:

a.	Specific safety factors in paragraph 4.0 of [[ASME Code Case N-5131]] must be satisfied, and 

b.	[[ASME Code Case N-5131]] may not be applied to:
 
:(1)	components other than pipe and tubing,
:(2)	leakage through a gasket,
:(3)	threaded connections employing nonstructural seal welds for leakage prevention (through-seal weld leakage is not a structural flaw, but thread integrity must be maintained), and
:(4)	degraded socket welds.

In addition, the NRC issued Generic Letter (GL) 90 05, “Guidance for Performing Temporary Non-Code Repair of [[ASME|ASME]] Code Class 1, 2, and 3 Piping,” which permits licensees to consider either the Athrough-wall flaw” or the “wall thinning” flaw evaluation approach when assessing the structural integrity of moderate- energy piping with identified through-wall flaws.  If the flaw is found acceptable by the “through-wall flaw” approach, a temporary non-code repair may be made following NRC staff review and approval of the evaluation.  A non-code repair is a repair not in compliance with the construction code or [[ASME|ASME]] Section XI.  Compensatory actions may be implemented by the licensee without NRC staff review and approval, provided the compensatory action does not involve a non-code repair to the piping system or supports and the compensatory action can be implemented in accordance with [[CFR::10 CFR 50.59#|10 CFR50.59]].  If the flaw is found acceptable by the “wall thinning” approach, immediate repair of the flaw is not required; but the licensee should comply with the guideline for flaw repair and monitoring.  Whenever a flaw does not meet [[ASME|ASME]] Code or construction code acceptance standards or the requirements of an NRC endorsed [[ASME|ASME]] code case, a relief request is required.  Whenever a flaw does not meet [[ASME|ASME]] Code or construction code acceptance standards or the requirements of an NRC endorsed [[ASME|ASME]] code case, a relief request needs to be submitted in a timely manner after completing the operability determination process documentation.

The NRC staff accepts the [[ASME|ASME]] Code, construction code, [[generic letter::NRC Generic Letter 90-05|GL 90-05]], [[ASME Code Case N 5131]], and any other applicable NRC-approved [[ASME|ASME]] Code Case criteria for conclusively establishing that a TS required [[ASME|ASME]] Code Class 2 or 3 piping system that contains a flaw has adequate structural integrity and is, therefore in a degraded but operable condition.  [[ASME|ASME]] Code Cases which describe methods, criteria, or requirements different from the [[ASME|ASME]] Code referenced in [[CFR::10 CFR 50.55a#|10 CFR 50.55a]] cannot be used to evaluate the acceptability of a flaw without prior NRC review and approval unless the [[ASME|ASME]] Code Cases are endorsed in the applicable regulatory guides.

Therefore, the table below summarizes the methods available to licensees who are acceptable to the NRC staff for evaluating structural integrity of flaws found in boiling or pressurized water-cooled nuclear power facilities on components (including supports) classified as [[ASME|ASME]] Code Class 1, Class 2, and Class 3 components. 

Methods Available to Evaluate Structural Integrity

Pipe Class/Energy	[[ASME|ASME]] Code Section XI/ Construction Code	NRC Approved Alternative e.g. RG approved Code Case	Code Case N-5131	
[[generic letter::NRC Generic Letter 90-05|GL 90-05]]
Class 1/HE
X
X



Class 2/HE
X
X



Class 2/ME
X
X
X


Class 3/HE
X
X

X

Class 3/ME
X
X
X
X


Once a flaw is determined to be unacceptable, regardless of whether the degraded component is degraded but operable, or inoperable, the component must be restored to meet [[ASME|ASME]] Code or construction code requirements, requirements of an NRC endorsed [[ASME|ASME]] Code Case, or an NRC approved alternative.  If this involves physical changes to the components, it must be  
completed in accordance with [[ASME|ASME]] Section XI, IWA-4000.  The NRC staff expects that components be restored to [[ASME|ASME]] Code or construction code acceptance standards by the end of the next refueling outage.  

==C.12	Operational Leakage from [[ASME|ASME]] Code Class 1, 2, and 3 Components ==

Leakage from the [[system::Reactor Coolant System|reactor coolant system]] is limited to specified values in the TSs depending on whether the leakage is from identified, unidentified, or specified sources such as the steam generator tubes or [[system::Reactor Coolant System|reactor coolant system]] pressure isolation valves.  If the leakage exceeds TS limits, the limiting condition for operation (LCO) must be declared not met and the applicable TS conditions must be entered.  For identified [[system::Reactor Coolant System|reactor coolant system]] leakage within the TS limits, the licensee should make an immediate operability determination for the degraded component (i.e., the leaking component) and include in the determination the effects of the leakage on other components and materials.

The regulations require that the structural integrity of [[ASME|ASME]] Code Class 1, 2, and 3 components be maintained in accordance with the [[ASME|ASME]] Code or construction code acceptance standards.  If a leak is discovered in a Class 1, 2, or 3 component while conducting an inservice inspection, maintenance activity, or during facility operation, any corrective measures to repair or replace the leaking component must be performed in accordance with IWA-4000 of Section XI.  The NRC staff expects that components be restored to [[ASME|ASME]] Code or construction code acceptance standards by the end of the next refueling outage.

The operational leakage TS LCO does not permit any reactor coolant pressure boundary leakage.  Upon discovery of leakage from a Class 1 pressure boundary component (pipe wall, valve body, pump casing, etc.), the licensee must declare the component inoperable.  Upon discovery of leakage from a TS-required Class 2 or Class 3 component (“Time of Discovery” for Performance Indicator and risk/PRA evaluations), the component is evaluated in an immediate determination of operability (followed by a prompt determination if additional or supporting analysis is needed) to support a reasonable expectation of operability.  In performing the immediate determination, the degradation mechanism would have to be readily apparent to support a determination of operable.  To be readily apparent, the degradation mechanism must be discernible from visual inspection (such as external corrosion or wear) or substantial operating experience must exist with the degradation mechanism on the system at the facility.  In addition, detailed non-destructive examination data may be necessary to support an immediate expectation of operability determination.  If detailed non-destructive examination is necessary and the examination cannot be completed within the time frame normally expected for an immediate operability determination, the component should be declared inoperable and the appropriate TS required actions taken.  As outlined under defined terms, Section 03.09, Reasonable Expectation, there is no such thing as an indeterminate state of operability; an [[SSC|SSC]] is either operable or inoperable.  [[generic letter::NRC Generic Letter 90-05|GL 90-05]] provides guidance for the evaluation of Class 3 piping and [[ASME|ASME]] Code Case N-5131 provides guidance for the evaluation of Class 2 and Class 3 moderate energy piping.  As noted above, upon discovery of leakage from a TS-required Class 2 or a Class 3 pressure boundary component a prompt operability determination supporting analysis to  
characterize the flaw may be needed.  In performing the prompt operability determination, the licensee must evaluate the structural integrity of the leaking component using the actual geometry of the through-wall flaw characterized or bounded with volumetric examination methods.  It may be possible to use visual methods to determine the exterior dimension(s) and orientation of a through-wall flaw in a leaking component.  However, even though the outside surface breaking dimension of a through-wall flaw may be small, the length and extent of the flaw inside the component wall may be quite long and potentially result in inadequate structural integrity of the component.  

To evaluate the structural integrity of the leaking component, the licensee may use the criteria in Section XI of the [[ASME|ASME]] Code, the construction code, or any applicable [[ASME|ASME]] Code Case approved by the NRC.  In addition, the licensee may evaluate the structural integrity of Class 3 piping by evaluating the flaw using the criteria of paragraph C.3.a of Enclosure 1 to [[generic letter::NRC Generic Letter 90-05|GL 90-05]].  If the flaw meets the [[generic letter::NRC Generic Letter 90-05|GL 90-05]] criteria, the piping is degraded but operable.  However, relief from [[ASME|ASME]] Code requirements is needed even if the structural integrity is found acceptable when applying [[generic letter::NRC Generic Letter 90-05|GL 90-05]].  Whenever a flaw is through-wall in an [[ASME|ASME]] Code component when evaluated using [[generic letter::NRC Generic Letter 90-05|GL 90-05]], a relief request needs to be submitted in a timely manner after completing the operability determination process documentation and prior to implementing a non-code repair/replacement activity to the [[SSC|SSC]].

Alternatively, the licensee may evaluate the structural integrity of leaking Class 2 or Class 3 moderate-energy piping using the criteria of [[ASME|ASME]] Code Case N-5131 or any other applicable NRC approved [[ASME|ASME]] Code Case, as indicated in the table in Appendix C.11, “Flaw Evaluation.”  If the flaw in the leaking component has adequate structural integrity in accordance with criteria of an [[ASME|ASME]] Code Case acceptable to the NRC staff, the piping can be deemed degraded but operable and continued temporary service of the degraded piping components is permitted.  A relief request is not necessary when evaluated in accordance with an NRC approved code case as endorsed by the code case regulatory guide, and the evaluation results demonstrate adequate structural integrity.  Components with these flaws must be restored to [[ASME|ASME]] Code or construction code requirements through repair/replacement or meet requirements acceptable to the NRC, as approved in a relief request or [[ASME|ASME]] Code Case approved under the RGs prior to the completion of the next scheduled refueling outage.  Other compensatory actions may be taken by the licensee, provided these compensatory actions are within the limitations of [[CFR::10 CFR 50.59#|10 CFR 50.59]].

The NRC staff does not consider through-wall conditions in components, unless intentionally designed to be there such as sparger flow holes, to be in accordance with the intent of the [[ASME|ASME]] Code or construction code and, therefore, would not meet code requirements, even though the system or component may demonstrate adequate structural integrity.  Thus, unless a through-wall flaw is evaluated and found acceptable using an applicable and NRC endorsed code case, in which all provisions are met including any additional requirements or limitations imposed by the RG endorsing the code case, a relief request is necessary.  

Once a component is evaluated for structural integrity using criteria acceptable to the NRC staff as described herein, and determined to be unacceptable, the component has to be declared inoperable and the TSs action statements for the applicable system must be followed.   

If the licensee decides to control the leakage and maintain structural integrity by mechanical clamping means, the requirements of [[ASME|ASME]] Code Case N-5231, ”Mechanical Clamping Devices for Class 2 and 3 Piping Section XI, Division 1,” may be followed, because the NRC staff endorses this Code Case in [[Regulatory Guide::Regulatory Guide 1.147|Regulatory Guide 1.147]], “Inservice Inspection Code Case Acceptability, [[ASME|ASME]] Section XI, Division 1”.  This Code Case applies to structural integrity of Class 2 and 3 piping which is 6 inches (nominal pipe size) and smaller and shall not be used on piping larger than 2 inches (nominal pipe size) when the nominal operating temperature or pressure exceeds 200F or 275 psig.  These and other applicable [[ASME|ASME]] Code Cases which have been determined to be acceptable for licensee use without a request or authorization from the NRC are listed in [[Regulatory Guide::Regulatory Guide 1.147|RG 1.147]] for [[ASME|ASME]] Section XI and [[Regulatory Guide::Regulatory Guide 1.84|RG 1.84]], ”Design, Fabrication, and Materials Code Case Acceptability, [[ASME|ASME]] Section III,” for [[ASME|ASME]] Section III.  These [[ASME|ASME]] Code Cases do not apply to Class 1 pressure boundary components.

The NRC has no specific guidance or generically approved alternatives for temporary repair of flaws (through-wall or non-through-wall) in system pressure boundary components other than piping in Class 1, 2, or 3 high-energy system components, or for Class 2 or 3 moderate-energy system components.  Therefore, all such flaws in these components must be repaired in accordance with [[ASME|ASME]] Code requirements, or relief from [[ASME|ASME]] Code requirements must be requested of and approval obtained from the NRC. 

==C.13 	Structural Requirements==

Structures may be required to be operable by the TSs, or they may be related support functions for [[SSC|SSC]]s in the TSs.  Examples of structural degradation are concrete cracking and spalling, excessive deflection or deformation, water leakage, rebar corrosion, missing or bent anchor bolts, and degradation of door and penetration sealing.  If a structure is degraded, the licensee should assess the capability of the structure to perform its TSs specified safety function and any necessary and related support function specified in the [[CLB|CLB]].  As long as the identified degradation does not result in exceeding acceptance limits specified in applicable design codes and standards referenced in the design basis documents, the affected structure is either operable or functional.

NRC inspectors, with possible headquarters support, should review licensees’ evaluations of structural degradations to determine their technical adequacy and conformance to licensing and regulatory requirements.


END
 
Attachment 1:  Operability Determination and Functionality Assessment Flowchart
  
Attachment 2:  Scope of an Operability Determination as it Relates to
the Scope of a Functionality Assessment










































 
=Attachment 3 - Revision History for [[Inspection Manual Chapter::NRC Inspection Manual 0326|IMC 0326]], “Operability Determinations & Functionality Assessments for Conditions Adverse to Quality or Safety”=

Commitment
Tracking Number	Accession Number
Issue Date
Change Notice	Description of Change	Description of Training Required and Completion Date	Comment and Feedback Resolution Accession Number 
None	[[document::ML12345A578|ML12345A578]]
01/31/14
[[CN|CN]] 14-004
	TG Part 9900 Technical Guidance STSODP “Operability Determinations & Functionality Assessments for Resolution of Degraded or Nonconforming Conditions Adverse to Quality or Safety” is updated and reissued as [[Inspection Manual Chapter::NRC Inspection Manual 0326|IMC 0326]], “Operability Determinations & Functionality Assessments For Conditions Adverse To Quality Or Safety.”  The pertinent changes includes the following:
*	Scope of [[SSC|SSC]]s for Operability Determinations. The parenthetical reference to the support systems (diesel fuel oil, lube oil and starting air) in the guidance is replaced with Nuclear Service Water and Station Battery examples in a footnote. The footnote discussion states that all design functions may not be within the scope of an operability determination, but may be within the scope of a Functionality Assessment.
*	Definition Functional – Functionality. [[CLB|CLB]] function(s) of [[SSC|SSC]]s not controlled by TSs may include the ability to perform a necessary and related support function for an [[SSC|SSC]](s) controlled by TSs. Definition Operable/Operability. Plant-specific operability definitions may refer to either “specified functions” or “specified safety functions” when describing the [[CLB|CLB]] of a structure, system or component and that these are descriptive terms that have the same meaning when used in operability determinations

	Incorporated into iLearn Operability Refresher Training	None
 

Commitment
Tracking Number	Accession Number
Issue Date
Change Notice	Description of Change	Description of Training Required and Completion Date	Comment and Feedback Resolution Accession Number 
*	Definition Specified Function/Specified Safety Function. Refers to the “specified safety functions” in the facility [[CLB|CLB]].  
*	Operability Determination Process. “PRA functional” is used to calculate risk-informed Completion Times but the term does not apply to operability determinations. 
*	Assessing Potential Degraded or Nonconforming Conditions. The time required should be limited to the time necessary to understand the known or expected extent of degradation or nonconforming condition and that an extended delay to complete an investigation or cause analysis is not appropriate.
*	Presumption of Operability. Includes performing TS surveillances to assure the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met.
*	Functionality Assessments. Functionality assessments are appropriate whenever a review, TS surveillance, or other information calls into question the ability of an [[SSC|SSC]] not required to be operable by TSs to perform its [[CLB|CLB]] function(s).  A [[CLB|CLB]] function(s) may also perform a necessary and related TSs support function for a [[SSC|SSC]] controlled by TSs.
*	Enforcement Discretion. Revised to be consistent with [[Inspection Manual Chapter::NRC Inspection Manual 0410|MC 0410]].  		
 

Commitment
Tracking Number	Accession Number
Issue Date
Change Notice	Description of Change	Description of Training Required and Completion Date	Comment and Feedback Resolution Accession Number 
		*	Compensatory Measures. Used to restore inoperable SSCS to operable but degraded status should be documented in a prompt operability determination. Compensatory measures may include temporary facility or procedure changes that impact other aspects of the facility which may require applying the requirements of [[CFR::10 CFR 50.59#|10 CFR 50.59]].
*	Missed Technical Specifications Surveillance. Revised to clarify use of [[SR::SR-3.0.3|SR 3.0.3]] does not apply when a TSs Surveillance has never been performed.
*	Relationship Between the General Design Criteria and the Technical Specifications. Revised to address recent staff licensing issues on the need to clarify the relation between TSs and the GDC.  
*	Single Failures. Revised to complete the list of applicable GDC and to clarify its language.