Regulatory Guide 1.177: Difference between revisions

From kanterella
Jump to navigation Jump to search
(Created page by program invented by StriderTol)
(StriderTol Bot change)
 
(6 intermediate revisions by the same user not shown)
Line 1: Line 1:
{{Adams
{{Adams
| number = ML003740176
| number = ML20164A034
| issue date = 08/31/1998
| issue date = 01/04/2021
| title = (Draft Issued as DG-1065) an Approach for Plant-Specific,Risk-Informed Decisionmaking:Technical Specifications
| title = (DG-1287) an Approach for Plant-Specific, Risk Informed Decisionmaking: Technical Specifications
| author name =  
| author name =  
| author affiliation = NRC/RES
| author affiliation = NRC/RES/DE
| addressee name =  
| addressee name =  
| addressee affiliation =  
| addressee affiliation =  
| docket =  
| docket =  
| license number =  
| license number =  
| contact person =  
| contact person = SJG1
| document report number = RG-1.177
| case reference number = DG-1287
| document report number = RG-1.177, Rev 2
| package number = ML20164A029
| document type = Regulatory Guide
| document type = Regulatory Guide
| page count = 28
| page count = 40
}}
}}
{{#Wiki_filter:U.S. NUCLEAR REGULATORY  
{{#Wiki_filter:U.S. NUCLEAR REGULATORY COMMISSION  
COMMISSION
 
August 1998 REGULATORY
REGULATORY GUIDE 1.177, REVISION 2
GUIDE OFFICE OF NUCLEAR REGULATORY  
 
RESEARCH REGULATORY
Issue Date: January 2021 Technical Lead: Todd Hilsmeier Pete Snyder 
GUIDE 1.177 (Draft was Issued as DG-1065) AN APPROACH FOR PLANT-SPECIFIC, RISK-INFORMED  
 
DECISIONMAKING:  
Written suggestions regarding this guide or development of new guides may be submitted through the NRCs public Web site in the NRC Library at https://nrcweb.nrc.gov/reading-rm/doc-collections/reg-guides/, under Document Collections, in Regulatory Guides, at https://nrcweb.nrc.gov/reading-rm/doc-collections/reg-guides/contactus.html.
TECHNICAL  
 
SPECIFICATIONS
Electronic copies of this RG, previous versions of RGs, and other recently issued guides are also available through the NRCs public Web site in the NRC Library at https://nrcweb.nrc.gov/reading-rm/doc-collections/reg-guides/, under Document Collections, in Regulatory Guides. This RG is also available through the NRCs Agencywide Documents Access and Management System (ADAMS) at http://www.nrc.gov/reading-rm/adams.html, under ADAMS Accession Number (No.) ML20164A034. The associated draft guide DG-1287 may be found in ADAMS under Accession No. ML19206A489, and the staff responses to the public comments on DG-1287 may be found under ADAMS Accession No. ML20191A231. The responses to public comments on the 2012 version of DG-1287 (ADAMS Accession No. ML12017A054) can be found in ADAMS under Accession No. ML12228A289. The regulatory analysis may be found in ADAMS under Accession No. ML19206A493.
 
PLANT-SPECIFIC, RISK-INFORMED DECISIONMAKING:  
TECHNICAL SPECIFICATIONS  


==A. INTRODUCTION==
==A. INTRODUCTION==
The NRC's policy statement on probabilistic risk analysis (PRA)(Ref.
Purpose This regulatory guide (RG) describes an approach that is acceptable to the staff of the U.S. Nuclear Regulatory Commission (NRC) for developing risk-informed applications for changes to completion times (CTs) and surveillance frequencies (SFs) of plant technical specifications (TS). This RG
provides specific guidance for considering engineering issues and using risk information to evaluate nuclear power plant TS changes to CTs and SFs.
 
This RG supplements the guidance in RG 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis (Ref. 1), and includes precise terminology to ensure that the defense-in-depth philosophy is interpreted and implemented consistently.
 
Applicability This RG applies to light-water reactor (LWR) licensees subject to Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic Licensing of Production and Utilization Facilities (Ref. 2), and
10 CFR Part 52, Licenses, Certifications, and Approvals for Nuclear Power Plants (Ref. 3). 
Applicable Regulations
*
10 CFR Part 50 provides regulations for licensing production and utilization facilities.
 
o
10 CFR 50.36, Technical Specifications, requires applicants to submit proposed TS for their facilities. The TS include items in the categories of (1) safety limits, limiting safety system settings, and limiting control settings, (2) limiting conditions for operation (LCOs), (3) surveillance requirements, (4) design features, and (5) administrative
 
RG 1.177, Rev. 2, Page 2 controls (stating that each licensee shall submit any reports to the Commission under approved TS as specified in 10 CFR 50.4, Written Communications).
o
10 CFR 50.90, Application for Amendment of License, Construction Permit, or Early Site Permit, requires that applications for license amendments fully describe the changes desired.
 
*
10 CFR Part 52 governs the issuance of early site permits, standard design certifications, combined licenses, standard design approvals, and manufacturing licenses for nuclear power facilities.
 
Related Guidance
*
NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition (Ref. 4), provides guidance to the NRC staff for performing safety reviews of construction permit or operating license applications (including requests for amendments) under 10 CFR Part 50 and of early site permit, design certification, combined license, standard design approval, or manufacturing license applications under 10 CFR Part 52 (including requests for amendments).
o NUREG-0800, Section 16.1, Risk-Informed Decision Making: Technical Specifications, addresses risk-informed decisionmaking for TS. The guidance pertaining to TS changes to SFs and CTs in Section 16.1 is consistent with the guidance in this RG.
 
o NUREG-0800, Section 19.1, Determining the Technical Adequacy of Probabilistic Risk Assessment for Risk-Informed License Amendment Requests after Initial Fuel Load, addresses the acceptability of a baseline probabilistic risk assessment (PRA) that a licensee uses to support license amendments for an operating reactor, as well as license amendment requests submitted after initial fuel load for new reactors.
 
o NUREG-0800, Section 19.2, Review of Risk Information Used To Support Permanent Plant-Specific Changes to the Licensing Basis: General Guidance, addresses the review of risk information used to support permanent plant-specific changes to the licensing basis.
 
*
NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking: Final Report, (Ref. 5), provides guidance on how to treat uncertainties associated with PRAs in risk-informed decisionmaking. This guidance is intended to foster an understanding of the uncertainties associated with PRAs and their impact on PRA
results.
 
*
RG 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants (Ref. 6),
provides methods demonstrating compliance with the provisions of 10 CFR 50.65, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants.
 
*
RG 1.174 provides guidance on an acceptable approach for developing risk-informed applications for a licensing basis change that considers engineering issues and applies risk insights.
 
*
RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities (Ref. 7), provides an approach for determining whether the base PRA, in total or the parts used to support an application, is acceptable for use in
 
RG 1.177, Rev. 2, Page 3 regulatory decisionmaking for LWRs. Also note that the NRC will periodically update RG 1.200
as the agency adopts new PRA standards.
 
Purpose of Regulatory Guides The NRC issues RGs to describe methods that are acceptable to the staff for implementing specific parts of the agencys regulations, to explain techniques that the staff uses in evaluating specific issues or postulated events, and to describe information that the staff uses in its review of applications for permits and licenses. Regulatory guides are not NRC regulations and compliance with them is not required. Methods and solutions that differ from those set forth in RGs are acceptable if supported by a basis for the issuance or continuance of a permit or license by the Commission.
 
Paperwork Reduction Act This RG provides voluntary guidance for implementing the mandatory information collections in
10 CFR Parts 50 and 52 that are subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.).
These information collections were approved by the Office of Management and Budget (OMB), approval numbers 3150-0011 and 3150-0151. Send comments regarding this information collection to the Information Services Branch (T6-A10M), U.S. Nuclear Regulatory Commission, Washington, DC
20555-0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the OMB reviewer at: OMB Office of Information and Regulatory Affairs (3150-0011 or 3150-0151), Attn: Desk Officer for the Nuclear Regulatory Commission, 725 17th Street, NW, Washington, DC 20503; e-mail:
oira_submission@omb.eop.gov.
 
Public Protection Notification The NRC may not conduct or sponsor, and a person is not required to respond to, a collection of information unless the document requesting or requiring the collection displays a currently valid OMB
control number.
 
RG 1.177, Rev. 2, Page 4
 
==B. DISCUSSION==
Reason for Revision This revision of the guide (Revision 2) provides updated guidance on the defense-in-depth philosophy to be consistent with the related guidance in RG 1.174. The NRC revised RG 1.174 in 2018 to expand the guidance on the meaning of and the process for assessing defense-in-depth considerations.
 
Specifically, this revision of RG 1.177 references the defense-in-depth guidance in RG 1.174 in several places in the staff regulatory guidance.
 
Additionally, the staff revised this guide to (1) adopt the term PRA acceptability, and related phrasing variants, instead of terms such as PRA quality, PRA technical adequacy, and technical adequacy to describe the appropriateness of the PRA used to support risk-informed licensing submittals,
(2) update Section C.2.3 on the evaluation of risk impact (Principle 4), (3) specify that long-term CT
extension requests will increase the depth and level of detail of the staffs review and the need for proposed measures to reduce the risk impact of the TS change commensurate with the proposed CT
extension, and (4) add a new Section C.2.6 on integrated decisionmaking consistent with RG 1.174, Section C.2.6.
 
Background The Commission established its regulatory requirements for TS in 10 CFR 50.36. In doing this, the Commission emphasized matters related to the prevention of accidents and the mitigation of accident consequences. The Commission noted that applicants were expected to incorporate into their TS those items that are directly related to maintaining the integrity of the physical barriers designed to contain radioactivity (Ref. 8).
In August 1995, the NRC issued Use of Probabilistic Risk Assessment Methods in Nuclear Regulatory Activities: Final Policy Statement (Ref. 9), which encourages greater use of this analysis technique to improve safety decisionmaking and regulatory efficiency. One activity undertaken in response to the policy statement is the use of PRA to support decisions to modify an individual plants licensing basis. Such modifications are related to decisions to modify an individual plants TS.
 
To support the use of risk-informed decisionmaking, the NRC developed RG 1.174, which provides guidance on an acceptable approach for developing risk-informed applications for a licensing basis change and considers engineering issues and applies risk insights. This RG supplements the guidance in RG 1.174.
 
The staff normally uses deterministic engineering analysis to evaluate license amendment requests for TS changes that are consistent with approved staff positions (e.g., generic letters (GLs), RGs, standard review plans, branch technical positions, or the Standard Technical Specifications (STS)
(Refs. 10-14)). For TS change requests that go beyond current staff positions, in which a licensee elects to use risk information to support the proposed TS change, the staffs evaluation may use deterministic engineering analyses and the risk-informed approach set forth in this RG. The staff will review the information provided by the licensee to determine whether it can approve the application based on the information provided using deterministic and risk-informed methods, as applicable, and will either approve or reject the application based on the review.
 
The guidance in this RG does not preclude other approaches for requesting changes to the TS.
 
Rather, this RG is intended to improve consistency in regulatory decisions when the results of risk analyses are used to help justify TS changes.
 
RG 1.177, Rev. 2, Page 5 This RG describes an acceptable approach for assessing the nature and impact of proposed TS
changes in CTs and SFs by considering engineering issues and applying risk insights. As presented in detail in Section C of this RG, assessments should consider relevant safety margins and defense-in-depth attributes, including success criteria and equipment functionality, reliability, and availability.
 
In addition, this RG describes acceptable TS change implementation strategies and performance monitoring plans that will help ensure that assumptions and analyses supporting the change are verified. It also indicates an acceptable level of documentation to reach a finding that the licensee has performed a sufficiently complete and scrutable TS change analysis and that the results of the engineering evaluations support the licensees proposed TS change.
 
Risk-informed TS submittals may address either permanent changes to TS requirements or one-time-only changes. Once approved, permanent changes apply to all future occurrences. Licensees request a one-time-only change to a TS requirement for a particular condition and for a specified period, typically for a CT. This RG provides guidance for both permanent and one-time-only CT changes to TS.
 
In addition, the term operable as used in this document and the single-failure criterion should be understood within the context of this RG. All TS contain a definition of the terms operable and operability that is similar to this example from NUREG-1431, Standard Technical Specifications, Westinghouse Plants, Revision 4 (Ref. 11):
A system, subsystem, train, component, or device shall be OPERABLE or have OPERABILITY when it is capable of performing its specified safety function(s) and when all necessary attendant instrumentation, controls, normal or emergency electrical power, cooling and seal water, lubrication, and other auxiliary equipment that are required for the system, subsystem, train, component, or device to perform its specified safety function(s) are also capable of performing their related support function(s).
As described above, a plant-specific TS may differ from the STS definition of Operable Operability. Therefore, some judgment is needed in applying the guidance from Inspection Manual Chapter 0326, Operability Determinations, dated September 30, 2019 (Ref. 15).
The staff gave the historical basis for this definition in GL 80-30, Clarification of the Term Operable as It Applies to Single Failure Criterion for Safety Systems Required by TS, dated April 10, 1980 (Ref. 16). GL 80-30 states that the TS were formulated to preserve the single-failure criterion for systems that are relied upon in the safety analysis report. When the required redundancy is not maintained, the TS require action within a specified time. GL 80-30 calls the specified time to take action an equipment out-of-service time. This term is equivalent to the term completion time used in the STS. This limited time is a temporary relaxation of the single-failure criterion to take action so that the equipment can be restored to an operable status in accordance with the TS.
 
Since publishing GL 80-30, the NRC has issued various initial operating licenses, combined licenses, and amendments to licenses, each of which contains a definition of operable similar to the GL 80-30 definition. These definitions do not require a licensee to assume an additional failure when assessing the operability of a degraded or nonfunctional safety system or component.
 
Harmonization with International Standards The NRC has a goal of harmonizing its regulatory guidance with documents issued by the International Atomic Energy Agency (IAEA) to the extent practical. Although the NRC does not endorse
 
RG 1.177, Rev. 2, Page 6 the following IAEA safety standard(s) and/or guide(s), this RG generally incorporates similar guidelines and is generally consistent with the basic safety principles provided in them.
 
*
IAEA Safety Standards Series No. SSG-3, Development and Application of Level 1 Probabilistic Safety Assessment for Nuclear Power Plants, Specific Safety Guide, issued 2010
(Ref. 17)
*
IAEA Safety Standards Series No. SSG-4, Development and Application of Level 2 Probabilistic Safety Assessment for Nuclear Power Plants, Specific Safety Guide, issued 2010
(Ref. 18)
*
IAEA Safety Standards Series No. SSR-2/1, Revision 1, Safety of Nuclear Power Plants:
Design, issued 2016 (Ref. 19)
 
RG 1.177, Rev. 2, Page 7 C.  STAFF REGULATORY GUIDANCE
This section provides detailed descriptions of the methods, approaches, or data that the staff considers acceptable for meeting the requirements of the applicable regulations cited in the Introduction of this guide.
 
RG 1.174 identifies five key principles that all risk-informed applications are expected to meet and that risk-informed changes to plant TS should explicitly address:
(1)
Principle 1: The proposed licensing basis change meets the current regulations unless it is explicitly related to a requested exemption (i.e., under 10 CFR 50.12, Specific Exemptions).
(2)
Principle 2: The proposed licensing basis change is consistent with the defense-in-depth philosophy.
 
(3)
Principle 3: The proposed licensing basis change maintains sufficient safety margins.
 
(4)
Principle 4: When proposed licensing basis changes result in an increase in risk, the increases should be small and consistent with the intent of the Commissions policy statement on safety goals for the operation of nuclear power plants.
 
(5)
Principle 5: The impact of the proposed licensing basis change should be monitored using performance measurement strategies.
 
RG 1.174 identifies a four-element approach to evaluating proposed licensing basis changes. This section addresses the applicability of these key principles and elements to TS changes.
 
1.
 
Element 1: Define the Proposed Change
1.1 Reason for Proposed Change The submittals should state the reasons for requesting the TS change or changes, along with information that demonstrates that the extent of the change is needed. Generally, acceptable reasons for requesting TS changes fall into one or more of the categories below. RG 1.174, Section C.1, provides additional guidance on defining the proposed change.
 
1.1.1 Improvement in Operational Safety A licensee may request the TS change to improve operational safety (i.e., a reduction in the plant risk or a reduction in occupational exposure of plant personnel in complying with the requirements).
1.1.2 Consistency of Risk Basis in Regulatory Requirements The TS change can be supported based on its risk implications. TS requirements can be changed to reflect improved design features in a plant or to reflect equipment reliability improvements that make a previous requirement unnecessarily stringent or ineffective. The TS may also be changed to establish consistently based requirements across the industry or across an industry group. The licensee must ensure that the risk resulting from the change remains acceptable.
 
RG 1.177, Rev. 2, Page 8
1.1.3 Reduce Unnecessary Burdens A licensee may request the TS change to reduce unnecessary burdens in complying with current TS requirements, based on the operating history of the plant or industry in general. For example, in specific instances, the repair time may need to be longer than the CT defined in the TS. The required surveillance may lead to plant transients, result in unnecessary equipment wear, cause excessive radiation exposure to plant personnel, or place unnecessary administrative burdens on plant personnel that are not justified by the safety significance of the surveillance requirement. In some cases, the change may provide operational flexibility; in those cases, the change might allow increased allocation of the plant personnels time to more safety-significant aspects.
 
In some cases, licensees may determine that there is a common need for a TS change among several licensees and that it is beneficial to request the changes as a group rather than individually. Group submittals can be advantageous when the equipment being considered in the change is similar across all plants in the group. The submittal still needs to provide plant-specific information about the engineering evaluations described in Section C.2. However, the group may be able to draw generic conclusions from a compilation of the plant-specific data. In addition, there will be benefits from cross comparison of the results of the plant-specific evaluations.
 
2.
 
Element 2: Perform Engineering Analysis As part of the second element, the licensee should evaluate the proposed TS change with regard to the key principles that ensure (1) current regulations are met, (2) adequate defense in depth is maintained, (3) sufficient safety margins are maintained, and (4) proposed increases in risk are small and are consistent with the intent of the Commissions policy statement on safety goals for the operation of nuclear power plants.
 
The staff expects licensees to provide strong technical bases for any TS change. The technical bases should be rooted in deterministic engineering and system analyses. Licensees should not submit for review TS change requests based on PRA results alone. TS change requests should give proper attention to the integration of considerations, such as conformance to the STS, generic applicability of the requested change if it is different from the STS, operational constraints, manufacturer recommendations, and practical considerations for test and maintenance. Standard practices used in setting CTs and SFs should be followed (e.g., CTs normally are 8 hours, 12 hours, 24 hours, 72 hours, 7 days, 14 days, and so on, and SFs normally are once per 12 hours, 7 days, 1 month, 3 months, and so on). Using such standards greatly simplifies implementation, scheduling, monitoring, and auditing. Logical consistency among the requirements should be maintained (e.g., CT requirements for multiple trains out of service should not be longer than that for one of the constituent trains).
2.1 Compliance with Current Regulations (Principle 1)
In evaluating proposed changes to TS, the licensee must ensure that the current regulations, orders, and license conditions are met, consistent with Principle 1 in RG 1.17
 
===4. The regulations in ===
10 CFR 50.36 are specific to TS. The NRCs final policy statement on TS improvements (Ref. 20) gives more information on the agencys TS policies. These documents define the main elements of TS and provide criteria for items to be included in the TS.
 
The final policy statement and the Statements of Consideration for 10 CFR 50.36, as published in Volume 60 of the Federal Register, pages 36953-36959 (60 FR 36953-36959; July 19, 1995) (Ref. 21),
also discuss the use of probabilistic approaches to improve TS. Regulations on applications for, and the issuance of, license amendments appear in 10 CFR 50.90; 10 CFR 50.91, Notice for Public Comment;
 
RG 1.177, Rev. 2, Page 9 State Consultation, and 10 CFR 50.92, Issuance of Amendment. In addition, the licensee should ensure that the evaluation identifies and considers any discrepancies between the proposed TS change and licensee commitments.
 
2.2 Deterministic Engineering Considerations
2.2.1 Technical Specification Change Is Consistent with the Defense-in-Depth Philosophy (Principle 2)
Defense in depth is an element of the NRCs safety philosophy that employs multiple independent and redundant layers of defense to compensate for potential human and mechanical failures so that no single layer, no matter how robust, is exclusively relied upon. Defense in depth includes the use of access controls, physical barriers, redundant and diverse key safety functions, and emergency response measures to prevent accidents or mitigate damage if a malfunction, accident, or naturally caused event occurs at a nuclear facility. The defense-in-depth philosophy has traditionally been applied in plant design and operation to provide multiple means to accomplish safety functions and prevent the release of radioactive material. It has been and continues to be an effective way to account for uncertainties in equipment and human performance and, in particular, to account for the potential for unknown and unforeseen failure mechanisms or phenomena that, because they are unknown or unforeseen, are not reflected in either the PRA or deterministic engineering analyses. Staff Requirements Memorandum-SECY-98-144, Staff RequirementsSECY-98-144White Paper on Risk-Informed and Performance-Based Regulation, dated March 1, 1999 (Ref. 22), provides additional information on defense in depth as an element of the NRCs safety philosophy.
 
The engineering evaluation should demonstrate whether the implementation of the proposed TS
change is consistent with the defense-in-depth philosophy (Principle 2 in RG 1.174). The intent of this key principle of risk-informed decisionmaking is to ensure that the licensee fully understands, and the submittal addresses, any impact of the proposed licensing basis change on defense in depth and that the change maintains consistency with the defense-in-depth philosophy. The intent is not to prevent changes in the way defense in depth is achieved. The licensee should fully understand how the proposed licensing basis change impacts plant design and operation from both risk and deterministic engineering perspectives.
 
RG 1.174 provides guidance on how to evaluate the impact of a proposed licensing basis change on defense in depth to determine whether that consistency is achieved. The seven defense-in-depth considerations in Section C.2.1.1 of RG 1.174 should be used to evaluate the impact of a proposed TS
change on defense in depth to determine whether it maintains consistency with the defense-in-depth philosophy.
 
Additionally, the licensee should select engineering analysis techniqueswhether quantitative or qualitative, deterministic or probabilisticappropriate for the proposed TS change and that address the following:
a.
 
whether there are appropriate restrictions in place to prevent simultaneous equipment outages that would erode the principles of redundancy and diversity, b.
 
whether compensatory measures that should be taken when entering the modified CT for preplanned maintenance are identified,
 
RG 1.177, Rev. 2, Page 10
c.


1) encourages greater use of this analysis technique to improve safety decisionmaking and improve regulatory efficiency.
whether voluntary removal of equipment from service during plant operation is scheduled when adverse weather conditions are predicted, or when the plant may be subjected to other abnormal conditions, d.


The NRC staff's PRA Implementation Plan (Ref. 2) describes activities now under way or planned to expand this use. One ac tivity under way in response to the policy statement is the use of PRA in support of decisions to modify an in dividual plant's technical specifications (TS).  Licensee-initiated TS changes that are consistent with currently approved staff positions
whether the impact of the TS change on the safety function should be considered (e.g., the impact of a change in the CT for the low-pressure safety injection system on the overall availability and reliability of the low-pressure injection function), and e.
[e.g., regulatory guides, standard review plans, branch technical posi tions, or the Standard Technical Specifications (STS) (Refs. 3-7)] are normally evaluated by the staff using traditional engineering analyses.


A licensee would not be expected to submit risk information in support of the proposed change. Licensee-initiated TS change re quests that go beyond current staff positions may be evaluated by the staff using traditional engineering analyses as well as the risk-informed approach set forth in this regulatory guide. A licensee may be requested to submit supplemental risk information if such informa tion is not provided in the original submittal by the li censee. If risk information on the proposed TS change is not provided to the staff, the staff will review the in formation provided by the licensee to determine whether the application can be approved based upon the information provided using traditional methods and will either approve or reject the application based upon the review.  The guidance provided here does not preclude other approaches for requesting changes to the TS.  Rather, this regulatory guide is intended to improve consistency in regulatory decisions when the results of risk analyses are used to help justify TS changes.
whether the potential loss of the TS-specified safety function should be evaluated for TS  
conditions with one or more trains, channels, systems, or subsystems inoperable.


Background Section 182a of the Atomic Energy Act requires that applicants for nuclear power plant operating li censes state: [S]uch technical specifications, including information of the amount, kind, and source of special nuclear material re quired, the place of the use, the specific characteristics of the facility, and such other information as the Commission may, by rule or regulation, deem neces sary in order to enable it to find that the utilization
2.2.2 Technical Specification Change Maintains Sufficient Safety Margin (Principle 3)
...of special nuclear material will be in accord with the common de fense and security and will provide ade-USNRC REGULATORY
The licensees engineering evaluation should assess whether the impact of the proposed TS
GUIDES The guides wre issued In t following ton broad dvisions:
change to a CT or SF is consistent with the principle that sufficient safety margins are maintained (Principle 3 in RG 1.174). The following summarizes an acceptable set of guidelines for making that assessment. Other equivalent decision guidelines are acceptable.
Reguolaty Guides am Issued to describe and make available to the pullic such Informa Ion as methods acceptable to the NRC staff for lmplementing pecdflc pers of the Com- 1. Power Reactor. 6. Products regulstons, technmiquesued bytheItanf ievautingepecc problems orpos. 2. Research and Test Reactors 7. Transportation tuiated acddents, and data needed by the NRC taff ltsrvIewofapplIct for per- 3. Fuel and Materials Fadlities Occuational Health mits and lcenses. Raguietory guOdes are not oulbtitutes for reguiations, and compliance
4, Envronmental and Siting 9. Anitut and FInancid Review wlththem Isno required.


Methodsandsouitorsdifferent fromrthoeeset outlntheguides
Sufficient safety margins are maintained under the following circumstances:
&. Materiala and Plant Protection
a.
10. General will be acceptable If they provide a basis for the Widings requisite to the issuarnce or con tnunce of a perfmi or license by the Commission.


Single copies of regulatory guides may be obtained free of charge by writing the Repro This gtide was Issued alter consideration of comments received from tie pbibc. Com- dumion end Distribution Services SecdM Office of the Chief Information Officer US. Nu ments aind suggestions for Improvements In tose guides areencouraged at eil times, and dear Regutlatory Commission, Washinlgton, DC 20555-0001;
Codes and standards (e.g., American Society of Mechanical Engineers, Institute of Electrical and Electronics Engineers) or alternatives approved for use by the NRC are met (e.g., the proposed TS change to a CT or SF does not conflict with approved codes and standards relevant to the subject system).  
or by ftx at (301)415-22W, u wi be revised, as appropriate, lo accommodate comments and to reflect new in- or by e-meal to GRWI@NRC.GOV.
b.


ormalooreIxpseaece.
Safety analysis acceptance criteria in the final safety analysis report are met, or proposed revisions provide sufficient margin to account for analysis and data uncertainties (e.g., the proposed TS change to a CT or SF does not adversely affect any assumptions or inputs to the safety analysis, or, if such inputs are affected, justification is provided to ensure sufficient safety margin will continue to exist). For TS CT changes, the effect on the final safety analysis report acceptance criteria should be assessed, assuming the plant is in the condition addressed by the proposed CT (i.e., the subject equipment is inoperable) and there are no additional failures. Such an assessment should result in identifying all situations in which entry into the condition addressed by the proposed CT could result in failure to meet an intended safety function.


Issued guides may also be purchased from the National Technical Informtion Service on Written comments may be eibmltted to the Rules Review and Directives Branch. ADM. a sttanding order basis. Details on Itis service may be obtained by writing NTIS, 6285 Port U.S. Nudear Regulatory Commission, Washington.
2.3 Evaluation of Risk Impact (Principle 4)
Consistent with Principle 4 in RG 1.174, the NRC staff has identified the following three-tiered approach for licensees to evaluate the risk associated with proposed TS CT changes:
a.


DC 20M55-0001.
Tier 1 evaluates the impact on plant risk of the proposed TS change as expressed by the change in core damage frequency (CDF), the incremental conditional core damage probability (ICCDP),1 the change in large early release frequency (LERF), and the incremental conditional large early release probability (ICLERP).2 To support this evaluation, two aspects are to be considered:


Royal Road, Springfield, VA 22101.
1 ICCDP = ((conditional CDF with the subject equipment out of service and nominal expected equipment unavailabilities for other equipment permitted to be out of service by the TS)  (baseline CDF with nominal expected equipment unavailabilities)) x (total duration of a single CT under consideration).
2 ICLERP = ((conditional LERF with the subject equipment out of service and nominal expected equipment unavailabilities for other equipment permitted to be out of service by the TS)  (baseline LERF with nominal expected equipment unavailabilities)) x (total duration of a single CT under consideration).  


quate protection to the health and safety of the public. Such technical specifications shall be a part of any license issued. In Section 50.36, "Technical Specifications," of 10 CFR Part 50, "Domestic Licensing of Production and Utilization Facilities," the Commission estab lished its regulatory requirements related to the content of TS. In doing this, the Commission emphasized mat ters related to the prevention of accidents and the miti gation of accident consequences;
RG 1.177, Rev. 2, Page 11
the Commission noted that applicants were expected to incorporate into their TS "those items that are directly related to main taining the integrity of the physical barriers designed to contain radioactivity" (33 FR 18612) (Ref. 8). Pursuant to 10 CFR 50.36, TS are required to contain items in the following five specific categories:
(1) the acceptability of the PRA and (2) the PRA insights and results. The licensee should demonstrate that its PRA is acceptable for assessing the proposed TS change, identify the impact of the TS change on plant risk, and demonstrate that this impact on plant risk meets the TS  
(1) safety limits, limiting safety system settings, and limiting control settings, (2) limiting conditions for operation, (3) sur veillance requirements, (4) design features, and (5) ad ministrative controls.
acceptance guidelines in Section C.2.4 of this RG.


Since the mid-1980s, the NRC has been reviewing and granting improvements to TS based, at least in part, on PRA insights.
b.


Some of these improvements have been proposed by the Nuclear Steam Supply System (NSSS) owners groups to apply to an entire class of plants. Many others have been proposed by individual licensees.
Tier 2 identifies potentially high-risk configurations that could exist if equipment, in addition to the item associated with the change, is taken out of service simultaneously or if other risk-significant operational factors, such as concurrent system or equipment testing, are also involved. The objective of this part of the evaluation is to ensure that appropriate restrictions on dominant risk-significant configurations associated with the change are in place. In addition, compensatory measures that can mitigate any corresponding increase in risk (e.g., backup equipment, increased SF, or upgraded procedures and training) should be identified and evaluated.


Typically, the proposed improvements in volved a relaxation of one or more allowed outage times (AOTs) or surveillance test intervals (STIs) in the "TS.1 In its July 22, 1993, final policy statement on TS "improvements (Ref. 9), the Commission stated that it: ...expects that licensees, in preparing their Technical Specification related submit tals, will utilize any plant-specific PSA or risk survey and any available literature on risk insights and PSAs... Similarly, the NRC staff will also employ risk insights and PSAs in evaluating Technical Speci fications related submittals.
c.


Further, as a part of the Commission's ongoing pro gram of improving Technical Specifica tions, it will continue to consider methods to make better use of risk and reliability information for defining future generic Technical Specification requirements.
Tier 3 establishes a risk-informed plant configuration control program (i.e., configuration risk management program (CRMP)) to ensure that other potentially lower probability, but nonetheless risk-significant, configurations resulting from maintenance and other operational activities are identified and compensated for. If the Tier 2 assessment demonstrates, with reasonable assurance, that there are no risk-significant configurations involving the subject equipment, the application of Tier 3 to the condition addressed by the proposed CT may not be necessary.


t The improved STSs (Refs. 3-7) (NUREGs-1430-1434)
Application of the three-tiered approach to risk-informed TS CT changes will ensure that such changes to the licensing basis will not significantly affect defense in depth.
use the ter minology "completion times" and "surveillance frequency" in place of "allowed outage time" and "surveillance test interval." The Commission reiterated this point when it is sued the revision to 10 CFR 50.36 in July 1995 (Ref.  10).  In August 1995, the NRC adopted the policy state ment, including the following regarding the expanded use of PRA (Ref. 1).  " The use of PRA technology should be in creased in all regulatory matters to the ex tent supported by the state of the art in PRA methods and data and in a manner that complements the NRC's determinis tic approach and supports the NRC's traditional defense-in-depth philosophy.  " PRA and associated analyses (e.g., sensi tivity studies, uncertainty analyses, and importance measures)
should be used in regulatory matters, where practical within the bounds of the state of the art, to reduce unnecessary conservatism associated with current regulatory requirements, reg ulatory guides, license commitments, and staff practices.


Where appropriate, PRA should be used to support the proposal of additional regulatory requirements in ac cordance with 10 CFR 50.109 (Backfit Rule). Appropriate procedures for includ ing PRA in the process for changing regu latory requirements should be developed and followed.
Sections C.2.3.1-2.3.7 and Appendix A to this RG discuss various issues related to the three-tiered approach. Specifically, Sections C.2.3.1-2.3.5 and Appendix A outline issues associated with Tier 1, and Sections C.2.3.6 and C.2.3.7 outline issues associated with Tier 2 and Tier 3, respectively.


It is, of course, understood that the intent of this policy is that existing rules and regulations shall be complied with unless these rules and regulations are revised.
The NRC staff has identified several factors, discussed below, that should be considered in proposals for SF changes. In summary, the licensee should identify the SFs to be evaluated, determine the risk contribution associated with the subject SFs, determine the risk impact from the change to the proposed SFs, and perform sensitivity and uncertainty evaluations to address uncertainties associated with the SF evaluations. Sections C.2.3.1-2.3.6 and Appendix A to this RG provide more detail on risk evaluation for SF changes.


PRA evaluations in support of regulatory decisions should be as realistic as practi cable and appropriate supporting data should be publicly available for review. The Commission's safety goals for nu clear power plants and subsidiary numeri cal objectives are to be used with ap propriate consideration of uncertainties in making regulatory judgments on need for proposing and backfitting new generic re quirements on nuclear power plant licen sees. In its approval of the policy statement, the Com mission articulated its expectation that implementation of the policy statement will improve the regulatory pro cess in three areas: foremost, through safety decision making enhanced by the use of PRA insights;
2.3.1 Acceptability of the Probabilistic Risk Assessment The PRA used to support the TS change evaluation is measured in terms of its appropriateness with respect to scope, level of detail, conformance to the technical elements, and plant representation. These aspects of the PRA are to be commensurate with its intended use and the role the PRA results play in justifying the TS change. This applies to Tier 1 and to Tiers 2 and 3 to the extent that a PRA model is used. Section C.2.3 of RG 1.174 provides guidance on evaluating the acceptability of the PRA with respect to these PRA aspects and should be used to support TS change evaluations. In addition, Sections C.2.3.2 and C.2.3.3 of this RG provide guidance on assessing the acceptability of the PRA scope and PRA level of detail, respectively, for TS change evaluations.
through 1.177-2 more efficient use of agency resources;
and through a reduction in unnecessary burdens on licensees.


Purpose of this Regulatory Guide .This regulatory guide describes methods accept able to the NRC staff for assessing the nature and im pact of proposed TS changes by considering engineer ing issues and applying risk insights.
2.3.2 Scope of the Probabilistic Risk Assessment for Technical Specification Change Evaluations The scope necessary to fully support the evaluation of a TS change depends on the type of TS  
change being sought. The text below discusses the scope required for a variety of cases. However, in


Licensees submitting risk information (whether on their own ini tiative or at the request of the staff) should address each of the principles of risk-informed regulation discussed in this regulatory guide. Licensees should identify how chosen approaches and methods (whether they are quantitative or qualitative, traditional or probabilistic), data, and criteria for considering risk are appropriate for the decision to be made. This regulatory guide provides the staff's recom mendations for utilizing risk information to evaluate changes to nuclear power plant TS AOTs and STIs in order to assess the impact of such proposed changes on the risk associated with plant operation.
RG 1.177, Rev. 2, Page 12 some cases, a PRA of sufficient scope may not be available. Qualitative arguments, bounding analyses, or compensatory measures will have to compensate for this lack.


Other types of TS changes that follow the principles outlined in this regulatory guide may be proposed and will be consid ered on their own merit. The guidance provided here does not preclude other approaches for requesting TS changes. Rather, this regulatory guide is intended to improve consistency in regulatory decisions related to TS changes in which the results of risk analyses are used to help justify the change. As such, this regulatory guide, the use of which is voluntary, provides guidance concerning an approach that the NRC has determined to be acceptable for analyzing issues associated with pro posed changes to a plant's TS and for assessing the im pact of such proposed changes on the risk associated with plant design and operation.
At a minimum, evaluations of CDF and LERF should be performed to support any risk-informed changes to TS. The scope of the analysis should include all hazard groups (i.e., internal events, internal flood, internal fires, seismic events, high winds, transportation events, and other external hazards) unless the contribution from specific hazard groups does not affect the decision. When the risk associated with a particular hazard group or operating mode would affect the decision being made, the Commissions policy is to assess the risk using a staff-endorsed PRA standard for that hazard group or operating mode.


Scope of this Regulatory Guide This regulatory guide describes an acceptable ap proach for assessing the nature and impact of proposed permanent TS changes in AOTs and STIs by consider ing engineering issues and applying risk insights.
Sections C.2.3.1 and C.2.5 of RG 1.174 provide more detail.


As sessments should consider relevant safety margins and defense-in-depth attributes, including considering suc cess criteria as well as equipment functionality, reli ability, and availability.
When changes to the requirements for systems needed for decay heat removal are considered, an appropriate assessment of shutdown risk should also be considered. Examples of such systems are auxiliary feedwater, residual heat removal, emergency diesel generator, and service water. In addition, when CTs are being modified to facilitate online maintenance (i.e., transferring scheduled preventive maintenance from shutdown to power operation), the impact on the shutdown modes should also be considered. Using both power operation and shutdown models, when available, a comparative evaluation may be presented to decide the appropriate condition for scheduling maintenance based on risk evaluations. In some cases, a semiquantitative analysis of shutdown risk may be adequate (e.g., fault tree analysis or failure modes and effects analysis).
When CTs are being modified in anticipation of the need for additional time for corrective maintenance, an assessment of transition risk (the risk of transitioning from power operation to the mode required by the current TS in question) that could be incurred under the current, shorter CT may be desirable if the initial calculated risk increase is near or somewhat above the acceptance guidelines. In addition, TS changes to requirements for a controlled shutdown (i.e., the time allocated to transit through hot standby to hot shutdown to cold shutdown or to the final state that should be reached) should be evaluated using a model for the transition risk covering these periods or at least a qualitative evaluation of the transition risk, if possible.


Acceptance guidelines for evaluating the results of such evaluations are provided also. This regulatory guide also describes acceptable TS change implementation strategies and performance monitoring plans that will help ensure that assumptions and analyses supporting the change are verified.This regulatory guide indicates an acceptable level of documentation that will enable the staff to reach a finding that the licensee has performed a sufficiently complete and scrutable TS change analysis and that the results of the engineering evaluations support the li censee's request for the TS change. Risk-informed TS submittals primarily deal with permanent changes to TS requirements, i.e., as the name suggests, the requirement is permanently changed when approved, and is applicable to all future occurrences.
2.3.3 Probabilistic Risk Assessment Modeling and Level of Detail
2.3.3.1 Detail Needed for Technical Specification Changes To evaluate a TS change, the PRA should model specific systems or components involved in the change. The model should also be able to treat the alignments of components during periods when testing and maintenance are being carried out. Typically, LCOs and surveillance requirements relate to the system trains or components that are modeled in the system fault trees of a PRA. System fault trees should be sufficiently detailed to specifically include all the components for which surveillance tests and maintenance are performed and are to be evaluated.


A one-time change to a TS requirement, in which a different requirement is requested for a par ticular incident, also can use risk-informed evaluations, but it involves slightly different scope and consider ations. This regulatory guide focuses on permanent changes to TS.  Relationship to Other Guidance Documents Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Deci sions on Plant-Specific Changes to the licensing Ba sis" (Ref. 11), describes a general approach to risk informed regulatory decisionmaking and includes dis cussion of specific topics common to all risk-informed regulatory applications.
Additional details that should be incorporated in the PRA in support of TS changes include the following:
a.


This regulatory guide provi des guidance specifically for risk-informed TS changes consistent with but more detailed than the generally ap plicable guidance given in Regulatory Guide 1.174. The information collections contained in this regu latory guide are covered by the requirements of 10 CFR Part 50, which were approved by the Office of Manage ment and Budget, approval number 3150-0011.
For CT evaluations, system train-level models are adequate if all components belonging to the train are clearly identified (i.e., all those components that could cause the train to fail).
b.


The NRC may not conduct or sponsor, and a person is not required to respond to, a collection of information un less it displays a currently valid OMB control number.
For evaluating SFs, individual component-level models are necessary.


==B. DISCUSSION==
c.
Risk-Informed Philosophy In its approval of the policy statement on the use of PRA methods in nuclear regulatory activities, the Commission stated an expectation that "the use of PRA technology should be increased in all regulatory mat ters...in a manner that complements the NRC's deter ministic approach and supports the NRC's traditional defense-in-depth philosophy" (Ref. 1). The use of risk insights in licensee submittals requesting TS changes will assist the staff in the disposition of such licensee proposals.
 
Since PRAs typically model the plant at the individual component level, they may be used directly to analyze both CTs and SFs.
 
RG 1.177, Rev. 2, Page 13 d.
 
Component unavailability models should include contributions from random failure, common-cause failure (CCF), test downtime, and maintenance downtime.
 
e.
 
Changes to the component unavailability model for test and maintenance downtimes should be based on a realistic estimate of expected surveillance and maintenance practices after the TS
change is approved and implemented (e.g., how often the CT is expected to be entered for preplanned maintenance or surveillance).
f.
 
The component unavailability model for test and maintenance downtimes should be based on plant-specific or industrywide operating experience, or both, as appropriate.
 
g.
 
The component unavailability model should have the flexibility to separate the unavailability contribution from test and maintenance downtimes. For evaluating a CT, the contribution from maintenance downtime can be equated to zero to delete maintenance activities, if desired. For an SF evaluation, the contribution from the test downtime determines a contribution to risk from carrying out the test.
 
h.
 
Additional details in terms of separating the failure rate contributions into cyclic demand-related and standby time-related contributions can be incorporated, if justifiable, for evaluating surveillance requirements.
 
The CCF contributions should be modeled so that they can be modified to reflect the condition in which one or more of the components is unavailable. Note that CCF modeling of components is not simply dependent on the number of remaining inservice components; it is also dependent on the reason the components were removed from service (i.e., whether for preventive or corrective maintenance). For appropriate configuration risk management and control, preventive and corrective maintenance activities are considered, and licensees should, therefore, have the ability to address the subtle difference that exists between maintenance activities (Section A-1.3.2 of Appendix A to this guide provides details).  
To account for the effects of test placements for redundant components in relation to each other (e.g., staggered or sequential test strategy), time-dependent models and additional evaluations with specialized codes may be used.
 
If the PRA does not model the system for which the TS change is being requested, specialized analyses may be necessary to demonstrate the sufficiency of the proposal. Examples of these situations include the following:
a.
 
When a system is modeled in the event tree, but a detailed fault tree model is not provided (a direct estimate of system unavailability from experience data or expert judgment is used), the TS
evaluation can proceed in several ways, such as the following:
(1)
A separate fault tree can be developed for the system for TS evaluation and used to complement the existing PRA model without directly modifying the PRA (e.g., detailed separate fault tree modeling of the reactor protection system combined with the existing PRA model).
(2)
A bounding evaluation can be conducted based on the impact of system failures that are modeled in the PRA event trees; that is, failure of any component in the system can be assumed to cause system failure.
 
RG 1.177, Rev. 2, Page 14 b.
 
When a separate fault tree is developed, specific TS requirements within the system can be changed, and changes in the system unavailability can be measured. These changes can then be used in the PRA model to obtain the corresponding risk measures, as appropriate. Such evaluations can be considered in the same way as those evaluations made directly using PRA
models, but they should satisfy the following conditions:
(1)
Failures within the system should not affect any other system or component failure.
 
(2)
The effect of system failure should not influence any initiating event frequency (or it should have a minimal or negligible effect).
(3)
The system should not share components with another system.
 
c.
 
When bounding evaluations are performed assuming any failure in the system as a system failure, the calculated risk impacts for TS changes are expected to be overestimated. The corresponding changes that may be acceptable will also be fewer than those that could have been justified using a detailed model. When considering the incorporation of non-PRA factors, this perspective should be kept, while at the same time considering the lack of a detailed model. Here also, the three conditions discussed for the previous case apply.
 
In some cases, since the risk-informed evaluation will be limited and some misestimation of the risk may have been incorporated, nonrisk-related engineering considerations gain importance in the overall decision. In such cases, arguments for the TS change also should be for small increments from current TS requirements (e.g., small changes to CTs or SFs).
2.3.3.2 Modeling of Initiating Events The PRA explicitly models (i.e., uses detailed fault tree models) some initiating events resulting from support system failure (e.g., service water, component cooling water, instrument air). Any TS
change for these systems will affect the corresponding initiating event frequency as well as the system unavailability and availability of other supported systems. The effect of TS changes on these initiating event frequencies should be considered.
 
Some test and maintenance activities can contribute to some transients. Initiating event frequencies used in the PRA do not typically separate out this contribution, but such a separation may be needed during TS change evaluations. For example, the effect of test-caused transients may be evaluated in determining an SF. Initiating event frequencies from conducting the test (i.e., test-caused transients)
could then be modeled separately to evaluate the risk contribution from test-caused transients.
 
Section A-2 of the appendix to this RG discusses data needs for estimating initiating event frequencies from test-caused transients.
 
2.3.3.3 Screening Criteria The main qualitative consideration for the screening of sequences in TS change evaluations is the inclusion of sequences directly affected by the TS change that would have been truncated by frequency-based screening alone. For example, if the TS change involves accumulators in a pressurized-water reactor, qualitative considerations imply the inclusion of sequences that contain the accumulators, even if these sequences do not meet the frequency criteria. Excluding these sequences would result in an underestimation of the risk impact of the proposed TS changes and, therefore, could have a significant influence on the ultimate acceptability of these changes.
 
RG 1.177, Rev. 2, Page 15
2.3.3.4 Truncation Limits Truncation levels should be used appropriately to ensure that significant underestimation caused by the truncation of cutsets does not occur, as discussed below. Additional precautions relevant to the cutset manipulation method of analysis are needed to avoid truncation errors in calculating risk measures.
 
When failure or outage of a single component is considered, as in the case of a CT or SF risk evaluation, the truncation levels in evaluating R1 and R0 are of concern. R1 is the increased CDF, with the component assumed to be inoperable (or equivalently, the component unavailability set to true), and R0
is the reduced CDF, with the component assumed to be operable (or equivalently, the component unavailability set to false). If the component in question appears in the cutsets near the truncation limit (e.g., all appearances are in cutsets within a factor of 10 of the truncation limit), it may be necessary to reduce the truncation limit. If R1 is marginally larger than the base case value, then one order of additional cutsets should be generated to ensure that any underestimation did not take place.
 
When considering risk from plant configurations involving multiple components, a cutset with a relatively small frequency can become a significant contributor to the CDF. This is because more than one of the affected components may appear in the same minimal cutset, and the unavailability (increased by the TS change) of more than one of these components could cause a significant increase in the cutsets frequency. For such cases, truncation levels should be reduced by a larger amount than would be the case for single components. Particular care should be taken if the evaluation of R1 is based on requantification of presolved cutsets, as the events related to the component of concern may not even appear in the cutsets.
 
2.3.4 Assumptions in Completion Time and Surveillance Frequency Evaluations When using PRA to evaluate TS changes, the evaluation should consider the assumptions made within the PRA that could have a significant influence on the ultimate acceptability of the proposed changes. The submittal requesting the TS changes should discuss such assumption
 
====s. Assumptions that CT ====
change evaluations should consider include the following:
a.
 
If CT risk evaluations are performed using only the PRA for power operation (i.e., to calculate the risk associated with (1) the equipment being unavailable during power operation for the duration of the CT and (2) any change in the CT), the risk associated with shutting the plant down because the CT is exceeded is not considered. In most cases, this risk has not been considered or, if considered, is assumed to further justify the requested change. If the risk evaluation results are marginal or exceed the guidelines for a proposed CT increase, and the systems involve those needed for shutdown (e.g., residual heat removal systems, service water systems, auxiliary feedwater systems), the licensee may want to perform comparative risk evaluations of continued power operation versus plant shutdown to justify the proposed CT increase. (Section C.2.5 of this RG provides additional discussion on comparative risk evaluations.)
b.
 
When calculating the risk impacts (i.e., a change in CDF or LERF caused by CT changes), the change in average CDF should be estimated using the mean outage times (or an appropriate surrogate) for the current and proposed CTs. If a licensee chooses to use the zero-maintenance state as the base case (i.e., the case in which no equipment is unavailable because of maintenance), the submittal should include an explanation stating so. Usually, data for outage times correspond to the current CT, not to the proposed CT. Different assumptions are made to estimate the outage time corresponding to the proposed CT. The submittal should discuss assumptions concerning changes in maintenance practices under the extended CT regime and characterize their impact on the results of the analysis.
 
RG 1.177, Rev. 2, Page 16 c.
 
When the risk impact of a CT change is evaluated, the yearly risk impact that is calculated takes into account the outage frequency. A CT extension may imply that the maintenance of the component is improved, which may reduce the components failure rate and, consequently, reduce the frequency of outages needed for correcting degradations or failure. There are no experience data for the extended CT; therefore, allowance for a lower failure rate should not be made. Here, the beneficial aspect of maintenance is not quantified, and this may give a slightly higher estimate of the yearly CT risk measure for the proposed CT.
 
d.
 
Often, CT extensions are requested to facilitate online (or at-power) preventive maintenance of safety-system components. The frequency and duration of the extension may be estimated and the risk impact from the resulting unavailability of such equipment can be calculated.
 
e.
 
When CTs of multiple safety system trains are extended, the likelihood of simultaneous outages of multiple components increases (resulting from combinations of failures, testing, and maintenance) because the increased duration increases the probability of the individual events that constitute the simultaneous multiple outages; hence, overlapping of routinely scheduled activities and random failures becomes more likely. The impact of such occurrences on the average plant risk (e.g., CDF) is small, but the conditional risk can be large. This issue is addressed as part of the implementation considerations (see Section C.2.3.7).
SF evaluations should consider the following assumptions:
a.
 
Surveillance tests usually are assumed to detect failures that have occurred in the standby period.
 
The component failure rate, , represents these failures in the formulation of component unavailability. The test-limited risk is normally estimated by assuming that a surveillance test of a component detects the failures and that after the test, the components unavailability resets to zero, or false in the Boolean expression. Depending on a components design and the test performed, a routine surveillance test may not detect a few component failures. Usually, their contribution to risk is considered negligible.
 
b.
 
Regular surveillance testing of a component, as performed for safety system components, is considered to influence its performance. Generally, for most components, the increase of a surveillance interval beyond a certain value may reduce the components performance (i.e., increase the failure rate). Experience data are not available to assess the SF values beyond which the component failure rate, , increases. In a risk-informed evaluation of surveillance requirements, if the failure rate is assumed to remain the same (i.e., unaffected by a change in the SF), this assumption implies that the SFs are not being changed beyond the value at which  may be affected. Care should be taken not to reduce the SFs beyond such values using risk-informed analyses only.
 
c.
 
The timing of surveillance tests for redundant components relative to each other (i.e., the test strategy used) impacts the risk measures calculated. Staggered or sequential test strategies are commonly used. The risk impacts of adopting different test strategies (e.g., sequential versus staggered) should be evaluated to determine whether there is an impact on the evaluation of the change being considered (Ref. 23).
d.
 
Notwithstanding the beneficial aspects of testing to detect failures that occur in a standby period, several adverse effects may be associated with the test that should be considered in the SF
evaluation, including downtime to conduct the test, errors of restoration after the test, test-caused transients, and test-caused wear of the equipment. A PRA usually models downtime and errors of restoration, unless they are negligible. Test-caused transients and wear of the equipment are
 
RG 1.177, Rev. 2, Page 17 applicable to a few tests but are not generally modeled separately in a PRA. However, they can be evaluated using PRA models supplemented with additional data and analysis. Methods are available to quantitatively address these aspects (Ref. 24); however, qualitative arguments can also support the reduction of an SF. If the adverse impact of testing is considered significant, such cases should be addressed quantitatively.
 
2.3.5 Sensitivity and Uncertainty Analyses Relating to Assumptions in Technical Specification Change Evaluations As in any risk-informed study, numerous uncertainties about the assumptions made during the PRA models development and application can affect risk-informed analyses of TS changes.
 
Sensitivity analyses may be necessary to address the important assumptions in the submittal with respect to TS change analyses. Such sensitivity analyses may include, as appropriate, the following:
a.
 
the impact of a variation in repair or maintenance policy because of CT changes (e.g., scheduling preventive maintenance of longer duration at power),
b.
 
the impact of variation in assumed mean downtimes or frequencies, c.
 
the effect of separating the cyclic demand versus the standby time-related contribution to the components unavailability in deciding changes to an SF,
d.
 
the effect of details about how CCFs are modeled in the PRA, and e.
 
the effect of modeling compensatory measures in the PRA.
 
Risk resulting from TS CT changes may be relatively insensitive to uncertainties (compared to the effect on risk from uncertainties in assumptions about plant design changes or significant changes to plant operating procedures, for example). This is because the uncertainties associated with CT changes tend to similarly affect the base case (i.e., before the change) and the changed case (i.e., with the change in place). That is, the risks result from similar causes in both cases (i.e., no new initiating transients or subsequent failure modes are likely to have been introduced by relatively minor CT changes). CT changes subject the plant to a variation in its exposure to the same type of risk, and the PRA model can predict, with relative surety based on data from operating experience, how much that risk will change based on that changed exposure. Similar results are expected for SF changes. The licensee should justify any deviations from these expectations.


The NRC staff has defined an acceptable approach to analyzing and evaluating proposed TS changes. This approach supports the NRC's desire to base its deci-1.177-3 sions on the results of traditional engineering evalua tions, supported by insights (derived from the use of PRA methods) about the risk significance of the pro posed changes. Decisions concerning proposed changes are expected to be reached in an integrated fashion, considering traditional engineering and risk information, and may be based on qualitative factors as well as quantitative analyses and information.
The effects of multiple outages may become significant during relatively large increases in CTs or SFs. In those cases, however, the Tier 2 and Tier 3 aspects of TS changes (i.e., configuration monitoring, risk predictions, and configuration control based on the risk predictions) are expected to be robust and will be relied on to control the resulting potential for significant risk increases. Therefore, the Tier 2 and Tier 3 aspects of such TS changes should be justified as robust and adequate to control the resulting potential for significant risk increases.


In implementing risk-informed decisionmaking, TS changes are expected to meet a set of key principles.
NUREG-1855 provides additional guidance on the treatment of uncertainties.


Some of these principles are written in terms typically used in traditional engineering decisions (e.g., defense in depth). While written in these terms, it should be un derstood that risk analysis techniques can be, and are encouraged to be, used to help ensure and show that these principles are met. These principles are: 1. The proposed change meets the current regula tions unless it is explicitly related to a requested exemption or rule change. Applicable rules and regulations that form the regulatory basis for TS are discussed in Regulatory Position 2.1, "Compliance with Current Regulations." 2. The proposed change is consistent with the de fense-in-depth philosophy.
RG 1.177, Rev. 2, Page 18
2.3.6 Restrictions on Dominant Risk-Significant Configurations and Compensatory Measures (Tier 2)
Consistent with the key principle that changes to TS should result in only small increases in the risk to public health and safety (Principle 4 in RG 1.174), and as part of proposed TS change evaluations, licensees may consider certain compensatory measures (discussed below) that balance the calculated risk increase caused by the changes. This consideration should be made in light of the acceptance guidelines given in RG 1.174. Note that these considerations may be part of Tier 2 or Tier 3 programs.


The guidance con tained in Regulatory Position 2.2, "Traditional En gineering Considerations," applies the various aspects of maintaining defense in depth to the sub ject of changes in TS.  3. The proposed change maintains sufficient safe ty margins. The guidance contained in Regulatory Position 2.2, "Traditional Engineering Consider ations," applies various aspects of maintaining suf ficient safety margin to the subject of changes to TS.4. When proposed changes result in an increase in core damage frequency or risk, the increases should be small and consistent with the intent of the Commission's Safety Goal Policy State ment. Regulatory Position 2.3, "Evaluation of Risk Impact," provides guidance for meeting this principle.
The licensee should demonstrate that there are appropriate restrictions on dominant risk-significant configurations associated with the TS change. An effective way to perform such an assessment is to evaluate equipment according to its contribution to plant risk (or safety) while the equipment covered by the proposed CT change is out of service. Evaluation of such combinations of equipment out of service against the Tier 1 ICCDP and ICLERP acceptance guidelines could be one appropriate method of identifying risk-significant configurations. Once plant equipment is so evaluated, an assessment can be made about whether certain enhancements to the TS or procedures are needed to avoid risk-significant plant configurations.


5. The impact of the proposed change should be monitored using performance measurement strategies.
To reduce the risk increase resulting from a proposed change, even though the licensee judges that the individual change meets the acceptance guidelines in Section C.2.4, the licensee might take compensatory measures such as those suggested below. If compensatory measures are considered part of the analysis of the change, the overall application for the TS change should include them. However, overreliance on programmatic activities such as compensatory measures associated with the change in the licensing basis should be avoided. Compensatory measures included in the submittal for a TS change should be measures for which the licensee is not already taking credit. Any such compensatory measures would become part of the licensing basis if the TS change were approved. The following are examples of compensatory measures:
a.


The three-tiered implementation ap proach discussed in Regulatory Position 3.1 and Maintenance Rule control discussed in Regulatory Position 3.2 provide guidance in meeting this prin ciple.  Additional information regarding to the staff's ex pectations with respect to implementation of these principles can be found in Regulatory Guide 1.174.  A Four-Element Approach to Integrated Decisionmaking for TS Changes Given the principles of risk-informed decision making discussed above, the staff expects that a certain evaluation approach and the acceptance guidelines that follow from those principles will be followed by licen sees in implementing these principles, and the staff has identified a four-element approach to evaluating pro posed changes to a plant's design, operations, and other activities that require NRC approval (illustrated in Fig ure 2), as described in Regulatory Guide 1.174 (Ref.  11). Those detailed discussions regarding the evalua tion approach and acceptance guidelines are not re peated here; instead, specific application of the four-element approach for risk-informed changes to IS is discussed.
adding a test of a redundant train before initiating a scheduled maintenance activity as part of a CT extension application, b.


Figure 1. Principles of Risk-Informed Integrated Decisionmaking
limiting simultaneous testing (e.g., surveillance tests) and maintenance of redundant or diverse systems as part of a CT extension application, especially if the testing causes unavailability of the redundant train or component, c.
1.177-4 Figure 2. Principal Elements of Risk-Informed, Plant-Specific Decisionmaking Element 1: Define the Proposed Change The licensee needs to explicitly identify the partic ular TS that are affected by the proposed change and identify available engineering studies (e.g., topical re ports), methods, codes, and PRA studies that are related to the proposed change. The licensee should also deter mine how the affected systems, components, or param eters are modeled in the PRA and should identify all elements of the PRA that the change impacts. This in formation should be used collectively to provide a de scription of the TS change and to outline the method of analysis.


The licensee should describe the proposed change and how it meets the objectives of the Commis sion's PRA Policy Statement, including enhanced deci sionmaking, more efficient use of resources, and reduc tion of unnecessary burden. Regulatory Position 1 describes element 1 in more detail.  Element 2: Perform Engineering Analysis The licensee should examine the proposed TS change to verify that it meets existing applicable rules and regulations.
incorporating a staggered test strategy as part of the SF reduction application, d.


In addition, the licensee should deter mine how the change impacts defense-in-depth aspects of the plant's design and operation and should deter mine the adequacy of safety margins following the pro posed change. The licensee should consider how plant and industry operating experience relates to the pro posed change, and whether potential compensatory measures could be taken to offset any negative impact from the proposed change.  The licensee should also perform risk-informed evaluations of the proposed change to determine the impact on plant risk. The evaluation should explicitly consider the specific plant equipment affected by the proposed TS changes and the effects of the proposed change on the functionality, reliability, and availability of the affected equipment.
improving test and maintenance procedures to reduce test- and maintenance-related errors, e.


The necessary scope and le vel of detail of the analysis depends upon the particular systems and functions that are affected, and it is recog nized that there will be cases for which a qualitative, rather than quantitative, risk analysis is acceptable.
improving operating procedures and operator training to reduce the impact of human errors, and f.


The licensee should provide the rationale that sup ports the acceptability of the proposed changes by inte grating probabilistic insights with traditional consider ations to arrive at a final determination of risk. The determination should consider continued conformance to applicable rules and regulations, the adequacy of the traditional engineering evaluation of the proposed change, and the change in plant risk relative to the ac ceptance guidelines.
improving system designs, which reduces overall system unavailability and plant risk.


All these areas should be ade quately addressed before the change is considered ac ceptable.
When compensatory measures are part of the TS change evaluation, the risk impact of these measures should be considered and presented, either quantitatively or qualitatively. When a quantitative evaluation is used, the total impact of these measures should be evaluated by comparison to the small guideline (Principle 4 in RG 1.174). This includes (1) evaluation of the proposed TS changes without the compensatory measures, (2) evaluation of the proposed TS changes with the compensatory measures, and
(3) specific discussion of how each compensatory measure is credited in the PRA model or during the evaluation process.


Specific guidance for an acceptable approach for performing engineering evaluations of changes to TS is found in Regulatory Position 2. Element 3: Define Implementation and Monitoring Program The licensee should consider implementation and performance monitoring strategies formulated to en sure (1) that no adverse safety degradation occurs be cause of the changes to the TS and (2) that the engineer ing evaluation conducted to examine the impact of the proposed changes continues to reflect the actual reli ability and availability of TS equipment that has been evaluated.
RG 1.177, Rev. 2, Page 19
2.3.7 Risk-Informed Plant Configuration Control Program (Tier 3)  
Consistent with the key principle that changes to TS result in small increases in the risk to public health and safety (Principle 4 in RG 1.174), certain configuration controls should be use


This will ensure that the conclusions that have been drawn from the evaluation remain valid.  Specific guidance for Element 3 is provided in Regula tory Position 3. Element 4: Submit Proposed Change The final element involves documenting the analy ses and submitting the license amendment request.
====d. To support TS ====
changes, a risk-informed plant configuration control program would uncover risk-significant plant equipment outage configurations in a timely manner during normal plant operation. This can be accomplished by evaluating the impact on plant risk of, for example, equipment unavailability, operational activities like surveillance testing or load dispatching, or weather conditions. The importance of this third tier stems from the difficulty of identifying all possible risk-significant configurations under Tier 2 that will ever be encountered over extended periods of plant operation.


NRC will review the submittal according to NRC Stan dard Review Plan (SRP) Chapter 16.1, "Risk-Informed Decisionmaking:
2.3.7.1 Configuration Risk Management Program Licensees should describe their capability to perform a contemporaneous assessment of the overall impact on the safety of proposed plant configurations before and during maintenance activities that remove equipment from service. Licensees should explain how these tools or other processes will be used to ensure that risk-significant plant configurations will not be entered and that appropriate actions will be taken when unforeseen events put the plant in a risk-significant configuration.
Technical Specifications" (Ref. 12), and in accordance with the NRC regulations governing license amendments
(10 CFR 50.90,50.91, and 50.92).  Guidance on documentation and submittals for risk-in formed TS change evaluations is in Regulatory Posi tion 4 of this regulatory guide.1.177-5 C. REGULATORY
POSITION 1. ELEMENT 1: DEFINE THE PROPOSED CHANGES 1.1 Reason for Proposed Change The reasons for requesting the TS change or changes should be stated in the submittals, along with information that demonstrates that the extent of the change is needed. Generally, acceptable reasons for re questing TS changes fall into one or more of the catego ries below.  1.1.1 Improvement in Operational Safety The reason for the TS change may be to improve operational safety; that is, a reduction in the plant risk or a reduction in occupational exposure of plant person nel in complying with the requirements.


1.1.2 Consistency of Risk Basis in Regulatory Requirements The TS changes requested can be supported on their risk implications.
2.3.7.2 Components of the Configuration Risk Management Program The licensee should ensure the CRMP contains the following components.


TS requirements can be changed to reflect improved design features in a plant or to reflect equipment reliability improvements that make a previous requirement unnecessarily stringent or ineffective.
Component 1: Implementation of the Configuration Risk Management Program The intent of the CRMP is to implement 10 CFR 50.65(a)(4) (part of the Maintenance Rule) for online maintenance for risk-informed TS, with the following additions and clarifications:
a.


TS may be changed to establish consistent ly based requirements across the industry or across an industry group. It must be ensured that the risk result ing from the change remains acceptable.
The scope of structures, systems, and components (SSCs) within the CRMP includes all SSCs modeled in the licensees plant PRA, in addition to all SSCs considered to have high safety significance in accordance with RG 1.160 that are not modeled in the PRA.


1.1.3 Reduce Unnecessary Burdens The change may be requested to reduce unneces sary burdens in complying with current TS require ments, based on the operating history of the plant or in dustry in general. For example, in specific instances, the repair time needed may be longer than the AOT de fined in the TS. The required surveillance may lead to plant transients, result in unnecessary equipment wear, result in excessive radiation exposure to plant person nel, or place unnecessary administrative burdens on plant personnel that are not justified by the safety sig nificance of the surveillance requirement.
b.


In some cases, the change may provide operational flexibility;
The CRMP assessment tool is informed by the PRA and may be in the form of a risk matrix, an online assessment, or a direct PRA assessment.
in those cases, the change might allow an increased allocation of the plant personnel's time to more safety-significant aspects.


In some cases, licensees may determine there is a common need for a TS change among several licensees and that it is beneficial to request the changes as a group rather than individually.
c.


Group submittals can be ad vantageous when the equipment being considered in the change is similar across all plants in the group.Plant-specific information with regard to the engineer ing evaluations described in Regulatory Position 2 must still be provided.
The CRMP should be invoked as follows:
(1)
For preplanned entrance into the plant configuration described by a TS action with a risk-informed CT, a risk assessment, including, at a minimum, a search for risk-significant configurations, should be performed before entering the action.


However, the group may be able to draw generic conclusions from a compilation of the plant-specific data. In addition, there will be benefits from cross-comparison of the results of the plant-spe cific evaluations.
(2)
For unplanned entrance into the plant configuration described by a TS action with a risk-informed CT, a similar assessment should be performed in a timeframe defined by the plants corrective action program (10 CFR Part 50, Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, Criterion XVI,
Corrective Action).  
(3)
In the plant configuration described by a TS action with a risk-informed CT, when additional SSCs become inoperable or nonfunctional, a risk assessment, including, at a minimum, a search for risk-significant configurations, should be performed in a


2. ELEMENT 2: ENGINEERING
RG 1.177, Rev. 2, Page 20
EVALUATION
timeframe defined by the plants corrective action program (10 CFR Part 50,  
As part of the second element, the licensee should evaluate the proposed TS change with regard to the principles that adequate defense in depth is maintained, that sufficient safety margins are maintained, and that proposed increases in core damage frequency and risk are small and are consistent with the intent of the Com mission's Safety Goal Policy Statement.
Appendix B, Criterion XVI).
d.


Licensees are expected to provide strong technical bases for any TS change. The technical bases should be rooted in traditional engineering and system analyses.
Tier 2 commitments apply only to planned maintenance but should be evaluated as part of the Tier 3 assessment for unplanned occurrences.


TS change requests based on PRA results alone should not be submitted for review. TS change requests should give proper attention to the integration of consider ations such as conformance to the STS, generic applica bility of the requested change if it is different from the STS, operational constraints, manufacturer recommen dations, and practical considerations for test and main tenance. Standard practices used in setting AOTs and STIs should be followed, e.g., AOTs normally are 8 hours, 12 hours, 24 hours, 72 hours, 7 days, 14 days, etc. STIs normally are 12 hours, 7 days, 1 month, 3 months, etc. Usingsuch standards greatly simplifies implementation, sclduling, monitoring, and auditing.
Component 2: Control and Use of the Configuration Risk Management Program Assessment Tool a.


Logical consistency among the requirements should be maintained, e.g., AOT requirements for multiple trains out of service should not be longer than that for one of the constituent trains. 2.1 Compliance with Current Regulations In evaluating proposed changes to TS, the licensee must ensure that the current regulations, orders, and li cense conditions are met, consistent with Principle I of risk-informed regulation.
Plant modifications and procedure changes should be monitored, assessed, and dispositioned as follows:
(1)
Evaluations of changes in plant configuration or PRA model features should be dispositioned by implementing PRA model changes or by the qualitative assessment of the impact of the changes on the CRMP assessment tool. This qualitative assessment recognizes that changes to the PRA take time to implement and that changes can be effectively compensated for without compromising the ability to make sound engineering judgments.


The NRC regulations specif ic toTIS are stated in 10 CFR 50.36, "Technical Specifi cations." Additional information with regard to the NRC's policies on TS is contained in the "Final Policy Statement on Technical Specification Improvements for Nuclear Power Reactors" (58 FR 39132) of July 22, 1993 (Ref. 9). These documents define the main ele ments of TS and provide criteria for items to be in cluded in the TS. The final policy statement and the statement of considerations for 10 CFR 50.36 of July 19,1995 (Ref. 10), also discuss the use of probabilistic
(2)  
1.177-6 approaches to improve TS. Regulations regarding ap plication for and issuance of license amendments are found in 10 CFR 50.90,50.91, and 50.92. In addition, the licensee should ensure that any discrepancies be tween the proposed TS change and licensee commit ments are identified and considered in the evaluation.
Limitations of the CRMP assessment tool are identified and understood for each specific CT extension.


2.2 Traditional Engineering Considerations
b.
2.2.1 Defense in Depth The engineering evaluation conducted should de termine whether the impact of the proposed TS change is consistent with the defense-in-depth philosophy.


In this regard, the intent of the principle is to ensure that the philosophy of defense in depth is maintained, not to prevent changes in the way defense in depth is achieved.
Procedures exist for the control and application of CRMP assessment tools, including a description of the process when the plant configuration of concern is outside the scope of the CRMP assessment tool.


The defense-in-depth philosophy has tradi tionally been applied in reactor design and operation to provide multiple means to accomplish safety functions and prevent the release of radioactive material.
Component 3: Level 1 Risk-Informed Assessment The CRMP assessment tool uses at least a Level 1, at-power, internal events PRA mode


It has been and continues to be an effective way to account for uncertainties in equipment and human performance.
====l. CRMP ====
assessments can reference a risk matrix, preexisting calculations, or new PRA analyse


When a comprehensive risk analysis can be performed, it can be used to help determine the appropriate extent of defense in depth (e.g., balance among core damage prevention, containment failures, and consequence mitigation)
====s. The CRMP ====
to ensure protection of public health and safety. When a comprehensive risk analysis is not or cannot be performed, traditional defense-in-depth con siderations should be used or maintained to account for uncertainties.
assessment may use any combination of quantitative and qualitative input:
a.


The evaluation should consider the in tent of the general design criteria, national standards, and engineering principles such as the single failure cri terion. Further, the evaluation should consider the im pact of the proposed IS change on barriers (both pre ventive and mitigative)
Quantitative assessments should be performed whenever necessary for sound decisionmaking.
to core damage, containment failure or bypass, and the balance among defense-in depth attributes.


As stated earlier, the licensee should select the engineering analysis techniques, whether quantitative or qualitative, traditional or probabilistic, appropriate to the proposed TS change.  The licensee should assess whether the proposed TS change meets the defense-in-depth principle.
b.


De fense in depth consists of a number of elements as sum marized below. These elements can be used as guide lines for assessing defense in depth. Other equivalent acceptance guidelines may also be used.  Consistency with the defense-in-depth philosophy is maintained if:
When quantitative assessments are not necessary for sound decisionmaking, qualitative assessments can be performed. Qualitative assessments should consider applicable existing insights from previous quantitative assessments.
* A reasonable balance among prevention of core damage, prevention of containment failure, and consequence mitigation is preserved, i.e., the pro-posed change in a TS has not significantly changed the balance among these principles of prevention and mitigation, to the extent that such balance is needed to meet the acceptance criteria of the spe cific design basis accidents and transients, consis tent with 10 CFR 50.36. TS change requests should consider whether the anticipated operational changes associated with a TS change could introduce new accidents or transients or could in crease the likelihood of an accident or transient (as is required by 10 CFR 50.92).  " Over-reliance on programmatic activities to com pensate for weaknesses in plant design is avoided, e.g., use of high reliability estimates that are pri marily based on optimistic program assumptions.  " System redundancy, independence, and diversity are maintained commensurate with the expected frequency and consequences of challenges to the system, e.g., there are no risk outliers.


The follow ing items should be considered.
Component 4: Level 2 Issues and External Hazards The licensee should treat external hazards and Level 2 issues qualitatively or quantitatively, or both.


-Whether there are appropriate restrictions in place to preclude simultaneous equipment out ages that would erode the principles of redun dancy and diversity, -Whether compensatory actions to be taken when entering the modified AOT for pre planned maintenance are identified, -Whether voluntary removal of equipment from service during plant operation should not be scheduled when adverse weather conditions are predicted or at times when the plant may be subjected to other abnormal conditions, and .Whether the impact of the TS change on the safety function should be taken into consider ation. For example, what is the impact of a change in the AOT for the low-pressure safety injection system on the overall availability and reliability of the low-pressure injection func tion? " Defenses against potential common cause failures are maintained and the potential for introduction of new common cause failure mechanisms is as sessed, e.g., TS change requests should consider whether the anticipated operational changes asso ciated with a change in an AOT or STI could introduce any new common cause failure modes not previously considered.  " Independence of physical barriers is not degraded, e.g., TS change requests should address a means of ensuring that the independence of barriers has not 177-7 I I
2.4 Acceptance Guidelines for Technical Specification Changes The guidelines discussed in Sections C.2.4 and C.2.5 of RG 1.174 are applicable to TS change requests for CTs and SFs. Those sections present risk-acceptance guidelines as a function of the result of the licensees risk analysis in terms of total CDF and total LERF predicted for the plant and the change in CDF and LERF predicted for the proposed licensing basis changes. TS submittals for changes to CTs should also be evaluated against the risk-acceptance guidelines in this RG, in addition to those in RG 1.174. All risk-acceptance guidelines to individual proposals for TS changes will be applied in a  
been degraded by the TS change (e.g., when chang ing TS for containment systems). 
"* Defenses against human errors are maintained, e.g., TS change requests should consider whether the anticipated operation changes associated with a change in an AOT or STI could change the ex pected operator response or introduce any new hu man errors not previously considered, such as the change from performing maintenance during shut down to performing maintenance at power when different personnel and different activities may be involved.


"* The intent of the General Design Criteria in Appen dix A to 10 CFR Part 50 is maintained.
RG 1.177, Rev. 2, Page 21 manner consistent with Principle 4 in RG 1.174changes to TS result in small increases in the risk to public health and safety.


2.2.2 Safety Margins The engineering evaluation conducted should as sess whether the impact of the proposed TS change is consistent with the principle that sufficient safety mar gins are maintained (Principle
TS change evaluations may involve some small increase in risk, as quantified by PRA models.
3). An acceptable set of guidelines for making that assessment are summarized below. Other equivalent decision guidelines are ac ceptable.


Sufficient safety margins are maintained when: "* Codes and standards (e.g., American Society of Mechanical Engineers (ASME), Institute of Elec trical and Electronic Engineers (IEEE) or alterna tives approved for use by the NRC are met, e.g., the proposed TS AOT or STI change is not in conflict with approved Codes and standards relevant to the subject system. "* Safety analysis acceptance criteria in the Final Safety Analysis Report (FSAR) are met, or pro posed revisions provide sufficient margin to ac count for analysis and data uncertainties, e.g., the proposed TS AOT or STI change does not ad versely affect any assumptions or inputs to the safety analysis, or, if such inputs are affected,justi fication is provided to ensure sufficient safety mar gin will continue to exist. For TS AOT changes, an assessment should be made of the effect on the FSAR acceptance criteria assuming the plant is in the AOT (i.e., the subject equipment is inoperable)
Such a small increase may be offset by the many beneficial effects of the change that are not modeled by the PRA. The role of numerical guidelines is to ensure that the increase in risk is small and to provide a quantitative basis for the risk increase based on aspects of the TS change that are modeled or quantified.
and there are no additional failures.


Such an as sessment should result in the identification of all si tuations in which entry into the proposed AOT could result in failure to meet an intended safety function.
In some instances, risk information submitted by a licensee may support a long-term CT
extension (e.g., greater than 90 days). Restricting CT extensions to a backstop or a maximum CT limits extended exposure to single-failure susceptibility and compensates for the inherent uncertainty associated with PRAs. TS conditions addressed by CTs are entered infrequently and are inherently temporary. As stated in Section 4.1.2 of Nuclear Energy Institute (NEI) 96-07, Guidelines for 10 CFR 50.59 Evaluations, dated February 22, 2000 (Ref. 25), if a temporary change in support of maintenance activities is expected to be in effect during at-power operations for more than 90 days, the provisions of
10 CFR 50.59, Changes, Tests and Experiments, would be applied to the temporary change in the same manner as a permanent change. Even though NEI 96-07 applies to conducting 10 CFR 50.59 evaluations, a parallel can be drawn to TS CT extensions, in that temporary configurations or modifications extending beyond 90 days may no longer be considered temporary. Licensees requesting long-term CT extensions should be aware that such a request would increase the depth and level of detail of the staffs review, and they should ensure that any proposed measures to reduce the risk impact of the TS change (e.g., risk management actions, Tier 2 and 3 analyses, less reliance on programmatic activities as compensatory measures, demonstrating backup equipment reliability or availability) are commensurate with the proposed CT extension.


2.3 Evaluation of Risk Impact The NRC staff has identified a three-tiered ap proach for licensees to evaluate the risk associated with proposed TS AOT changes. Tier I is an evaluation of the impact on plant risk of the proposed TS change as expressed by the change in core damage frequency (ACDF), the incremental conditional core damage probability (ICCDP), 2 and, when appropriate, the change in large early release frequency (ALERF) and the incremental conditional large early release proba bility (ICLERP).3 Tier 2 is an identification of poten tially high-risk configurations that could exist if equip ment in addition to that associated with the change were to be taken out of service simultaneously, or other risk significant operational factors such as concurrent sys tem or equipment testing were also involved.
Using the risk measures discussed in this RG, the change in risk should be calculated for TS  
changes and compared against the numerical guidelines referenced in RG 1.174 or, for CT changes, against the numerical guidelines presented below. In calculating the risk impact of the changed case, licensees can credit additional changes to be implemented as part of the change. For example, in seeking an SF change, if the test strategy is also to be changed, the risk evaluation should incorporate its effect.


The ob jective of this part of the evaluation is to ensure that appropriate restrictions on dominant risk-significant configurations associated with the change are in place.  Tier 3 is the establishment of an overall configuration risk management program to ensure that other poten tially lower probability, but nonetheless risk-signifi cant, configurations resulting from maintenance and other operational activities are identified and compen sated for. If the Tier 2 assessment demonstrates, with reasonable assurance, that there are no risk-significant configurations involving the subject equipment, the ap plication of Tier 3 to the proposed AOT may not be nec essary. Although defense in depth is protected to some degree by most current TS, application of the three tiered approach to risk-informed TS AOT changes dis cussed below provides additional assurance that de fense in depth will not be significantly impacted by such changes to the licensing basis.  Tier 1: PRA Capability and Insights In Tier 1, the licensee should assess the impact of the proposed TS change on CDF, ICCDP, and, when ap propriate, LERF and ICLERP. To support this assess ment, two aspects need to be considered:
TS conditions addressed by CTs are entered infrequently and are temporary by their very nature.
(1) the valid ity of the PRA and (2) the PRA insights and findings.


The licensee should demonstrate that its PRA is valid for assessing the proposed TS changes and identify the impact of the TS change on plant risk.  Tier 2: Avoidance of Risk-Significant Plant Configurations The licensee should also provide reasonable assur ance that risk-significant plant equipment outage con figurations will not occur when specific plant equip ment is out of service consistent with the proposed TS 2 ICCDP -[(conditional CDF with the subject equipment out of ser vice)-(baseline CDFwith nominalexpected equipment unavailabili ties)] x (duration of single AOT under consideration). 
However, TS do not typically restrict the frequency of entry into conditions addressed by CTs. Therefore, the staff provides the following TS acceptance guidelines specific to permanent CT changes for evaluating the risk associated with the revised CT, in addition to those acceptance guidelines in RG 1.174:
3 ICLERP -[(conditional LERF with the subject equipment out of service) -(baseline LERFwith nominal expected equipment unavai labilities)]
a.
x (duration of single AOT under consideration).
1.177-8 change. An effective way to perform such an asse., ment is to evaluate equipment according to contribution to plant risk (or safety) while the equi ment covered by the proposed AOT change is out service. Evaluation of such combinations of equipme out of service against the Tier 1 ICCDP acceptan guideline could be one appropriate method of identif ing risk-significant configurations.


Once plant equi ment is so evaluated, an assessment can be made as whether certain enhancements to the TS or procedur are needed to avoid risk-significant Plant configut tions. In addition, compensatory actions that can mi gate any corresponding increase in risk (e.g., baclk equipment, increased surveillance frequency, or u grading procedures and training)
The licensee has demonstrated that the TS CT change has only a small quantitative impact on plant risk. An ICCDP of less than 1x10-6 and an ICLERP of less than 1x10-7 are considered small for a single TS condition entry3 (Tier 1).  
should be identifit and evaluated.
b.


Any changes made to the plant design operating procedures as a result of such a risk evalu tion (e.g., required backup equipment, increased st veillance frequency, or upgraded procedures and trai ing required before certain plant system configuratio can be entered) should be incorporated into the analys utilized for TS changes as described under Tier I abo-, Tier 3: Risk-Informed Configuration Risk Management The licensee should develop a program that e sures that the risk impact of out-of-service equipment appropriately evaluated prior to performing any mai tenance activity.
The licensee has demonstrated that there are appropriate restrictions on dominant risk-significant configurations associated with the change (Tier 2).  


A viable program would be one that able to uncover risk-significant plant equipment outaj configurations in a timely manner during normal pla operation.
3 The ICCDP and ICLERP acceptance guidelines of 1x10-6 and 1x10-7, respectively, are established for consistency with the incremental core damage probability (ICDP) and incremental large early release probability (ILERP) limits of Section 11 in Nuclear Management and Resources Council (NUMARC) 93-01, Revision 4F, Industry Guidelines for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, issued April 2018 (Ref. 26), applicable for maintenance activities involving normal work controls. RG 1.160 endorses, with certain provisions and clarifications, NUMARC 93-01.


This can be accomplished by evaluating C impact on plant risk of, for example, equipment u availability, operational activities like testing or loi dispatching, or weather conditions.
RG 1.177, Rev. 2, Page 22 c.


The need for tl third tier stems from the difficulty of identifying possible risk-significant configurations under Tier that will ever be encountered over extended periods plant operation.
The licensee has implemented a risk-informed plant configuration control program, including procedures to use, maintain, and control such a program (Tier 3).
For one-time-only changes to TS CTs, the frequency of entry into the CT may be known, and the configuration of the plant SSCs may be established. Further, there is no permanent change to the plant CDF or LERF, and hence, the risk guidelines of RG 1.174 cannot be applied directly. The staff provides the following TS acceptance guidelines specific to one-time-only CT changes for evaluating the risk associated with the revised CT:
a.


Regulatory Positions
The licensee has demonstrated that the impact on plant risk from implementing the one-time-only TS CT change is acceptable (Tier 1):
2.3.1 through 2.3.7 and A pendix A discuss various issues related to t] three-tiered approach described above. In general, Re, ulatory Positions
(1)
2.3.2 through 2.3.5 and Appendix outline issues associated with Tier 1, and Regulato Positions
an ICCDP of less than 1x10-6 and an ICLERP of less than 1x10-7, or
2.3.6 and 2.3.7 outline issues associated wi Tiers 2 and 3.  The NRC staff has identified several factors th should be considered in proposals for ST1 changes th are discussed below. In summary, the licensee shou identify the STIs to be evaluated, determine the ri: contribution associated with the subject STIs, dete mine the risk impact from the change to the propose;s- STI, and perform sensitivity and uncertainty evalua its tions to address uncertainties associated with the STI p- evaluations.
(2)
an ICCDP of less than 1x10-5 and an ICLERP of less than 1x10-6 with effective compensatory measures implemented to reduce the sources of increased risk.4 b.


More detail on risk evaluation for STI of changes is provided in Regulatory Positions
The licensee has demonstrated that there are appropriate restrictions on dominant risk-significant configurations associated with the change (Tier 2).  
2.3.1 :nt through 2.3.6 and in Appendix A.  Ice 2.3.1 Quality of the PRA p IlThe quality of the PRA must be compatible with to the safety implications of the TS change being re es quested and the role that the PRA plays in justifying ,a- that change. That is, the more the potential change in ti- risk or the greater the uncertainty in that risk from the Lp requested TS change, or both, the more rigor that must p- go into ensuring the quality of the PRA. One approach ed a licensee could use to ensure quality is to perform a or peer review of the PRA. In this case, the submittal a- should document the review process, the qualification ir- of the reviewers, a summary of the review findings, and n- resolutions to these findings when applicable.
c.


Industry ns PRA certification programs and PRA cross es comparison studies could also be used to help ensure ,e. appropriate scope, level of detail, and quality of the PRA. If such a program or studies are to be used, a de scription of the program, including the approach and standard or guidelines to which the PRA is compared;
The licensee has implemented a risk-informed plant configuration control program, including procedures to use, maintain, and control such a program (Tier 3).  
the depth of the review; and the make-up and qualifica n- tions of the personnel involved should be provided for is NRC review. Based on the peer review or other certifi n- cation process and on the findings from this process, the is licensee should justify why the PRA is adequate for the ge present TS application in terms of scope and quality. A nt peer review, certification, or cross-comparison would he not replace a staff review in its entirety, although the n- more confidence the staff has in the review that has id been performed by or for the licensee, the less rigor is should be expected of the staff review. For most TS re Ill views, demonstration of PRA quality by means of an 2 industry certification or cross-comparison process, in of combination with a focus-scoped staff review, should be sufficient.
In the context of integrated decisionmaking, the acceptance guidelines should not be interpreted as overly prescriptive. They are intended to provide an indication, in numerical terms, of what is considered acceptable. As such, the numerical values above are approximate values that indicate the changes that are generally acceptable. Furthermore, the state of knowledge, or epistemic uncertainties, associated with PRA calculations prevent a definitive decision with respect to the acceptance of the proposed change based purely on the numerical results. The intent in comparing the PRA results with the acceptance guidelines is to demonstrate with reasonable assurance that Principle 4 is being met. This decision should be based on a full understanding of the contributors to the PRA results and the impacts of the uncertainties, both those that are explicitly accounted for in the results and those that are not. In accordance with Section C.2.6 of RG 1.174, the NRC would give increased attention to the application if the calculated values of the changes in the risk metrics and their base values, when appropriate, approach the acceptance guidelines. Therefore, if the risk metrics approach, or even slightly exceed, the acceptance guidelines, the licensees submittal should address the additional aspects of plant risk and operation discussed in Section C.2.6 of RG 1.174.


Cross-comparisons are most appropriate when the system designs are similar across the plants he being compared.
There may be situations in which a nonquantitative assessment of risk (either alone or accompanied by a quantitative assessment) is sufficient to justify the proposed TS changes. The licensee is expected to use judgment in developing an appropriate (to support regulatory decisionmaking) risk argument to justify the proposed TS changes, including the appropriate blend of quantitative and qualitative assessments.


Some licensees may elect to use the PRA underlying their individual plant examination A (IPE) to analyze the risk impact associated with re ry quested TS changes. It should be noted that the NRC th staff's review of the IPE submittal alone does not suf fice as an adequate review for TS applications.
2.5 Comparison of Risk of Available Alternatives Available alternatives are sometimes compared to justify a TS change. For changes in TS CTs, such cases primarily involve comparing the risk of shutting down with the risk of continuing power


at 2.3.2 Scope of the PRA for TS Change at Evaluations ld The scope and the level of PRA necessary to fully sk support the evaluation of a TS change depend on the :r- type of TS change being sought. The scope and level of ed analysis required is discussed below for a variety of 1.177-9 cases. However, in some cases, a PRA of sufficient scope may not be available.
4 For one-time-only CT changes, the ICCDP and ICLERP acceptance guidelines of 1x10-5 and 1x10-6, respectively, are established for compatibility with the ICDP and ILERP limits of Section 11 in NUMARC 93-01, which is applicable for voluntary maintenance activities requiring risk-management actions.


This will have to be com pensated for by qualitative arguments, bounding analy ses, or compensatory measures.
RG 1.177, Rev. 2, Page 23 operation, given that the plant is not meeting one or more TS LCOs. Such comparisons can be used to justify the increase in at-power risk associated with the TS change by averting some transition or shutdown risk.


As a minimum, for systems used to prevent core damage (i.e., most of the TS systems modeled in a PRA other than the containment systems), Level 1 evalua tions should be performed.
Similarly, in the case of an SF change, the beneficial and adverse impacts can also be compared.


For containment systems, Level 2 evaluations are likely to be needed at least to the point of assessing containment structural performance in order to estimate the LERF. When only a Level 1 PRA is available but additional Level 2 information is desirable, one acceptable method for approximating the needed information is proposed in NUREG/CR 6595, "An Approach for Estimating the Frequencies of Various Containment Failure Modes and Bypass Events" (Ref. 13).  For changes to TS requirements defined for the power operation mode, the scope of analysis should in clude internal fires and flooding if appropriate (e.g., when the subject TS equipment is located in areas iden tified as vulnerable to fires or floods). When changes to requirements for systems needed for decay heat remov al are considered, an appropriate assessment of shut down risk should also be considered.
The modified SF should be chosen so that the benefit of testing is at least equal to or greater than the adverse effects of testing. For example, if the calibration of relays in the reactor protection system causes plant transients, the risk from the test-caused transients is then estimated and compared with the test-limited risk of a reduced SF.


Examples of such systems are auxiliary feedwater, residual heat removal, emergency diesel generator, and service water. Also, when AOTs are being modified to facilitate online maintenance (that is, transferring scheduled preventive maintenance (PM) from shutdown to power operation), the impact on the shutdown modes should also be eval uated. When available, using both power operation and shutdown models, a comparative evaluation may be presented to decide the appropriate condition for sched uling maintenance based on risk evaluations.
In using such guidelines, the following considerations apply:
a.


In some cases, a semi-quantitative analysis of shutdown risk may be adequate (e.g., fault tree analysis or failure modes and effects analysis). 
The uncertainty associated with the two measures being compared can differ and should be considered in deciding on an acceptable change.
When AOTs are being modified in anticipation of the need for additional time for corrective maintenance, an assessment of transition risk (the risk of transition ing from power operation to the mode required by the current TS in question)
that could be incurred under the current, shorter AOT may be desirable, if the initial cal culated risk increase is near or somewhat above the ac ceptance guidelines.


Also, TS changes to requirements for a controlled shutdown (i.e., the time allocated to transit through hot standby to hot shutdown to cold shutdown, or to the final state that should be reached) should be evaluated, if possible, using a model for the transition risk covering these periods, or at least a quali tative evaluation of the transition risk.2.3.3 PRA Modeling 2.3.3.1 Detail Needed forTS Changes. To evalu ate a TS change, the specific systems or components in volved should be modeled in the PRA. The model should also be able to treat the alignments of compo nents during periods when testing and maintenance are being carried out. Typically, limiting conditions for op erations (LCOs) and surveillance requirements relate to the system trains or components that are modeled in the system fault trees of a PRA. System fault trees should be sufficiently detailed to specifically include all the components for which surveillance tests and mainte nance are performed and are to be evaluated.
b.


"* For AOT evaluations, system train-level models are adequate as long as all components belonging to the train are clearly identified (i.e., all those components that could cause the train to fail). "* For evaluating STIs, individual component-level models are necessary.
When the risk measures associated with all alternatives are unacceptably large, ways to reduce the risk should be explored instead of only extending the TS requirement. That is, a large risk from one of the alternatives should not justify relaxing TS without giving appropriate attention to risk-reduction options. If the risk from test-caused transients is large, attention may then be given to exploring changes in test procedures to reduce such risk, rather than only reducing the SF.


Since PRAs are typically done at the component level, they are directly used to analyze both AOTs and STIs.  Component unavailability models should include contributions from random failure, common cause fail ure (CCF), test downtime, and maintenance downtime.
However, a combination of the two approaches also may be appropriate.


"* Changes to the component unavailability model for test downtime and maintenance downtime should be based on a realistic estimate of expected surveillance and maintenance practices after the TS change is approved and implemented, e.g., how often the AOT is expected to be entered for pre planned maintenance or surveillance.
2.6 Integrated Decisionmaking In accordance with Section C.2.6 of RG 1.174, the results of the evaluations under Sections C.1, C.2, and C.3 should be considered in an integrated manner to determine the final acceptability of the proposed TS change. PRA results are compared to numerical acceptance guidelines, along with other deterministic considerations, operating experience, lessons learned from previous changes, practical considerations associated with test and maintenance practices, and the implementation and monitoring program. The final acceptability of the proposed TS change should be based on all these considerations and not solely on the numerical results of the PRA. These results are one input into the decisionmaking and help in building an overall picture of the risk implications of the proposed TS change. As discussed previously, the numerical guidelines are used to ensure that any increase in risk is within acceptable limits, deterministic considerations are used to ensure that the change satisfies rules and regulations, practical considerations are taken into account to judge the acceptability of implementing the change, lessons learned from past experience ensure that mistakes are not repeated, and monitoring ensures that the TS change does not degrade operational safety over time. RG 1.174, Section C.2.6, provides additional guidance on the integrated decisionmaking process.


"* The component unavailability model for test downtime and maintenance downtime should be based on plant-specific or industry-wide operating experience, or both, as appropriate.
3.


"* The component unavailability model should have the flexibility to separate contributions from test and maintenance downtime.
Element 3: Define Implementation and Monitoring Program
3.1 Three-Tiered Implementation Approach As described in Section C.2.3, the licensee should use a three-tiered approach to implement the proposed TS CT changes. Application of the three-tiered approach is consistent with the fundamental principle that the proposed change is consistent with the defense-in-depth philosophy. It also provides assurance that the proposed change will not significantly impact defense in depth.


For evaluating an AOT, the contribution from maintenance down time can be equated to zero to delete maintenance activities, if desired. For an STI evaluation, the contribution from test downtime determines a con tribution to risk from carrying out the test.  "* Additional details in terms of separating the failure rate contributions into cyclic demand-related and standby time-related contributions can be incorpo rated, if justifiable, for evaluating surveillance re quirements.
RG 1.177, Rev. 2, Page 24
3.2 Technical Specification Change Monitored Using Performance Measurement Strategies (Principle 5)
Consistent with Principle 5 in RG 1.174, extension of a TS CT or reduction of a TS SF should not degrade operational safety over time. The licensee should ensure, as part of its Maintenance Rule program
(10 CFR 50.65), that when equipment does not meet its performance criteria, the scope of the evaluation required under the Maintenance Rule includes prior related TS changes. If the performance or condition of TS equipment affected by a TS change does not meet established performance criteria, the licensee should take appropriate corrective action, in accordance with the Maintenance Rule. Such corrective action could consider another TS change to shorten the revised CT or increase the revised SF, or impose a more restrictive administrative limit if the licensee determines this to be an important factor in reversing the negative trend.


The CCF contributions should be modeled so that they can be modified to reflect the condition in which 1.177-10 i one or more of the components is unavailable.
4.


It should be noted, however, that CCF modeling of components is not only dependent on the number of remaining in-service components, but is also dependent on the reason components were removed from service, i.e., whether for preventive or corrective maintenance.
Element 4: Submit Proposed Change The evaluations performed to justify the proposed TS changes should be documented, maintained, and included in the license amendment request submittal in accordance with Section C.6 of RG 1.174. Specifically, documentation for risk-informed TS change submittals should include a description or discussion of the following:
a.


For appropriate configuration risk management and con trol, preventive and corrective maintenance activities need to be considered, and licensees should, therefore, have the ability to address the subtle difference that ex ists between maintenance activities (see Section A.1.3.2 of Appendix A to this guide for details). 
the TS changes being proposed and the reasons for seeking the changes (Section C.1, Element 1),  
To account for the effects of test placements for re dundant components in relation to each other (e.g., staggered or sequential test s'rategy), time-dependent models and additional evaluations using specialized codes may be used, if available.
b.


If the PRA does not model the system for which the TS change is being requested, specialized analyses may be necessary when requesting changes to the TS for these systems. Examples of these situations are given below: " When a system is modeled in the event tree, but a detailed fault tree model is not provided (direct es timate of system unavailability from experience data or expert judgment is used), the TS evaluation can proceed in one of two ways: (1) A separate fault tree can be developed for the system for TS evaluation and used to comple ment the existing PRA model without directly modifying the PRA (e.g., detailed separate fault tree modeling of the reactor protection system combined with the existing PRA mod el), or (2) Abounding evaluation can be conducted based on the impact of system failures that are mod eled in the PRA event trees, that is, failure of any component in the system can be assumed to cause system failure.  " When a separate fault tree is developed, specificTS
a summary of the engineering analyses conducted to justify the proposed TS changes and evidence that they meet the principles described in this RG (Section C.2, Element 2),  
requirements within the system can be changed and changes in the system unavailability can be measured, which can then be used in the PRA mod el to obtain the corresponding Level 1 and Level 2 and 3 measures, as appropriate.
c.


Such evaluations can be considered similarly as those evaluations made directly using PRA models, but should satis fy the following conditions:
compliance with current regulations, orders, and license conditions (Section C.2.1, Principle 1),  
* (1) Failures within the system should not affect any other system or component failure, (2) The effect of system failure should not influ ence any initiating event frequency (or it should have a minimal or negligible effect), and (3) The system should not share components with another system.  ° When bounding evaluations are performed assum ing any failure in the system as a system failure, the calculated risk impacts for TS changes are ex pected to be overestimated.
d.


The corresponding changes that may be acceptable will also be fewer than those that could have been justified using a de tailed model. When considering the incorporation of non-PRA factors, this perspective should be kept, while at the same time considering the lack of a detailed model. Here also, the above three condi tions discussed for the previous case apply. In some cases, since the risk-informed evaluation will be limited and some mis-estimation of the risk may have been incorporated, non-risk-related engineering considerations gain importance in the overall decision.
the defense-in-depth evaluation (Section C.2.2.1, Principle 2),  
e.


In such cases, arguments for the change also must be for small increments from current requirements.
the safety margins evaluation (Section C.2.2.2, Principle 3),
f.


2.3.3.2 Modeling of Initiating Events. Some ini tiating events resulting from support system failure (e.g., service water, component cooling water, instru ment air) are modeled explicitly in the logic model, i.e., fault tree models are developed in the PRA. Any TS change for these systems will affect the corresponding initiating event frequency as well as the system un availability and availability of other supported sys tems. The effect of TS changes on these initiating event frequencies should be considered.
the risk impact evaluation (Sections C.2.3-2.5, Principle 4):
(1)
acceptability of the PRA models used to evaluate proposed TS changes (Sections C.2.3.1, C.2.3.2, and C.2.3.3),  
(2)  
changes made to the PRA models used to evaluate proposed TS changes (including data developed and used in addition to the plants PRA database) (Section C.2.3.3),  
(3)
assumptions of the PRA analysis used to evaluate proposed TS changes (Section C.2.3.4),
(4)
sensitivity and uncertainty analyses performed and associated results (Section C.2.3.5),
(5)
the approach used to identify the dominant risk-significant plant configurations associated with proposed TS changes, identification of these dominant risk-significant plant configurations, explanation of how these plant configurations will be prohibited (e.g., by TS or plant procedures) during the TS outage, discussion of any compensatory measures proposed as part of the TS change evaluation, and quantitative or qualitative presentation of the risk impact of these compensatory measures (Section C.2.3.6, Tier 2),


Some test and maintenance activities can contrib ute to some transients.
RG 1.177, Rev. 2, Page 25
(6)
the capability of the risk-informed plant configuration control program to perform contemporaneous assessments of the overall impact on safety of proposed plant configurations, including an explanation of how these tools or other processes will be used to ensure that risk-significant plant configurations will not be entered and that appropriate actions will be taken when unforeseen events put the plant in a risk-significant configuration (Section C.2.3.7, Tier 3),
(7)
risk measures used in evaluating the proposed TS changes, providing the calculated risk measure values associated with the TS change evaluation (including intermediate results)
and addressing how they align with the risk-acceptance guidelines presented in this RG,
in addition to those in RG 1.174, as applicable; if the risk metrics approach, or slightly exceed, the acceptance guidelines, discussion of the additional aspects of plant risk and operation identified in Section C.2.6 of RG 1.174 (Section C.2.4), and
(8)
a comparison of the risk of available alternatives, as applicable (Section C.2.5),
g.


Initiating-event frequencies used in the PRA do not typically separate out this con tribution, but such a separation may be needed during TS change evaluations.
the integrated decision to determine final acceptability of the proposed TS change (Section C.2.6),
h.


For example, the effect of test caused transients may be evaluated in deciding an STI.  Initiating-event frequencies from conduct of the test (i.e., test-caused transients)  
the implementation and monitoring program (Principle 5), including use of the Maintenance Rule program (10 CFR 50.65) (Section C.3, Element 3),
could then be modeled sep arately to evaluate the risk contribution from test caused transients.
i.


Data needs for estimating initiating event frequencies from test-caused transients are dis cussed in Section A.2 of the appendix to this guide.  2.3.3.3 Screening Criteria.
a marked-up copy (e.g., redline markup) of the relevant TS and bases, including adequate information to provide the technical basis for the revised CT or SF, and j.


The main qualitative consideration regarding the screening of sequences in TS change evaluations is the inclusion of sequences di rectly affected by the TS change that would have been truncated by frequency-based screening alone. For ex ample, if the TS change involves accumulators in a pressurized-water reactor (P WR), qualitative consider-1.177-11 I I
all other documentation required to be submitted with a license amendment request.
ations imply that sequences that contain the accumula tors should be included, even if these sequences do not meet the frequency criteria.


Excluding these sequences would result in an underestimate of the risk impact of the TS changes.
RG 1.177, Rev. 2, Page 26


23.3.4 Truncation Limits. Truncation levels should be used appropriately to ensure that significant underestimation, caused by truncation of cutsets, does not occur as discussed below. Additional precautions relevant to the cutset manipulation method of analysis are needed to avoid truncation errors in calculating risk measures.
==D. IMPLEMENTATION==
The NRC staff may use this regulatory guide as a reference in its regulatory processes, such as licensing, inspection, or enforcement. However, the NRC staff does not intend to use the guidance in this regulatory guide to support NRC staff actions in a manner that would constitute backfitting as that term is defined in 10 CFR 50.109, Backfitting, and as described in NRC Management Directive 8.4, Management of Backfitting, Forward Fitting, Issue Finality, and


When failure or outage of a single component is considered, as in the case of an AOT or STI risk evalua tion, the truncation levels in evaluating R 1 and Ro are of concern. [Ri is the increased CDF, with the component assumed to be inoperable (or equivalently the compo nent unavailability set to "true"), and Ro is the reduced CDF, with the component assumed to be operable (or equivalently, the component unavailability set to "false")].
===
If the component in question appears in the cutsets near the truncation limit (e.g., all appearances are in cutsets within a factor of 10 of the truncation lim it), it may be necessary to reduce the truncation limit. If R 1 is marginally larger than the base case value, then one order of additional cutsets should be generated to ensure that any underestimation did not take place.  When risk from plant configurations involving multiple components is being considered, a cutset with a relatively small frequency can become a significant contributor to the CDF. This is because more than one of the affected components may appear in the same minimal cutset, and the unavailability (increased by the TS change) of more than one of these components could cause a significant increase in the cutset's fre quency. For such cases, truncation levels have to be re duced by a larger amount than would be the case for the case of single components.


Particular care should be taken if the evaluation of R 1 is based on requantifica tion of pre-solved cutsets, as the events related to the component of concern may not even appear in the cut sets. 2.3.4 Assumptions in AOT and STI Evaluations Using PRAs to evaluate TS changes requires con sideration of a number of assumptions made within the PRA that can have a significant influence on the ulti mate acceptability of the proposed changes. Such as sumptions should be discussed in the submittal re questing the TS changes. Assumptions that should be considered for AOT change evaluations can be summa rized as follows.
===Information Requests===
===
(Ref. 27), nor does the NRC staff intend to use the guidance to affect the issue finality of an approval under
10 CFR Part 52, Licenses, Certifications, and Approvals for Nuclear Power Plants. The staff also does not intend to use the guidance to support NRC staff actions in a manner that constitutes forward fitting as that term is defined and described in Management Directive 8.4. If a licensee believes that the NRC is using this regulatory guide in a manner inconsistent with the discussion in this Implementation section, then the licensee may file a backfitting or forward fitting appeal with the NRC in accordance with the process in Management Directive 8.4.


1. If AOT risk evaluations are performed using only the PRA for power operation (i.e., to calculate the risk associated with (a) the equipment being un available during power operation for the duration of the AOT and (b) any change in the AOT), the risk associated with shutting the plant down because of AOT violations is not being considered.
RG 1.177, Rev. 2, Page 27 REFERENCES5
1.


In most cases, this risk has not been considered or, if con sidered, is assumed to further justify the requested change. For some situations (e.g., for residual heat removal systems, service water systems, auxiliary feedwater systems), comparative risk evaluations of continued power operation vs. plant shutdown should be considered.
U.S. Nuclear Regulatory Commission, Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Washington DC.


2. When calculating the risk impacts (i.e., a change in CDF or LERF caused by AOT changes), the change in average CDF should be estimated using the mean outage times (or an appropriate surrogate)
2.
for the current and proposed AOTs. If a licensee chooses to use the zero maintenance state as the base case (case in which no equipment is unavail able because of maintenance), an explanation stat ing so should be part of the submittal.


Usually, data for outage times correspond to the current AOT, but not to the proposed AOT. Different assumptions are made to estimate the outage time corresponding to the proposed AOT. Assumptions concerning changes in maintenance practices under the ex tended AOT regime should be discussed and their impact on the results of the analysis characterized.
U.S. Code of Federal Regulations, Domestic Licensing of Production and Utilization Facilities, Part 50, Chapter I, Title 10, Energy.


3. When the risk impact of an AOT change is evaluat ed, the yearly risk impact that is calculated takes into account the outage frequency.
3.


An AOT exten sion may imply that the maintenance of the compo nent is improved, which may reduce the compo nent's failure rate, and consequently, reduce the frequency of outages needed for correcting degra dations or failure. Again, there are no experience data for the extended AOT; therefore, the assump tion should be made that both the frequency of out age for corrective maintenance and the compo nent's failure rate remain the same. Here, the beneficial aspect of maintenance is not quantified and this may give a slightly higher estimate of the yearly AOT risk measure for the proposed AOT.  4. Often, AOT extensions are requested to facilitate on-line (or at-power)
U.S. Code of Federal Regulations, Licenses, Certifications, and Approvals for Nuclear Power Plants, Part 52, Chapter I, Title 10, Energy.
preventive maintenance of safety-system components.


The frequency and duration of the extension may be estimated and the risk impact from the resulting unavailability of such equipment can be calculated.
4.


1.177-12
U.S. Nuclear Regulatory Commission, NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, Washington DC.
5. When AOTs of multiple safety system trains are extended, the likelihood of simultaneous outages of multiple components increases (resulting from combinations of failures, testing, and mainte nances) because the increased duration increases the probability of the individual events that consti tute the simultaneous multiple outages; hence, overlapping of routinely scheduled activities and random failures becomes more likely. The impact of such occurrences on the average plant risk, e.g., CDF, is small, but the conditional risk can be large.  This issue is addressed as part of the implementa tion considerations (see Regulatory Positions
2.3.7 and 4.1).  Assumptions that should be considered for STI evaluations can be summarized as follows.


1. Surveillance tests usually are assumed to detect failures that have occurred in the standby period.  The component failure rate, X, represents these fail ures in the formulation of component unavailabil ity. The test-limited risk is normally estimated by assuming that a surveillance test of a component detects the failures, and that after the test, the com ponent's unavailability resets to zero or "false" in the Boolean expression.
5.


A few component fail ures, depending on a component's design and the test performed, may not be detected by a routine surveillance test. Usually, their contribution to risk is considered negligible.
U.S. Nuclear Regulatory Commission, NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking: Final Report, Washington DC.


2. Regular surveillance testing of a component, as performed for safety system components, is con sidered to influence its performance.
6.


Generally, for most components, the increase of a surveillance in terval beyond a certain value may reduce the com ponent's performance (i.e., increase the failure rate). Experience data are not available to assess the STI values beyond which the component fail ure rate, X., increases.
U.S. Nuclear Regulatory Commission, Regulatory Guide 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, Washington DC.


If, in a risk-informed evalua tion of surveillance requirements, the failure rate is assumed to remain the same (i.e., unaffected by a change in the test interval), this assumption implies that the STIs are not being changed beyond the val ue at which k.may be affected.
7.


Care should be taken not to extend the STIs beyond such values using risk-informed analyses only. 3. The timing of surveillance tests for redundant com ponents relative to each other (i.e., the test strategy used) has an impact on the risk measures calcu lated. Staggered or sequential test strategies are commonly used. The risk impacts of adopting dif ferent test strategies (e.g., sequential vs. staggered)
U.S. Nuclear Regulatory Commission, Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Washington DC.
should be evaluated to determine whether there is an impact on the evaluation of the change being considered (NUREG/CR-6141, Ref. 14).  4. Notwithstanding the beneficial aspects of testing to detect failures that occur in a standby period, a number of adverse effects may be associated with the test: downtime to conduct the test, errors of res toration after the test, test-caused transients, and test-caused wear of the equipment.


Downtime and errors of restoration are usually modeled in a PRA, unless they are negligible.
8.


Test-caused transients and wear of the equipment are applicable to a few tests, but they are not generally modeled separately in a PRA. However, they can be evaluated using PRA models supplemented with additional data and analysis.
Atomic Energy Commission, Part 50Licensing of Production and Utilization Facilities Technical Specifications for Facility Licenses; Safety Analyses Reports, Federal Register, Vol. 33, No. 244, December 17, 1968, pp. 18610-18613.


Methods are available to quantita tively address these aspects [NUREG/CR-5775 (Ref.15)];
9.
however, qualitative arguments can also be presented to support the extension of a test inter val. If the adverse impact of testing is considered significant, such cases should be addressed quanti tatively.


2.3.5 Sensitivity and Uncertainty Analyses Relating to Assumptions in TS Change Evaluations As in any risk-informed study, risk-informed anal yses of TS changes can be affected by numerous uncer tainties regarding the assumptions made during the PRA model's development and application.
U.S. Nuclear Regulatory Commission, Use of Probabilistic Risk Assessment Methods in Nuclear Regulatory Activities; Final Policy Statement, Federal Register, Vol. 60, No. 158, August 16, 1995, pp. 42622-42629.


Sensitivity analyses may be necessary to address the important assumptions in the submittal made with respect to TS change analyses.
10.


They may include, as appropriate:
U.S. Nuclear Regulatory Commission, NUREG-1430, Standard Technical Specifications, Babcock and Wilcox Plants, Revision 4, Washington DC.
"* The impact of variation in repair/maintenance policy because of AOT changes (e.g., scheduling a PM of longer duration at power).  " The impact of variation in assumed mean down times or frequencies.


"* The effect of separating the cyclic demand vs.  standby time-related contribution to the compo nent's unavailability in deciding changes to an STI.
11.


* The effect of details (e.g., equipment failure rate,)., 0) regarding how CCFs are modeled in the PRA.  Previous sensitivity analyses performed for risk informed TS changes have shown that the risk resulting from TS AOT changes is relatively insensitive to un certainties (compared, for example, to the effect on risk from uncertainties in assumptions regarding plant de sign changes, or regarding significant changes to plant operating procedures).
U.S. Nuclear Regulatory Commission, NUREG-1431, Standard Technical Specifications, Westinghouse Plants, Revision 4, Washington DC.
This is because the uncertain ties associated with AOT changes tend to similarly af fect the base case (i.e., before the change) and the 77-13 changed case (i.e., with the change in place). That is, the risks result from similar causes in both cases (i.e., no new initiating transients or subsequent failure modes are likely to have been introduced by relatively minor AOT changes).
AOT changes subject the plant to a variation in its exposure to the same type of risk, and the PRA model is able to predict, with relative sure ty based on data from operating experience, how much that risk will change based on that changed exposure.


Similar results are expected for STI changes. Licensees are expected to justify any deviations from these expec tations.
12.


The above argument may be more difficult tojusti fy in cases when the effects of multiple outages may be come significant during relatively large increases in AOTs or STIs. In those cases, however, the Tier 2 and Tier 3 aspects of TS changes (i.e., configuration moni toring, risk predictions, and configuration control based on the risk predictions)
U.S. Nuclear Regulatory Commission, NUREG-1432, Standard Technical Specifications, Combustion Engineering Plants, Revision 4, Washington DC.
are expected to be robust and will be relied upon to control the resulting potential for significant risk increases.


2.3.6 Use of Compensatory Measures in TS Change Evaluations Consistent with the fundamental principle that changes to TS should result in only small increases in the risk to the public health and safety (Principle
13.
4, as described in the Discussion section of this regulatory guide), and as part of proposed TS change evaluations, certain compensatory measures (discussed below) that balance the calculated risk increase caused by the changes may be considered.


This consideration should be made in light of the acceptance guidelines given in Regulatory Guide 1.174 (Ref. 11). Also, note that these considerations may be part of Tier 2 or Tier 3 programs.
U.S. Nuclear Regulatory Commission, NUREG-1433, Standard Technical Specifications, General Electric BWR/4 Plants, Revision 4, Washington DC.


When the licensee wishes to reduce the risk in crease resulting from a proposed change even though the individual change is judged by the licensee to meet the acceptance guidelines, the licensee might consider taking compensatory measures such as those suggested below. If compensatory measures are considered as part of the analysis of the change, they should be in cluded in the overall application for the TS change.  However, compensatory measures should not be relied upon to compensate for weaknesses in plant design.  Compensatory measures included in the submittal for a TS change should be measures for which the licensee is not already taking credit. Any such compensatory mea sures would become part of the licensing basis if the TS change were approved.
14.


Examples of compensatory measures are: S Adding a test of a redundant train before initiating a scheduled maintenance activity as part of an AOT extension application.
U.S. Nuclear Regulatory Commission, NUREG-1434, Standard Technical Specifications, General Electric BWR/6 Plants, Revision 4, Washington DC.


"* Limiting simultaneous testing and maintenance of redundant or diverse systems as part of an AOT ex tension application.
5 Publicly available NRC published documents are available electronically through the NRC Library on the NRCs public Web site at https://www.nrc.gov/reading-rm/doc-collections/ and through the NRCs Agencywide Documents Access and Management System (ADAMS) at https://www.nrc.gov/reading-rm/adams.html. The documents can also be viewed online or printed for a fee in the NRCs Public Document Room (PDR) at 11555 Rockville Pike, Rockville, MD. For problems with ADAMS, contact the PDR staff at (301) 415-4737 or (800) 397-4209; fax (301) 415-3548; or e-mail pdr.resource@nrc.gov.


"* Incorporating a staggered test strategy aspart of the STI extension application.
RG 1.177, Rev. 2, Page 28
15.


"* Improving test and maintenance procedures to re-. duce test-and maintenance-related errors. "* Improving operating procedures and operator training to reduce the impact of human errors.  "* Improving system designs, which reduces overall system unavailability and plant risk.  When compensatory measures are part of the TS change evaluation, the risk impact of these measures should be considered and presented, either quantita tively or qualitatively.
U.S. Nuclear Regulatory Commission, Inspection Manual Chapter 0326, Operability Determinations, September 30, 2019, ADAMS Accession No. ML19273A878.


When a quantitative evaluation is used, the total impact of these measures should be evaluated by comparison to the "small" guideline (Principle
16.
4, as described in the Discussion section of this regulatory guide). This includes:
(1) Evaluation of the proposed TS changes without the compensatory measures.


(2) Evaluation of the proposed TS changes with the compensatory measures.
U.S. Nuclear Regulatory Commission, Generic Letter 80-30, Clarification of the Term Operable as It Applies to Single Failure Criterion for Safety Systems Required by TS,
Washington DC, April 10, 1980.


(3) Specific discussion of how each of the compensa tory measures is credited in the PRA model or dur ing the evaluation process.
17.


2.3.7 Contemporaneous Configuration Control Consistent with the fundamental principle that changes to TS result in small increases in the risk to public health and safety (Principle
International Atomic Energy Agency, Development and Application of Level 1 Probabilistic Safety Assessment for Nuclear Power Plants, Specific Safety Guide, Safety Standards Series No. SSG-3, Vienna, Austria, 2010.6
4), certain configu ration controls need to be utilized.
18.


The need for the controls discussed below is described at the beginning of Regulatory Position 2.3 in the discussion regarding Tier 3.  2.3.7.1 Configuration Risk Management Pro gram (CRMP). Licensees should describe their capa bility to perform a contemporaneous assessment of the overall impact on safety of proposed plant configura tions prior to performing and during performance of maintenance activities that remove equipment, from service. Licensees should explain how these tools or other processes will be used to ensure that risk-signifi cant plant configurations will not be entered and that appropriate actions will be taken when unforeseen events put the plant in a risk-significant configuration.
International Atomic Energy Agency, Development and Application of Level 2 Probabilistic Safety Assessment for Nuclear Power Plants, Specific Safety Guide, Safety Standards Series No. SSG-4, Vienna, Austria, 2010.


1.177-14 (
19.
., The TS Administrative Controls section should de scribe the licensee's program for performing a real time risk assessment.


The bases for TS for which an ex tended AOT is granted should reference this program 23.7.2 Key Components of the CRMP. The li censee should ensure that the CRMP contains the fol lowing key components.
International Atomic Energy Agency, Safety of Nuclear Power Plants: Design, Safety Standards Series No. SSR-2/1, Rev. 1, Vienna, Austria, 2016.


Key Component
20.
1: Implementation of CRMP The intent of the CRMP is to implement Section a(3) of the Maintenance Rule (10 CFR 50.65) with re spect to on-line maintenance for risk-informed TS, with the following additions and clarifications:
1. The scope of structures, systems, and components (SSCs). to be included in the CRMP is all SSCs modeled in the licensee's plant PRA in addition to all SSCs considered high safety significant per Re vision 2 of Regulatory Guide 1.160 (Ref. 16) that are not modeled in the PRA.  2. The CRMP assessment tool is PRA-informed and may be in the form of a risk matrix, an on-line as sessment, or a direct PRA assessment.


3. The CRMP will be invoked as follows: For pre-planned entrance into the plant config uration described by a TS action statement with a risk-informed AOT, a risk assessment, including, at a minimum, a search for risk significant configurations, will be performed prior to entering the action statement.
U.S. Nuclear Regulatory Commission, Final Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors, Federal Register, Vol. 58, No. 139, July 22, 1993, pp. 39132-39139.


description.
21.


The following program should be incorpo rated and should be described in the TS Administrative Controls section."* For unplanned entrance into the plant configu ration described by a TS action statement with a risk-informed AOT, a similar assessment will be performed in a time frame defined by the plant's Corrective Action Program (Criteria XVI of Appendix B to 10 CFR Part 50).  "* When in the plant configuration described by a "TS action statement with a risk-informed AOT, if additional SSCs become inoperable or non functional, a risk assessment, including, at a minimum, a search for risk-significant config urations, will be performed in a time frame de fined by the plant's Corrective Action Program (Criteria XVI of Appendix B to 10 CFR Part 50). 4. Tier 2 commitments apply only for planned main tenance, but should be evaluated as part of the Tier 3 assessment for unplanned occurrences.
U.S. Nuclear Regulatory Commission, Technical SpecificationsFinal Rule, Federal Register, Vol. 60, No. 138, July 19, 1995, pp. 36953-36959.


Key Component
22.
2: Control and Use of the CRMP Assessment Tool 1. Plant modifications and procedure changes will be monitored, assessed, and dispositioned.


* Evaluation of changes in plant configuration or PRA model features will be dispositioned by implementing PRA model changes or by the 1.177-15 SI i , MODEL CONFIGURATION
U.S. Nuclear Regulatory Commission, Staff RequirementsSECY-98-144White Paper on Risk-Informed and Performance-Based Regulation, Staff Requirements Memorandum-SECY-98-144, March 1, 1999, ADAMS Accession No. ML003753601.
RISK MANAGEMENT
PROGRAM The Configuration Risk Management Program (CRMP) provides a proceduralized risk-informed assessment to manage the risk associated with equipment inoperability.


The program applies to technical specification structures, systems, or components for which a risk-informed allowed outage time has been granted.'
23.
The program is to include the following.


a. Provisions for the control and implementation of a Level I at-power internal events PRA-informed methodolo gy. The assessment is to be capable of evaluating the applicable plant configuration.
U.S. Nuclear Regulatory Commission, Handbook of Methods for Risk-Based Analyses of Technical Specifications, NUREG/CR-6141, BNL-NUREG-52398, December 1994, ADAMS
Accession No. ML093090361.


b. Provisions for performing an assessment prior to entering the plant configuration described by the Limiting Conditions for Operation (LCO) Action Statement for preplanned activities.
24.


c. Provisions for performing an assessment after entering the plant configuration described by the LCO Action Statement for unplanned entry into the LCO Action Statement.
U.S. Nuclear Regulatory Commission, Quantitative Evaluation of Surveillance Test Intervals Including Test-Caused Risks, NUREG/CR-5775, BNL-NUREG-52296, February 1992, ADAMS Accession No. ML19172A254.


d. Provisions for assessing the need for additional actions after the discovery of additional equipment-out-of service conditions while in the plant configuration described by the LCO Action Statement.
25.


e. Provisions for considering other applicable risk-significant contributors such as Level 2 issues and external events, qualitatively or quantitatively.
Nuclear Energy Institute, NEI 96-07, Guidelines for 10 CFR 50.59 Evaluations, February 22, 2000, ADAMS Accession No. ML003686043.


Each submittal for a risk-informed TS AOT extension should contain appropriate changes to the Administrative Control section that incorporates the above program description, unless an approved CRMP program description has already been incorporated into the licensee's TS.
26.


qualitative assessment of the impact of the changes on the CRMP assessment tool. This qualitative assessment recognizes that changes to the PRA take time to implement and that changes can be effectively compensated for without compromising the ability to make sound engineering judgments..
Nuclear Management and Resources Council, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, NUMARC 93-01, Rev. 4F, April 2018, ADAMS Accession No. ML18120A069.7
Limitations of the CRMP assessment tool are identified and understood for each specific AOT extension.
27.


2. Procedures exist for the control and application of CRMP assessment tools, including a description of the process when the plant configuration of con cern is outside the scope of the CRMP assessment too
U.S. Nuclear Regulatory Commission, Management of Backfitting, Forward Fitting, Issue Finality, and


====l. Key Component ====
===
3: Level 1 Risk-Informed Assessment The CRMP assessment tool utilizes at least a Level 1, at-power, internal events PRA model. The CRMP assessment may use any combination of quantitative and qualitative input. CRMP assessments can include reference to a risk matrix, pre-existing calculations, or new PRA analyses.


1. Quantitative assessments should be performed whenever necessary for sound decisionmaking.
===Information Requests===
===
, Management Directive 8.4, September 20, 2019.


2. When quantitative assessments are not necessary for sound decisionmaking, qualitative assessments can be performed.
6 Copies of International Atomic Energy Agency (IAEA) documents may be obtained through their website:
WWW.IAEA.Org/ or by writing the International Atomic Energy Agency, P.O. Box 100 Wagramer Strasse 5, A-1400
Vienna, Austria.


Qualitative assessments should consider applicable existing insights from previous quantitative assessments.
7 Publications from the Nuclear Energy Institute (NEI) are available at the NEI Web site: http://www.nei.org/ or by contacting the headquarters at Nuclear Energy Institute, 1776 I Street, NW, Washington, DC 20006-3708, Phone: (202) 739-800,
Fax (202) 785-4019.


Key Component
Appendix A to RG 1.177, Rev. 2, Page A-1 APPENDIX A
4: Level 2 Issues and External Events External events and Level 2 issues are treated qual itatively or quantitatively, or both. 2.4 Acceptance Guidelines for TS Changes The guidelines discussed in Sections 2.2.4 and 2.2.5 of Regulatory Guide 1.174 (Ref. 11) are applica ble to TS AOT and STI change requests.
CONSIDERATIONS AND DATA NEEDS FOR
TECHNICAL SPECIFICATION CHANGE RISK EVALUATIONS
A-1.


Risk acceptance guidelines are presented in those sections as a function of the result of the licensee's.risk analysis in terms of total CDF predicted for the plant and the change in CDF and LERF predicted for the TS changes requested by the licensee.
Other Considerations in Technical Specification Change Risk Evaluations A-1.1 Risk-Informed Measures for Technical Specification Changes to Completion Times and Surveillance Frequencies This section lists the risk-informed measures used in completion time (CT) and surveillance frequency (SF) evaluations.1 NUREG/CR-6141, Handbook of Methods for Risk-Based Analyses of Technical Specifications, issued December 1994 (Ref. 1), discusses these measures in more detail.


In addition, those sections discuss cases when the scope of the licensee's PRA does not include a Level 2 (containment performance)
The measures applicable for CT evaluations include the following:
analysis, and when, according to the guidelines pre sented in this regulatory guide and in Regulatory Guide 1.174, such an analysis is needed. TS submittals for changes to AOTs should also be evaluated against the risk acceptance guidelines presented herein, in addition to those in Regulatory Guide 1.174. Application of all the risk acceptance guidelines to individual proposals for TS changes will be done in a manner consistent with the fundamental principle that changes to TS result in small increases in the risk to the health and safety of the public (Principle
a.
4, as described in the Discussion sec tion of this regulatory guide).  TS change evaluations may involve some small in crease in risk as quantified by PRA models. Usually, it is argued that such a small increase is offset by the many beneficial effects of the change that are not modeled by the PRA. The role of numerical guidelines is to ensure that the increase in risk is small, and to provide a quanti tative basis for the risk increase based on aspects of the TS change that are modeled or quantified.


The numerical guidelines used to decide an accept able TS change are taken into account along with other traditional considerations, operating experience, les sons learned from previous changes, and practical con siderations associated with test and maintenance prac tices. The final acceptability of the proposed change should be based on all these considerations and not solely on the use of PRA-informed results compared to numerical acceptance guidelines.
conditional risk given the limiting condition for operation (LCO),  
b.


As discussed previously, the numerical guidelines are used to ensure that any increase in risk is within ac ceptable limits; traditional considerations are used to ensure that the change satisfies rules and regulations that are in effect; practical considerations judge the ac ceptability of implementing the change; and lessons learned from past experience ensure that mistakes are not repeated.
incremental conditional core damage probability (ICCDP), and c.


Using the risk measures discussed in this regula tory guide, the change in risk should be calculated for the TS changes and compared against the numeric guidelines referenced in Regulatory Guide 1.174, and for AOT changes, against the numerical guidelines presented below. In calculating the risk impact of the changed case, additional changes to be implemented as part of the change can be credited.
yearly CT risk.


For example, in seek ing an STI change, if the test strategy is also to be changed, the effect of this should also be incorporated in the risk evaluation.
When comparing the risk of shutting down with the risk of continuing power operation for a given LCO, the following measures apply:
a.


It should be noted that this regulatory guide, as well as Regulatory Guide 1.174, are applicable only to per manent (as opposed to temporary, or "one time") changes to TS requirements.
risk of continued power operation for a given downtime, like ICCDP, and b.


TS AOT changes are per manent changes, but because AOTs are entered infre quently and are temporary by their very nature, the fol lowing TS acceptance guidelines specific to AOT changes are provided for evaluating the risk associated
risk of shutting down the plant for the same downtime.
1.177-16 with the revised AOT, in addition to those acceptance guidelines given in Regulatory Guide 1.174.  1. The licensee has demonstrated that the TS AOT change has only a small quantitative impact on plant risk. An ICCDP 4 of less than 5.0E-7is con sidered small for a single TS AOT change.5 An ICLERP 6 of 5.OE-8 or less is also considered small. Also, the ICCDP contribution should be distributed in time such that any increase in the as sociated conditional risk is small and within the normal operating background (risk fluctuations)
of the plant (Tier 1).  2. The licensee has demonstrated that there are ap propriate restrictions on dominant risk-significant configurations associated with the change (Tier 2).  3. The licensee has implemented a risk-informed plant configuration control program. The licensee has implemented procedures to utilize, maintain, and control such a program (Tier 3).  In the context of the integrated decisionmaking, the acceptance guidelines should not be interpreted as being overly prescriptive.


They are intended to provide an indication, in numerical terms, of what is considered acceptable.
The following measures apply for SF evaluations:
a.


As such, the numerical values above are approximate values that provide an indication of the changes that are generally acceptable.
test-limited risk, and b.


Furthermore, the state of knowledge, or epistemic, uncertainties associ ated with PRA calculations preclude a definitive deci sion with respect to the acceptance of the proposed change based purely on the numerical results. The in tent in comparing the PRA results with the acceptance guidelines is to demonstrate with reasonable assurance that Principle
test-caused risk.
4 is being met. This decision must be based on a full understanding of the contributors to the PRA results and the impacts of the uncertainties, both those that are explicitly accounted for in the results and those that are not.  There may be situations in which a nonquantitative assessment of risk (either alone or accompanied by quantitative assessment)
is sufficient to justify TS changes. The licensee is expected to use judgment on 4 ICCDP -[(conditional CDF with the subject equipment out of ser vice) -(baseline CDFwith nominal expected equipment unavailabi lities)] x duration of single AOT under consideration). 
The ICCDP acceptance guideline of 5.OE-7 is based upon the hypo thetical situation in which the subject equipment at a representative plant is out for five hours, causing the CDF of the plant, with an as sumed baseline CDF of 1.OE4 per reactor year, to conditionally in crease to I.OE-3 per reactor year during the five-hour period. This basis assumes that the majority of repairs can be made infive hoursor less and that the NRC has accepted this level of risk for existingoper ating plants.  61CLERP [(conditional LERF with the subject equipment out of service) -(baseline LERF with nominal expected equipment unavailabilities)]
x (duration of single AOT under consideration).
the acceptability (to support regulatory decisionmak ing) of the risk argument being considered, including the appropriate blend of quantitative and qualitative assessments.


2.5 Comparison of Risk of Available Alternatives In some cases, in support of a TS change, available alternatives are compared tojustify the TS change. For changes in TS AOTs, such cases primarily involve comparing the risk of shutting down with the risk of continuing power operation, given that the plant is not meeting one or more TS LCOs. Such comparisons can be used to justify that the increase in at-power risk asso ciated with the TS change is offset by the averting of some transition or shutdown risk.  In the case of an STI change, the beneficial and ad verse impacts can be similarly compared.
Similar to the CT evaluations, the risk contributions for preventive maintenance (PM) include the following:
a.


The modi fied STI should be chosen so that the benefit of testing is at least equal to, or greater than, the adverse effects of testing. For example, if the calibration of relays in the reactor protection system causes plant transients, the risk from the test-caused transients is then estimated and compared with the test-limited risk of an extended STI.  In using such guidelines, the following consider ations apply: (1) The uncertainty associated with the two measures being compared can differ and should be consid ered in deciding on an acceptable change.  (2) When the risk measures associated with all alterna tives are unacceptably large, ways to reduce the risk should be explored instead of only extending the TS requirement.
single PM risk, and b.


That is, a large risk from one of the alternatives should not be the justification for TS relaxation without giving appropriate attention to risk-reduction options. If the risk from test caused transients is large, attention may then be given to exploring changes in test procedures to re duce such risk, rather than only extending the test interval.
yearly PM risk.


However, a combination of the two also may be appropriate.
The risk associated with simultaneous outages of multiple components, called configuration risk, is calculated as part of CT changes. The three-tiered approach discussed in Section C.2.3 of this regulatory guide (RG) includes calculations of risks for multiple components that may be taken down together. The following applicable measures are similar to the CT measures stated above:
a.


3. ELEMENT 3: DEFINEIMPLEMEN
conditional risk (e.g., increase in core damage frequency (CDF)) caused by the configuration, and
TATION AND MONITORING
PROGRAM 3.1 Three-Tiered Implementation Approach As described in Regulatory Position 2.3, the staff expects the licensee to use a three-tiered approach in implementing the proposed TS AOT changes. Ap plication of the three-tiered approach is in keeping with the fundamental principle that the proposed change is consistent with the defense-in-depth philosophy.


Ap plication of the three-tiered approach provides assur-1.177-17 ance that defense in depth will not be significantly im pacted by the proposed change.  3.2 Maintenance Rule Control To ensure that extension of a TS AOT or STI does not degrade operational safety over time, the licensee should ensure, as part of its Maintenance Rule program (10 CFR 50.65), that when equipment does not meet its performance criteria, the evaluation required under the Maintenance Rule includes prior related TS changes in its scope. If the licensee concludes that the perfor mance or condition of TS equipment affected by a TS change does not meet established performance criteria, appropriate corrective action should be taken, in accor dance with the Maintenance Rule. Such corrective ac tion could include consideration of another TS change to shorten the revised AOT or STI, or imposition of a more restrictive administrative limit, if the licensee de termines this is an important factor in reversing the neg ative trend.  4. ELEMENT 4: DOCUMENTATION
1 The improved Standard Technical Specifications (NUREGs 1430-1434; see References in this RG) use completion time and surveillance frequency in place of allowed outage time and surveillance test interval.
AND SUBMITfAL
The evaluations performed to justify the proposed TS changes should be documented and included in the license amendment request submittal.


Specifically, documentation to support risk-informed TS change re quests should include: "* A description of the TS changes being proposed and the reasons for seeking the changes, "* A description of the process used to arrive at the proposed changes, "* Traditional engineering evaluations performed,"* Changes made to the PRA for use in the TS change evaluation, "* Review of the applicability and quality of the PRA models for TS evaluations, "* Discussion of the risk measures used in evaluating the changes, "* Data developed and used in addition to the plant's PRA database, "* Summary of the riskmeasures calculated including intermediate results, "* Sensitivity and uncertainty analyses performed, "* Summary of the risk impacts of the proposed changes and any compensating actions proposed, "* A tabulation of the outage configurations that could threaten the integrity of the safety functions of the subject equipment and that are, or will be, prohibited by TS or plant procedures (Tier 2).  "* A description of the capability to perform a con temporaneous assessment of the overall impact on safety of proposed plant configurations, including an explanation of how these tools will be used to ensure that risk-significant plant configurations will not be entered and that appropriate actions will be taken when unforeseen events put the plant in a risk-significant configuration (Tier 3).  "* A marked up copy of the relevant TS and bases.  The level of detail provided in the TS Bases should include adequate information to provide the tech nical basis for the revised AOT or STI.  " All other documentation required to be submitted with a license amendment request.1.177-18 REFERENCES
Appendix A to RG 1.177, Rev. 2, Page A-2 b.
1. USNRC, "Use of Probabilistic Risk Assessment Methods in Nuclear Activities:
Final Policy State ment," Federal Register, Vol. 60, p. 42622, Au gust 16, 1995.1 2. "Quarterly Status Update for the Probabilistic Risk Assessment Implementation Plan, SECY-97-234, October 14, 1997.1 3. USNRC, "Standard Technical Specifications, Bab cock and Wilcox Plants," NUREG-1430 (latest re vision).2 4. USNRC, "Standard Technical Specifications, Westinghouse Plants," NUREG-1431 (latest revi sion).2 5. USNRC, "Standard Technical Specifications, Combustion Engineering Plants," NUREG-1432 (latest revision).
2 6. USNRC, "Standard Technical Specifications, General Electric Plants, BWR/4," NUREG-1433 (latest revision).
2 7. USNRC, "Standard Technical Specifications, General Electric Plants, BWR/6," NUREG-1434 (latest revision).
2 8. USNRC, Statement of Considerations, "Technical Specifications for Facility Licensees;
Safety Anal yses Reports," Federal Register, 33 FR 18612, December 17, 1968.  ICopies are available for inspection or copyingforafee from the NRC Public Document Room at 2120 L Street NW, Washington, DC; the PDR's mailing address is Mail Stop LL-6, Washington, DC 20555; telephone
(202)634-3273;
fax (202)634-3343.


2 Copies of NUREG-series documents are available at current rates from the U.S. Government Printing Office, P.O. Box 37082, Washing ton, DC20402-9328 (telephone
increase in risk (e.g., core damage probability, which is obtained by multiplying the increase in CDF by the duration of the configuration for the occurrence of a given configuration).
(202)512-2249);orfrom the Nation al Technical Information Service bywritingNTIS
If the licensee uses different measures, it should adequately discuss them in its submittal.
at 5285 PortRoyal Road, Springfield, VA 22161. Copies are available for inspection or copying for a fee from the NRC Public Document Room at 2120 L Street NW, Washington, DC; the PDR's mailing addressis Mail Stop LL-6, Washington, DC 20555; telephone
(202)634-3273;
fax (fl22634-3343.


9. USNRC, "Final Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors,"FederalRegister, 58 FR 39132, July 22, 1993.  10. USNRC, 10 CFR 50.36, "Technical Specifica tions," Federal Register, 60 FR 36953, July 19, 1995.  11. USNRC, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Regulatory Guide 1.174, July 1998.3 12. USNRC, "Risk-Informed Decisionmaking:
A-1.2 Measures for Multiple Technical Specification Changes When multiple technical specification (TS) changes are being evaluated, the combined impact of the individual changes should also be considered. The following sections discuss the considerations related to the calculation of total impacts.
Tech nical Specifications," NUREG-0800, SRP Chapter 16.1, August 1998.3 13. W.T. Pratt et al., "An Approach for Estimating the Frequencies of Various Containment Failure Modes and Bypass Events," Draft NUREG/ CR-6595, December 1997.3 14. P.K. Samanta and I.S.Kim, "Handbook of Methods for Risk-Based Analyses of Technical Specifica tions," NUREG/CR-6141, USNRC, December 1994.2 15. I.S. Kim et al., "Quantitative Evaluation of Sur veillance Test Intervals Including Test-Caused Risks," NUREG/CR-5775, USNRC, February 1992.2 16. USNRC, "Monitoring the Effectiveness of Mainte nance at Nuclear Power Plants," Regulatory Guide 1.160, Revision 2, March 1997.3 3Single copies of regulatory guides, both active and draft, and draft NUREG documents, may be obtained free of charge by writing the Reproduction and Distribution Services Section, OCIO, USNRC, Washington, DC 20555-0001, or by fax to (301)415-2289, or by email to GRWI@NRC.GOV
Active guides may also be purchased from the National Technical Information Service on astandingorderbasis.


Details on this service may be obtained by writing NTIS, 5285 Port RoyalRoad,Springfield,VA22161.
A-1.2.1 Measures That Can Be Combined for Multiple Technical Specification Changes When considering risk contributions from several CTs, the risk measures can be combined according to the following guidelines:
a.


Copiesofactive and draftguides are available for inspection or copying for a fee from the NRC Public Document Room at 2120 L Street NW, Washington, DC; the PDR's ma'lingaddressisMailStopLL-6,Wa~shington,DC20555;telephone
The ICCDPs from several CTs do not generally interact nor accumulate to give a total contribution because the single CT risks are conditional risks per event, and the downtime events for the different CTs are different events. The only time that ICCDPs should be considered simultaneously is when multiple components can be down at the same time, constituting the same event. Such a case is referred to as a downed configuration, or simply a configuration. The risk contribution associated with a configuration is referred to as the configuration risk and is evaluated separately as a multiple component downtime. Conducting maintenance on several components is a principal cause of potentially high configuration risks.
(202)634-3343;
fax (202)634-3343.


1.177-19 APPENDIX A CONSIDERATIONS
b.
AND DATA NEEDS FOR TECHNICAL
SPECIFICATION
CHANGE RISK EVALUATIONS
A.1 OTHER CONSIDERATIONS
IN TECHNICAL
SPECIFICATION
CHANGE RISK EVALUATIONS
A.1.1 Risk Measures for Technical Specification Changes to Allowed Outage Times and Surveillance Test Intervals In this section, a list of the risk-informed measures used in allowed outage time (AOT) and surveillance test interval (STI) evaluations is presented.


Amore de tailed discussion of these measures can be found in NUREG/CR-6141, "Handbook of Methods for Risk Based Analyses of Technical Specifications" (Ref. 1). The measures applicable for AOT evaluations are: a Conditional risk given the limiting condition of operation (LCO)"* Incremental conditional core damage probability (ICCDP) "o Yearly AOT risk When comparing the risk of shutting down with the risk of continuing power operation for a given LCO, the applicable measures are:
Yearly CT risk contributions from several CTs can interact and should be accumulated to give the total yearly contribution from all the CTs being considered. When the CTs do not interact (i.e., when the downed components are not in the same minimal cutset), the yearly CT risk contribution from several CTs is the sum of the individual yearly CT risk contributions. When the CTs do interact (i.e., when two or more of the downed components are in the same minimal cutset), interaction of the CT risk contributions should be considered.
* Risk of continued power operation for a given downtime, similar to ICCDP ° Risk of shutting down for the same downtime The measures applicable for STI evaluations are:
* Test-limited risk
* Test-caused risk Similar to the AOT evaluations, the risk contribu tions associated with preventive maintenance (PM) are: "* Single PM risk "* Yearly PM risk The risk associated with simultaneous outages of multiple components, called configuration risk, is cal culated as part of AOT changes. The three-tier ap proach discussed in Regulatory Position 2.3 of Regula tory Guide 1.177 includes calculations of risks associated with multiple components that may be taken down together.


The applicable measures are similar to the AOT measures stated above.  -Conditional risk (e.g., increase in core damage fre quency (CDF)) caused by the configuration
c.
* Increase in risk [e.g., core damage probability (CDP) (obtained by multiplying the increase in CDF by the duration of the configuration for the occurrence of a given configuration)]. 
If different measures are used, the licensee should provide adequate discussions of them in the submittal.


A.1.2 Measures for Multiple Technical Specification Changes When multiple technical specification (TS) changes are being considered, the combined impact of the changes should be considered in addition to the in dividual impacts. The considerations related to the cal culation of total impacts are discussed here.  A.1.2.1 Measures That Can Be Combined for Multiple TS Changes When considering risk contributions from several AOTs, the risk measures can be combined according to the following guidelines.
When calculating the test-limited risk for changes in multiple SFs, the total test-limited risk should be properly evaluated. Simple addition of individual test-limited risks will not provide the combined test-limited risk. In a simple addition, the total test-limited risk contribution is underestimated because the interacting terms are neglected.


The ICCDPs from several AOTs do not generally interact nor do they accumulate to give a total contribu tion because the single AOT risks are conditional risks per event, and the downtime events for the different AOTs are different events. The only time that ICCDPs should be considered simultaneously is when multiple components can be down at the same time, constituting the same event. Such a case is referred to as "downed configuration," or simply a "configuration." The risk contribution associated with a configuration is referred to as the configuration risk and is evaluated separately as a multiple component downtime.
A-1.2.2 Total Impact of Multiple Changes When multiple changes are requested, the total collective risk impact from all the changes should be evaluated. For example, for a group of CT and SF changes, this includes the total impact of all the requested CT changes, SF changes, and CT and SF changes.


Conducting main tenance on several components is a principal cause of potentially high configuration risks.  Yearly AOT risk contributions from several AOTs can interact and should be accumulated to give the total yearly contribution from all the AOTs being consid ered. When the AOTs do not interact, that is, when the downed components are not in the same minimal cut set, the yearly AOT risk contribution from several AOTs is the sum of the individual yearly AOT risk con tributions.
If multiple changes are made, the impact of each change is assessed individually; as a check, the plant probabilistic risk assessment (PRA) should be used to quantify the total impact.


When the AOTs do interact, that is, when two or more of the downed components are in the same minimal cutset, interaction of the AOT risk contribu tions should be considered.
Appendix A to RG 1.177, Rev. 2, Page A-3 A-1.3 Quantification of Risk Measures A-1.3.1 Alternative Ways of Calculating Technical Specification Change Risk Measures In calculating the measures discussed for evaluating TS changes, two specific risk levels should be quantified using PRA. Focusing on the CDF level, the risk levels are R1, the increased risk level (e.g., CDF) with the component assumed down or equivalent component unavailability set to true, and R0, the reduced CDF with the component assumed up; that is, the component unavailability is set to false.


When calculating the test-limited risk for changes in multiple STIs, the total test-limited risk should be 1.177-20
A-1.3.1.1 Using Probabilistic Risk Assessment To Obtain Completion Time, Preventive Maintenance, and Configuration Risk Contributions R1 can be calculated by setting the component-down event to a true state in the PRA. Similarly, R0 can be calculated by setting the component-down event to a false state in the PRA. The component-down event in the PRA is the event showing that the component is down for repair or maintenance. If the existing minimal cutsets include the component-down event, these minimal cutsets can be used to determine R1 and R0, provided the minimal cutsets sufficiently cover the contribution of the down event. The existing minimal cutsets are sufficient if those containing the down event are not all near the truncation limit (i.e., are not all within a factor of 10 of the truncation limit).
properly evaluated.
Alternatively, the minimal cutsets are sufficient if those containing the down event have a nonnegligible contribution (i.e., a contribution greater than or equal to 1 percent). If the existing minimal cutsets are sufficient, the increased risk level R1 can be determined by setting the component-down unavailability to 1 and deleting larger minimal cutsets that contain smaller minimal cutsets (i.e., those absorbed by the smaller minimal cutsets). If any minimal cutsets contain complementary events, they also should be removed if they are inconsistent with the component being down. The reduced risk level R0 can be determined analogously by setting the down unavailability to zero.


Simple addition of individual test limited risks will not provide the combined test-limited risk. In a simple addition, the total test-limited risk con tribution is underestimated because the interacting terms are neglected.
If the existing minimal cutsets do not contain the component-down event, or if there is a question on the coverage of the existing minimal cutsets, the minimal cutsets should be regenerated. R1 is determined by setting the component-down event in the PRA models to a true state. The truncation limit of the minimal cutset can be reduced by at least a factor of 10 to give added assurance of sufficient coverage. The minimal cutsets that are generated using the reduced truncation limit can then be used to determine R1 by setting the down unavailability to zero.


A.1.2.2 Total Impact of Multiple Changes When multiple changes are requested, the total col lective risk impact from all the changes should be eval uated. For example, for a group of AOT and STI changes, this includes the total impact of all the re quested:
Contributions from common-cause failures (CCFs) need special attention when calculating the increased risk level R1. If the component is down because of a failure, the common-cause contributions involving the component should be divided by the probability of the component being down because of failure since the component is given to be down. If the component is down because it is being brought down for maintenance (but not failed), the CCF contributions involving the component should be modified to remove the component and to only include failures of the remaining components (also see Section C.2.3.3 of this RG).  
* AOT changes
If other components are reconfigured while the component is down, these reconfigurations can be incorporated in estimating R1 or R using the PRA. If other components are tested before repair or if maintenance is carried out on the downed components, the conduct of these tests and their outcomes also can be modeled. If other components are more frequently tested when the component is down for the conditions addressed by the CT, this increased frequency of testing also can be incorporated into the PRA.
* STI changes
* AOT and STI changes If multiple changes are made, the impact of each change is assessed individually;
then as a check, the plant probabilistic risk analysis (PRA) should be used to quantify the total impact. A.1.3 Quantification of Risk Measures A.1.3.1 Alternative Ways of Calculating TS Change Risk Measures In calculating the measures discussed for evaluat ing TS changes, two specific risk levels are discussed, which should be quantified using a PRA. Focusing on the CDF level, they are R 1 , the increased risk level (e.g., CDF) with the component assumed down or equivalent component unavailability set to "true," and R 0 , the re duced CDF with the component assumed up; that is, the component unavailability is set to "false." A.1.3.1.1 Using PRA To Obtain AOT, PM, and Configuration Risk Contributions.


R 1 can be calcu lated by setting the component-down event to a true state in the PRA. Similarly, Ro can be calculated by set ting the component-down event to a false state in the PRA. The component-down event in the PRA is the event describing that the component is down for repair or maintenance.
These modeling details are sometimes neglected in the PRA because of their apparently small


If the component-down event is in cluded in the existing minimal cutsets, these minimal cutsets can be used to determine RI and Ro provided the minimal cutsets sufficiently cover the contribution of the down event. The existing minimal cutsets are suffi cient if those containing the down event are not all near the truncation limit (i.e., are not all within a factor of 10 of the truncation limit). Alternatively, the minimal cut sets are sufficient if those containing the down event have a non-negligible contribution (i.e., have a con tribution greater than or equal to 1%). If the existing minimal cutsets are sufficient, the increased risk level RI can be determined by setting the component-down unavailability to I and deleting larger minimal cutsets that contain smaller minimal cutsets (i.e., are absorbed by the smaller minimal cutsets).
Appendix A to RG 1.177, Rev. 2, Page A-4 contribution. However, when isolating the CT risk contributions and in justifying modified CTs, these details can become significant.
If there are any mini mal cutsets containing complementary events, they also should be removed if they are inconsistent with the component being down. The reduced risk level Ro can be determined analogously by setting the down un availability to zero.  If the component-down event is not contained in the existing minimal cutsets, or if there is a question on the coverage of the existing minimal cutsets, the mini mal cutsets should be regenerated.


R 1 is determined by setting the down-component event in the PRA models to a true state. The truncation limit of the minimal cut set can be reduced by at least a factor of 10 to give added assurance of sufficient coverage.
A-1.3.1.2 Appropriate Use of Probabilistic Risk Assessment Minimal Cutsets As indicated, a PRA computes the yearly CT risk contribution to the yearly CDF. Basically, the yearly CT risk contribution is the sum of the minimal cutset contributions containing the component-down unavailability (typically for maintenance) qm,


The minimal cutsets that are generated using the reduced truncation limit can then be used to determine R1 by setting the down unavailability at zero.  Contributions from common cause failures (CCFs) need special attention when calculating the increased risk level R 1.If the component is down because of a failure, the common-cause contributions involving the component should be divided by the probability of the component being down because of failure since the component is given to be down. If the component is down because it is being brought down for mainte nance, the CCF contributions involving the component should be modified to remove the component and to only include failures of the remaining components (also see Regulatory Position 2.3.1 of Regulatory Guide 1.177).  If other components are reconfigured while the component is down, these reconfigurations can be in corporated in estimating R 1 or AR, using the PRA. If other components are tested before repair or if mainte nance is carried out on the downed components, the conduct of these tests and their outcomes also can be modeled. If other components are more frequently tes ted when the component is down for the AOT, this in creased frequency of testing also can be incorporated.
d f
qm


These modeling details are sometimes neglected in the PRA because of their apparently small contribution.
=


However, when isolating the AOT risk contributions and in justifying modified AOTs, these details can be come significant.
where f is the downtime frequency and d is the downtime associated with the CT. The downtime d usually is estimated as an average downtime associated with the CT. If the minimal cutsets sufficiently cover the downed unavailability, those that contain the downed unavailability, qm, can be summed to give the yearly CT risk contribution, Ry.


A.-.3.1.2 Use of PRA Minimal Cutsets When It Is Appropriate.
A-1.3.1.3 Using the Probabilistic Risk Assessment To Determine the Test-Limited Risk Contribution The PRA can be used to calculate the increase in the risk-level R and to obtain the component unavailability, q, which are the contributing factors in calculating the test-limited risk contribution. The preceding and following sections discuss considerations involved in calculating R1 and R0 to obtain R.


As indicated, a PRA computes the yearly AOT risk contribution to the yearly CDF. Basi cally, the yearly AOT risk contribution is the sum of the minimal cutset contributions containing the compo-1.177-21 I I
When the effect of change in SF for one or more components is being evaluated, the PRA can directly calculate the change in the risk measure (e.g., in the CDF). The calculation of PRA results, when changed SFs are included, incorporates interactions among the SFs. The differences between the results (i.e., CDF when the SFs are changed from the baseline CDF) provide the test-limited risk contribution for changing the SFs.
nent-downed unavailability (typically, for mainte nance) qm, qm =f'd where f is the downtime frequency and d is the downtime associated with the AOT. The downtime d usually is estimated as an average downtime associated with the AOT. If the minimal cutsets sufficiently cover the downed unavailability, those that contain the downed unavailability qm can be summed to give the yearly AOT risk contribution Ry.  A.13.13 Using the PRA To Determine the Test Limited Risk Contribution.


The PRA can be used to calculate the increase in the risk-level AR and to obtain the component unavailability, q, which are the contrib uting factors in calculating the test-limited risk con tribution.
Such a calculation should include appropriately modified contributions of CCFs. The common-failure terms modeled as a function of the SF should be modified to reflect the new SF.


The considerations involved in calculating RI and Re to obtain AR are those discussed above and in the next section.
Typically, CCFs are modeled using a -factor or multiple Greek letter model when the CCF of multiple components is a function of the SF. When changing SFs, care should be taken to change this term within the common-cause contribution. The common cause of failing multiple components resulting from human error following a test is not a function of the SF, but it may be affected by the test strategy used.


When the effect of change in STI for one or more components is being evaluated, the PRA can be directly used to calculate the change in the risk measure (e.g., in the CDF). The calculation of PRA results, when changed STIs are included, incorporates interactions among the STIs. The differences between the results (i.e., CDF when the STIs are changed from the baseline CDF) provides the test-limited risk contribution for changing the STIs.  In such a calculation, the contributions of CCFs should be appropriately modified.
When different test strategies are being evaluated, the human error term should be considered.


The common failure terms modeled as a function of the test interval should be modified to reflect the new STI. Typically, CCFs are modeled using a il-factor or Multiple Greek Letter model when the CCF of multiple components is a func tion of the STI. When changing STIs, care should be ta ken to change this term within the common cause con tribution.
Specific assumptions that were used in quantifying the human error common-cause term should be identified and checked if they apply to the test strategy being analyzed. For example, if the term was developed assuming a sequential test strategy, but a staggered test strategy is being analyzed, the term should be modified to reflect this change. The failure probability from a common-cause human error for a staggered test strategy is expected to be significantly lower than that for the sequential test strategy.


The common cause of failing multiple components resulting from human error following a test is not a function of the STI, but may be affected by the test strategy used. When different test strategies are being evaluated, the human error term should be evaluated.
A-1.3.1.4 Using Minimal Cutsets To Calculate Test-Limited Risks The test-limited risk for a component or a set of components also can be determined by identifying those minimal cutsets that contain one or more of the SF contributions. The sum of the relevant minimal cutset contributions is then equal to the test-limited risk. To evaluate changes in the test-limited risks for changes in the SFs, the difference between the minimal cutset contributions with and without the SF changes will be the difference between the test-limited risks. In using the minimal cutsets, the SF contributions should all be included in the set of minimal cutsets used. Even though use of the


Specific as sumptions that were used in quantifying the human er ror common cause term should be identified and checked if they apply for the test strategy being ana lyzed. For example, if the term was developed assum ing a sequential test strategy, but a staggered test stra tegy is being analyzed, the term should be modified to reflect this change. The failure probability from a com mon cause human error for a staggered test strategy is expected to be significantly lower than that for the se quential test strategy.
Appendix A to RG 1.177, Rev. 2, Page A-5 minimal cutsets gives the same results, the above basic description of methods for obtaining the test-limited risks is useful because it shows the basic factors contributing to the SF risk.


A.1.3.1.4 Using Minimal Cutsets To Calculate Test-Limited Risks. The test-limited risk for a compo nent or a set of components also can be determined by identifying those minimal cutsets that contain one or more of the STI contributions.
A-1.3.1.5 Specific Considerations for Evaluating Multiple Test-Limited Risks When multiple SFs are modified or defined, the total test-limited risk from the multiple SF
changes or definitions should be properly evaluated. Instead of using the PRA to evaluate all the changes in a given run, the individual test-limited risks can be evaluated one at a time, provided that the updated SFs are used for the other relevant components. An iterative procedure can then be used, in which individual SFs are successively updated using the methods described above for individual component SF
risk contributors. These one-at-a-time, or iterative, evaluations are useful if acceptable guidelines on test-limited risks are defined and the SFs are selected to satisfy the risk guidelines.


The sum of the relevant minimal cutset contributions is then equal to the test limited risk. To evaluate changes in the test-limited risks for changes in the STIs, the difference between the minimal cutset contributions with and without the STI changes will be the difference between the test-limited risks. In using the minimal cutsets, one should ensure that the STI contributions are all included in the set of minimal cutsets used. Even though use of the minimal cutsets gives the same results, the above basic descrip tion of methods for obtaining the test-limited risks is useful, since it shows the basic contributing factors to the STI risk. A.1.3.1.5 Specific Considerations for Evaluat ing Multiple Test-Limited Risks. When multiple STIs are modified or are defined, the total test-limited risk from the multiple STI changes or definitions should be properly evaluated.
A-1.3.2 Appropriate Calculation of Conditional Core Damage Frequency A-1.3.2.1 Conditional Core Damage Frequency for Failure of a Component To calculate the conditional CDF when a component is failed (typically represented by R1 in this RG), the component unavailability is changed to the true, or T, state. However, the component unavailability may be modeled in terms of many contributors: random failure, maintenance downtime, test downtime, and CCF. The CCF term represents the failure probability of two or more redundant components that include the failed component in question. The CCF term is modeled as a product of multiple terms (e.g., using the -factor model for two redundant components; the CCF term is  times the component unavailability from random failures) but may be represented by one parameter.


Instead of using the PRA to evaluate all the changes in a given run, the individual test-limited risks can be evaluated one at a time, pro vided that the updated STIs are used for the other rele vant components.
Consider a component Q in train A of a safety system and let QLA, QMA, and QTA represent the components unavailability from random failures, maintenance downtimes, and test downtimes, respectively. Also, let QC = QL be the term for CCF of the redundant components in trains A and B,  
where QL is numerically equal to QLA and represents QLA or QLB. QLB is the unavailability of a component in train B from random failure. Usually, the terms QLA, QMA, QTA, and QC will be part of the PRA input data.


An iterative procedure can then be used in which individual STIs are successively up dated, using the methods described above for individ ual component STI risk contributors.
To calculate the conditional CDF, given that the component is failed, the component unavailability should be represented by the T state. This means that QLA, QMA, and QTA should be changed to the T state and QC should be divided by QLA since the component is down because of failure. In principle, changing one of the three conditions (QLA, QMA, QTA) to the T state should suffice. However, in many cases, truncated cutsets are used to calculate the conditional CDF, and changing all three will ensure that the failed state of the component is represented. For this example, QC
will be changed to , which represents the conditional failure probability of the redundant component.


These one-at-a time evaluations, or "iterative" evaluations, are useful if acceptable guidelines on test-limited risks are de fined and the STIs are to be selected to satisfy the risk guidelines.
When QC represents the failure of more than two components, QC will be converted to the failure probability of the remaining componentsin this case, two components.


A.1.3.2 Appropriate Calculation of Conditional CDF A.1.3.2.1 Conditional CDF for Failure of a Component.
A-1.3.2.2 Conditional Core Damage Frequency When a Component Is Down (But Not Failed) for Preventive Maintenance To calculate the conditional CDF when a component is taken down for PM (R1 for PM analyses),
the CCF term should be treated differently from that described above for the failure of the component.


To calculate the conditional CDF when a component is failed (typically represented by R 1 in this document), the component unavailability is changed to the "true" or "T" state. However, the component un availability may be modeled in terms of many contribu tors: random failure, maintenance downtime, test downtime, and CCF. The CCF term represents the fail ure probability of two or more redundant components that include the failed component in question.
Considering the same example as above, the down state of the component is represented by changing QLA, QMA, and QTA to T and by changing QC to QL, which is numerically the same as QLB or QLA. The CCF term is changed to represent the unavailability of the remaining component and


The CCF term is modeled as a product of multiple terms (e.g., using the P-factor model for two redundant com ponents, the CCF term is 0 times the component un-1.177-22 availability from random failures), but may be repre sented by one parameter.
Appendix A to RG 1.177, Rev. 2, Page A-6 not  because the initial component is already down for PM and not because of failure. If the redundant component is successfully tested before taking the component down for PM, QC can then be equated to zero for a short-duration PM (i.e., when the duration of the PM is much less than the test interval).
A-1.3.2.3 Conditional Core Damage Frequency When the Component Is Not Down for Maintenance or Is Tested Operable The conditional CDF is reduced when the component is not down for maintenance or when it has just successfully been tested. The determination of CT and SF risk contributions involves calculating this conditional CDF (R0). For evaluating the CT risk contribution, R0 signifies that the component is not down for test or maintenance, and setting test and maintenance downtime unavailabilities to the false, or F, state represents this condition. In this example, QMA and QTA should be changed to the F
state. For SF evaluations, R0 signifies that the component is up, which is known from the test and is represented by setting its unavailability to false. In this example, QLA, QMA, and QTA should be changed to the F state. In many cases, the reduction in CDF from the baseline CDF is negligible.


Consider a component Q in Train A of a safety sys/' tem, letting QLA, QMA, and QTA represent the com ponent's unavailability from random failures, mainte nance downtimes, and test downtimes, respectively.
A-1.3.2.4 Conditional Core Damage Frequency When Multiple Components Are Involved To calculate conditional CDFs (R1 and R0) when multiple components are involved, the corresponding terms relating to each of the components should be changed to the T or F state. For each component, the corresponding terms relating to random failures, CCFs, test downtimes, and maintenance downtimes should be converted, as discussed above. When all the components modeled by a common-cause term are failed, this term changes to the T state for calculating R1. Otherwise, it is modeled as discussed above, representing the unavailability of the remaining component


Also, let QC = PQL be the term for CCF of the redun dant components in Trains A and B, where QL is nu merically equal to QLA and represents QLA or QLB. QLB is the unavailability of a component in Train B from random failure. Usually, the terms QLA, QMA, QTA, and QC will be part of the PRA input data.  To calculate the conditional CDF given that the component is failed, the component unavailability should be represented by the "T" state. This means that QLA, QMA, and QTA should be changed to the "T" state and QC should be divided by QLA since the com ponent is down because of failure. In principle, chang ing one of the three conditions (QLA, QMA, QTA) to the "T" state should suffice. However, in many cases, truncated cutsets are used to calculate the conditional CDF, and changing all three will ensure that the failed state of the component is represented.
====s. In many PRA ====
computer codes, the CCF term does not retain the specific component designator (e.g., a unique notation identifying the specific component involved may not be part of the name of the CCF term), and the relevant term cannot be identified directly by searching the names of the input parameters of the PRA.


For this exam ple, QC will be changed to P3, which represents the con ditional failure probability of the redundant compo nent. When QC represents the failure of more than two components, QC will be converted to the failure proba bility of the remaining components, in this case, two components.
The description of the CCF terms modeled in the PRA may need to be examined to identify the relevant term or the input parameter.


A.13.2.2 Conditional CDF When a Compo nent Is Down (but Not Failed) for PM. To calculate the conditional CDF when a component is taken down for PM (R 1 for PM analyses), the CCF term should be treated differently from that described above for the failure of the component.
A-1.3.3 Treatment of Common-Cause Failure and Recovery Factors The treatment of CCF in estimating the conditional CDF for CT and SF evaluations was discussed above, as were the appropriate considerations in modifying CCF terms modeled in the PRA (to include the effect of a component being unavailable because of failure, maintenance, or testing, and for implementing a staggered test strategy). In addition, since the CCF contributions can be a dominant contributor, sensitivity analyses with respect to these parameters may be appropriate (see Section C.2.3.5 of this RG). Recovery factors used in the PRA model should perhaps be reviewed to learn whether the component assumed to be down because of failure is credited to be recovered. For example, consider that a TS change for an emergency diesel generator (EDG) is being evaluated, and conditional CDF for the EDG being down is being calculated. Then, if the cutsets used to calculate the conditional CDF take credit for the same EDG being recovered, such recovery factors should be modified. In such cases, no credit should be taken.


Considering the same example as above, the down state of the component is represented by changing QLA, QMA, and QTA to "T" and by changing QC to QL, which is numerically the same as QLB or QLA.  The CCF term is changed to represent the unavailabil ity of the remaining component and not 0, since the ini tial component is already down for PM and is not down due to failure. If the redundant component is success fully tested before taking the component down for PM, OC can then be equated to zero for a short-duration PM (i.e., when the duration of the PM is much less than the test interval). 
A-1.3.4 Calculations of Transition Risk Transition risk is calculated to compare the risk of continuing operation in a given LCO to that of a transition to plant shutdown. Such comparisons can be used to decide which option is preferable and which alternatives may be used. Such evaluations particularly apply to systems used to remove decay heat. The following considerations apply in calculating transition risk:
A.1.3.2.3 Conditional CDF When the Compo nent Is Not Down for Maintenance or Is Tested Op erable. The conditional CDFis reduced when the com ponent is not down for maintenance or when it has just successfully been tested. The calculation of AOT and STI risk contributions involve calculating this condi tional CDF (R 0). For evaluating the AOT risk contribu tion, Ro signifies that the component is not down for test or maintenance, and this condition is represented by setting test and maintenance downtime unavailabili ties to the "false" or "F' state. In this example, QMA and QTA should be changed to the "F' state. For STI evaluations, Rk signifies that the component is up, which is known from the test and is represented by set ting its unavailability to "false." In this example, QLA, QMA, and QTA should be changed to the "F" state. In many cases, the reduction in CDF from the baseline CDF is negligible.


A.1.3.2.4 Conditional CDF When Multiple Components Are Involved.
Appendix A to RG 1.177, Rev. 2, Page A-7 a.


To calculate conditional CDFs (Ri and Ro) when multiple components are in volved, the corresponding terms relating to each of the components should be changed to the "T" or "F' state.  For each component, the corresponding terms relating to random failures, CCFs, test downtimes, and mainte nance downtimes should be converted, as discussed above. When all the components modeled by a com mon cause term are failed, this term changes to the 'T' state for calculating R 1.Otherwise, it is modeled as dis cussed above, representing the unavailability of the re maining components.
Various stages of the shutdown cooling phases and the operators interactions should be modeled to assess the impact on the CDF of shutting down the plant in an LCO.


In many PRA computer codes, the CCF term does not retain the specific component designator (for example, a unique notation identifying the specific component involved may not be part of the name of the CCF term), and the relevant term cannot di rectly be identified by searching the names of the input parameters of the PRA. The description of the CCF terms modeled in the PRA may need to be examined to identify the relevant term or the input parameter.
b.


A.1.3.3 Treatment of CCF and Recovery Factors The treatment of CCF in estimating the conditional CDF for AOT and STI evaluations was discussed ear lier. Appropriate considerations in modifying CCF terms modeled in the PRA (to include the effect of a component being unavailable because of failure, main tenance, or testing and for implementing a staggered test strategy)  
Any initiating event not modeled in the basic PRA but important during the shutdown phases should be modeled. Specific examples are those events that challenge the residual heat removal (RHR) system and that can render part of it unavailable. Additionally, the frequency of initiating events during the transition to shutdown may have to be reassessed since it may differ from that during power operation (e.g., more frequent loss of offsite power or loss of main feedwater during the transition to shutdown).
have been discussed.
c.


In addition, since the CCF contributions can be a dominant contributor, sensitivity analyses with respect to these parameters may be appropriate (see Regulatory Position 2.3.5 of RG 1.177). Recovery factors used in the PRA model perhaps should be reviewed to learn whether the com ponent assumed to be down because of failure is cred ited to be recovered.
Different recovery paths applicable at various stages of shutdown should be modeled to realistically quantify the risk of shutting down, considering the diminishing levels of decay heat.


For example, consider that a TS change for an emergency diesel generator (EDG) is be ing evaluated, and conditional CDF for the EDG being 1.177-23 I I -I J I
d.
down is being calculated.


Then, if the cutsets used to calculate the conditional CDF take credit for the same EDG being recovered, such recovery factors should be modified.
Available time margins for uncovering the reactor core and heating up the suppression pool (in a boiling-water reactor) or drying out the steam generator (in a pressurized-water reactor) should be modeled to evaluate specific accident sequences.


In such cases, no credit should be taken.  A.1.3.4 Calculations of Transition Risk Transition risk is calculated to compare the risk of continuing operation in a given LCO to that of a transi tion to plant shutdown.
A-2.


Such companions can be used to decide which option is preferable and which other al ternatives may be used. Such evaluations particularly apply for systems used to remove decay heat. The fol lowing considerations apply in calculating transition risk.  (1) Various stages of the shutdown cooling phases and the operator's interactions should be modeled to as sess the impact on the CDF of shutting down the plant in a LCO. (2) Any initiating event not modeled in the basic PRA, but important during the shutdown phases, should be modeled. Specific examples are those events that challenge the residual heat removal (RHR) system and that can render part of it unavailable.
Data Needs for Technical Specification Change Evaluations A request for plant-specific TS changes should use plant-specific data and not rely solely on generic data or data from similar plant designs. Usually, TS changes are requested because plant operation indicates that such changes are needed and, accordingly, plant-specific data are expected to be available. For the components or systems for which TS changes are being considered, plant-specific data should be evaluated, and assurance should be obtained that these data are consistent with the plant experience. The licensee should justify the use of other than plant-specific data.


Also, the frequency of initiating events during the transition to shutdown may have to be reassessed, since it may differ from that during power opera tion (e.g., more frequent loss of offsite power or loss of main feedwater during the transition to shut down). (3) Different recovery paths applicable at various stages of shutdown should be modeled to realisti cally quantify the risk of shutting down, consider ing the diminishing levels of decay heat.  (4) Available time margins for uncovering the reactor core and heating up the suppression pool [in a boil ing water reactor (BWR)] or drying out the steam generator
When a generic analysis uses a representative plant model, the incorporation of generic data from similar plants is acceptable. The generic data should bound the specific plants under consideration, not an average plant.
[in a pressurized water reactor (PWR)] should be modeled to evaluate specific accident se quences.


A.2 DATA NEEDS FOR TS CHANGE EVALUATIONS
A-2.1 Care in Using Plant-Specific Data When using plant-specific data to update input parameters of the PRA during a TS change evaluation (in addition to those used during the latest update of the PRA), care should be taken to ensure that such data are consistently used both for the base case, where existing TS requirements apply, and the change case, where TS changes are incorporated. This provides assurance that the increase in the risk measure obtained is associated with the TS change only and not with the use of plant-specific data in aspects of plant operation.
A request for plant-specific TS changes should use plant-specific data and not rely solely on generic data or data from similar plant designs. Usually, TS changes are requested because plant operation indicates that such changes are needed and, accordingly, plant specific data are expected to be available.


For the com ponents or systems for which TS changes are being considered, plant-specific data should be evaluated and assurance should be obtained that the data used are con-sistent with the plant experience.
This situation typically arises when recent plant-specific data are evaluated and reduced values of the parameters are obtained. Use of the reduced values may negate the risk increase from the TS change and may give an erroneous impression that the TS change has reduced the risk. When the base case is also updated, such difficulties are avoided. Sensitivity and uncertainty analyses should also be performed using the same set of input data.


The use of other than plant-specific data should be justified.
A-2.2 Considerations When Generic Data Are Used When using generic data for the TS parameters in evaluating TS changes, the focus should be on justifying small changes that do not strongly depend on the data parameters. The licensee should present the reasons why generic data are being used and why generic data apply to plant-specific evaluations. In


When a generic analysis is being performed using a representative plant model, the use of generic data from similar plants is acceptable.
Appendix A to RG 1.177, Rev. 2, Page A-8 many cases, because of limited experience, the use of plant-specific data may result in very optimistic values, justifying the use of generic data.


The generic data should bound the specific plants under consideration, not an average plant.  A.2.1 Care in Using Plant-Specific Data When plant-specific data are used to update input parameters of the PRA during a TS change evaluation (additional to that used during the latest update of the PRA), care should be taken that such data are consis tently used both for the base case, where existing TS re quirements apply, and the change case, where TS changes are incorporated.
A-2.3 Specific Data Needs Basic data needed for a TS change evaluation (using PRA information) for risk-informed regulation are those collected as part of the PRA. Comparative risk calculations for LCO changes require no additional data beyond those in the Level 1 PRAs for full-power operations and low power/shutdown.


This is done to ensure that the increase in the risk measure obtained is due to the TS change only and not to the use of plant-specific data in aspects of plant operation.
The following sections discuss additional data needs for evaluating changes in TS requirements, such as SFs and CTs.


This situation typically arises when recent plant specific data are evaluated and reduced values of the pa rameters are obtained.
A-2.3.1 Maintenance Downtime Data Maintenance downtime data should be partitioned into plant-specific unplanned unavailability for unscheduled maintenance and planned unavailability for PM or testing. For this purpose, data are needed on the frequency of events leading to planned and unplanned maintenance (i.e., the number of occurrences of each type of downtime event during a given time period) and the time interval for each occasion the component was out of service. These data are also needed for judging whether an adequate CT is being provided to complete a repair. The distribution of downtimes also can be used to estimate the expected risk for a given CT.


Use of the reduced values may negate the risk increase from the TS change and may give an erroneous impression that the TS change has re duced the risk. When the base case is also updated, such difficulties are avoided. Sensitivity and uncer tainty analyses should also be performed using the same set of input data. A.2.2 Considerations When Generic Data Are Used When generic data are used for the TS parameters in evaluating TS changes, the focus should be on justi fying small changes that do not strongly depend on the data parameters.
The distribution of time for unscheduled maintenance may shift with a change in a CT. For this reason, information about such an influence on the distribution is not expected to be available when the CT change is being evaluated. The average downtime can be assumed to proportionally increase with the increase in the proposed CT for downtimes associated with unscheduled maintenance. For scheduled (preventive) maintenance, the downtime assumed can be representative of plant practices (e.g., one-half of the CT).  
A-2.3.2 Maintenance Schedules and Frequency Maintenance schedule and frequency data include the maintenance scheduling used by the licensee to define the situations in which multiple equipment or system trains may be taken down for PM.


The reasons why generic data are be ing used and why generic data apply for plant-specific evaluations should be presented.
These schedules are important to ensure that components being down simultaneously, implicitly allowed by the TS change, do not create high risks. The maintenance frequency or frequency of downtime for a component may be from 3 to 10 times higher than the failure frequency. Since CTs can be used for maintenance, the frequency of maintenance should be incorporated in estimating the downtime frequency.


In many cases, be cause of limited experience, the use of plant-specific data may result in very optimistic values justifying the use of generic data. A.2.3 Specific Data Needs Basic data needed for a PRA-informed TS change evaluation for risk-informed regulation are those col lected as part of the PRA. Comparative risk calcula tions for LCO changes require no additional data be yond those in the Full-Power Operations Level 1 and the Low Power/Shutdown Level 1 PRAs. The addi tional data needs for evaluating changes in TS require ments, such as STIs and AOTs, are discussed in this subsection.
A-2.3.3 Data Relating to Component Testing The following data related to component testing, in addition to those available as part of the PRA  
study, form part of a TS change evaluation relating to surveillance requirements:
a.


1.177-24'4'
The evaluation should list the components being tested, any component realigned from the safety position during a test, the duration of the test, and the test frequency recommended by the manufacturer.
A.2.3.1 Maintenance Downtime Data Maintenance downtime data should be partitioned into plant-specific unplanned unavailability for un scheduled maintenance and planned unavailability for preventive maintenance or testing. For this purpose, data are needed on the frequency of events leading to planned and unplanned maintenance, i.e., the number of occurrences of each type of downtime event during a given time period, and the time interval that the compo nent was out of service for each occurrence.


These data are also needed forjudgingwhether an adequate AOTis being provided to complete a repair. The distribution of downtimes also can be used to estimate the expected risk for a given AOT.  The distribution of time for unscheduled mainte nance may shift when an AOT is being changed. For this reason, information about such an influence on the distribution is not expected to be available when the AOT change is being evaluated.
b.


The average down time can be assumed to proportionally increase with the increase in the proposed AOT for downtimes associ ated with unscheduled maintenance.
The evaluation should include the efficiency of the test (i.e., the failure modes detected by the test with regard to aspects such as components and support system interfaces).
Bounding assumptions can be made if obtaining detailed data or related information is costly.


For scheduled (preventive)
Appendix A to RG 1.177, Rev. 2, Page A-9 c.
maintenance, the downtime assumed can be representative of plant practices (e.g., one-half of the AOT).  A.2.3.2 Maintenance Schedules and Frequency These data include the maintenance scheduling used by the plant for defining the situations in which multiple equipment or system trains may be taken down for PM. These schedules are important to ensure that high risks from components being down simulta neously, implicitly allowed by the TS change, do not occur. The maintenance frequency or frequency of downtime for a component may be from 3 to 10 times higher than the failure frequency.


Since AOTs can be used for maintenance, the frequency of maintenance should be incorporated in estimating the downtime fre quency. A.2.3.3 Data Relating to Component Testing The following data related to component testing, in addition to those available as part of the PRA study, form part of a TS change evaluation relating to surveil lance requirements.
The analyses should account for any potential negative effects of surveillance testing (e.g., that may cause the introduction of plant transients or unnecessary wear of the equipment). Preliminary evaluations can be used to determine the need for a more detailed analysis.


* A list of the components being tested, any compo nent realigned from the safety position during a test, duration of the test, and the test frequency rec ommended by the manufacturer
d.
* The efficiency of the test (i.e., the failure modes de tected by the test in regard to components, support system interfaces, and so forth). Bounding as-sumptions can be made if obtaining detailed data or related information is costly.  "Any potential for negative effects of surveillance testing (e.g., that may cause the potential for introducing plant transients, or that may cause un necessary wear of the equipment)
should be taken into account by the analyses.


Preliminary evalua tions can be used to determine whether a more de tailed analysis should be performed.  " The test strategy used for the redundant compo nents in a system (i.e., whether staggered or se quential testing is performed)  
The evaluation should state the test strategy used for the redundant components in a system (i.e., whether staggered or sequential testing is performed). The standard PRA  
should be stated. The standard PRA quantification assumes that components follow no specific schedule and are randomly placed with regard to one another. By staggering the test times of components in different trains, the test-limited risk contribution will be re duced for the same STIs as compared to the PRA assumption.
quantification assumes that components follow no specific schedule and are randomly placed. Staggering the test times of components in different trains will reduce the test-limited risk contribution for the same SFs as compared to the PRA assumption.


Conversely, if the tests are carried out sequentially, the test-limited risk will increase compared to the PRA assumptions.
Conversely, if the tests are carried out sequentially, the test-limited risk will increase compared to the PRA assumptions.


A.2.3.4 Parameters for Component Unavailability The component unavailabilities used in a PRA contain a number of parameters that are relevant for evaluating TS changes. These parameters should be delineated, as modeled, to facilitate evaluations to be conducted and reviewed by the regulatory authority.
A-2.3.4 Parameters for Component Unavailability The component unavailabilities used in a PRA contain several relevant parameters for evaluating TS changes. These parameters should be delineated, as modeled, to facilitate the evaluations and their review by the regulatory authority. The following desirable parameters contribute to the estimated component unavailability:
a.
 
component failure rate, b.
 
component test interval, c.
 
maintenance/repair downtime contribution (i.e., maintenance frequency, downtime for scheduled and unscheduled maintenance),
d.
 
test downtime, if applicable, e.
 
human errors following test or maintenance, if modeled, and f.
 
separation of cyclic-demand from the standby time contribution, if modeled.
 
A-2.3.5 Separating Demand and Standby Time Contributions to Unavailability Since the test-limited risk (typically defined as RD) is associated with a failure occurring between tests, the standby time-related failure rate should be used in calculating the test-limited risk. The standby time-related failure rate is associated with what could occur while the component is in standby between tests. Test-limited risk contributes to increases in risk associated with longer test intervals caused by the longer time to detect standby-stress failures. The time-related failure rate is expressed in units per time period, such as per hour. Estimating RD requires the standby stress failure rate of the component and the proposed SF.
 
The failure probability of a component consists of a time-related contribution (the standby time-related failure rate) and a cyclic, demand-related contribution (the demand stress failure probability).
The latter is the probability contribution associated with failures that are caused by demanding, starting, or cycling the component, which include (but are not necessarily limited to) test-caused transients (discussed in Section A-2.3.6). Since the test-limited risk, RD, is associated with a failure occurring between tests, the failure rate that should be used in calculating the test-limited risk is the time-related standby stress failure rate. From the total number of failures on demand, the number of failures caused by standby stress and the number of failures from demand stresses can be partitioned by either an
 
Appendix A to RG 1.177, Rev. 2, Page A-10
engineering analysis of failure causes or by a graphical method based on the relationship between the observed number of failures and the SFs from which the failures came.
 
The test-caused contribution to risk is primarily composed of Rdown, the risk contribution caused by the unavailability of equipment from aligning the equipment away from its preferred position or state to conduct a test, when there is no automatic return to the preferred position. The additional data needed for estimating this parameter are the SF and the out-of-service time needed for each test.
 
Dividing the failure probability into a time-related and cyclic demand-related contribution results in a lower test-limited risk because only part of the components failure rate is treated as time related.
 
However, treating only part of the failure rate as time related when this is not the case underestimates the test-limited risk; therefore, such a breakdown of the failure rate should be justified through data or engineering analyses.


The following desirable parameters contributed to the estimated component unavailability:
In addition, sometimes only the failure probability (i.e., the component unavailability, q) may be provided without giving a failure rate. In such a case, the effect of a change in the SF cannot be evaluated unless the component test interval previously used for T is used to convert the unavailability, q, in terms of and T. When the breakdown between time-related and cyclic demand-related contribution is unknown, all failures can be assumed to be time related to obtain the maximum test-limited risk contribution.
"* Component failure rate "* Component test interval "° Maintenance/repair downtime contribution (main tenance frequency, downtime for scheduled and unscheduled maintenance)
"* Test downtime, if applicable
"* Human errors following test or maintenance, if modeled " Separation of cyclic-demand vs. standby time con tribution, if modeled.


A.2.3.5 Separating Demand and Standby Time Contributions to Unavailability Since the test-limited risk (typically defined as RD) is associated with a failure occurring between tests, the failure rate that should be used in calculating the test limited risk should be the standby time-related failure rate, which is associated with what can occur while the component is in standby between tests. Test-limited risk contributes to increases in risk associated with lon-1.177-25 I II I
In summary, the data required for measuring a change in risk with a change in the SF are a breakdown of the failure probability of the component into its time-related and demand-related components, the proposed SF, and the out-of-service time for surveillance testing of the component.
ger test intervals caused by the longer time to detect standby-stress failures.


The time-related failure rate is expressed in units per time period, such as per hour. For estimating RD, the data needed are the standby stress failure rate of the component and the proposed test in terval.  The failure probability of a component consists of a time-related contribution (the standby time-related failure rate), and a cyclic, demand-related contribution (the demand stress failure probability).  
A-2.3.6 Test-Caused Transients To evaluate and identify the test-caused transient risk (typically defined as RC), transient events, as well as those caused by a test, should be identified. In most cases, this requires reading through the description of transients that have occurred and noting those caused by the test. When reduced SFs are allowed, the resulting reduction in test-caused transients per unit of time tends to cause decreases in risk because there are fewer adverse effects of testing over that longer test interval (which, however, will be partially or wholly balanced by increases in RD that are caused by the longer time period before the detection and correction of failures).  
The latter is the probability contribution associated with failures that are caused by demanding, starting, or cycling the com ponent, which include (but are not necessarily limited to) test-caused transients as discussed below in A.2.3.6.
The transient events are obtained from the following plant operating data:
a.


Since the test-limited risk, RD, is associated with a fail ure occurring between tests, the failure rate that should be used in calculating the test-limited risk is the time related standby stress failure rate. From the total num ber of failures on demand, the number of failures caused by standby stress and the number of failures from demand stresses can be partitioned by either an engineering analysis of failure causes or by a graphical method based on the relationship between the observed number of failures and the test interval lengths from which the failures came.  The test-caused contribution to risk is primarily composed of Rdown, the risk contribution that is due to the unavailability of equipment resulting from aligning equipment away from its preferred position/state to conduct a test, when there is no automatic return to the preferred position.
Performance indicator reports list the number of reactor trips and safety system actuations at each plant, the date of the events, and the numbers of the relevant licensee event reports (LERs).
b.


The additional data needed for esti mating this parameter are the surveillance test interval and the out-of-service time needed for each test.  Dividing the failure probability into a time-related and cyclic demand-related contribution results in a lower test-limited risk because only part of the compo nent's failure rate is treated as time-related.
LERs, in the LER system, describe reactor trips.


However, treating only part of the failure rate as being time related when this is not the case underestimates the test-limited risk; therefore, such a breakdown of the failure rate should be justified through data analysis or engineering analyses.
When test-caused transients for a single plant are evaluated, the plant-specific data may be sparse unless the plants operating experience covers a substantial period. When plant-specific data are sparse, more data may be used from the operating experience of other plants of similar vintage (e.g., other Type 4 boiling-water reactors), assuming the likelihood of occurrence of test-caused transients is similar for all the plants in the database. (The performance indicator reports categorize plants according to design classes.) Testing, however, tends to be very plant specific; therefore, cross-plant data applicability needs to be evaluated in detail.


Also, sometimes only the failure probability (i.e., the component unavailability q) may be provided with out giving a failure rate. In such a case, the effect of a change in the test interval cannot be evaluated unless the component test interval previously used for T is used to convert the unavailability q in terms of X and T.  When the breakdown between time-related and cyclic demand-related contribution is unknown, all failures can be assumed to be time-related to obtain the maxi mum test-limited risk contribution.
Appendix A to RG 1.177, Rev. 2, Page A-11 A-2.3.7 Data for Evaluating Transition Risk Data available in a PRA for full-power operation provide the basic information for evaluating the transition risks when a plant is being shut down for an LCO. In addition, the PRA for low-power and shutdown operations, if available, will significantly ease the acquisition of the data necessary for evaluating the risk of shutdown. The low-power and shutdown PRAs typically contain relevant data, such as the durations of shutdown phases and the frequencies of initiators that may occur during shutdown operation (e.g., loss of RHR).
The full-power PRA is available for most operating plants, but the low-power and shutdown PRAs are available only for some plants. Hence, the following data are needed to evaluate transition risk if only data from a full-power PRA are available:
a.


In summary, the data required for measuring a change in risk with a change in the surveillance test in terval are a breakdown of the failure probability of the component into its time-related and demand-related components, the proposed test interval, and the out-of service time for surveillance testing for the component.
Plant-specific data on shutdown operations: To analyze shutdown phases in detail, the analyst may need plant-specific information, such as operating and abnormal procedures, shift supervisor logbooks, or monthly operating reports. Data on timing of the plant shutdown and operational preferences of equipment during plant shutdown can be extracted from this information.


A.2.3.6 Test-Caused Transients To evaluate and identify the test-caused transients risk (typically defined as Rc), transient events should be analyzed and those caused by a test should be identi fied. In most cases, this requires reading through the description of transients that have occurred and noting those caused by the test. When longer test intervals are allowed, the resulting reduction in test-caused tran sients per unit time tends to cause decreases in risk be cause there are fewer adverse effects of testing over that longer test interval (which, however, will be partially or wholly balanced by increases in RD that are caused by the longer time period before detection and correction of failures). 
b.
The transient events are obtained from the follow ing plant operating data: (1) Performance indicator reports: These reports list the number of reactor trips and safety system actua tions at each plant, the date of the events, and the numbers of the relevant licensee event reports (LERs).  (2) LER system: Reactor trips are described in LERs.  When test-caused transients for a single plant are evaluated, the plant-specific data may be sparse unless the plant's operating experience covers a substantial pe riod. When this is the case, more data may be used from the operating experience of other plants of similar vin tage (for example, other BWR/4s) assuming that the likelihood of occurrence of test-caused transients is similar for all the plants in the data base. (The perfor mance indicator reports categorize plants according to design classes.)
Testing, however, tends to be very plant-specific, so that cross-plant data applicability must be evaluated in detail.  A.2.3.7 Data for Evaluating Transition Risk Data available in a PRA for full-power operation provide the basic information for evaluating the transi tion risks when a plant is being shut down for an LCO.  In addition, the PRA for low-power and shutdown op erations, if available, will significantly ease the ac quisition of the data necessary for evaluating the risk of shutdown.


The low-power and shutdown PRAs typi-1.177-26 cally contain relevant data, such as the durations of shutdown phases and the frequencies of initiators that may occur during shutdown operation (e.g., loss of RHR). The full-power PRA is available for most operat ing plants, but the low-power and shutdown PRAs are only available for some plants. Hence, the data needed to evaluate transition risk are discussed here, assuming that only data from a full-power PRA are available.
Plant-specific deterministic data: The evaluation of heatup and recovery scenarios, including estimates of heatup time, requires some design data on the plant, such as the temperature of the ultimate heat sink or the cooling capacity of the RHR system. These data typically are available from the plants final safety analysis report.


(1) Plant-specific data on shutdown operations:
c.
To analyze shutdown phases in detail, plant-specific information may be needed, such as operating and abnormal procedures, shift supervisor's log books, or monthly operating reports. From this informa tion, data on timing of the plant shutdown and op erational preferences of equipment during plant shutdown can be extracted.


(2) Plant-specific traditional data: The evaluation of heatup and recovery scenarios, including estimates of heatup time, requires some design data on the plant, such as the temperature of the ultimate heat sink or the cooling capacity of the RHR system.  These data typically are available from the plant's final safety analysis report (FSAR).(3) Frequency of transients during controlled shut down: The LERs for the plant may need to be re viewed in order to evaluate the likelihood of tran sients during controlled shutdown.
Frequency of transients during controlled shutdown: The analyst may need to review the LERs for the plant to evaluate the likelihood of transients during controlled shutdown.


The likelihood of a transient during a shutdown may be different from that during power operation (this should be considered). 
The analyst should consider that the likelihood of a transient during a shutdown may differ from that during power operation.
REFERENCE
1. P.IKSamanta and I.S.Kim, "Handbook of Methods for Risk-Based Analyses of Technical Specifica tions," NUREG/CR-6141, USNRC, December 1994.1 1 Copies of NUREG-series documents are available at current rates fromthe U.S. GovernmentPrintingOffice,PO.


Box37082,Washing ton, DC20402-9328 (telephone
Appendix A to RG 1.177, Rev. 2, Page A-12 REFERENCES2
(202)512-2249);
1.
orfrom the Nation al Technical Information Service bywriting NTIS at 5285 Port Royal Road, Springfield, VA 22161. Copies are available for inspection or copying for a fee from the NRC Public Document Room at 2120 L Street NW, Washington, DC; the PDR's mailing address is Mail Stop LL-6, Washington, DC 20555; telephone
(202)634-3273;
fax (202)634-3343.


Value/Impact Statement A draft value/impact statement was published with the draft of this guide, DG-1065, when it was published for public comment in June 1997. No significant changes were necessary from the original draft, so a separate value/impact statement for the final guide has not been prepared.
U.S. Nuclear Regulatory Commission, Handbook of Methods for Risk-Based Analyses of Technical Specifications, NUREG/CR-6141, BNL-NUREG-52398, December 1994, ADAMS
Accession No. ML093090361.


A copy of the draft value/impact statement is available for inspection or copying for a fee in the Commission's Public Document Room at 2120 L Street NW, Washington, DC. 1.177-27 I I ý i I
2  Publicly available NRC published documents are available electronically through the NRC Library on the NRCs public website at http://www.nrc.gov/reading-rm/doc-collections/ and through the NRCs Agencywide Documents Access and Management System (ADAMS) at http://nrc.gov/reading-rm/adams.html. The documents can also be viewed online or printed for a fee in the NRCs Public Document Room (PDR) at 11555 Rockville Pike, Rockville, MD. For problems with ADAMS, contact the PDR staff at (301) 415-4737 or (800) 397-4209; fax (301) 415-3548; or e-mail pdr.resource@nrc.gov.}}
UNITED STATES NUCLEAR REGULATORY
COMMISSION
WASHINGTON, DC 20555-0001 FIRST CLASS MAIL POSTAGE AND FEES PAID USNRC PERMIT NO. G-67 OFFICIAL BUSINESS PENALTY FOR PRIVATE USE, $300}}


{{RG-Nav}}
{{RG-Nav}}

Latest revision as of 08:59, 24 May 2025

(DG-1287) an Approach for Plant-Specific, Risk Informed Decisionmaking: Technical Specifications
ML20164A034
Person / Time
Issue date: 01/04/2021
From:
NRC/RES/DE
To:
SJG1
Shared Package
ML20164A029 List:
References
DG-1287 RG-1.177, Rev 2
Download: ML20164A034 (40)
v • d • e


U.S. NUCLEAR REGULATORY COMMISSION

REGULATORY GUIDE 1.177, REVISION 2

Issue Date: January 2021 Technical Lead: Todd Hilsmeier Pete Snyder

Written suggestions regarding this guide or development of new guides may be submitted through the NRCs public Web site in the NRC Library at https://nrcweb.nrc.gov/reading-rm/doc-collections/reg-guides/, under Document Collections, in Regulatory Guides, at https://nrcweb.nrc.gov/reading-rm/doc-collections/reg-guides/contactus.html.

Electronic copies of this RG, previous versions of RGs, and other recently issued guides are also available through the NRCs public Web site in the NRC Library at https://nrcweb.nrc.gov/reading-rm/doc-collections/reg-guides/, under Document Collections, in Regulatory Guides. This RG is also available through the NRCs Agencywide Documents Access and Management System (ADAMS) at http://www.nrc.gov/reading-rm/adams.html, under ADAMS Accession Number (No.) ML20164A034. The associated draft guide DG-1287 may be found in ADAMS under Accession No. ML19206A489, and the staff responses to the public comments on DG-1287 may be found under ADAMS Accession No. ML20191A231. The responses to public comments on the 2012 version of DG-1287 (ADAMS Accession No. ML12017A054) can be found in ADAMS under Accession No. ML12228A289. The regulatory analysis may be found in ADAMS under Accession No. ML19206A493.

PLANT-SPECIFIC, RISK-INFORMED DECISIONMAKING:

TECHNICAL SPECIFICATIONS

A. INTRODUCTION

Purpose This regulatory guide (RG) describes an approach that is acceptable to the staff of the U.S. Nuclear Regulatory Commission (NRC) for developing risk-informed applications for changes to completion times (CTs) and surveillance frequencies (SFs) of plant technical specifications (TS). This RG

provides specific guidance for considering engineering issues and using risk information to evaluate nuclear power plant TS changes to CTs and SFs.

This RG supplements the guidance in RG 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis (Ref. 1), and includes precise terminology to ensure that the defense-in-depth philosophy is interpreted and implemented consistently.

Applicability This RG applies to light-water reactor (LWR) licensees subject to Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic Licensing of Production and Utilization Facilities (Ref. 2), and

10 CFR Part 52, Licenses, Certifications, and Approvals for Nuclear Power Plants (Ref. 3).

Applicable Regulations

10 CFR Part 50 provides regulations for licensing production and utilization facilities.

o

10 CFR 50.36, Technical Specifications, requires applicants to submit proposed TS for their facilities. The TS include items in the categories of (1) safety limits, limiting safety system settings, and limiting control settings, (2) limiting conditions for operation (LCOs), (3) surveillance requirements, (4) design features, and (5) administrative

RG 1.177, Rev. 2, Page 2 controls (stating that each licensee shall submit any reports to the Commission under approved TS as specified in 10 CFR 50.4, Written Communications).

o

10 CFR 50.90, Application for Amendment of License, Construction Permit, or Early Site Permit, requires that applications for license amendments fully describe the changes desired.

10 CFR Part 52 governs the issuance of early site permits, standard design certifications, combined licenses, standard design approvals, and manufacturing licenses for nuclear power facilities.

Related Guidance

NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition (Ref. 4), provides guidance to the NRC staff for performing safety reviews of construction permit or operating license applications (including requests for amendments) under 10 CFR Part 50 and of early site permit, design certification, combined license, standard design approval, or manufacturing license applications under 10 CFR Part 52 (including requests for amendments).

o NUREG-0800, Section 16.1, Risk-Informed Decision Making: Technical Specifications, addresses risk-informed decisionmaking for TS. The guidance pertaining to TS changes to SFs and CTs in Section 16.1 is consistent with the guidance in this RG.

o NUREG-0800, Section 19.1, Determining the Technical Adequacy of Probabilistic Risk Assessment for Risk-Informed License Amendment Requests after Initial Fuel Load, addresses the acceptability of a baseline probabilistic risk assessment (PRA) that a licensee uses to support license amendments for an operating reactor, as well as license amendment requests submitted after initial fuel load for new reactors.

o NUREG-0800, Section 19.2, Review of Risk Information Used To Support Permanent Plant-Specific Changes to the Licensing Basis: General Guidance, addresses the review of risk information used to support permanent plant-specific changes to the licensing basis.

NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking: Final Report, (Ref. 5), provides guidance on how to treat uncertainties associated with PRAs in risk-informed decisionmaking. This guidance is intended to foster an understanding of the uncertainties associated with PRAs and their impact on PRA

results.

RG 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants (Ref. 6),

provides methods demonstrating compliance with the provisions of 10 CFR 50.65, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants.

RG 1.174 provides guidance on an acceptable approach for developing risk-informed applications for a licensing basis change that considers engineering issues and applies risk insights.

RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities (Ref. 7), provides an approach for determining whether the base PRA, in total or the parts used to support an application, is acceptable for use in

RG 1.177, Rev. 2, Page 3 regulatory decisionmaking for LWRs. Also note that the NRC will periodically update RG 1.200

as the agency adopts new PRA standards.

Purpose of Regulatory Guides The NRC issues RGs to describe methods that are acceptable to the staff for implementing specific parts of the agencys regulations, to explain techniques that the staff uses in evaluating specific issues or postulated events, and to describe information that the staff uses in its review of applications for permits and licenses. Regulatory guides are not NRC regulations and compliance with them is not required. Methods and solutions that differ from those set forth in RGs are acceptable if supported by a basis for the issuance or continuance of a permit or license by the Commission.

Paperwork Reduction Act This RG provides voluntary guidance for implementing the mandatory information collections in

10 CFR Parts 50 and 52 that are subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.).

These information collections were approved by the Office of Management and Budget (OMB), approval numbers 3150-0011 and 3150-0151. Send comments regarding this information collection to the Information Services Branch (T6-A10M), U.S. Nuclear Regulatory Commission, Washington, DC

20555-0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the OMB reviewer at: OMB Office of Information and Regulatory Affairs (3150-0011 or 3150-0151), Attn: Desk Officer for the Nuclear Regulatory Commission, 725 17th Street, NW, Washington, DC 20503; e-mail:

oira_submission@omb.eop.gov.

Public Protection Notification The NRC may not conduct or sponsor, and a person is not required to respond to, a collection of information unless the document requesting or requiring the collection displays a currently valid OMB

control number.

RG 1.177, Rev. 2, Page 4

B. DISCUSSION

Reason for Revision This revision of the guide (Revision 2) provides updated guidance on the defense-in-depth philosophy to be consistent with the related guidance in RG 1.174. The NRC revised RG 1.174 in 2018 to expand the guidance on the meaning of and the process for assessing defense-in-depth considerations.

Specifically, this revision of RG 1.177 references the defense-in-depth guidance in RG 1.174 in several places in the staff regulatory guidance.

Additionally, the staff revised this guide to (1) adopt the term PRA acceptability, and related phrasing variants, instead of terms such as PRA quality, PRA technical adequacy, and technical adequacy to describe the appropriateness of the PRA used to support risk-informed licensing submittals,

(2) update Section C.2.3 on the evaluation of risk impact (Principle 4), (3) specify that long-term CT

extension requests will increase the depth and level of detail of the staffs review and the need for proposed measures to reduce the risk impact of the TS change commensurate with the proposed CT

extension, and (4) add a new Section C.2.6 on integrated decisionmaking consistent with RG 1.174, Section C.2.6.

Background The Commission established its regulatory requirements for TS in 10 CFR 50.36. In doing this, the Commission emphasized matters related to the prevention of accidents and the mitigation of accident consequences. The Commission noted that applicants were expected to incorporate into their TS those items that are directly related to maintaining the integrity of the physical barriers designed to contain radioactivity (Ref. 8).

In August 1995, the NRC issued Use of Probabilistic Risk Assessment Methods in Nuclear Regulatory Activities: Final Policy Statement (Ref. 9), which encourages greater use of this analysis technique to improve safety decisionmaking and regulatory efficiency. One activity undertaken in response to the policy statement is the use of PRA to support decisions to modify an individual plants licensing basis. Such modifications are related to decisions to modify an individual plants TS.

To support the use of risk-informed decisionmaking, the NRC developed RG 1.174, which provides guidance on an acceptable approach for developing risk-informed applications for a licensing basis change and considers engineering issues and applies risk insights. This RG supplements the guidance in RG 1.174.

The staff normally uses deterministic engineering analysis to evaluate license amendment requests for TS changes that are consistent with approved staff positions (e.g., generic letters (GLs), RGs, standard review plans, branch technical positions, or the Standard Technical Specifications (STS)

(Refs. 10-14)). For TS change requests that go beyond current staff positions, in which a licensee elects to use risk information to support the proposed TS change, the staffs evaluation may use deterministic engineering analyses and the risk-informed approach set forth in this RG. The staff will review the information provided by the licensee to determine whether it can approve the application based on the information provided using deterministic and risk-informed methods, as applicable, and will either approve or reject the application based on the review.

The guidance in this RG does not preclude other approaches for requesting changes to the TS.

Rather, this RG is intended to improve consistency in regulatory decisions when the results of risk analyses are used to help justify TS changes.

RG 1.177, Rev. 2, Page 5 This RG describes an acceptable approach for assessing the nature and impact of proposed TS

changes in CTs and SFs by considering engineering issues and applying risk insights. As presented in detail in Section C of this RG, assessments should consider relevant safety margins and defense-in-depth attributes, including success criteria and equipment functionality, reliability, and availability.

In addition, this RG describes acceptable TS change implementation strategies and performance monitoring plans that will help ensure that assumptions and analyses supporting the change are verified. It also indicates an acceptable level of documentation to reach a finding that the licensee has performed a sufficiently complete and scrutable TS change analysis and that the results of the engineering evaluations support the licensees proposed TS change.

Risk-informed TS submittals may address either permanent changes to TS requirements or one-time-only changes. Once approved, permanent changes apply to all future occurrences. Licensees request a one-time-only change to a TS requirement for a particular condition and for a specified period, typically for a CT. This RG provides guidance for both permanent and one-time-only CT changes to TS.

In addition, the term operable as used in this document and the single-failure criterion should be understood within the context of this RG. All TS contain a definition of the terms operable and operability that is similar to this example from NUREG-1431, Standard Technical Specifications, Westinghouse Plants, Revision 4 (Ref. 11):

A system, subsystem, train, component, or device shall be OPERABLE or have OPERABILITY when it is capable of performing its specified safety function(s) and when all necessary attendant instrumentation, controls, normal or emergency electrical power, cooling and seal water, lubrication, and other auxiliary equipment that are required for the system, subsystem, train, component, or device to perform its specified safety function(s) are also capable of performing their related support function(s).

As described above, a plant-specific TS may differ from the STS definition of Operable Operability. Therefore, some judgment is needed in applying the guidance from Inspection Manual Chapter 0326, Operability Determinations, dated September 30, 2019 (Ref. 15).

The staff gave the historical basis for this definition in GL 80-30, Clarification of the Term Operable as It Applies to Single Failure Criterion for Safety Systems Required by TS, dated April 10, 1980 (Ref. 16). GL 80-30 states that the TS were formulated to preserve the single-failure criterion for systems that are relied upon in the safety analysis report. When the required redundancy is not maintained, the TS require action within a specified time. GL 80-30 calls the specified time to take action an equipment out-of-service time. This term is equivalent to the term completion time used in the STS. This limited time is a temporary relaxation of the single-failure criterion to take action so that the equipment can be restored to an operable status in accordance with the TS.

Since publishing GL 80-30, the NRC has issued various initial operating licenses, combined licenses, and amendments to licenses, each of which contains a definition of operable similar to the GL 80-30 definition. These definitions do not require a licensee to assume an additional failure when assessing the operability of a degraded or nonfunctional safety system or component.

Harmonization with International Standards The NRC has a goal of harmonizing its regulatory guidance with documents issued by the International Atomic Energy Agency (IAEA) to the extent practical. Although the NRC does not endorse

RG 1.177, Rev. 2, Page 6 the following IAEA safety standard(s) and/or guide(s), this RG generally incorporates similar guidelines and is generally consistent with the basic safety principles provided in them.

IAEA Safety Standards Series No. SSG-3, Development and Application of Level 1 Probabilistic Safety Assessment for Nuclear Power Plants, Specific Safety Guide, issued 2010

(Ref. 17)

IAEA Safety Standards Series No. SSG-4, Development and Application of Level 2 Probabilistic Safety Assessment for Nuclear Power Plants, Specific Safety Guide, issued 2010

(Ref. 18)

IAEA Safety Standards Series No. SSR-2/1, Revision 1, Safety of Nuclear Power Plants:

Design, issued 2016 (Ref. 19)

RG 1.177, Rev. 2, Page 7 C. STAFF REGULATORY GUIDANCE

This section provides detailed descriptions of the methods, approaches, or data that the staff considers acceptable for meeting the requirements of the applicable regulations cited in the Introduction of this guide.

RG 1.174 identifies five key principles that all risk-informed applications are expected to meet and that risk-informed changes to plant TS should explicitly address:

(1)

Principle 1: The proposed licensing basis change meets the current regulations unless it is explicitly related to a requested exemption (i.e., under 10 CFR 50.12, Specific Exemptions).

(2)

Principle 2: The proposed licensing basis change is consistent with the defense-in-depth philosophy.

(3)

Principle 3: The proposed licensing basis change maintains sufficient safety margins.

(4)

Principle 4: When proposed licensing basis changes result in an increase in risk, the increases should be small and consistent with the intent of the Commissions policy statement on safety goals for the operation of nuclear power plants.

(5)

Principle 5: The impact of the proposed licensing basis change should be monitored using performance measurement strategies.

RG 1.174 identifies a four-element approach to evaluating proposed licensing basis changes. This section addresses the applicability of these key principles and elements to TS changes.

1.

Element 1: Define the Proposed Change

1.1 Reason for Proposed Change The submittals should state the reasons for requesting the TS change or changes, along with information that demonstrates that the extent of the change is needed. Generally, acceptable reasons for requesting TS changes fall into one or more of the categories below. RG 1.174, Section C.1, provides additional guidance on defining the proposed change.

1.1.1 Improvement in Operational Safety A licensee may request the TS change to improve operational safety (i.e., a reduction in the plant risk or a reduction in occupational exposure of plant personnel in complying with the requirements).

1.1.2 Consistency of Risk Basis in Regulatory Requirements The TS change can be supported based on its risk implications. TS requirements can be changed to reflect improved design features in a plant or to reflect equipment reliability improvements that make a previous requirement unnecessarily stringent or ineffective. The TS may also be changed to establish consistently based requirements across the industry or across an industry group. The licensee must ensure that the risk resulting from the change remains acceptable.

RG 1.177, Rev. 2, Page 8

1.1.3 Reduce Unnecessary Burdens A licensee may request the TS change to reduce unnecessary burdens in complying with current TS requirements, based on the operating history of the plant or industry in general. For example, in specific instances, the repair time may need to be longer than the CT defined in the TS. The required surveillance may lead to plant transients, result in unnecessary equipment wear, cause excessive radiation exposure to plant personnel, or place unnecessary administrative burdens on plant personnel that are not justified by the safety significance of the surveillance requirement. In some cases, the change may provide operational flexibility; in those cases, the change might allow increased allocation of the plant personnels time to more safety-significant aspects.

In some cases, licensees may determine that there is a common need for a TS change among several licensees and that it is beneficial to request the changes as a group rather than individually. Group submittals can be advantageous when the equipment being considered in the change is similar across all plants in the group. The submittal still needs to provide plant-specific information about the engineering evaluations described in Section C.2. However, the group may be able to draw generic conclusions from a compilation of the plant-specific data. In addition, there will be benefits from cross comparison of the results of the plant-specific evaluations.

2.

Element 2: Perform Engineering Analysis As part of the second element, the licensee should evaluate the proposed TS change with regard to the key principles that ensure (1) current regulations are met, (2) adequate defense in depth is maintained, (3) sufficient safety margins are maintained, and (4) proposed increases in risk are small and are consistent with the intent of the Commissions policy statement on safety goals for the operation of nuclear power plants.

The staff expects licensees to provide strong technical bases for any TS change. The technical bases should be rooted in deterministic engineering and system analyses. Licensees should not submit for review TS change requests based on PRA results alone. TS change requests should give proper attention to the integration of considerations, such as conformance to the STS, generic applicability of the requested change if it is different from the STS, operational constraints, manufacturer recommendations, and practical considerations for test and maintenance. Standard practices used in setting CTs and SFs should be followed (e.g., CTs normally are 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, 7 days, 14 days, and so on, and SFs normally are once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, 7 days, 1 month, 3 months, and so on). Using such standards greatly simplifies implementation, scheduling, monitoring, and auditing. Logical consistency among the requirements should be maintained (e.g., CT requirements for multiple trains out of service should not be longer than that for one of the constituent trains).

2.1 Compliance with Current Regulations (Principle 1)

In evaluating proposed changes to TS, the licensee must ensure that the current regulations, orders, and license conditions are met, consistent with Principle 1 in RG 1.17

4. The regulations in

10 CFR 50.36 are specific to TS. The NRCs final policy statement on TS improvements (Ref. 20) gives more information on the agencys TS policies. These documents define the main elements of TS and provide criteria for items to be included in the TS.

The final policy statement and the Statements of Consideration for 10 CFR 50.36, as published in Volume 60 of the Federal Register, pages 36953-36959 (60 FR 36953-36959; July 19, 1995) (Ref. 21),

also discuss the use of probabilistic approaches to improve TS. Regulations on applications for, and the issuance of, license amendments appear in 10 CFR 50.90; 10 CFR 50.91, Notice for Public Comment;

RG 1.177, Rev. 2, Page 9 State Consultation, and 10 CFR 50.92, Issuance of Amendment. In addition, the licensee should ensure that the evaluation identifies and considers any discrepancies between the proposed TS change and licensee commitments.

2.2 Deterministic Engineering Considerations

2.2.1 Technical Specification Change Is Consistent with the Defense-in-Depth Philosophy (Principle 2)

Defense in depth is an element of the NRCs safety philosophy that employs multiple independent and redundant layers of defense to compensate for potential human and mechanical failures so that no single layer, no matter how robust, is exclusively relied upon. Defense in depth includes the use of access controls, physical barriers, redundant and diverse key safety functions, and emergency response measures to prevent accidents or mitigate damage if a malfunction, accident, or naturally caused event occurs at a nuclear facility. The defense-in-depth philosophy has traditionally been applied in plant design and operation to provide multiple means to accomplish safety functions and prevent the release of radioactive material. It has been and continues to be an effective way to account for uncertainties in equipment and human performance and, in particular, to account for the potential for unknown and unforeseen failure mechanisms or phenomena that, because they are unknown or unforeseen, are not reflected in either the PRA or deterministic engineering analyses. Staff Requirements Memorandum-SECY-98-144, Staff RequirementsSECY-98-144White Paper on Risk-Informed and Performance-Based Regulation, dated March 1, 1999 (Ref. 22), provides additional information on defense in depth as an element of the NRCs safety philosophy.

The engineering evaluation should demonstrate whether the implementation of the proposed TS

change is consistent with the defense-in-depth philosophy (Principle 2 in RG 1.174). The intent of this key principle of risk-informed decisionmaking is to ensure that the licensee fully understands, and the submittal addresses, any impact of the proposed licensing basis change on defense in depth and that the change maintains consistency with the defense-in-depth philosophy. The intent is not to prevent changes in the way defense in depth is achieved. The licensee should fully understand how the proposed licensing basis change impacts plant design and operation from both risk and deterministic engineering perspectives.

RG 1.174 provides guidance on how to evaluate the impact of a proposed licensing basis change on defense in depth to determine whether that consistency is achieved. The seven defense-in-depth considerations in Section C.2.1.1 of RG 1.174 should be used to evaluate the impact of a proposed TS

change on defense in depth to determine whether it maintains consistency with the defense-in-depth philosophy.

Additionally, the licensee should select engineering analysis techniqueswhether quantitative or qualitative, deterministic or probabilisticappropriate for the proposed TS change and that address the following:

a.

whether there are appropriate restrictions in place to prevent simultaneous equipment outages that would erode the principles of redundancy and diversity, b.

whether compensatory measures that should be taken when entering the modified CT for preplanned maintenance are identified,

RG 1.177, Rev. 2, Page 10

c.

whether voluntary removal of equipment from service during plant operation is scheduled when adverse weather conditions are predicted, or when the plant may be subjected to other abnormal conditions, d.

whether the impact of the TS change on the safety function should be considered (e.g., the impact of a change in the CT for the low-pressure safety injection system on the overall availability and reliability of the low-pressure injection function), and e.

whether the potential loss of the TS-specified safety function should be evaluated for TS

conditions with one or more trains, channels, systems, or subsystems inoperable.

2.2.2 Technical Specification Change Maintains Sufficient Safety Margin (Principle 3)

The licensees engineering evaluation should assess whether the impact of the proposed TS

change to a CT or SF is consistent with the principle that sufficient safety margins are maintained (Principle 3 in RG 1.174). The following summarizes an acceptable set of guidelines for making that assessment. Other equivalent decision guidelines are acceptable.

Sufficient safety margins are maintained under the following circumstances:

a.

Codes and standards (e.g., American Society of Mechanical Engineers, Institute of Electrical and Electronics Engineers) or alternatives approved for use by the NRC are met (e.g., the proposed TS change to a CT or SF does not conflict with approved codes and standards relevant to the subject system).

b.

Safety analysis acceptance criteria in the final safety analysis report are met, or proposed revisions provide sufficient margin to account for analysis and data uncertainties (e.g., the proposed TS change to a CT or SF does not adversely affect any assumptions or inputs to the safety analysis, or, if such inputs are affected, justification is provided to ensure sufficient safety margin will continue to exist). For TS CT changes, the effect on the final safety analysis report acceptance criteria should be assessed, assuming the plant is in the condition addressed by the proposed CT (i.e., the subject equipment is inoperable) and there are no additional failures. Such an assessment should result in identifying all situations in which entry into the condition addressed by the proposed CT could result in failure to meet an intended safety function.

2.3 Evaluation of Risk Impact (Principle 4)

Consistent with Principle 4 in RG 1.174, the NRC staff has identified the following three-tiered approach for licensees to evaluate the risk associated with proposed TS CT changes:

a.

Tier 1 evaluates the impact on plant risk of the proposed TS change as expressed by the change in core damage frequency (CDF), the incremental conditional core damage probability (ICCDP),1 the change in large early release frequency (LERF), and the incremental conditional large early release probability (ICLERP).2 To support this evaluation, two aspects are to be considered:

1 ICCDP = ((conditional CDF with the subject equipment out of service and nominal expected equipment unavailabilities for other equipment permitted to be out of service by the TS) (baseline CDF with nominal expected equipment unavailabilities)) x (total duration of a single CT under consideration).

2 ICLERP = ((conditional LERF with the subject equipment out of service and nominal expected equipment unavailabilities for other equipment permitted to be out of service by the TS) (baseline LERF with nominal expected equipment unavailabilities)) x (total duration of a single CT under consideration).

RG 1.177, Rev. 2, Page 11

(1) the acceptability of the PRA and (2) the PRA insights and results. The licensee should demonstrate that its PRA is acceptable for assessing the proposed TS change, identify the impact of the TS change on plant risk, and demonstrate that this impact on plant risk meets the TS

acceptance guidelines in Section C.2.4 of this RG.

b.

Tier 2 identifies potentially high-risk configurations that could exist if equipment, in addition to the item associated with the change, is taken out of service simultaneously or if other risk-significant operational factors, such as concurrent system or equipment testing, are also involved. The objective of this part of the evaluation is to ensure that appropriate restrictions on dominant risk-significant configurations associated with the change are in place. In addition, compensatory measures that can mitigate any corresponding increase in risk (e.g., backup equipment, increased SF, or upgraded procedures and training) should be identified and evaluated.

c.

Tier 3 establishes a risk-informed plant configuration control program (i.e., configuration risk management program (CRMP)) to ensure that other potentially lower probability, but nonetheless risk-significant, configurations resulting from maintenance and other operational activities are identified and compensated for. If the Tier 2 assessment demonstrates, with reasonable assurance, that there are no risk-significant configurations involving the subject equipment, the application of Tier 3 to the condition addressed by the proposed CT may not be necessary.

Application of the three-tiered approach to risk-informed TS CT changes will ensure that such changes to the licensing basis will not significantly affect defense in depth.

Sections C.2.3.1-2.3.7 and Appendix A to this RG discuss various issues related to the three-tiered approach. Specifically, Sections C.2.3.1-2.3.5 and Appendix A outline issues associated with Tier 1, and Sections C.2.3.6 and C.2.3.7 outline issues associated with Tier 2 and Tier 3, respectively.

The NRC staff has identified several factors, discussed below, that should be considered in proposals for SF changes. In summary, the licensee should identify the SFs to be evaluated, determine the risk contribution associated with the subject SFs, determine the risk impact from the change to the proposed SFs, and perform sensitivity and uncertainty evaluations to address uncertainties associated with the SF evaluations. Sections C.2.3.1-2.3.6 and Appendix A to this RG provide more detail on risk evaluation for SF changes.

2.3.1 Acceptability of the Probabilistic Risk Assessment The PRA used to support the TS change evaluation is measured in terms of its appropriateness with respect to scope, level of detail, conformance to the technical elements, and plant representation. These aspects of the PRA are to be commensurate with its intended use and the role the PRA results play in justifying the TS change. This applies to Tier 1 and to Tiers 2 and 3 to the extent that a PRA model is used. Section C.2.3 of RG 1.174 provides guidance on evaluating the acceptability of the PRA with respect to these PRA aspects and should be used to support TS change evaluations. In addition, Sections C.2.3.2 and C.2.3.3 of this RG provide guidance on assessing the acceptability of the PRA scope and PRA level of detail, respectively, for TS change evaluations.

2.3.2 Scope of the Probabilistic Risk Assessment for Technical Specification Change Evaluations The scope necessary to fully support the evaluation of a TS change depends on the type of TS

change being sought. The text below discusses the scope required for a variety of cases. However, in

RG 1.177, Rev. 2, Page 12 some cases, a PRA of sufficient scope may not be available. Qualitative arguments, bounding analyses, or compensatory measures will have to compensate for this lack.

At a minimum, evaluations of CDF and LERF should be performed to support any risk-informed changes to TS. The scope of the analysis should include all hazard groups (i.e., internal events, internal flood, internal fires, seismic events, high winds, transportation events, and other external hazards) unless the contribution from specific hazard groups does not affect the decision. When the risk associated with a particular hazard group or operating mode would affect the decision being made, the Commissions policy is to assess the risk using a staff-endorsed PRA standard for that hazard group or operating mode.

Sections C.2.3.1 and C.2.5 of RG 1.174 provide more detail.

When changes to the requirements for systems needed for decay heat removal are considered, an appropriate assessment of shutdown risk should also be considered. Examples of such systems are auxiliary feedwater, residual heat removal, emergency diesel generator, and service water. In addition, when CTs are being modified to facilitate online maintenance (i.e., transferring scheduled preventive maintenance from shutdown to power operation), the impact on the shutdown modes should also be considered. Using both power operation and shutdown models, when available, a comparative evaluation may be presented to decide the appropriate condition for scheduling maintenance based on risk evaluations. In some cases, a semiquantitative analysis of shutdown risk may be adequate (e.g., fault tree analysis or failure modes and effects analysis).

When CTs are being modified in anticipation of the need for additional time for corrective maintenance, an assessment of transition risk (the risk of transitioning from power operation to the mode required by the current TS in question) that could be incurred under the current, shorter CT may be desirable if the initial calculated risk increase is near or somewhat above the acceptance guidelines. In addition, TS changes to requirements for a controlled shutdown (i.e., the time allocated to transit through hot standby to hot shutdown to cold shutdown or to the final state that should be reached) should be evaluated using a model for the transition risk covering these periods or at least a qualitative evaluation of the transition risk, if possible.

2.3.3 Probabilistic Risk Assessment Modeling and Level of Detail

2.3.3.1 Detail Needed for Technical Specification Changes To evaluate a TS change, the PRA should model specific systems or components involved in the change. The model should also be able to treat the alignments of components during periods when testing and maintenance are being carried out. Typically, LCOs and surveillance requirements relate to the system trains or components that are modeled in the system fault trees of a PRA. System fault trees should be sufficiently detailed to specifically include all the components for which surveillance tests and maintenance are performed and are to be evaluated.

Additional details that should be incorporated in the PRA in support of TS changes include the following:

a.

For CT evaluations, system train-level models are adequate if all components belonging to the train are clearly identified (i.e., all those components that could cause the train to fail).

b.

For evaluating SFs, individual component-level models are necessary.

c.

Since PRAs typically model the plant at the individual component level, they may be used directly to analyze both CTs and SFs.

RG 1.177, Rev. 2, Page 13 d.

Component unavailability models should include contributions from random failure, common-cause failure (CCF), test downtime, and maintenance downtime.

e.

Changes to the component unavailability model for test and maintenance downtimes should be based on a realistic estimate of expected surveillance and maintenance practices after the TS

change is approved and implemented (e.g., how often the CT is expected to be entered for preplanned maintenance or surveillance).

f.

The component unavailability model for test and maintenance downtimes should be based on plant-specific or industrywide operating experience, or both, as appropriate.

g.

The component unavailability model should have the flexibility to separate the unavailability contribution from test and maintenance downtimes. For evaluating a CT, the contribution from maintenance downtime can be equated to zero to delete maintenance activities, if desired. For an SF evaluation, the contribution from the test downtime determines a contribution to risk from carrying out the test.

h.

Additional details in terms of separating the failure rate contributions into cyclic demand-related and standby time-related contributions can be incorporated, if justifiable, for evaluating surveillance requirements.

The CCF contributions should be modeled so that they can be modified to reflect the condition in which one or more of the components is unavailable. Note that CCF modeling of components is not simply dependent on the number of remaining inservice components; it is also dependent on the reason the components were removed from service (i.e., whether for preventive or corrective maintenance). For appropriate configuration risk management and control, preventive and corrective maintenance activities are considered, and licensees should, therefore, have the ability to address the subtle difference that exists between maintenance activities (Section A-1.3.2 of Appendix A to this guide provides details).

To account for the effects of test placements for redundant components in relation to each other (e.g., staggered or sequential test strategy), time-dependent models and additional evaluations with specialized codes may be used.

If the PRA does not model the system for which the TS change is being requested, specialized analyses may be necessary to demonstrate the sufficiency of the proposal. Examples of these situations include the following:

a.

When a system is modeled in the event tree, but a detailed fault tree model is not provided (a direct estimate of system unavailability from experience data or expert judgment is used), the TS

evaluation can proceed in several ways, such as the following:

(1)

A separate fault tree can be developed for the system for TS evaluation and used to complement the existing PRA model without directly modifying the PRA (e.g., detailed separate fault tree modeling of the reactor protection system combined with the existing PRA model).

(2)

A bounding evaluation can be conducted based on the impact of system failures that are modeled in the PRA event trees; that is, failure of any component in the system can be assumed to cause system failure.

RG 1.177, Rev. 2, Page 14 b.

When a separate fault tree is developed, specific TS requirements within the system can be changed, and changes in the system unavailability can be measured. These changes can then be used in the PRA model to obtain the corresponding risk measures, as appropriate. Such evaluations can be considered in the same way as those evaluations made directly using PRA

models, but they should satisfy the following conditions:

(1)

Failures within the system should not affect any other system or component failure.

(2)

The effect of system failure should not influence any initiating event frequency (or it should have a minimal or negligible effect).

(3)

The system should not share components with another system.

c.

When bounding evaluations are performed assuming any failure in the system as a system failure, the calculated risk impacts for TS changes are expected to be overestimated. The corresponding changes that may be acceptable will also be fewer than those that could have been justified using a detailed model. When considering the incorporation of non-PRA factors, this perspective should be kept, while at the same time considering the lack of a detailed model. Here also, the three conditions discussed for the previous case apply.

In some cases, since the risk-informed evaluation will be limited and some misestimation of the risk may have been incorporated, nonrisk-related engineering considerations gain importance in the overall decision. In such cases, arguments for the TS change also should be for small increments from current TS requirements (e.g., small changes to CTs or SFs).

2.3.3.2 Modeling of Initiating Events The PRA explicitly models (i.e., uses detailed fault tree models) some initiating events resulting from support system failure (e.g., service water, component cooling water, instrument air). Any TS

change for these systems will affect the corresponding initiating event frequency as well as the system unavailability and availability of other supported systems. The effect of TS changes on these initiating event frequencies should be considered.

Some test and maintenance activities can contribute to some transients. Initiating event frequencies used in the PRA do not typically separate out this contribution, but such a separation may be needed during TS change evaluations. For example, the effect of test-caused transients may be evaluated in determining an SF. Initiating event frequencies from conducting the test (i.e., test-caused transients)

could then be modeled separately to evaluate the risk contribution from test-caused transients.

Section A-2 of the appendix to this RG discusses data needs for estimating initiating event frequencies from test-caused transients.

2.3.3.3 Screening Criteria The main qualitative consideration for the screening of sequences in TS change evaluations is the inclusion of sequences directly affected by the TS change that would have been truncated by frequency-based screening alone. For example, if the TS change involves accumulators in a pressurized-water reactor, qualitative considerations imply the inclusion of sequences that contain the accumulators, even if these sequences do not meet the frequency criteria. Excluding these sequences would result in an underestimation of the risk impact of the proposed TS changes and, therefore, could have a significant influence on the ultimate acceptability of these changes.

RG 1.177, Rev. 2, Page 15

2.3.3.4 Truncation Limits Truncation levels should be used appropriately to ensure that significant underestimation caused by the truncation of cutsets does not occur, as discussed below. Additional precautions relevant to the cutset manipulation method of analysis are needed to avoid truncation errors in calculating risk measures.

When failure or outage of a single component is considered, as in the case of a CT or SF risk evaluation, the truncation levels in evaluating R1 and R0 are of concern. R1 is the increased CDF, with the component assumed to be inoperable (or equivalently, the component unavailability set to true), and R0

is the reduced CDF, with the component assumed to be operable (or equivalently, the component unavailability set to false). If the component in question appears in the cutsets near the truncation limit (e.g., all appearances are in cutsets within a factor of 10 of the truncation limit), it may be necessary to reduce the truncation limit. If R1 is marginally larger than the base case value, then one order of additional cutsets should be generated to ensure that any underestimation did not take place.

When considering risk from plant configurations involving multiple components, a cutset with a relatively small frequency can become a significant contributor to the CDF. This is because more than one of the affected components may appear in the same minimal cutset, and the unavailability (increased by the TS change) of more than one of these components could cause a significant increase in the cutsets frequency. For such cases, truncation levels should be reduced by a larger amount than would be the case for single components. Particular care should be taken if the evaluation of R1 is based on requantification of presolved cutsets, as the events related to the component of concern may not even appear in the cutsets.

2.3.4 Assumptions in Completion Time and Surveillance Frequency Evaluations When using PRA to evaluate TS changes, the evaluation should consider the assumptions made within the PRA that could have a significant influence on the ultimate acceptability of the proposed changes. The submittal requesting the TS changes should discuss such assumption

s. Assumptions that CT

change evaluations should consider include the following:

a.

If CT risk evaluations are performed using only the PRA for power operation (i.e., to calculate the risk associated with (1) the equipment being unavailable during power operation for the duration of the CT and (2) any change in the CT), the risk associated with shutting the plant down because the CT is exceeded is not considered. In most cases, this risk has not been considered or, if considered, is assumed to further justify the requested change. If the risk evaluation results are marginal or exceed the guidelines for a proposed CT increase, and the systems involve those needed for shutdown (e.g., residual heat removal systems, service water systems, auxiliary feedwater systems), the licensee may want to perform comparative risk evaluations of continued power operation versus plant shutdown to justify the proposed CT increase. (Section C.2.5 of this RG provides additional discussion on comparative risk evaluations.)

b.

When calculating the risk impacts (i.e., a change in CDF or LERF caused by CT changes), the change in average CDF should be estimated using the mean outage times (or an appropriate surrogate) for the current and proposed CTs. If a licensee chooses to use the zero-maintenance state as the base case (i.e., the case in which no equipment is unavailable because of maintenance), the submittal should include an explanation stating so. Usually, data for outage times correspond to the current CT, not to the proposed CT. Different assumptions are made to estimate the outage time corresponding to the proposed CT. The submittal should discuss assumptions concerning changes in maintenance practices under the extended CT regime and characterize their impact on the results of the analysis.

RG 1.177, Rev. 2, Page 16 c.

When the risk impact of a CT change is evaluated, the yearly risk impact that is calculated takes into account the outage frequency. A CT extension may imply that the maintenance of the component is improved, which may reduce the components failure rate and, consequently, reduce the frequency of outages needed for correcting degradations or failure. There are no experience data for the extended CT; therefore, allowance for a lower failure rate should not be made. Here, the beneficial aspect of maintenance is not quantified, and this may give a slightly higher estimate of the yearly CT risk measure for the proposed CT.

d.

Often, CT extensions are requested to facilitate online (or at-power) preventive maintenance of safety-system components. The frequency and duration of the extension may be estimated and the risk impact from the resulting unavailability of such equipment can be calculated.

e.

When CTs of multiple safety system trains are extended, the likelihood of simultaneous outages of multiple components increases (resulting from combinations of failures, testing, and maintenance) because the increased duration increases the probability of the individual events that constitute the simultaneous multiple outages; hence, overlapping of routinely scheduled activities and random failures becomes more likely. The impact of such occurrences on the average plant risk (e.g., CDF) is small, but the conditional risk can be large. This issue is addressed as part of the implementation considerations (see Section C.2.3.7).

SF evaluations should consider the following assumptions:

a.

Surveillance tests usually are assumed to detect failures that have occurred in the standby period.

The component failure rate, , represents these failures in the formulation of component unavailability. The test-limited risk is normally estimated by assuming that a surveillance test of a component detects the failures and that after the test, the components unavailability resets to zero, or false in the Boolean expression. Depending on a components design and the test performed, a routine surveillance test may not detect a few component failures. Usually, their contribution to risk is considered negligible.

b.

Regular surveillance testing of a component, as performed for safety system components, is considered to influence its performance. Generally, for most components, the increase of a surveillance interval beyond a certain value may reduce the components performance (i.e., increase the failure rate). Experience data are not available to assess the SF values beyond which the component failure rate, , increases. In a risk-informed evaluation of surveillance requirements, if the failure rate is assumed to remain the same (i.e., unaffected by a change in the SF), this assumption implies that the SFs are not being changed beyond the value at which may be affected. Care should be taken not to reduce the SFs beyond such values using risk-informed analyses only.

c.

The timing of surveillance tests for redundant components relative to each other (i.e., the test strategy used) impacts the risk measures calculated. Staggered or sequential test strategies are commonly used. The risk impacts of adopting different test strategies (e.g., sequential versus staggered) should be evaluated to determine whether there is an impact on the evaluation of the change being considered (Ref. 23).

d.

Notwithstanding the beneficial aspects of testing to detect failures that occur in a standby period, several adverse effects may be associated with the test that should be considered in the SF

evaluation, including downtime to conduct the test, errors of restoration after the test, test-caused transients, and test-caused wear of the equipment. A PRA usually models downtime and errors of restoration, unless they are negligible. Test-caused transients and wear of the equipment are

RG 1.177, Rev. 2, Page 17 applicable to a few tests but are not generally modeled separately in a PRA. However, they can be evaluated using PRA models supplemented with additional data and analysis. Methods are available to quantitatively address these aspects (Ref. 24); however, qualitative arguments can also support the reduction of an SF. If the adverse impact of testing is considered significant, such cases should be addressed quantitatively.

2.3.5 Sensitivity and Uncertainty Analyses Relating to Assumptions in Technical Specification Change Evaluations As in any risk-informed study, numerous uncertainties about the assumptions made during the PRA models development and application can affect risk-informed analyses of TS changes.

Sensitivity analyses may be necessary to address the important assumptions in the submittal with respect to TS change analyses. Such sensitivity analyses may include, as appropriate, the following:

a.

the impact of a variation in repair or maintenance policy because of CT changes (e.g., scheduling preventive maintenance of longer duration at power),

b.

the impact of variation in assumed mean downtimes or frequencies, c.

the effect of separating the cyclic demand versus the standby time-related contribution to the components unavailability in deciding changes to an SF,

d.

the effect of details about how CCFs are modeled in the PRA, and e.

the effect of modeling compensatory measures in the PRA.

Risk resulting from TS CT changes may be relatively insensitive to uncertainties (compared to the effect on risk from uncertainties in assumptions about plant design changes or significant changes to plant operating procedures, for example). This is because the uncertainties associated with CT changes tend to similarly affect the base case (i.e., before the change) and the changed case (i.e., with the change in place). That is, the risks result from similar causes in both cases (i.e., no new initiating transients or subsequent failure modes are likely to have been introduced by relatively minor CT changes). CT changes subject the plant to a variation in its exposure to the same type of risk, and the PRA model can predict, with relative surety based on data from operating experience, how much that risk will change based on that changed exposure. Similar results are expected for SF changes. The licensee should justify any deviations from these expectations.

The effects of multiple outages may become significant during relatively large increases in CTs or SFs. In those cases, however, the Tier 2 and Tier 3 aspects of TS changes (i.e., configuration monitoring, risk predictions, and configuration control based on the risk predictions) are expected to be robust and will be relied on to control the resulting potential for significant risk increases. Therefore, the Tier 2 and Tier 3 aspects of such TS changes should be justified as robust and adequate to control the resulting potential for significant risk increases.

NUREG-1855 provides additional guidance on the treatment of uncertainties.

RG 1.177, Rev. 2, Page 18

2.3.6 Restrictions on Dominant Risk-Significant Configurations and Compensatory Measures (Tier 2)

Consistent with the key principle that changes to TS should result in only small increases in the risk to public health and safety (Principle 4 in RG 1.174), and as part of proposed TS change evaluations, licensees may consider certain compensatory measures (discussed below) that balance the calculated risk increase caused by the changes. This consideration should be made in light of the acceptance guidelines given in RG 1.174. Note that these considerations may be part of Tier 2 or Tier 3 programs.

The licensee should demonstrate that there are appropriate restrictions on dominant risk-significant configurations associated with the TS change. An effective way to perform such an assessment is to evaluate equipment according to its contribution to plant risk (or safety) while the equipment covered by the proposed CT change is out of service. Evaluation of such combinations of equipment out of service against the Tier 1 ICCDP and ICLERP acceptance guidelines could be one appropriate method of identifying risk-significant configurations. Once plant equipment is so evaluated, an assessment can be made about whether certain enhancements to the TS or procedures are needed to avoid risk-significant plant configurations.

To reduce the risk increase resulting from a proposed change, even though the licensee judges that the individual change meets the acceptance guidelines in Section C.2.4, the licensee might take compensatory measures such as those suggested below. If compensatory measures are considered part of the analysis of the change, the overall application for the TS change should include them. However, overreliance on programmatic activities such as compensatory measures associated with the change in the licensing basis should be avoided. Compensatory measures included in the submittal for a TS change should be measures for which the licensee is not already taking credit. Any such compensatory measures would become part of the licensing basis if the TS change were approved. The following are examples of compensatory measures:

a.

adding a test of a redundant train before initiating a scheduled maintenance activity as part of a CT extension application, b.

limiting simultaneous testing (e.g., surveillance tests) and maintenance of redundant or diverse systems as part of a CT extension application, especially if the testing causes unavailability of the redundant train or component, c.

incorporating a staggered test strategy as part of the SF reduction application, d.

improving test and maintenance procedures to reduce test- and maintenance-related errors, e.

improving operating procedures and operator training to reduce the impact of human errors, and f.

improving system designs, which reduces overall system unavailability and plant risk.

When compensatory measures are part of the TS change evaluation, the risk impact of these measures should be considered and presented, either quantitatively or qualitatively. When a quantitative evaluation is used, the total impact of these measures should be evaluated by comparison to the small guideline (Principle 4 in RG 1.174). This includes (1) evaluation of the proposed TS changes without the compensatory measures, (2) evaluation of the proposed TS changes with the compensatory measures, and

(3) specific discussion of how each compensatory measure is credited in the PRA model or during the evaluation process.

RG 1.177, Rev. 2, Page 19

2.3.7 Risk-Informed Plant Configuration Control Program (Tier 3)

Consistent with the key principle that changes to TS result in small increases in the risk to public health and safety (Principle 4 in RG 1.174), certain configuration controls should be use

d. To support TS

changes, a risk-informed plant configuration control program would uncover risk-significant plant equipment outage configurations in a timely manner during normal plant operation. This can be accomplished by evaluating the impact on plant risk of, for example, equipment unavailability, operational activities like surveillance testing or load dispatching, or weather conditions. The importance of this third tier stems from the difficulty of identifying all possible risk-significant configurations under Tier 2 that will ever be encountered over extended periods of plant operation.

2.3.7.1 Configuration Risk Management Program Licensees should describe their capability to perform a contemporaneous assessment of the overall impact on the safety of proposed plant configurations before and during maintenance activities that remove equipment from service. Licensees should explain how these tools or other processes will be used to ensure that risk-significant plant configurations will not be entered and that appropriate actions will be taken when unforeseen events put the plant in a risk-significant configuration.

2.3.7.2 Components of the Configuration Risk Management Program The licensee should ensure the CRMP contains the following components.

Component 1: Implementation of the Configuration Risk Management Program The intent of the CRMP is to implement 10 CFR 50.65(a)(4) (part of the Maintenance Rule) for online maintenance for risk-informed TS, with the following additions and clarifications:

a.

The scope of structures, systems, and components (SSCs) within the CRMP includes all SSCs modeled in the licensees plant PRA, in addition to all SSCs considered to have high safety significance in accordance with RG 1.160 that are not modeled in the PRA.

b.

The CRMP assessment tool is informed by the PRA and may be in the form of a risk matrix, an online assessment, or a direct PRA assessment.

c.

The CRMP should be invoked as follows:

(1)

For preplanned entrance into the plant configuration described by a TS action with a risk-informed CT, a risk assessment, including, at a minimum, a search for risk-significant configurations, should be performed before entering the action.

(2)

For unplanned entrance into the plant configuration described by a TS action with a risk-informed CT, a similar assessment should be performed in a timeframe defined by the plants corrective action program (10 CFR Part 50, Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, Criterion XVI,

Corrective Action).

(3)

In the plant configuration described by a TS action with a risk-informed CT, when additional SSCs become inoperable or nonfunctional, a risk assessment, including, at a minimum, a search for risk-significant configurations, should be performed in a

RG 1.177, Rev. 2, Page 20

timeframe defined by the plants corrective action program (10 CFR Part 50,

Appendix B, Criterion XVI).

d.

Tier 2 commitments apply only to planned maintenance but should be evaluated as part of the Tier 3 assessment for unplanned occurrences.

Component 2: Control and Use of the Configuration Risk Management Program Assessment Tool a.

Plant modifications and procedure changes should be monitored, assessed, and dispositioned as follows:

(1)

Evaluations of changes in plant configuration or PRA model features should be dispositioned by implementing PRA model changes or by the qualitative assessment of the impact of the changes on the CRMP assessment tool. This qualitative assessment recognizes that changes to the PRA take time to implement and that changes can be effectively compensated for without compromising the ability to make sound engineering judgments.

(2)

Limitations of the CRMP assessment tool are identified and understood for each specific CT extension.

b.

Procedures exist for the control and application of CRMP assessment tools, including a description of the process when the plant configuration of concern is outside the scope of the CRMP assessment tool.

Component 3: Level 1 Risk-Informed Assessment The CRMP assessment tool uses at least a Level 1, at-power, internal events PRA mode

l. CRMP

assessments can reference a risk matrix, preexisting calculations, or new PRA analyse

s. The CRMP

assessment may use any combination of quantitative and qualitative input:

a.

Quantitative assessments should be performed whenever necessary for sound decisionmaking.

b.

When quantitative assessments are not necessary for sound decisionmaking, qualitative assessments can be performed. Qualitative assessments should consider applicable existing insights from previous quantitative assessments.

Component 4: Level 2 Issues and External Hazards The licensee should treat external hazards and Level 2 issues qualitatively or quantitatively, or both.

2.4 Acceptance Guidelines for Technical Specification Changes The guidelines discussed in Sections C.2.4 and C.2.5 of RG 1.174 are applicable to TS change requests for CTs and SFs. Those sections present risk-acceptance guidelines as a function of the result of the licensees risk analysis in terms of total CDF and total LERF predicted for the plant and the change in CDF and LERF predicted for the proposed licensing basis changes. TS submittals for changes to CTs should also be evaluated against the risk-acceptance guidelines in this RG, in addition to those in RG 1.174. All risk-acceptance guidelines to individual proposals for TS changes will be applied in a

RG 1.177, Rev. 2, Page 21 manner consistent with Principle 4 in RG 1.174changes to TS result in small increases in the risk to public health and safety.

TS change evaluations may involve some small increase in risk, as quantified by PRA models.

Such a small increase may be offset by the many beneficial effects of the change that are not modeled by the PRA. The role of numerical guidelines is to ensure that the increase in risk is small and to provide a quantitative basis for the risk increase based on aspects of the TS change that are modeled or quantified.

In some instances, risk information submitted by a licensee may support a long-term CT

extension (e.g., greater than 90 days). Restricting CT extensions to a backstop or a maximum CT limits extended exposure to single-failure susceptibility and compensates for the inherent uncertainty associated with PRAs. TS conditions addressed by CTs are entered infrequently and are inherently temporary. As stated in Section 4.1.2 of Nuclear Energy Institute (NEI) 96-07, Guidelines for 10 CFR 50.59 Evaluations, dated February 22, 2000 (Ref. 25), if a temporary change in support of maintenance activities is expected to be in effect during at-power operations for more than 90 days, the provisions of

10 CFR 50.59, Changes, Tests and Experiments, would be applied to the temporary change in the same manner as a permanent change. Even though NEI 96-07 applies to conducting 10 CFR 50.59 evaluations, a parallel can be drawn to TS CT extensions, in that temporary configurations or modifications extending beyond 90 days may no longer be considered temporary. Licensees requesting long-term CT extensions should be aware that such a request would increase the depth and level of detail of the staffs review, and they should ensure that any proposed measures to reduce the risk impact of the TS change (e.g., risk management actions, Tier 2 and 3 analyses, less reliance on programmatic activities as compensatory measures, demonstrating backup equipment reliability or availability) are commensurate with the proposed CT extension.

Using the risk measures discussed in this RG, the change in risk should be calculated for TS

changes and compared against the numerical guidelines referenced in RG 1.174 or, for CT changes, against the numerical guidelines presented below. In calculating the risk impact of the changed case, licensees can credit additional changes to be implemented as part of the change. For example, in seeking an SF change, if the test strategy is also to be changed, the risk evaluation should incorporate its effect.

TS conditions addressed by CTs are entered infrequently and are temporary by their very nature.

However, TS do not typically restrict the frequency of entry into conditions addressed by CTs. Therefore, the staff provides the following TS acceptance guidelines specific to permanent CT changes for evaluating the risk associated with the revised CT, in addition to those acceptance guidelines in RG 1.174:

a.

The licensee has demonstrated that the TS CT change has only a small quantitative impact on plant risk. An ICCDP of less than 1x10-6 and an ICLERP of less than 1x10-7 are considered small for a single TS condition entry3 (Tier 1).

b.

The licensee has demonstrated that there are appropriate restrictions on dominant risk-significant configurations associated with the change (Tier 2).

3 The ICCDP and ICLERP acceptance guidelines of 1x10-6 and 1x10-7, respectively, are established for consistency with the incremental core damage probability (ICDP) and incremental large early release probability (ILERP) limits of Section 11 in Nuclear Management and Resources Council (NUMARC) 93-01, Revision 4F, Industry Guidelines for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, issued April 2018 (Ref. 26), applicable for maintenance activities involving normal work controls. RG 1.160 endorses, with certain provisions and clarifications, NUMARC 93-01.

RG 1.177, Rev. 2, Page 22 c.

The licensee has implemented a risk-informed plant configuration control program, including procedures to use, maintain, and control such a program (Tier 3).

For one-time-only changes to TS CTs, the frequency of entry into the CT may be known, and the configuration of the plant SSCs may be established. Further, there is no permanent change to the plant CDF or LERF, and hence, the risk guidelines of RG 1.174 cannot be applied directly. The staff provides the following TS acceptance guidelines specific to one-time-only CT changes for evaluating the risk associated with the revised CT:

a.

The licensee has demonstrated that the impact on plant risk from implementing the one-time-only TS CT change is acceptable (Tier 1):

(1)

an ICCDP of less than 1x10-6 and an ICLERP of less than 1x10-7, or

(2)

an ICCDP of less than 1x10-5 and an ICLERP of less than 1x10-6 with effective compensatory measures implemented to reduce the sources of increased risk.4 b.

The licensee has demonstrated that there are appropriate restrictions on dominant risk-significant configurations associated with the change (Tier 2).

c.

The licensee has implemented a risk-informed plant configuration control program, including procedures to use, maintain, and control such a program (Tier 3).

In the context of integrated decisionmaking, the acceptance guidelines should not be interpreted as overly prescriptive. They are intended to provide an indication, in numerical terms, of what is considered acceptable. As such, the numerical values above are approximate values that indicate the changes that are generally acceptable. Furthermore, the state of knowledge, or epistemic uncertainties, associated with PRA calculations prevent a definitive decision with respect to the acceptance of the proposed change based purely on the numerical results. The intent in comparing the PRA results with the acceptance guidelines is to demonstrate with reasonable assurance that Principle 4 is being met. This decision should be based on a full understanding of the contributors to the PRA results and the impacts of the uncertainties, both those that are explicitly accounted for in the results and those that are not. In accordance with Section C.2.6 of RG 1.174, the NRC would give increased attention to the application if the calculated values of the changes in the risk metrics and their base values, when appropriate, approach the acceptance guidelines. Therefore, if the risk metrics approach, or even slightly exceed, the acceptance guidelines, the licensees submittal should address the additional aspects of plant risk and operation discussed in Section C.2.6 of RG 1.174.

There may be situations in which a nonquantitative assessment of risk (either alone or accompanied by a quantitative assessment) is sufficient to justify the proposed TS changes. The licensee is expected to use judgment in developing an appropriate (to support regulatory decisionmaking) risk argument to justify the proposed TS changes, including the appropriate blend of quantitative and qualitative assessments.

2.5 Comparison of Risk of Available Alternatives Available alternatives are sometimes compared to justify a TS change. For changes in TS CTs, such cases primarily involve comparing the risk of shutting down with the risk of continuing power

4 For one-time-only CT changes, the ICCDP and ICLERP acceptance guidelines of 1x10-5 and 1x10-6, respectively, are established for compatibility with the ICDP and ILERP limits of Section 11 in NUMARC 93-01, which is applicable for voluntary maintenance activities requiring risk-management actions.

RG 1.177, Rev. 2, Page 23 operation, given that the plant is not meeting one or more TS LCOs. Such comparisons can be used to justify the increase in at-power risk associated with the TS change by averting some transition or shutdown risk.

Similarly, in the case of an SF change, the beneficial and adverse impacts can also be compared.

The modified SF should be chosen so that the benefit of testing is at least equal to or greater than the adverse effects of testing. For example, if the calibration of relays in the reactor protection system causes plant transients, the risk from the test-caused transients is then estimated and compared with the test-limited risk of a reduced SF.

In using such guidelines, the following considerations apply:

a.

The uncertainty associated with the two measures being compared can differ and should be considered in deciding on an acceptable change.

b.

When the risk measures associated with all alternatives are unacceptably large, ways to reduce the risk should be explored instead of only extending the TS requirement. That is, a large risk from one of the alternatives should not justify relaxing TS without giving appropriate attention to risk-reduction options. If the risk from test-caused transients is large, attention may then be given to exploring changes in test procedures to reduce such risk, rather than only reducing the SF.

However, a combination of the two approaches also may be appropriate.

2.6 Integrated Decisionmaking In accordance with Section C.2.6 of RG 1.174, the results of the evaluations under Sections C.1, C.2, and C.3 should be considered in an integrated manner to determine the final acceptability of the proposed TS change. PRA results are compared to numerical acceptance guidelines, along with other deterministic considerations, operating experience, lessons learned from previous changes, practical considerations associated with test and maintenance practices, and the implementation and monitoring program. The final acceptability of the proposed TS change should be based on all these considerations and not solely on the numerical results of the PRA. These results are one input into the decisionmaking and help in building an overall picture of the risk implications of the proposed TS change. As discussed previously, the numerical guidelines are used to ensure that any increase in risk is within acceptable limits, deterministic considerations are used to ensure that the change satisfies rules and regulations, practical considerations are taken into account to judge the acceptability of implementing the change, lessons learned from past experience ensure that mistakes are not repeated, and monitoring ensures that the TS change does not degrade operational safety over time. RG 1.174, Section C.2.6, provides additional guidance on the integrated decisionmaking process.

3.

Element 3: Define Implementation and Monitoring Program

3.1 Three-Tiered Implementation Approach As described in Section C.2.3, the licensee should use a three-tiered approach to implement the proposed TS CT changes. Application of the three-tiered approach is consistent with the fundamental principle that the proposed change is consistent with the defense-in-depth philosophy. It also provides assurance that the proposed change will not significantly impact defense in depth.

RG 1.177, Rev. 2, Page 24

3.2 Technical Specification Change Monitored Using Performance Measurement Strategies (Principle 5)

Consistent with Principle 5 in RG 1.174, extension of a TS CT or reduction of a TS SF should not degrade operational safety over time. The licensee should ensure, as part of its Maintenance Rule program

(10 CFR 50.65), that when equipment does not meet its performance criteria, the scope of the evaluation required under the Maintenance Rule includes prior related TS changes. If the performance or condition of TS equipment affected by a TS change does not meet established performance criteria, the licensee should take appropriate corrective action, in accordance with the Maintenance Rule. Such corrective action could consider another TS change to shorten the revised CT or increase the revised SF, or impose a more restrictive administrative limit if the licensee determines this to be an important factor in reversing the negative trend.

4.

Element 4: Submit Proposed Change The evaluations performed to justify the proposed TS changes should be documented, maintained, and included in the license amendment request submittal in accordance with Section C.6 of RG 1.174. Specifically, documentation for risk-informed TS change submittals should include a description or discussion of the following:

a.

the TS changes being proposed and the reasons for seeking the changes (Section C.1, Element 1),

b.

a summary of the engineering analyses conducted to justify the proposed TS changes and evidence that they meet the principles described in this RG (Section C.2, Element 2),

c.

compliance with current regulations, orders, and license conditions (Section C.2.1, Principle 1),

d.

the defense-in-depth evaluation (Section C.2.2.1, Principle 2),

e.

the safety margins evaluation (Section C.2.2.2, Principle 3),

f.

the risk impact evaluation (Sections C.2.3-2.5, Principle 4):

(1)

acceptability of the PRA models used to evaluate proposed TS changes (Sections C.2.3.1, C.2.3.2, and C.2.3.3),

(2)

changes made to the PRA models used to evaluate proposed TS changes (including data developed and used in addition to the plants PRA database) (Section C.2.3.3),

(3)

assumptions of the PRA analysis used to evaluate proposed TS changes (Section C.2.3.4),

(4)

sensitivity and uncertainty analyses performed and associated results (Section C.2.3.5),

(5)

the approach used to identify the dominant risk-significant plant configurations associated with proposed TS changes, identification of these dominant risk-significant plant configurations, explanation of how these plant configurations will be prohibited (e.g., by TS or plant procedures) during the TS outage, discussion of any compensatory measures proposed as part of the TS change evaluation, and quantitative or qualitative presentation of the risk impact of these compensatory measures (Section C.2.3.6, Tier 2),

RG 1.177, Rev. 2, Page 25

(6)

the capability of the risk-informed plant configuration control program to perform contemporaneous assessments of the overall impact on safety of proposed plant configurations, including an explanation of how these tools or other processes will be used to ensure that risk-significant plant configurations will not be entered and that appropriate actions will be taken when unforeseen events put the plant in a risk-significant configuration (Section C.2.3.7, Tier 3),

(7)

risk measures used in evaluating the proposed TS changes, providing the calculated risk measure values associated with the TS change evaluation (including intermediate results)

and addressing how they align with the risk-acceptance guidelines presented in this RG,

in addition to those in RG 1.174, as applicable; if the risk metrics approach, or slightly exceed, the acceptance guidelines, discussion of the additional aspects of plant risk and operation identified in Section C.2.6 of RG 1.174 (Section C.2.4), and

(8)

a comparison of the risk of available alternatives, as applicable (Section C.2.5),

g.

the integrated decision to determine final acceptability of the proposed TS change (Section C.2.6),

h.

the implementation and monitoring program (Principle 5), including use of the Maintenance Rule program (10 CFR 50.65) (Section C.3, Element 3),

i.

a marked-up copy (e.g., redline markup) of the relevant TS and bases, including adequate information to provide the technical basis for the revised CT or SF, and j.

all other documentation required to be submitted with a license amendment request.

RG 1.177, Rev. 2, Page 26

D. IMPLEMENTATION

The NRC staff may use this regulatory guide as a reference in its regulatory processes, such as licensing, inspection, or enforcement. However, the NRC staff does not intend to use the guidance in this regulatory guide to support NRC staff actions in a manner that would constitute backfitting as that term is defined in 10 CFR 50.109, Backfitting, and as described in NRC Management Directive 8.4, Management of Backfitting, Forward Fitting, Issue Finality, and

=

Information Requests

=

(Ref. 27), nor does the NRC staff intend to use the guidance to affect the issue finality of an approval under

10 CFR Part 52, Licenses, Certifications, and Approvals for Nuclear Power Plants. The staff also does not intend to use the guidance to support NRC staff actions in a manner that constitutes forward fitting as that term is defined and described in Management Directive 8.4. If a licensee believes that the NRC is using this regulatory guide in a manner inconsistent with the discussion in this Implementation section, then the licensee may file a backfitting or forward fitting appeal with the NRC in accordance with the process in Management Directive 8.4.

RG 1.177, Rev. 2, Page 27 REFERENCES5

1.

U.S. Nuclear Regulatory Commission, Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Washington DC.

2.

U.S. Code of Federal Regulations, Domestic Licensing of Production and Utilization Facilities, Part 50, Chapter I, Title 10, Energy.

3.

U.S. Code of Federal Regulations, Licenses, Certifications, and Approvals for Nuclear Power Plants, Part 52, Chapter I, Title 10, Energy.

4.

U.S. Nuclear Regulatory Commission, NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, Washington DC.

5.

U.S. Nuclear Regulatory Commission, NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking: Final Report, Washington DC.

6.

U.S. Nuclear Regulatory Commission, Regulatory Guide 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, Washington DC.

7.

U.S. Nuclear Regulatory Commission, Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Washington DC.

8.

Atomic Energy Commission, Part 50Licensing of Production and Utilization Facilities Technical Specifications for Facility Licenses; Safety Analyses Reports, Federal Register, Vol. 33, No. 244, December 17, 1968, pp. 18610-18613.

9.

U.S. Nuclear Regulatory Commission, Use of Probabilistic Risk Assessment Methods in Nuclear Regulatory Activities; Final Policy Statement, Federal Register, Vol. 60, No. 158, August 16, 1995, pp. 42622-42629.

10.

U.S. Nuclear Regulatory Commission, NUREG-1430, Standard Technical Specifications, Babcock and Wilcox Plants, Revision 4, Washington DC.

11.

U.S. Nuclear Regulatory Commission, NUREG-1431, Standard Technical Specifications, Westinghouse Plants, Revision 4, Washington DC.

12.

U.S. Nuclear Regulatory Commission, NUREG-1432, Standard Technical Specifications, Combustion Engineering Plants, Revision 4, Washington DC.

13.

U.S. Nuclear Regulatory Commission, NUREG-1433, Standard Technical Specifications, General Electric BWR/4 Plants, Revision 4, Washington DC.

14.

U.S. Nuclear Regulatory Commission, NUREG-1434, Standard Technical Specifications, General Electric BWR/6 Plants, Revision 4, Washington DC.

5 Publicly available NRC published documents are available electronically through the NRC Library on the NRCs public Web site at https://www.nrc.gov/reading-rm/doc-collections/ and through the NRCs Agencywide Documents Access and Management System (ADAMS) at https://www.nrc.gov/reading-rm/adams.html. The documents can also be viewed online or printed for a fee in the NRCs Public Document Room (PDR) at 11555 Rockville Pike, Rockville, MD. For problems with ADAMS, contact the PDR staff at (301) 415-4737 or (800) 397-4209; fax (301) 415-3548; or e-mail pdr.resource@nrc.gov.

RG 1.177, Rev. 2, Page 28

15.

U.S. Nuclear Regulatory Commission, Inspection Manual Chapter 0326, Operability Determinations, September 30, 2019, ADAMS Accession No. ML19273A878.

16.

U.S. Nuclear Regulatory Commission, Generic Letter 80-30, Clarification of the Term Operable as It Applies to Single Failure Criterion for Safety Systems Required by TS,

Washington DC, April 10, 1980.

17.

International Atomic Energy Agency, Development and Application of Level 1 Probabilistic Safety Assessment for Nuclear Power Plants, Specific Safety Guide, Safety Standards Series No. SSG-3, Vienna, Austria, 2010.6

18.

International Atomic Energy Agency, Development and Application of Level 2 Probabilistic Safety Assessment for Nuclear Power Plants, Specific Safety Guide, Safety Standards Series No. SSG-4, Vienna, Austria, 2010.

19.

International Atomic Energy Agency, Safety of Nuclear Power Plants: Design, Safety Standards Series No. SSR-2/1, Rev. 1, Vienna, Austria, 2016.

20.

U.S. Nuclear Regulatory Commission, Final Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors, Federal Register, Vol. 58, No. 139, July 22, 1993, pp. 39132-39139.

21.

U.S. Nuclear Regulatory Commission, Technical SpecificationsFinal Rule, Federal Register, Vol. 60, No. 138, July 19, 1995, pp. 36953-36959.

22.

U.S. Nuclear Regulatory Commission, Staff RequirementsSECY-98-144White Paper on Risk-Informed and Performance-Based Regulation, Staff Requirements Memorandum-SECY-98-144, March 1, 1999, ADAMS Accession No. ML003753601.

23.

U.S. Nuclear Regulatory Commission, Handbook of Methods for Risk-Based Analyses of Technical Specifications, NUREG/CR-6141, BNL-NUREG-52398, December 1994, ADAMS

Accession No. ML093090361.

24.

U.S. Nuclear Regulatory Commission, Quantitative Evaluation of Surveillance Test Intervals Including Test-Caused Risks, NUREG/CR-5775, BNL-NUREG-52296, February 1992, ADAMS Accession No. ML19172A254.

25.

Nuclear Energy Institute, NEI 96-07, Guidelines for 10 CFR 50.59 Evaluations, February 22, 2000, ADAMS Accession No. ML003686043.

26.

Nuclear Management and Resources Council, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, NUMARC 93-01, Rev. 4F, April 2018, ADAMS Accession No. ML18120A069.7

27.

U.S. Nuclear Regulatory Commission, Management of Backfitting, Forward Fitting, Issue Finality, and

=

Information Requests

=

, Management Directive 8.4, September 20, 2019.

6 Copies of International Atomic Energy Agency (IAEA) documents may be obtained through their website:

WWW.IAEA.Org/ or by writing the International Atomic Energy Agency, P.O. Box 100 Wagramer Strasse 5, A-1400

Vienna, Austria.

7 Publications from the Nuclear Energy Institute (NEI) are available at the NEI Web site: http://www.nei.org/ or by contacting the headquarters at Nuclear Energy Institute, 1776 I Street, NW, Washington, DC 20006-3708, Phone: (202) 739-800,

Fax (202) 785-4019.

Appendix A to RG 1.177, Rev. 2, Page A-1 APPENDIX A

CONSIDERATIONS AND DATA NEEDS FOR

TECHNICAL SPECIFICATION CHANGE RISK EVALUATIONS

A-1.

Other Considerations in Technical Specification Change Risk Evaluations A-1.1 Risk-Informed Measures for Technical Specification Changes to Completion Times and Surveillance Frequencies This section lists the risk-informed measures used in completion time (CT) and surveillance frequency (SF) evaluations.1 NUREG/CR-6141, Handbook of Methods for Risk-Based Analyses of Technical Specifications, issued December 1994 (Ref. 1), discusses these measures in more detail.

The measures applicable for CT evaluations include the following:

a.

conditional risk given the limiting condition for operation (LCO),

b.

incremental conditional core damage probability (ICCDP), and c.

yearly CT risk.

When comparing the risk of shutting down with the risk of continuing power operation for a given LCO, the following measures apply:

a.

risk of continued power operation for a given downtime, like ICCDP, and b.

risk of shutting down the plant for the same downtime.

The following measures apply for SF evaluations:

a.

test-limited risk, and b.

test-caused risk.

Similar to the CT evaluations, the risk contributions for preventive maintenance (PM) include the following:

a.

single PM risk, and b.

yearly PM risk.

The risk associated with simultaneous outages of multiple components, called configuration risk, is calculated as part of CT changes. The three-tiered approach discussed in Section C.2.3 of this regulatory guide (RG) includes calculations of risks for multiple components that may be taken down together. The following applicable measures are similar to the CT measures stated above:

a.

conditional risk (e.g., increase in core damage frequency (CDF)) caused by the configuration, and

1 The improved Standard Technical Specifications (NUREGs 1430-1434; see References in this RG) use completion time and surveillance frequency in place of allowed outage time and surveillance test interval.

Appendix A to RG 1.177, Rev. 2, Page A-2 b.

increase in risk (e.g., core damage probability, which is obtained by multiplying the increase in CDF by the duration of the configuration for the occurrence of a given configuration).

If the licensee uses different measures, it should adequately discuss them in its submittal.

A-1.2 Measures for Multiple Technical Specification Changes When multiple technical specification (TS) changes are being evaluated, the combined impact of the individual changes should also be considered. The following sections discuss the considerations related to the calculation of total impacts.

A-1.2.1 Measures That Can Be Combined for Multiple Technical Specification Changes When considering risk contributions from several CTs, the risk measures can be combined according to the following guidelines:

a.

The ICCDPs from several CTs do not generally interact nor accumulate to give a total contribution because the single CT risks are conditional risks per event, and the downtime events for the different CTs are different events. The only time that ICCDPs should be considered simultaneously is when multiple components can be down at the same time, constituting the same event. Such a case is referred to as a downed configuration, or simply a configuration. The risk contribution associated with a configuration is referred to as the configuration risk and is evaluated separately as a multiple component downtime. Conducting maintenance on several components is a principal cause of potentially high configuration risks.

b.

Yearly CT risk contributions from several CTs can interact and should be accumulated to give the total yearly contribution from all the CTs being considered. When the CTs do not interact (i.e., when the downed components are not in the same minimal cutset), the yearly CT risk contribution from several CTs is the sum of the individual yearly CT risk contributions. When the CTs do interact (i.e., when two or more of the downed components are in the same minimal cutset), interaction of the CT risk contributions should be considered.

c.

When calculating the test-limited risk for changes in multiple SFs, the total test-limited risk should be properly evaluated. Simple addition of individual test-limited risks will not provide the combined test-limited risk. In a simple addition, the total test-limited risk contribution is underestimated because the interacting terms are neglected.

A-1.2.2 Total Impact of Multiple Changes When multiple changes are requested, the total collective risk impact from all the changes should be evaluated. For example, for a group of CT and SF changes, this includes the total impact of all the requested CT changes, SF changes, and CT and SF changes.

If multiple changes are made, the impact of each change is assessed individually; as a check, the plant probabilistic risk assessment (PRA) should be used to quantify the total impact.

Appendix A to RG 1.177, Rev. 2, Page A-3 A-1.3 Quantification of Risk Measures A-1.3.1 Alternative Ways of Calculating Technical Specification Change Risk Measures In calculating the measures discussed for evaluating TS changes, two specific risk levels should be quantified using PRA. Focusing on the CDF level, the risk levels are R1, the increased risk level (e.g., CDF) with the component assumed down or equivalent component unavailability set to true, and R0, the reduced CDF with the component assumed up; that is, the component unavailability is set to false.

A-1.3.1.1 Using Probabilistic Risk Assessment To Obtain Completion Time, Preventive Maintenance, and Configuration Risk Contributions R1 can be calculated by setting the component-down event to a true state in the PRA. Similarly, R0 can be calculated by setting the component-down event to a false state in the PRA. The component-down event in the PRA is the event showing that the component is down for repair or maintenance. If the existing minimal cutsets include the component-down event, these minimal cutsets can be used to determine R1 and R0, provided the minimal cutsets sufficiently cover the contribution of the down event. The existing minimal cutsets are sufficient if those containing the down event are not all near the truncation limit (i.e., are not all within a factor of 10 of the truncation limit).

Alternatively, the minimal cutsets are sufficient if those containing the down event have a nonnegligible contribution (i.e., a contribution greater than or equal to 1 percent). If the existing minimal cutsets are sufficient, the increased risk level R1 can be determined by setting the component-down unavailability to 1 and deleting larger minimal cutsets that contain smaller minimal cutsets (i.e., those absorbed by the smaller minimal cutsets). If any minimal cutsets contain complementary events, they also should be removed if they are inconsistent with the component being down. The reduced risk level R0 can be determined analogously by setting the down unavailability to zero.

If the existing minimal cutsets do not contain the component-down event, or if there is a question on the coverage of the existing minimal cutsets, the minimal cutsets should be regenerated. R1 is determined by setting the component-down event in the PRA models to a true state. The truncation limit of the minimal cutset can be reduced by at least a factor of 10 to give added assurance of sufficient coverage. The minimal cutsets that are generated using the reduced truncation limit can then be used to determine R1 by setting the down unavailability to zero.

Contributions from common-cause failures (CCFs) need special attention when calculating the increased risk level R1. If the component is down because of a failure, the common-cause contributions involving the component should be divided by the probability of the component being down because of failure since the component is given to be down. If the component is down because it is being brought down for maintenance (but not failed), the CCF contributions involving the component should be modified to remove the component and to only include failures of the remaining components (also see Section C.2.3.3 of this RG).

If other components are reconfigured while the component is down, these reconfigurations can be incorporated in estimating R1 or R using the PRA. If other components are tested before repair or if maintenance is carried out on the downed components, the conduct of these tests and their outcomes also can be modeled. If other components are more frequently tested when the component is down for the conditions addressed by the CT, this increased frequency of testing also can be incorporated into the PRA.

These modeling details are sometimes neglected in the PRA because of their apparently small

Appendix A to RG 1.177, Rev. 2, Page A-4 contribution. However, when isolating the CT risk contributions and in justifying modified CTs, these details can become significant.

A-1.3.1.2 Appropriate Use of Probabilistic Risk Assessment Minimal Cutsets As indicated, a PRA computes the yearly CT risk contribution to the yearly CDF. Basically, the yearly CT risk contribution is the sum of the minimal cutset contributions containing the component-down unavailability (typically for maintenance) qm,

d f

qm

=

where f is the downtime frequency and d is the downtime associated with the CT. The downtime d usually is estimated as an average downtime associated with the CT. If the minimal cutsets sufficiently cover the downed unavailability, those that contain the downed unavailability, qm, can be summed to give the yearly CT risk contribution, Ry.

A-1.3.1.3 Using the Probabilistic Risk Assessment To Determine the Test-Limited Risk Contribution The PRA can be used to calculate the increase in the risk-level R and to obtain the component unavailability, q, which are the contributing factors in calculating the test-limited risk contribution. The preceding and following sections discuss considerations involved in calculating R1 and R0 to obtain R.

When the effect of change in SF for one or more components is being evaluated, the PRA can directly calculate the change in the risk measure (e.g., in the CDF). The calculation of PRA results, when changed SFs are included, incorporates interactions among the SFs. The differences between the results (i.e., CDF when the SFs are changed from the baseline CDF) provide the test-limited risk contribution for changing the SFs.

Such a calculation should include appropriately modified contributions of CCFs. The common-failure terms modeled as a function of the SF should be modified to reflect the new SF.

Typically, CCFs are modeled using a -factor or multiple Greek letter model when the CCF of multiple components is a function of the SF. When changing SFs, care should be taken to change this term within the common-cause contribution. The common cause of failing multiple components resulting from human error following a test is not a function of the SF, but it may be affected by the test strategy used.

When different test strategies are being evaluated, the human error term should be considered.

Specific assumptions that were used in quantifying the human error common-cause term should be identified and checked if they apply to the test strategy being analyzed. For example, if the term was developed assuming a sequential test strategy, but a staggered test strategy is being analyzed, the term should be modified to reflect this change. The failure probability from a common-cause human error for a staggered test strategy is expected to be significantly lower than that for the sequential test strategy.

A-1.3.1.4 Using Minimal Cutsets To Calculate Test-Limited Risks The test-limited risk for a component or a set of components also can be determined by identifying those minimal cutsets that contain one or more of the SF contributions. The sum of the relevant minimal cutset contributions is then equal to the test-limited risk. To evaluate changes in the test-limited risks for changes in the SFs, the difference between the minimal cutset contributions with and without the SF changes will be the difference between the test-limited risks. In using the minimal cutsets, the SF contributions should all be included in the set of minimal cutsets used. Even though use of the

Appendix A to RG 1.177, Rev. 2, Page A-5 minimal cutsets gives the same results, the above basic description of methods for obtaining the test-limited risks is useful because it shows the basic factors contributing to the SF risk.

A-1.3.1.5 Specific Considerations for Evaluating Multiple Test-Limited Risks When multiple SFs are modified or defined, the total test-limited risk from the multiple SF

changes or definitions should be properly evaluated. Instead of using the PRA to evaluate all the changes in a given run, the individual test-limited risks can be evaluated one at a time, provided that the updated SFs are used for the other relevant components. An iterative procedure can then be used, in which individual SFs are successively updated using the methods described above for individual component SF

risk contributors. These one-at-a-time, or iterative, evaluations are useful if acceptable guidelines on test-limited risks are defined and the SFs are selected to satisfy the risk guidelines.

A-1.3.2 Appropriate Calculation of Conditional Core Damage Frequency A-1.3.2.1 Conditional Core Damage Frequency for Failure of a Component To calculate the conditional CDF when a component is failed (typically represented by R1 in this RG), the component unavailability is changed to the true, or T, state. However, the component unavailability may be modeled in terms of many contributors: random failure, maintenance downtime, test downtime, and CCF. The CCF term represents the failure probability of two or more redundant components that include the failed component in question. The CCF term is modeled as a product of multiple terms (e.g., using the -factor model for two redundant components; the CCF term is times the component unavailability from random failures) but may be represented by one parameter.

Consider a component Q in train A of a safety system and let QLA, QMA, and QTA represent the components unavailability from random failures, maintenance downtimes, and test downtimes, respectively. Also, let QC = QL be the term for CCF of the redundant components in trains A and B,

where QL is numerically equal to QLA and represents QLA or QLB. QLB is the unavailability of a component in train B from random failure. Usually, the terms QLA, QMA, QTA, and QC will be part of the PRA input data.

To calculate the conditional CDF, given that the component is failed, the component unavailability should be represented by the T state. This means that QLA, QMA, and QTA should be changed to the T state and QC should be divided by QLA since the component is down because of failure. In principle, changing one of the three conditions (QLA, QMA, QTA) to the T state should suffice. However, in many cases, truncated cutsets are used to calculate the conditional CDF, and changing all three will ensure that the failed state of the component is represented. For this example, QC

will be changed to , which represents the conditional failure probability of the redundant component.

When QC represents the failure of more than two components, QC will be converted to the failure probability of the remaining componentsin this case, two components.

A-1.3.2.2 Conditional Core Damage Frequency When a Component Is Down (But Not Failed) for Preventive Maintenance To calculate the conditional CDF when a component is taken down for PM (R1 for PM analyses),

the CCF term should be treated differently from that described above for the failure of the component.

Considering the same example as above, the down state of the component is represented by changing QLA, QMA, and QTA to T and by changing QC to QL, which is numerically the same as QLB or QLA. The CCF term is changed to represent the unavailability of the remaining component and

Appendix A to RG 1.177, Rev. 2, Page A-6 not because the initial component is already down for PM and not because of failure. If the redundant component is successfully tested before taking the component down for PM, QC can then be equated to zero for a short-duration PM (i.e., when the duration of the PM is much less than the test interval).

A-1.3.2.3 Conditional Core Damage Frequency When the Component Is Not Down for Maintenance or Is Tested Operable The conditional CDF is reduced when the component is not down for maintenance or when it has just successfully been tested. The determination of CT and SF risk contributions involves calculating this conditional CDF (R0). For evaluating the CT risk contribution, R0 signifies that the component is not down for test or maintenance, and setting test and maintenance downtime unavailabilities to the false, or F, state represents this condition. In this example, QMA and QTA should be changed to the F

state. For SF evaluations, R0 signifies that the component is up, which is known from the test and is represented by setting its unavailability to false. In this example, QLA, QMA, and QTA should be changed to the F state. In many cases, the reduction in CDF from the baseline CDF is negligible.

A-1.3.2.4 Conditional Core Damage Frequency When Multiple Components Are Involved To calculate conditional CDFs (R1 and R0) when multiple components are involved, the corresponding terms relating to each of the components should be changed to the T or F state. For each component, the corresponding terms relating to random failures, CCFs, test downtimes, and maintenance downtimes should be converted, as discussed above. When all the components modeled by a common-cause term are failed, this term changes to the T state for calculating R1. Otherwise, it is modeled as discussed above, representing the unavailability of the remaining component

s. In many PRA

computer codes, the CCF term does not retain the specific component designator (e.g., a unique notation identifying the specific component involved may not be part of the name of the CCF term), and the relevant term cannot be identified directly by searching the names of the input parameters of the PRA.

The description of the CCF terms modeled in the PRA may need to be examined to identify the relevant term or the input parameter.

A-1.3.3 Treatment of Common-Cause Failure and Recovery Factors The treatment of CCF in estimating the conditional CDF for CT and SF evaluations was discussed above, as were the appropriate considerations in modifying CCF terms modeled in the PRA (to include the effect of a component being unavailable because of failure, maintenance, or testing, and for implementing a staggered test strategy). In addition, since the CCF contributions can be a dominant contributor, sensitivity analyses with respect to these parameters may be appropriate (see Section C.2.3.5 of this RG). Recovery factors used in the PRA model should perhaps be reviewed to learn whether the component assumed to be down because of failure is credited to be recovered. For example, consider that a TS change for an emergency diesel generator (EDG) is being evaluated, and conditional CDF for the EDG being down is being calculated. Then, if the cutsets used to calculate the conditional CDF take credit for the same EDG being recovered, such recovery factors should be modified. In such cases, no credit should be taken.

A-1.3.4 Calculations of Transition Risk Transition risk is calculated to compare the risk of continuing operation in a given LCO to that of a transition to plant shutdown. Such comparisons can be used to decide which option is preferable and which alternatives may be used. Such evaluations particularly apply to systems used to remove decay heat. The following considerations apply in calculating transition risk:

Appendix A to RG 1.177, Rev. 2, Page A-7 a.

Various stages of the shutdown cooling phases and the operators interactions should be modeled to assess the impact on the CDF of shutting down the plant in an LCO.

b.

Any initiating event not modeled in the basic PRA but important during the shutdown phases should be modeled. Specific examples are those events that challenge the residual heat removal (RHR) system and that can render part of it unavailable. Additionally, the frequency of initiating events during the transition to shutdown may have to be reassessed since it may differ from that during power operation (e.g., more frequent loss of offsite power or loss of main feedwater during the transition to shutdown).

c.

Different recovery paths applicable at various stages of shutdown should be modeled to realistically quantify the risk of shutting down, considering the diminishing levels of decay heat.

d.

Available time margins for uncovering the reactor core and heating up the suppression pool (in a boiling-water reactor) or drying out the steam generator (in a pressurized-water reactor) should be modeled to evaluate specific accident sequences.

A-2.

Data Needs for Technical Specification Change Evaluations A request for plant-specific TS changes should use plant-specific data and not rely solely on generic data or data from similar plant designs. Usually, TS changes are requested because plant operation indicates that such changes are needed and, accordingly, plant-specific data are expected to be available. For the components or systems for which TS changes are being considered, plant-specific data should be evaluated, and assurance should be obtained that these data are consistent with the plant experience. The licensee should justify the use of other than plant-specific data.

When a generic analysis uses a representative plant model, the incorporation of generic data from similar plants is acceptable. The generic data should bound the specific plants under consideration, not an average plant.

A-2.1 Care in Using Plant-Specific Data When using plant-specific data to update input parameters of the PRA during a TS change evaluation (in addition to those used during the latest update of the PRA), care should be taken to ensure that such data are consistently used both for the base case, where existing TS requirements apply, and the change case, where TS changes are incorporated. This provides assurance that the increase in the risk measure obtained is associated with the TS change only and not with the use of plant-specific data in aspects of plant operation.

This situation typically arises when recent plant-specific data are evaluated and reduced values of the parameters are obtained. Use of the reduced values may negate the risk increase from the TS change and may give an erroneous impression that the TS change has reduced the risk. When the base case is also updated, such difficulties are avoided. Sensitivity and uncertainty analyses should also be performed using the same set of input data.

A-2.2 Considerations When Generic Data Are Used When using generic data for the TS parameters in evaluating TS changes, the focus should be on justifying small changes that do not strongly depend on the data parameters. The licensee should present the reasons why generic data are being used and why generic data apply to plant-specific evaluations. In

Appendix A to RG 1.177, Rev. 2, Page A-8 many cases, because of limited experience, the use of plant-specific data may result in very optimistic values, justifying the use of generic data.

A-2.3 Specific Data Needs Basic data needed for a TS change evaluation (using PRA information) for risk-informed regulation are those collected as part of the PRA. Comparative risk calculations for LCO changes require no additional data beyond those in the Level 1 PRAs for full-power operations and low power/shutdown.

The following sections discuss additional data needs for evaluating changes in TS requirements, such as SFs and CTs.

A-2.3.1 Maintenance Downtime Data Maintenance downtime data should be partitioned into plant-specific unplanned unavailability for unscheduled maintenance and planned unavailability for PM or testing. For this purpose, data are needed on the frequency of events leading to planned and unplanned maintenance (i.e., the number of occurrences of each type of downtime event during a given time period) and the time interval for each occasion the component was out of service. These data are also needed for judging whether an adequate CT is being provided to complete a repair. The distribution of downtimes also can be used to estimate the expected risk for a given CT.

The distribution of time for unscheduled maintenance may shift with a change in a CT. For this reason, information about such an influence on the distribution is not expected to be available when the CT change is being evaluated. The average downtime can be assumed to proportionally increase with the increase in the proposed CT for downtimes associated with unscheduled maintenance. For scheduled (preventive) maintenance, the downtime assumed can be representative of plant practices (e.g., one-half of the CT).

A-2.3.2 Maintenance Schedules and Frequency Maintenance schedule and frequency data include the maintenance scheduling used by the licensee to define the situations in which multiple equipment or system trains may be taken down for PM.

These schedules are important to ensure that components being down simultaneously, implicitly allowed by the TS change, do not create high risks. The maintenance frequency or frequency of downtime for a component may be from 3 to 10 times higher than the failure frequency. Since CTs can be used for maintenance, the frequency of maintenance should be incorporated in estimating the downtime frequency.

A-2.3.3 Data Relating to Component Testing The following data related to component testing, in addition to those available as part of the PRA

study, form part of a TS change evaluation relating to surveillance requirements:

a.

The evaluation should list the components being tested, any component realigned from the safety position during a test, the duration of the test, and the test frequency recommended by the manufacturer.

b.

The evaluation should include the efficiency of the test (i.e., the failure modes detected by the test with regard to aspects such as components and support system interfaces).

Bounding assumptions can be made if obtaining detailed data or related information is costly.

Appendix A to RG 1.177, Rev. 2, Page A-9 c.

The analyses should account for any potential negative effects of surveillance testing (e.g., that may cause the introduction of plant transients or unnecessary wear of the equipment). Preliminary evaluations can be used to determine the need for a more detailed analysis.

d.

The evaluation should state the test strategy used for the redundant components in a system (i.e., whether staggered or sequential testing is performed). The standard PRA

quantification assumes that components follow no specific schedule and are randomly placed. Staggering the test times of components in different trains will reduce the test-limited risk contribution for the same SFs as compared to the PRA assumption.

Conversely, if the tests are carried out sequentially, the test-limited risk will increase compared to the PRA assumptions.

A-2.3.4 Parameters for Component Unavailability The component unavailabilities used in a PRA contain several relevant parameters for evaluating TS changes. These parameters should be delineated, as modeled, to facilitate the evaluations and their review by the regulatory authority. The following desirable parameters contribute to the estimated component unavailability:

a.

component failure rate, b.

component test interval, c.

maintenance/repair downtime contribution (i.e., maintenance frequency, downtime for scheduled and unscheduled maintenance),

d.

test downtime, if applicable, e.

human errors following test or maintenance, if modeled, and f.

separation of cyclic-demand from the standby time contribution, if modeled.

A-2.3.5 Separating Demand and Standby Time Contributions to Unavailability Since the test-limited risk (typically defined as RD) is associated with a failure occurring between tests, the standby time-related failure rate should be used in calculating the test-limited risk. The standby time-related failure rate is associated with what could occur while the component is in standby between tests. Test-limited risk contributes to increases in risk associated with longer test intervals caused by the longer time to detect standby-stress failures. The time-related failure rate is expressed in units per time period, such as per hour. Estimating RD requires the standby stress failure rate of the component and the proposed SF.

The failure probability of a component consists of a time-related contribution (the standby time-related failure rate) and a cyclic, demand-related contribution (the demand stress failure probability).

The latter is the probability contribution associated with failures that are caused by demanding, starting, or cycling the component, which include (but are not necessarily limited to) test-caused transients (discussed in Section A-2.3.6). Since the test-limited risk, RD, is associated with a failure occurring between tests, the failure rate that should be used in calculating the test-limited risk is the time-related standby stress failure rate. From the total number of failures on demand, the number of failures caused by standby stress and the number of failures from demand stresses can be partitioned by either an

Appendix A to RG 1.177, Rev. 2, Page A-10

engineering analysis of failure causes or by a graphical method based on the relationship between the observed number of failures and the SFs from which the failures came.

The test-caused contribution to risk is primarily composed of Rdown, the risk contribution caused by the unavailability of equipment from aligning the equipment away from its preferred position or state to conduct a test, when there is no automatic return to the preferred position. The additional data needed for estimating this parameter are the SF and the out-of-service time needed for each test.

Dividing the failure probability into a time-related and cyclic demand-related contribution results in a lower test-limited risk because only part of the components failure rate is treated as time related.

However, treating only part of the failure rate as time related when this is not the case underestimates the test-limited risk; therefore, such a breakdown of the failure rate should be justified through data or engineering analyses.

In addition, sometimes only the failure probability (i.e., the component unavailability, q) may be provided without giving a failure rate. In such a case, the effect of a change in the SF cannot be evaluated unless the component test interval previously used for T is used to convert the unavailability, q, in terms of and T. When the breakdown between time-related and cyclic demand-related contribution is unknown, all failures can be assumed to be time related to obtain the maximum test-limited risk contribution.

In summary, the data required for measuring a change in risk with a change in the SF are a breakdown of the failure probability of the component into its time-related and demand-related components, the proposed SF, and the out-of-service time for surveillance testing of the component.

A-2.3.6 Test-Caused Transients To evaluate and identify the test-caused transient risk (typically defined as RC), transient events, as well as those caused by a test, should be identified. In most cases, this requires reading through the description of transients that have occurred and noting those caused by the test. When reduced SFs are allowed, the resulting reduction in test-caused transients per unit of time tends to cause decreases in risk because there are fewer adverse effects of testing over that longer test interval (which, however, will be partially or wholly balanced by increases in RD that are caused by the longer time period before the detection and correction of failures).

The transient events are obtained from the following plant operating data:

a.

Performance indicator reports list the number of reactor trips and safety system actuations at each plant, the date of the events, and the numbers of the relevant licensee event reports (LERs).

b.

LERs, in the LER system, describe reactor trips.

When test-caused transients for a single plant are evaluated, the plant-specific data may be sparse unless the plants operating experience covers a substantial period. When plant-specific data are sparse, more data may be used from the operating experience of other plants of similar vintage (e.g., other Type 4 boiling-water reactors), assuming the likelihood of occurrence of test-caused transients is similar for all the plants in the database. (The performance indicator reports categorize plants according to design classes.) Testing, however, tends to be very plant specific; therefore, cross-plant data applicability needs to be evaluated in detail.

Appendix A to RG 1.177, Rev. 2, Page A-11 A-2.3.7 Data for Evaluating Transition Risk Data available in a PRA for full-power operation provide the basic information for evaluating the transition risks when a plant is being shut down for an LCO. In addition, the PRA for low-power and shutdown operations, if available, will significantly ease the acquisition of the data necessary for evaluating the risk of shutdown. The low-power and shutdown PRAs typically contain relevant data, such as the durations of shutdown phases and the frequencies of initiators that may occur during shutdown operation (e.g., loss of RHR).

The full-power PRA is available for most operating plants, but the low-power and shutdown PRAs are available only for some plants. Hence, the following data are needed to evaluate transition risk if only data from a full-power PRA are available:

a.

Plant-specific data on shutdown operations: To analyze shutdown phases in detail, the analyst may need plant-specific information, such as operating and abnormal procedures, shift supervisor logbooks, or monthly operating reports. Data on timing of the plant shutdown and operational preferences of equipment during plant shutdown can be extracted from this information.

b.

Plant-specific deterministic data: The evaluation of heatup and recovery scenarios, including estimates of heatup time, requires some design data on the plant, such as the temperature of the ultimate heat sink or the cooling capacity of the RHR system. These data typically are available from the plants final safety analysis report.

c.

Frequency of transients during controlled shutdown: The analyst may need to review the LERs for the plant to evaluate the likelihood of transients during controlled shutdown.

The analyst should consider that the likelihood of a transient during a shutdown may differ from that during power operation.

Appendix A to RG 1.177, Rev. 2, Page A-12 REFERENCES2

1.

U.S. Nuclear Regulatory Commission, Handbook of Methods for Risk-Based Analyses of Technical Specifications, NUREG/CR-6141, BNL-NUREG-52398, December 1994, ADAMS

Accession No. ML093090361.

2 Publicly available NRC published documents are available electronically through the NRC Library on the NRCs public website at http://www.nrc.gov/reading-rm/doc-collections/ and through the NRCs Agencywide Documents Access and Management System (ADAMS) at http://nrc.gov/reading-rm/adams.html. The documents can also be viewed online or printed for a fee in the NRCs Public Document Room (PDR) at 11555 Rockville Pike, Rockville, MD. For problems with ADAMS, contact the PDR staff at (301) 415-4737 or (800) 397-4209; fax (301) 415-3548; or e-mail pdr.resource@nrc.gov.


Retrieved from "https://kanterella.com/w/index.php?title=Regulatory_Guide_1.177&oldid=5490217"