NRC Inspection Manual 0326, Operability Determinations & Functionality Assessments for Conditions Adverse to Quality of Safety

Operability Determinations & Funtionality Assessments for Conditions Adverse to Quality of Safety

• 10/01/2019 - https://www.nrc.gov/docs/ML1927/ML19273A878.pdf
• 1/31/2014 - https://www.nrc.gov/docs/ML1327/ML13274A578.pdf

text

NRC INSPECTION MANUAL STSB

INSPECTION MANUAL CHAPTER 0326

OPERABILITY DETERMINATIONS

Effective Date: 10/01/2019

Issue Date: 09/30/19 i 0326

0326-01 PURPOSE

To assist NRC inspectors in their review of licensees’ operability determinations (OD). This guidance may not be directly applicable in every case at every plant and inspectors should discuss significant differences among licensee practices with NRC management to ensure the guidance is applied in an accurate and consistent manner.

0326-02 OBJECTIVES

02.01 To provide inspectors clear guidance regarding the process for evaluating operability determinations performed by licensees

02.02 To ensure inspectors evaluate licensees’ operability determinations consistently throughout the agency utilizing sound engineering practices

02.03 To provide inspectors references to guidance/documents available to aid when assessing operability determinations

0326-03 APPLICABILITY

Operability is the responsibility of the licensee. Licensees continuously assess operability. When conditions affecting structures, systems, and components (SSCs) are identified, an input into the Corrective Action Program (CAP) is usually made. It is the responsibility of the licensed Senior Reactor Operator (SRO) to assess the operational impact on the SSC.

03.01 Scope of SSC for Operability Determinations

The OD process is used to assess operability of SSCs described in Technical Specifications (TS). The scope of SSC considered within the OD process is as follows:

a. SSCs that are required to be operable by TS in accordance with 10 CFR 50.36. These SSCs may perform required support functions for other SSCs required to be operable by TS (e.g., Emergency Diesel Generators and Service Water).

b. SSCs that are not explicitly required to be operable by TS but perform necessary and related support functions for TS SSCs are required to be operable by TS.

SSCs may also have design functions that do not perform a necessary and related support function for TS SSCs. These design functions are not within the scope of an OD.

For example, (1) Nuclear Service Water supplied to components that do not have a TS specified safety function or a necessary and related support function and, (2) station battery nonconformance with the Station Blackout Rule, 10 CFR 50.63, “Loss of all alternating current power,” would not necessarily render operating or shutdown DC Source Limiting Condition for Operation (LCO) requirements not met and therefore

inoperable.

0326-04 DEFINITIONS

04.01 Current Licensing Basis (CLB): The set of NRC requirements applicable to a specific plant for ensuring compliance with, and operation within, applicable NRC requirements and the plant-specific design basis over the life of that facility’s operating license.

The set of NRC requirements applicable to a specific plant’s CLB include but are not limited to:

a. NRC regulations in 10 CFR Parts 2, 19, 20, 21, 26, 30, 40, 50, 51, 52, 54, 55, 70, 72, 73, and 100 and appendices thereto,

b. Commission Orders,

c. License Conditions,

d. Exemptions,

e. Technical Specifications, and

f. Plant-specific design basis information defined in 10 CFR 50.2 and documented in the most recent Updated Final Safety Analysis Report (UFSAR) (as required by 10 CFR 50.71).

04.02 Defect: A flaw of such size, shape, orientation, location or properties found

unacceptable for continued service (i.e. exceeds the acceptance criteria of the American

Society of Mechanical Engineers (ASME)Section XI Code, the applicable construction code, or

an NRC approved ASME Code Case).

04.03 Design Bases: Design bases, as defined by 10 CFR 50.2, means that information

which identifies the specific functions to be performed by a structure, system, or component of a

facility, and the specific values or ranges of values chosen for controlling parameters as

reference bounds for design. These values may be (1) restraints derived from generally

accepted “state of the art” practices for achieving functional goals, or (2) requirements derived

from analysis (based on calculation and/or experiments) of the effects of a postulated accident

for which a structure, system, or component must meet its functional goals.

Design Bases information is typically documented in the UFSAR as required by 10 CFR 50.71.

NRC Regulatory Guide (RG) 1.186, “Guidance and Examples for Identifying 10 CFR 50.2

Design Basis,” endorses Appendix B to Nuclear Energy Institute (NEI) document NEI 97-04,

“Guidance and Examples for Identifying 10 CFR 50.2 Design Basis.” The design basis of

safety-related SSCs is established initially during the original plant licensing and relates

primarily to the accident prevention or mitigation functions of safety-related SSCs. The design

basis of a safety-related SSC is a subset of the CLB.

04.04 Flaw: An imperfection or unintentional discontinuity that is detectable by

non-destructive examination.

04.05 High Energy Systems: Generally, these are systems where the maximum operating

temperature exceeds 200°F or the maximum operating pressure exceeds 275 psig. Inspectors

should refer to the facility’s CLB.

04.06 Moderate Energy Systems: Generally, there are systems where the maximum

operating temperature is less than or equal to 200°F and the maximum operating pressure is

less than or equal to 275 psig. Inspectors should refer to the facility’s CLB.

04.07 NDE Indication: The response or evidence resulting from the application of a

nondestructive examination.

04.08 Operability Determination (OD): A decision by an SRO on the operating shift crew of

whether or not there is reasonable assurance an SSC can perform its specified safety

function(s).

04.09 Operable – Operability: In this IMC, the term “specified safety function” is synonymous

with the term “specified function” used in plant-specific (custom) TS that do not use the

Improved Standard Technical Specifications (STS) definition of Operable-Operability.

Improved STS (NUREGs 1430 through 1434 and NUREG-2194) define “Operable – Operability”

as follows:

A system, subsystem, train, component, or device shall be OPERABLE or have

OPERABILITY when it is capable of performing its specified safety function(s),

and when all necessary attendant instrumentation, controls, normal or

emergency electrical power, cooling and seal water, lubrication and other

auxiliary equipment that are required for the system, subsystem, train,

component, or device to perform its specified safety function(s) are also capable

of performing their related support function(s).

Plant-specific TS that are not based on the improved STS definition typically defines “Operable

– Operability” as follows:

A system, subsystem, train, component, or device shall be OPERABLE or have

OPERABILITY when it is capable of performing its specified function(s), and

when all necessary attendant instrumentation, controls, electrical power, cooling

or seal water, lubrication and other auxiliary equipment that are required for the

system, subsystem, train, component, or device to perform its specified safety

function(s) are also capable of performing their related support function(s).

As described above, plant-specific TS may differ from the improved STS definition of Operable

– Operability. Therefore, some judgment is needed in applying this guidance. Word

differences that exist are not viewed by the NRC to imply a significant difference in application

of the plant-specific TS. Any problems resulting from inconsistencies between a plant-specific

definition of operability and this guidance should be discussed with regional managers, who

should discuss the issues with NRR if deemed necessary. In all cases, a licensee’s

plant-specific TS definition of Operable – Operability governs.

04.10 Specified Function/Specified Safety Function: The definition of operability refers to the

capability to perform the specified function (at non-improved TS plants) and specified safety

function (at improved STS plants). The specified function/specified safety function of an SSC is

that specified safety function(s) in the CLB for the facility. Not all SSC functions described in

the CLB are specified safety functions required for operability as described in Section 03.01.b.

0326-05 RESPONSIBILITIES AND AUTHORITIES

05.01 Director/Deputy Director, Division of Safety Systems (DSS), Office of Nuclear Reactor Regulation (NRR)

• Coordinates development and revision preparation to the manual chapter,

• Coordinates regional implementation with the Division Reactor Oversight (DRO), and

• Serves as the NRR contact with the regional offices for guidance development and implementation.

05.02 Branch Chief, Technical Specifications Branch (DSS/NRR)

• Reviews and approves the technical content of periodic revisions to the content contained in the manual chapter

0326-06 OPERABILITY DETERMINATION PROCESS

Operability determinations are appropriate whenever a condition calls into question the ability of an SSC to perform its specified safety function(s). The OD process is used to assess operability of SSCs and their support functions for compliance with TS when a condition is identified for a specific SSC required to be operable by TS, or when a condition is identified which impacts a necessary and related support function. PRA availability is used to calculate risk-informed extended TS completion times (CT) and surveillance requirement frequencies; however, the concept of PRA Available – Availability does not apply to Operable – Operability determinations. An SSC that is determined to be PRA available could be determined to be TS inoperable.

06.01 Continuous Assessment of Operability

Operability of SSCs is continuously assessed by the licensee. This continuous assessment is normally accomplished using operator rounds, log readings, plant alarms and periodic surveillances. When a condition is identified, the licensee should assess the impact of the condition on the specified safety function(s) of the SSC based upon what is known at the time.

The content of the functional impact assessment is dictated by the licensee’s process and the specific condition. Examples such as an operating log entry, a work order description, screening questions for entry into the CAP, a checked box for operable or not, and extent of condition reviews based on operating experience may provide insights as to the functional impact. If a licensee determines the functional impact does not affect a specified safety function, the inspector should be able to understand the basis for the functional impact decision using the information available at the time. It is acceptable for an inspector to ask the licensee for the basis of the functional impact decision if it is not clear. The licensee may or may not formally document the functional impact decision basis, therefore inspectors are expected to actively engage with the licensee when reviewing functional impact decisions. Inspection sample selection should be guided by risk insights resulting from the identified condition.

06.02 Presumption of Operability

The TS are organized and implemented on the presumption that SSCs are operable.

Surveillance testing periodically supports the reasonable assurance of operability. It is reasonable to assume that once an SSC is declared operable by the SRO it will remain operable absent contrary information. This is the presumption of operability.

It should be noted, that once a condition is identified that may impact the function of an SSC, the presumption of operability is not necessarily lost. The presumption of operability is only lost when it is apparent that a condition has been identified that causes a substantive (i.e. non-trivial) functional impact during the required mission time or would be expected to have a substantive functional impact during an event requiring the SSC to perform its specified safety function(s). Furthermore, the loss of the presumption of operability does not necessarily mean the SSC in question is inoperable, only that the licensee must provide an additional basis to support continued operability. A question, concern or presence of a condition alone does not automatically invalidate the presumption of operability.

06.03 Review Activities

Reviewing the performance of SSCs and ensuring their operability is a continual process.

Inspector’s review of the following activities may reveal conditions that challenge the

presumption of operability:

a. Additions to facilities,

b. Day-to-day operation of the facility,

c. Design modifications to facilities,

d. Engineering design reviews, including design basis reconstitution,

e. Examinations of records,

f. Inservice testing and inspection programs,

g. Maintenance activities,

h. NRC inspections,

i. Observations from the control room,

j. Operational event reviews,

k. Operational experience reports,

l. Part 21 notifications,

m. Plant walkdowns and tours,

n. Allegations,

o. Quality assurance activities such as audits and reviews,

p. SSC performance reviews (including common-cause mode failures), and

q. Vendor reviews or inspections.

06.04 Reasonable Assurance of Operability

The concept of presumption of operability and reasonable assurance of operability are distinct concepts. Inspectors should recognize that licensees may use the nomenclature ‘reasonable expectation’ vice ‘reasonable assurance’ regarding their standard. An operability determination should be based on the reasonable assurance, from the evidence collected, that the SSC is capable of performing its specified safety function(s). Reasonable assurance does not mean absolute assurance that the SSC is operable. The SSC may be considered operable when there is evidence that the possibility of failure of an SSC has increased, but not to the point of eroding confidence in the reasonable assurance that the SSC remains operable. The supporting basis for the reasonable assurance of SSC operability should provide a high degree of confidence that the SSC remains operable. The inspector’s independent review of a condition and the licensee’s basis for operability should confirm the high degree of confidence that the SSC remains operable.

A TS SSC is either operable or inoperable when its specified safety function(s) is required in the mode of applicability and there is no indeterminate state of operability. Once a licensee declares an SSC operable, the presumption of operability remains until enough direct or indirect evidence is present which could or would result in the SSC not being able to perform its specified safety function(s) should a licensing basis event occur.

06.05 Conditions Warranting Operability Determinations

Licensees should enter their operability determination process upon discovery of a condition that results in the loss of the presumption of operability. It is the responsibility of the SRO to determine if an identified condition has a substantive functional impact on an SSC such that an OD would be necessary. If an SSC is clearly inoperable (e.g. loss of motive power or failed TS surveillance), it must be declared inoperable and an OD would not be required. Documentation of the assessment should be in accordance with Section 06.10 of this IMC. See Sections 03.01.b and 08.10 of this IMC for discussions on the relationship between necessary and related support functions and the operability of SSCs described in TS.

An inspector’s review of conditions warranting ODs should be risk informed and focused on conditions that potentially have a substantive functional impact on the SSC’s capability. A question or concern from an inspector regarding the substantive functional impact assessment does not change the presumption of operability. An inspector’s challenge to an SRO’s OD should consist of credible technical evidence that is either new or different from the information assessed by the licensee. Also, conditions that do not result in a substantive functional impact can be reviewed under the corrective action program.

For example, a licensee may identify an elevated EDG bearing temperature during a surveillance test and an SRO determines that the presumption of operability is maintained. An inspector may conclude that the SRO’s determination failed to consider credible technical evidence (vendor manual, operating data, calculations/analysis, operating experience, etc.) that may impact the reasonable assurance of operability. This may include a previously unidentified temperature trend, or vendor manual restrictions on bearing temperatures below the alarm set point that will result in a significant functional impact on the SSC. The inspector should discuss these differences with the licensee to ensure a clear understanding that all aspects of the conditions impact on the SSC’s ability to perform its specified safety function(s) have been adequately addressed in an OD.

06.06 Timing of Operability Determinations

Operability is assessed continuously and upon identification of a condition, the licensee should assess the presumption of operability of the SSC without undue delay. If the condition results in a substantive functional impact on the SSC, then the licensee should enter the OD process.

While an OD may be based on limited information, the information should be sufficient to conclude that there is reasonable assurance the SSC is capable of performing the required specified safety function.

In any case, if the available information is incomplete, the licensee should collect any additional information that is material to the operability determination (i.e., information that could result in a change to the operability determination conclusion) and then promptly make an OD based on the complete set of information. If, at any time, information emerges that negates a previous determination that an SSC is operable, the licensee should declare the SSC inoperable. As an example, if operating experience reveals some internal sub-component failure of an SSC, a licensee may investigate, using the corrective action program, to determine whether there is current evidence of a substantive impact on the susceptible SSC. The presence of the failure may not be readily or directly observable. There may be indirect or downstream effects which may indicate the presence of the sub-component failure. The absence of these indirect effects could be used to support a reasonable assurance of continued operability. If no direct or indirect indications are available, then a comparison of key characteristics between similar operating units’ SSCs may be used to support conclusions regarding the condition of the SSC.

The types of information which may be considered include but are not limited to run time, operating cycles, maintenance history, SSC failure history, etc. If the result of the corrective

action program review concludes there is not enough evidence to call into question the presumption of operability, the licensee should respond to the operating experience item in

accordance with the corrective action program. Another example would be if a licensee receives a Part 21 notice for a defective component, the specific facility is named, and that

facility has installed the component, then the presumption of operability may be lost.

06.07 Scope of Operability Determinations

The scope of an OD should be sufficient to address the capability of an SSC to perform its specified safety function(s). The OD may be based on analysis, a test or partial test, experience with operating events, engineering judgment, or a combination of these factors, considering an SSC’s functional requirements.

a. Possible elements of an OD include:

(1) The SSC affected by the condition,

(2) The extent of condition for all similarly affected SSCs,

(3) The CLB requirements or commitments established for the affected SSC,

(4) The specified safety function(s) performed by the affected SSCs,

(5) The effect or potential effect of the condition on the affected SSC’s ability to perform its specified safety function(s), and

(6) Whether there is a reasonable assurance of operability, including the basis for the determination and any compensatory measures put in place to establish or restore operability.

b. The following things should be considered when reviewing ODs:

(1) Design basis events are plant-specific, and plant-specific TS, bases, and safety evaluations may contain plant-specific considerations related to operability,

(2) An SSC’s operability requirements are based on safety analyses of specific design basis events for one mode or specified condition of operation and may not be the same for other modes or conditions of operation; therefore, all applicable modes and conditions of operation should be considered,

(3) The operability requirements for an SSC encompass all necessary support systems (per the TS definition of operability) regardless of whether the TS explicitly specifies operability requirements for the support functions,

(4) In order to evaluate conditions, it is assumed in the OD that the design basis event occurs. The occurrence of multiple simultaneous design basis events should be considered only to the extent that they are required as a part of the plant’s CLB, and

(5) Compensatory measures may be established to restore or maintain operability of an SSC. See section 06.08 of this IMC for additional guidance on compensatory measures.

06.08 Compensatory Measures

When evaluating the effect of a condition on an SSC’s capability to perform any of its specified safety functions, a licensee may decide to implement compensatory measures, as an interim action, until final corrective action to resolve the condition is completed.

Compensatory measures’ purposes include:

a. Maintaining or enhancing an operable SSC’s capability to perform its specified safety function(s). Compensatory measures for SSCs may restore plant operating margins,

b. Monitoring performance of an SSC to allow the licensee to take additional action prior to the SSC becoming inoperable, and

c. Restoring an inoperable SSC to an operable status.

In general, these measures should have minimal impact on the operators or plant operations, should be relatively simple to implement, and should be documented.

Conditions calling for a compensatory measure can place additional burden on plant operators and inspectors should verify the licensee addresses the conditions commensurate with its safety significance per 10 CFR 50 Appendix B Criterion XVI. Section 08.05 of this IMC contains guidance on the temporary use of manual actions instead of automatic actions to support ODs.

Also, the planned removal of hazard barriers for maintenance is considered a temporary facility alteration. Additional guidance on hazard barriers is provided in Regulatory Issue Summary (RIS) 2001-09, “Control of Hazard Barriers,” dated April 2, 2001. In all cases, licensees must continue to comply with the plant TS, particularly the operability provisions applicable to the protected SSCs.

Additionally, if a compensatory measure involves a temporary facility or procedure change, 10 CFR 50.59 applies to the temporary change to determine whether the temporary change/compensatory measure itself (not the condition) impacts other aspects of the facility or procedures described in the UFSAR. In considering whether a temporary facility or procedure change impacts other aspects of the facility, a licensee should apply 10 CFR 50.59, paying particular attention to ancillary aspects of the temporary change that result from actions taken to directly compensate for the condition.

Licensees may use the guidance in NEI 96-07, Revision 1, “Guidelines for Implementing 10 CFR 50.59,” which is endorsed by Regulatory Guide 1.187, “Guidance for Implementation of 10 CFR 50.59, Changes, Tests, and Experiments.” Inspectors can also refer to Section 08.05 of this IMC for additional compensatory measures guidance.

06.09 Operator Awareness and Responsibilities

The operating shift crew is responsible for overall control of facility operation. As part of that responsibility, the operating shift crew will be aware of conditions that have a functional impact on SSCs and maintain knowledge of the SSC’s operability status. A licensed SRO on the operating shift crew with responsibility for plant operations makes the determination of operability (i.e., “makes the call” on whether an SSC described in TS is operable or inoperable).

Plant staff in other organizations (e.g., operations, engineering, and licensing) with expertise in the subject matter and appropriate knowledge of plant operations may prepare ODs.

Regardless of who prepares the evaluation, it is the ultimate responsibility of the on shift licensed SRO to approve the OD document.

06.10 Documentation

Operability determinations should be documented in sufficient detail to allow an individual knowledgeable in the technical discipline associated with the condition to understand the basis for the determination. Adequate documentation is necessary to establish a basis and allow for subsequent independent reviews. Supporting information should be included or appropriately referenced. If the presumption of operability has not been lost, then the level of documentation should be consistent with applicable licensee procedures.

06.11 Enforcement Discretion

Under unique circumstances, a licensee may experience an unanticipated, temporary noncompliance with a TS or license condition that would result in one or more of the following:

a. An unnecessary plant transient,

b. An unnecessary down-power or the shutdown of a reactor without a corresponding health and safety benefit,

c. The performance of testing, inspection, or system realignment that is inappropriate for the specific plant conditions,

d. Unnecessary delays in plant startup without a corresponding health and safety benefit, and

e. The potential for an unexpected plant shutdown during severe weather, a pandemic, other natural phenomena, or a terrorist attack that could exacerbate already degraded electrical grid conditions and could have an adverse impact on the overall public health and safety or common defense and security.

If there is adequate time, a licensee (who chooses to do so) should seek to obtain a license amendment before taking action that is not in compliance with license conditions, TS or the CLB, except in certain emergency situations when 10 CFR 50.54(x) and (y) apply. If there is not sufficient time to obtain a license amendment, licensees may seek enforcement discretion from the NRC. Guidance applicable to these limited circumstances is provided in Section I-3 of the NRC Enforcement Manual, “Use of Enforcement Discretion.”

06.12 Issue Resolution and Internal Alignment

If the inspector disagrees with an SRO’s assessment of the operability of an SSC, then the inspector should work through the licensee’s management to resolve the issue as expeditiously as possible. A good practice is to make sure that licensee management is aware of potential operability issues while the inspector is still evaluating the issue. Once the inspector has concluded that there is disagreement with the licensee, then the inspector should brief his/her NRC supervisor as soon as possible and work with NRC management to identify appropriate means to resolve the issue with the licensee.

Regional office staff may consult with NRR technical experts regarding a plant-specific operability issue as part of the inspector’s review of the licensee’s operability decision. This consultation may be informal (phone, email, etc.) or may be formalized using the NRC’s Task Interface Agreement (TIA) process (COM-106 “Control of Task Interface Agreements”). In cases where there is a disagreement between the NRR and the regional office staff regarding the operability of an SSC, the deciding authority shall be the appropriate Regional Administrator, or his/her delegate. Subsequent actions shall be coordinated with NRR and other offices as appropriate. Regarding the deciding authority, inspectors may utilize Management Directive (MD) 9.29, “Organization and Functions, Regional Office” and MD 9.27, “Organization and Functions, Office of Nuclear Reactor Regulation.”

If the inspector believes the issue may impact other facilities, then the inspector should contact the appropriate NRR technical staff through their DORL Project Manager for evaluation as to the generic applicability of the issue. If the Region and/or NRR determines the issue is generic, then NRR should take the lead in developing a plan for addressing the issue through NRR’s generic issue process. NRR may also implement the LIC-504 process which provides a risk-informed method for evaluating the safety significance of the issue and for deciding on the path forward for resolution. As NRR proceeds through developing and implementing a plan for resolution, the regional offices should be kept informed of the issue status and progress through regular communication paths.

The NRC’s MD 10.160, “Open Door Policy,” MD 10.158 “Non-Concurrence Process,” and MD 10.159 “Differing Professional Views Process” are all options for any staff member who is not aligned with the NRC’s chosen path forward for addressing the issue in question.

0326-07 SURVEILLANCES

07.01 Operability during Technical Specification Surveillances

As described in 10 CFR 50.36(c)(3), “Surveillance requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met.” The Commission’s Final Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors (58 FR 39132; July 22, 1993) gives the Commission’s expectations that bases for a SR should describe the specific functional requirement the surveillance is designed to verify, and why the surveillance is necessary at the specified frequency to assure that the system or component function is maintained, that facility operation will be within the Safety Limits, and that the LCO will be met.

Some TS surveillances require an SSC to be rendered incapable of performing its specified safety function(s) in order to perform the test. In these cases, SSCs should be declared inoperable and the LCO must immediately be declared not met. Upon completion of the surveillance, the licensee should verify restoration to operable status of at least the parts of the SSC or system features that were altered to accomplish the surveillance.

Technical Specifications permit the entry into LCO action statements to perform surveillance testing for several reasons. One reason is that the time needed to perform most surveillance tests is usually only a small fraction of the allowed outage time for the required action. Another reason is that the safety benefits (increased level of assurance of reliability and verification of operability) of meeting surveillance requirements more than compensates for the safety risk for operating the facility when a TS LCO is not met.

07.02 System Configuration during Surveillance and Operability Testing

It is preferable that TS surveillances be performed in the same configuration and conditions representative of those the system must be in to perform its specified safety function.

However, testing in other configurations or conditions may be required if testing in the specified safety function configuration would result in unjustifiable safety concerns or transients. In this case, the surveillance requirement acceptance criteria in the TS for the test condition should be based on an extrapolation from the test condition to the condition in which the specified safety function is performed. Operability is based on meeting the acceptance criteria specified in the TS. The system configuration for TS surveillance requirements is usually prescribed, and the acceptance criteria are based on the prescribed configuration.

Test failures should be examined to determine the cause and correct the problem before continuation of testing. Repetitive testing to achieve acceptable test results without identifying the cause or correction of a problem in a previous test is not an acceptable means to establish or verify operability and may constitute “preconditioning” (as defined in NUREG-1482 “Guidelines for Inservice Testing at Nuclear Power Plants - Inservice Testing of Pumps and Valves and Inservice Examination and Testing of Dynamic Restraints (Snubbers) at Nuclear Power Plants - Final Report”.)

07.03 Missed Technical Specification Surveillance

When a TS surveillance is not performed within the prescribed time interval, the applicable TS action statement should be followed. For most plants STS SR 3.0.3 or the equivalent applies. TSTF-529, Revision 4, “Clarify Use and Application Rules,” revised SR 3.0.3 to permit an allowance that may be used in certain circumstances when an SR has never been performed. For those licensees who have not adopted TSTF-529, SR 3.0.3 may not be applied. Inspectors should utilize the license, which includes TS, when evaluating a licensee’s application of SR 3.0.3 related to operability.

0326-08 SPECIFIC OPERABILITY ISSUES

08.01 Relationship between the General Design Criteria (GDC) and the Technical Specifications

The GDC, or a plant-specific equivalent as incorporated into the CLB, have an important relationship to the operability requirements of the TS. For example, plants with construction permits issued prior to May 21, 1971, may have been approved for construction based on the proposed General Design Criteria published by the Atomic Energy Commission (AEC) in the Federal Register (32 FR 10213) on July 11, 1967, sometimes referred to as the AEC Draft GDC. Comprehending this relationship is critical to understanding how licensees should address nonconformance with CLB design requirements. Some facilities were licensed before the GDC were codified in 10 CFR. As a result, the applicability of the GDC varies among facilities. In all cases, the plant-specific CLB governs.

The GDC and the TS differ from each other in that the GDC specify requirements for the design of nuclear power reactors, whereas the TS specifies requirements for the operation of nuclear power reactors. As such, the GDC cover a broad category of SSCs that are important to safety, including the SSCs that are covered by TS. Failure to meet a design criterion described in the licensing basis (e.g., discovering that a system’s design does not meet Criterion 2 “Design bases for protection against natural phenomena”) should be treated as a condition and evaluated to determine if the condition calls into question the ability of an SSC to perform its specified safety function(s) or a necessary and related support function(s). The licensee should then perform an OD as appropriate. If the licensee’s determination concludes that the TS SSC is operable or the necessary and related support function is capable of providing the required support to the SSC ability to perform the specified safety function, it would be appropriate to address the condition through the licensee’s corrective action program. However, if the licensee’s evaluation concludes the TS SSC is inoperable, then the licensee must follow its TS and perform any remedial actions.

The GDC Correspond Both Directly and Indirectly to TS Operational Requirements Design requirements, such as the GDC or similar requirements, are typically included in the licensing basis for every nuclear power plant. The GDC, according to Appendix A of 10 CFR Part 50, “establish the necessary design, fabrication, construction, testing, and performance requirements for structures, systems, and components important to safety.” As such, the GDC cover a broad category of SSCs that are important to safety, including the SSCs that are covered by TS. The safety analysis report describes the design capability of the facility to meet the GDC (or a plant-specific equivalent). The staff safety evaluation report documents the acceptability of safety analysis report analyses. The analyses and evaluation included in the safety analyses serve as the basis for the TS issued with the operating license.

The TS limiting conditions for operation, according to 10 CFR 50.36(c)(2)(i), “are the lowest functional capability or performance levels of equipment required for safe operation of the facility.” Section 182 of the Atomic Energy Act of 1954, as amended and as implemented by 10 CFR 50.36, requires that those design features of the facility that, if altered or modified, would have a significant effect on safety, be included in the TS. Thus, TS are intended to ensure that the most safety significant design features of a plant, as determined by the safety analysis, maintain their capability to perform their safety functions, (i.e., that SSCs are capable of performing their specified safety function(s) or necessary and related support function(s)).

Required actions and completion times of the TS illustrate the relationship between the GDC and the TS. For example, the GDC may require redundancy of function for safety systems.

This is normally accomplished by incorporating at least two redundant trains into the design of the safety systems. The TS typically allow a facility to continue to operate for a specified time with only one train of a two-train safety system operable. In that case, the GDC are met because the system design provides the necessary redundancy. The TS permit the operation of the system with only a single train based on an evaluation of the protection provided by the unique system lineup for the specified period. Not all GDC that are included in the CLB are explicitly identified in TS. However, those that are not explicitly identified may still need to be considered when either determining or establishing the basis for operability of TS SSC.

08.02 Single Failures

A single failure is defined as follows in 10 CFR Part 50, Appendix A, “General Design Criteria for Nuclear Power Plants.

A single failure means an occurrence which results in the loss of capability of a component to perform its intended safety function(s). Multiple failures resulting from a single occurrence are considered to be a single failure.

10 CFR Part 50, Appendix A contains GDC for SSC that perform major safety functions. Many of the GDC, for example GDC 17, 21, 34, 35, 38, 41, and 44, contain a statement similar to the following:

Suitable redundancy in components and features and suitable interconnections, leak detection, isolation and containment capabilities shall be provided to assure that for onsite electrical power system operation (assuming offsite power is not available) and for offsite electrical power system operation (assuming onsite power is not available) the system safety function can be accomplished assuming a single failure.

Therefore, if these provisions are incorporated into the licensing basis, the capability to withstand a single failure in fluid or electrical systems becomes a plant-specific design requirement ensuring that a single failure does not result in a loss of the capability of the system to perform its specified safety function(s) or necessary and related function(s). Where the licensing basis does not require redundancy, the single failure guidance herein does not apply.

Failure to meet a GDC (or plant-specific equivalent) that is incorporated in the licensing basis should be treated as a condition and evaluated to determine if an OD is warranted if the capability of an SSC to withstand a single failure is compromised.

08.03 Treatment of Consequential Failures in Operability Determinations

A consequential failure is a failure of an SSC caused by a postulated accident within the design basis. For example, if during a loss-of-coolant accident (a design basis event) a broken pipe whips and incapacitates a pump such that it cannot function; such a pump failure is called a consequential failure because the pump fails as a result of the design basis event itself. In general, facility design takes into consideration any consequential failures that are deemed credible. In this case, the broken pump cannot be credited in the safety analysis for loss of coolant accident mitigation.

When a condition is identified with an SSC and this condition requires an OD, the OD should assess credible consequential failures previously considered in the design (i.e., the SSC failures that are the direct consequence of a design basis event for which the SSC needs to function).

Where a consequential failure (i.e., considering the condition) would cause the loss of a specified safety function(s), the affected SSC is inoperable. Such situations are most likely discovered during design basis reconstitution studies, or when new credible failure modes are identified.

08.04 Use of Alternative Analytical Methods in Operability Determinations

10 CFR 50.59 requires that if a licensee makes a change that results in a departure from a method of evaluation described in the UFSAR then prior NRC approval is required. When performing ODs, licensees sometimes use analytical methods or computer codes different from those originally used in the calculations supporting the plant design. This practice involves applying “engineering judgment” to determine if an SSC remains capable of performing its specified safety function(s) during the corrective action period. The use of alternative methods for the purpose of evaluating operability is not subject to 10 CFR 50.59 unless the methods are used in the final corrective action. Section 50.59 is applicable upon implementation of the corrective action.

Although the use of alternative (and normally more recent) methods or computer codes may raise complex plant-specific issues, their use may be useful and acceptable in ODs. Therefore, the inspector should consult with the regional office and NRR when reviewing such determinations. The use of alternative methods should generally be handled as follows:

a. Occasionally, a regulation or license condition may specify the name of the analytic method for a particular application. In such instances, the application of the alternative analysis must be consistent with the TS, license condition, or regulation.

For example, the methods used to determine limits placed in the core operating limits report (COLR) may be specified in TS. An evaluation of an SSC performance capability may be determined with a non-COLR method, but the limits in the COLR must continue to comply with the technical specification.

b. The use of any analytical method must be technically appropriate to characterize the SSC involved, the nature of the condition, and specific facility design. General considerations for establishing this adequacy include:

(1) If the analytic method in question is described in the CLB, the licensee should evaluate the situation-specific application of this method, including the differences between the CLB-described analyses and the proposed application in support of the OD process,

(2) Utilizing a new method because it has been approved for use at a similar facility does not alone constitute adequate justification,

(3) The method should produce results consistent with the applicable acceptance criteria in the CLB. For example, if the current performance levels are expressed in terms of rem, the method cannot generate results expressed in

Total Effective Dose Equivalent (TEDE),

(4) If the analytic method is not currently described in the CLB, the models employed must be capable of properly characterizing the SSC’s performance. This includes modeling of the effect of the condition,

(5) Acceptable alternative methods may include the use of “best estimate” codes, methods, and techniques. In these cases, the evaluation should ensure that the SSC’s performance is not over-predicted by performing a benchmark comparison of the non-CLB analysis methods to the applicable CLB analysis methods, and

(6) The use of the software should be controlled in accordance with the licensee’s quality assurance program, as applicable. This includes the availability of reviewers qualified to verify results.

08.05 Use of Temporary Manual Action in Place of Automatic Action in Support of Operability

Automatic action is frequently provided as a design feature specific to each SSC to ensure that specified safety functions will be accomplished. Limiting safety system settings for nuclear reactors are described in 10 CFR Part 50.36(c)(1)(ii)(A) as follows:

Limiting safety system settings for nuclear reactors are settings for automatic protective devices related to those variables having significant safety functions. Where a limiting safety system setting is specified for a variable on which a safety limit has been placed, the setting must be so chosen such that automatic protective action will correct the abnormal situation before a safety limit is exceeded.

If, during operation, it is determined that the automatic safety system does not function as required, the licensee shall take appropriate action, which may include shutting down the reactor.

Accordingly, it is not appropriate to consider SSC operable by taking credit for manual action in place of automatic action for protection of safety limits. This does not forbid operator action to put the plant in a safe condition, but operator action cannot be a substitute for automatic safety limit protection. Refer to the compensatory measures discussion in Section 06.08 of this IMC.

Credit for manual initiation of a specified safety function should be established as part of the licensing review of a facility. Although the licensing of specific facility designs includes consideration of automatic and manual action in the performance of specified safety functions, not all combinations of circumstances have been evaluated from an operability standpoint. For situations where substitution of manual action for automatic action is proposed for an OD, the evaluation of manual action must focus on the physical differences between automatic and manual action and the ability of the manual action to accomplish the specified safety function(s).

The physical differences to be considered include the ability to recognize input signals for action, ready access to or recognition of setpoints, design nuances that may complicate subsequent manual operation (such as auto-reset, repositioning on temperature or pressure), timing required for automatic action, minimum staffing requirements, and emergency operating procedures written for the automatic mode of operation. The licensee should have written procedures in place and personnel should be trained on the procedures before any manual action is substituted for the loss of an automatic action.

The assignment of a designated operator for a manual action normally involves written procedures and full consideration of all pertinent differences. The consideration of a manual action in remote areas must include the abilities of the assigned personnel and how much time is needed to reach the area, training of personnel to accomplish the task, and occupational hazards such as radiation, temperature, chemical, sound, or visibility hazards. One reasonable test of the reliability and effectiveness of a manual action may be the approval of the manual action for the same function at a similar facility. Nevertheless, a manual action is expected to be a temporary measure and to promptly end when the automatic action is corrected in accordance with 10 CFR Part 50, Appendix B, and the licensee’s corrective action program.

Licensees may use the guidance in NEI 96-07, Revision 1, “Guidelines for Implementing 10 CFR 50.59,” which is endorsed by Regulatory Guide 1.187, “Guidance for Implementation of 10 CFR 50.59, Changes, Tests, and Experiments.”

08.06 Use of Probabilistic Risk Assessment in Operability Decisions

Probabilistic risk assessment is a valuable tool for evaluating accident scenarios because it can consider the probabilities of occurrence of accidents or external events. Nevertheless, the definition of operability is that the SSC must be capable of performing its specified safety function(s), which inherently assumes that the event occurs and that the safety function(s) will need to be performed. As such, the use of PRA or probabilities of occurrence of accidents or external events is not consistent with the assumption that the event occurs and is therefore not acceptable for making operability decisions.

However, PRA may provide valid and useful supporting information on the timeliness of an operability decision and a corrective action. PRA is also useful for determining the safety significance of SSCs. The safety significance, whether determined by PRA or other analyses, is a factor in making decisions about the timeliness of ODs.

08.07 Use of Seismic Margin Assessment in Operability Decisions

Seismic Margin Assessment (SMA) methodologies have been used to demonstrate that seismic margin exists for ground motion levels above the safe shutdown earthquake (SSE). These analyses have been used for beyond design basis calculations; however, the SMA approach may be appropriate for demonstrating operability on a temporary basis until compliance with the licensing basis is achieved. If an SMA is used, the seismic demand should be the recently developed Ground Motion Response Spectra (GMRS) for the Fukushima 2.1 seismic evaluation, and its application should be consistent with EPRI NP-6041-SL.

08.08 Environmental Qualification

When a licensee identifies a condition that affects compliance with 10 CFR 50.49, (e.g., a licensee does not have an adequate basis to establish qualification), the licensee should determine if this condition results in the loss of the presumption of operability and if so enter the OD process. The licensee may use the criteria of Section 06.04 to establish reasonable assurance the SSC will perform its specified safety function(s). In this connection, it must also be shown to a reasonable assurance standard that a subsequent failure of the equipment, if likely under accident conditions, will not result in a consequential failure as discussed in Section 08.03.

08.09 Technical Specification Operability vs. ASME OM Code Criteria

The TS normally applies to the overall performance of plant systems, but sometimes contains limiting values for the performance of certain components. The limiting values are specified to ensure that the operational limits established by the design basis and safety analysis are satisfied. The values (e.g., pump flow rate, valve closure time, valve leakage rate, safety/relief valve set point pressure) are criteria that can be used to verify operability. If at any time these values are not met, the system must be declared inoperable, the LCO must be declared not met, and the applicable conditions must be entered.

The ASME OM Code establishes the requirements for preservice and inservice testing and the examination of certain components to assess their operational readiness. ASME OM Code acceptance criteria for inservice testing (IST) include “required action ranges” or limiting values for certain component performance parameters. These required action ranges or limiting values, defined by the ASME OM Code as component performance parameters, may be more limiting than the TS values (which are accident analysis limits). Where IST requirements are incorporated into a facility’s surveillance requirements when performance data falls outside the required action range, regardless of whether the limit is equal to the TS limit or more restrictive, the surveillance requirement is not met (the word “inoperative” is used in the text of the ASME Code, i.e., the pump or valve is “inoperative”) and the LCO must be declared not met and the applicable conditions must be entered.

When the required action range is more limiting than its corresponding TS, the corrective action need not be limited to replacement or repair; an analysis demonstrating the specific performance degradation does not impair operability would be acceptable. A new required action range may be established after such analysis, allowing a new OD.

The NRC does not accept durations specified by the ASME OM Code for analyzing test results as a reason for postponing entry into a TS action statement. As soon as data are recognized as being within the required action range for pumps or as exceeding the limiting-value full-stroke time for valves, the associated component must be declared inoperable, and if subject to TS, the completion time specified in the action statement must be started at the time the component was declared inoperable. For inoperable pumps and valves that are part of an ASME IST program but not subject to TS, only the actions required by the applicable sections of the ASME code are applicable.

Recalibrating test instruments and then repeating pump or valve tests are acceptable as an alternative to repair or replacement but cannot be done before declaring the pump or valve inoperable. However, if during a test it is obvious that a test instrument is malfunctioning, the test may be halted and the instruments promptly recalibrated or replaced. During a test, anomalous data with no clear indication of the cause must be attributed to the pump or valve under test. In that case, the licensee should evaluate to determine if this condition results in the loss of the presumption of operability and if so enter the OD process.

08.10 Support System Operability

The definition of operability assumes that an SSC described in TS can perform its specified safety function(s) when all necessary support systems are capable of performing their related support function(s). Each licensee must understand which support systems are necessary and related to ensure operability of supported TS systems. In some cases, the licensee could use “engineering judgment” in determining whether a support system that is not described in TS is necessary and related and is, therefore, required to be capable of performing its support function(s).

The licensee may need to apply engineering principles in the final analysis of the basis for the decision. For example, a ventilation system may be required in the summer to ensure that SSCs can perform their specified safety function(s) but may not be required in the winter.

Similarly, the electrical power supply for heat tracing may be required in the winter to ensure that SSCs can perform their specified safety function(s) but may not be required in the summer.

In all such cases, the licensee should periodically review the basis for determining that a support system is not required to ensure (a) the conclusion remains valid, and (b) there is timely restoration of the support system (the review may be done as part of the corrective action program). As an alternative to restoration, the licensee may modify the support function (as it would make any other change to the facility) by following the 10 CFR 50.59 change process and updating the UFSAR.

Upon discovery of a support system that is not capable of performing its necessary and related support function(s), the most important consideration is the possibility of having lost all capability to perform a specified safety function. Upon declaring a support or supported system inoperable in one train, the required actions in the TS should be implemented. The licensee must verify the SSC has not lost the complete capability to perform its specified safety function(s). The word "verify" as used here, covers examining logs or other information to determine if required features are out of service for maintenance or other reasons. The TS may contain specific requirements or allowances regarding support systems. In all cases, a licensee’s plant-specific TS governs.

08.11 Pipe Support Requirements

Piping and pipe supports found to be degraded or not conforming, as defined by the ASME Code,Section XI, IWF, and that support SSC described in TS should be evaluated to determine if this condition results in the loss of the presumption of operability and if so enter the OD process. The following criteria are provided to address various components, including piping, supports, support plates, and anchor bolts. Inspection and Enforcement (IE)Bulletin 79-14, “Seismic Analyses for As-Built Safety-Related Piping Systems,” including Supplements 1 and 2, provides additional guidance. Seismic Qualification Users Group Generic Implementation Procedure-2 (SQUG GIP-2) also provides acceptable criteria that can be used to confirm operability of mechanical component anchorages consistent with design basis loadings. RG 1.199, “Anchoring Components and Structural Supports in Concrete”, November 2003 which endorses American Concrete Institute (ACI) 349, “Code Requirements for Nuclear Safety Related Concrete Structures,” 2001 provides acceptance criteria for evaluation of nonconforming or degraded anchors (steel embedments).

Specific operability criteria for concrete anchor bolts and pipe supports are given in IE Bulletin 79-02, “Pipe Support Base Plate Designs Using Concrete Expansion Anchor Bolts” (see Revision 1, Supplement 1, and Revision 2). The criteria for evaluating the seismic design of piping supports and anchor bolts relating to Bulletins 79-02 and 79-14 are described in NRC memo dated July 16, 1979 (ADAMS Accession No. ML 993430206). When a degradation or nonconformance associated with piping or pipe supports is discovered, the licensee may use the criteria in Appendix F of Section III of the ASME Boiler and Pressure Vessel Code for ODs.

Additionally, licensees may choose to perform inelastic analysis of an affected piping system using strain limits to demonstrate structural integrity. The licensee may use these criteria until compliance with CLB criteria can be satisfied. Where a piping support is determined to be a required support system, the licensee should determine the operability of the associated piping system.

08.12 Flaw Evaluation

In accordance with Title 10 of the Code of Federal Regulations (10 CFR) 50.55a(g)/50.55a(f), structural integrity must be maintained in conformance with ASME Code Section XI for those parts of a system that are subject to ASME Code requirements. 10 CFR 50.55a(g)(4) further requires, “Throughout the service life of a boiling or pressurized water-cooled nuclear power facility, components (including supports) which are classified as ASME Code Class 1, Class 2, and Class 3 must meet the requirements, except design and access provisions and pre-service examination requirements, set forth in Section XI…”

ASME Section XI is generally written for pre-service and in-service examinations and any identified flaw. ASME Section XI, Article IWA 3000 contains material and weld examination flaw acceptance standards. If flaws are found in components for which ASME Section XI has no acceptance standards, then the construction code is to be used to establish the acceptance standards. This is supported by Sub-article IWA-3100(b) which states “if acceptance standards for a particular component, Examination Category, or examination method are not specified in this Division [Division 1] then flaws that exceed the acceptance standards for materials and welds specified in the Section III Edition applicable to the construction of the component shall be evaluated to determine disposition.” The ASME Code contains requirements describing acceptable means of performing pre-service and in-service inspection of welds and certain other locations in piping, vessels, and other pressure boundary components. For pre-service and inservice inspections, the ASME Code also specifies acceptable flaw sizes based on the material type, location, and service of the system within which the flaw is discovered. If the flaw exceeds these specified acceptable flaw sizes, the ASME Code describes an alternate method by which a calculation may be performed to evaluate the acceptability of the flaw. Several “Nonmandatory Appendices” in Section XI provide evaluation methodology for flaws in ASME Code components. While ASME Section XI does not specifically provide flaw acceptance standards for components other than those specified in Table IWB-2500-1, Table IWC-2500-1 and Table IWD-2500-1, its methods and standards may be applied to other components when appropriate as determined by the licensee.

The NRC is aware that the ASME Section XI Executive Committee stated through Code Interpretations (XI-1-92-03 and XI-1-92-19 [Question 2]) that the corrective action requirements of the ASME Code Section XI IWA-5250 are not required to be implemented when leakage is found outside of the performance of an ASME Code required pressure test and VT-2 examination. However, it is the NRC’s position that the provisions of the ASME BPV Code Section XI are incorporated by reference in 10 CFR 50.55a and are applicable at all times because they do not, by their own terms, limit application to ASME Code examinations. For potentially degraded components discovered between in-service inspections, licensees may use reasonable engineering judgment to determine whether the component is operable unless the ASME Code explicitly states otherwise. For Class 1, 2, and 3 components, ASME BPV Section XI provides specific criteria for determining whether a component is “acceptable for service,” and there are no provisions for temporary acceptance of flaws. However, Nonmandatory Appendix U to Chapter XI provides criteria for temporary acceptance of flaws or degradation in some Class 2 and 3 moderate energy components (i.e., all piping, vessels, and tanks that are below a certain temperature and pressure threshold). Licensees may use Nonmandatory Appendix U to determine that a flawed component is temporarily acceptable for service under the ASME Code. However, the Nonmandatory Appendix U provides criteria only for the “integrity” of the degraded component. Nonmandatory Appendix U specifically makes the “Owner” (i.e., licensee) responsible for demonstrating operability in light of the flaw. To determine that Class 2 or 3 piping is operable, licensees must evaluate the integrity of the component according to Nonmandatory Appendix U. Licensees may use reasonable engineering judgment to select methods for other operability considerations.

ASME Class 1 Components

When flaws in ASME Class 1 components do not meet ASME Code or construction code acceptance standards, the requirements of an NRC accepted ASME code case as listed in Section C.1 and C.2 of Regulatory Guide (RG) 1.147, “Inservice Inspection Code Case Acceptability, ASME Section XI, Division 1” (herein RG 1.147), the component should be declared inoperable because this is indicative of unacceptable material degradation which could cause further deterioration if left in service. The NRC position is that satisfaction of ASME Code acceptance standards is the minimum necessary for operability of Class 1 pressure boundary components because of the importance of the safety function being performed.

ASME Class 2 and 3 Components

When a flaw is identified in ASME Class 2 or Class 3 components, the licensee should evaluate and determine if the flaw meets ASME Code, construction code acceptance standards, an

approved alternative or the requirements of an NRC-accepted ASME code case as listed in RG 1.147. In addition, the licensee may use NRC issued Generic Letter (GL) 90-05, “Guidance for Performing Temporary Non-Code Repair of ASME Code Class 1, 2, and 3 Piping,” to evaluate the flaw. GL 90-05 provides analysis tools, acceptance standards and allow non-code repairs of code Class 3 piping when a code repair was determined to be impractical. The scope of GL 90-05 is limited to Class 3 systems, but it does address moderate and high-energy systems.

GL 90-05 preceded the ASME Code cases, which address the structural integrity of components containing flaws. However, the definition of moderate energy systems is consistent with these code cases, which came later. GL 90-05 permits licensees to consider either the “through-wall flaw” or the “wall thinning” flaw evaluation approach when assessing the structural integrity of Class 3 piping with identified flaws where no leakage is present. If the flaw is found acceptable by the “wall thinning” approach, or by the “through-wall flaw” approach, and no leakage is present, immediate repair of the flaw is not required and the component can be declared operable. In either case, the licensee should submit a relief request to the NRC and comply with the guidelines provided for flaw repair and monitoring. The relief request is to justify performing a temporary non-code repair in lieu of the Code repair due to the hardship of performing the required “code repair” at the time. Compensatory actions may be implemented by the licensee without NRC staff review and approval, provided the compensatory action does not involve a non-code repair to the piping system or supports and the compensatory action can be implemented in accordance with 10 CFR 50.59.

If it is identified that a flaw does not meet the criteria in ASME Code, construction code acceptance standards, or an NRC-accepted ASME code case as listed in RG 1.147, the component should be declared inoperable and the applicable TS action statement is to be addressed at that time. Alternatively, a relief request/alternative can be submitted and at a minimum, verbally approved by the NRC before the TS completion time expires.

The table below summarizes methods for evaluating structural integrity of defects found in boiling or pressurized water-cooled nuclear power facilities on components (including supports) classified as ASME Code Class 1, Class 2, and Class 3 components.

Methods Acceptable to Evaluate Structural Integrity

Pipe

Class/Energy

ASME Code Section

XI/ Construction

Code

NRC Approved

Alternative e.g. RG

approved code case

code case

N-513 GL 90-05

Class 1/HE X X

Class 2/HE X X

Class 2/ME X X X

Class 3/HE X X X

Class 3/ME X X X X

When a defect is identified, the component must be restored to meet ASME Code, construction

code requirements or an NRC-accepted ASME code case as listed in RG 1.147., or an NRC

approved alternative. If this involves physical changes to the component, these changes must

be completed in accordance with ASME Section XI, IWA-4000.

08.13 Operational Leakage from ASME Code Class 1, 2, and 3 Components

The NRC staff does not consider through-wall leakage in components to be in accordance with

the intent of the ASME Code or construction code, unless intentionally designed to be there

such as sparger flow holes. Therefore, components with through-wall leakage would not meet

ASME Section XI or construction code requirements. Thus, unless a 100% through-wall flaw is

evaluated and found acceptable using an applicable methodology as described in the table

above and in which all provisions are met including any additional requirements or limitations

imposed (e.g. by the NRC approved code case), the system or component does not

demonstrate structural integrity.

10 CFR 50.55a requires that the structural integrity of ASME Code Class 1, 2, and 3

components be maintained in accordance with the ASME Code or construction code

acceptance standards. If a leak is discovered in a Class 1, 2, or 3 component while conducting

an in-service inspection, maintenance activity, refueling outage, or during facility operation,

appropriate corrective measures to repair or replace the leaking component must be performed

in accordance with IWA-4000 of Section XI.

ASME Class 1 Components

Leakage from the reactor coolant system is limited to specified values in the TS depending on

whether the leakage is from identified, unidentified, or specified sources such as the steam

generator tubes or reactor coolant system pressure isolation valves. If the leakage exceeds TS

limits, the applicable LCO must be declared not met and the associated action statements must

be entered. For identified reactor coolant system leakage within the TS limits, the licensee

should evaluate the condition (i.e., the leaking component) to determine if an OD is required.

The licensee should also evaluate any impact the leakage has (if any) on nearby components

and their ability to perform their specified safety function(s).

The operational leakage TS LCO does not permit any reactor coolant pressure boundary

leakage. Upon discovery of leakage from a Class 1 pressure boundary component (pipe wall,

valve body, pump casing, etc.), the licensee must isolate the component or take actions in

accordance with TS. If the leak cannot be isolated, the leaking component should be declared

inoperable.

ASME Class 2 and 3 Components

Upon discovery of leakage from a TS-required Class 2 or Class 3 component (“Time of

Discovery” for Performance Indicator and risk/PRA evaluations), the component should be

evaluated to determine if the flaw is acceptable and demonstrate structural integrity.

The licensee must also assess the impact of the leak on the SSC’s ability to provide sufficient

flow for the associated mission time and any impact the leakage has (if any) on nearby

components and their ability to perform their specified safety function(s).

To evaluate the structural integrity of the leaking component, the licensee may use the criteria in

the ASME Code, the construction code, or an applicable NRC-accepted ASME code cases as

listed in RG 1.147. In addition, the licensee may evaluate the structural integrity of Class 3

piping by evaluating the flaw using the criteria of paragraph C.3.a of Enclosure 1 to GL 90-05.

If the flaw meets the GL 90-05 “through-wall flaw” criteria, the piping is operable. If the flaw is

found acceptable by the “through-wall flaw” approach, a “non-code” repair may be proposed and

made following NRC staff review and approval. A non-code repair is a repair not in compliance

with the construction code or ASME Section XI. GL 90-05 requires “non-code” repairs of Class

3 high-energy systems to have load-bearing capability similar to that provided by engineered

weld overlays or engineered mechanical clamps. Whenever a through-wall flaw in an ASME

Code component is evaluated and accepted using GL 90-05, a relief request from ASME Code

requirements needs to be submitted in a timely manner after completing the OD process

documentation and prior to implementing a non-code repair/replacement activity to the SSC.

The relief request is to justify the impracticality of performing the required “code repair”, the

acceptability of the “non-code” repair and the flaw monitoring. Compensatory actions may be

implemented by the licensee without NRC staff review and approval, provided the

compensatory action does not involve a non-code repair to the piping system or supports and

the compensatory action can be implemented in accordance with 10 CFR 50.59.

Alternatively, the licensee may evaluate the structural integrity of leaking Class 2 or Class 3

moderate-energy components using the criteria of ASME code case N-513, N-705 or any other

applicable NRC approved methodology as indicated in the table in Section 08.12, “Flaw

Evaluation.” If the flaw in the leaking component has adequate structural integrity in

accordance with the mentioned criteria, the component can be deemed operable. A relief

request/alternative is not necessary if the licensee determined that the flaw is acceptable and

demonstrates adequate structural integrity in accordance with the ASME Code,Section XI,

Construction Code, or relevant NRC approved code cases (except as required by GL 90-05).

Other compensatory actions may be taken by the licensee, provided these compensatory

actions are within the limitations of 10 CFR 50.59.

If the licensee decides to maintain structural integrity by mechanical clamping means, the

requirements of ASME Section XI, appendix titled “Mechanical Clamping Devices for Class 2

and 3 Piping Pressure Boundary” subject to any conditions imposed by 10 CFR 50.55a(b)(2)

must be used (in the 1995 Edition w/1997 Addenda through the 2011 Addenda this was

Mandatory Appendix IX and in the 2013 Edition it is NonMandatory Appendix W) . This

Appendix permits the use of mechanical clamping devices on a temporary basis to maintain

piping pressure boundary of Class 2 and 3 piping which is 6 inches (nominal pipe size) and

smaller and should not be used on piping larger than 2 inches (nominal pipe size) when the

nominal operating temperature or pressure exceeds 200F or 275 psig. In addition, this

Appendix cannot be applied to Class 1 piping or portions of a piping system that forms the

containment boundary.

The NRC has no specific guidance or generically approved alternatives for temporary repair of

defects (through-wall or non-through-wall) in system pressure boundary components other than

piping in Class 1, 2, or 3 high-energy system components (e.g., GL 90-05), or for Class 2 or 3

moderate-energy system components (e.g., Code Case N-513-X). Therefore, all such defects

in these components must be repaired in accordance with ASME Code requirements, or

relief/alternative from ASME Code requirements should be requested of and approval obtained

from the NRC.

Class 2 and 3 Heat Exchanger Tube Leakage

Note - This guidance is applicable to a through-wall defect in an internal heat exchanger tube

causing leakage/loss of inventory in an ASME Section XI Code Class 2 or 3 system (e.g. not

Class 1 systems). If a portion of a HX internal tube develops a through-wall defect, a

nonconformance with the design tube wall thickness and/or the tube material product

specifications may exist. Specifically, a safety-related HX is procured to meet a Construction

Code/Standard and a HX Design Specification/Drawing which typically includes details such as

the number of internal tubes, tube wall thickness, tube diameter and tube material - product

specification (e.g. 1800 tubes, 1” diameter, and 0.1” minimum wall thickness, stainless steel

type 304; SA-213/SA-213M).

The ASME Code Section XI does not provide for inservice examination or acceptance criteria

for Class 2 or 3 heat exchanger (HX) internal tubing and a minor tube leak would not normally

preclude the HX from supporting system safety functions. Therefore, if immediate repairs to

correct the leaking HX tube are not practical, continued service can be justified by establishing

an adequate technical basis. For example, HX operability could be demonstrated with an

analysis that confirms failure of a single, or additional tubes (if multiple tubes failures are

possible) will not preclude the HX from performing its safety function(s), impact other system

safety functions, or exceed NRC regulatory limits for licensed material.

Alternatively, continued HX operability could be confirmed based on an analysis that adequately

addresses each of the following elements:

• Tube Structural Integrity - An evaluation of the structural integrity of the degraded HX

tube(s) is established that considers the cause of the degradation, possible failure

mode(s), prediction of degradation growth, stability of flaw(s) under the applicable

applied load combinations. For example, the ASME Code Case N-705 “Evaluation

Criteria for Temporary Acceptance of Degradation in Moderate Energy Class 2 or 3

Vessels and Tanks”, provides a methodology for evaluation and acceptance of through

wall flaws in Class 2 and 3 components which is acceptable to the NRC.

• Tube Leakage Limiting Condition - An assessment of the HX tube degradation

progression/growth is performed which enables the establishment of the maximum time

available before reaching a limiting condition as described below:

• Time to reach the maximum structurally allowable size in accordance with the

tube structural integrity acceptance criteria established above,

• Time to reach a leakage condition that causes unacceptable HX thermal

performance or challenges other components within the system that impact

system safety functions (e.g. inventory loss from tube leakage results in

inadequate net positive suction head for system pumps),

• Time to reach a leakage condition which would result in exceeding NRC regulatory limits for licensed materials (e.g. 10 CFR Part 20 discharge limits for radioactive material), and

• Time to reach a leakage condition with an unacceptable impact to other systems structures or components (e.g. over-pressurization of systems with lower design pressures).

• Frequent monitoring is established to estimate and track increases in the tube leakage

for the affected HX. This surveillance frequency is adequate to ensure the HX is

removed from service prior to reaching a limiting leakage condition and should be at

least daily until the tube leakage impacts have been fully evaluated and a less frequent

monitoring schedule is justified.

08.14 Structural Requirements

Structures may be required to be operable by the TS, or they may be providing related support

functions for SSCs in the TS. Examples of structural degradation are concrete cracking and

spalling, excessive deflection or deformation, water leakage, rebar corrosion, cracked welds,

missing or bent anchor bolts or structural bolting, and degradation of door and penetration

sealing. If a condition with a structure is identified, the licensee should assess the capability of

the structure to perform its specified safety function(s). For structures and related support

functions, OD evaluations need to include applicable design and licensing basis loads and load

combinations. When a condition associated with a structure is discovered, an OD evaluation

should ensure that a presumption of operability remains for meeting acceptance limits for

expected load combinations. Unless adequately justified in the operability evaluation, design

basis load factors should be used for all applicable load combinations.

Physical conditions such as concrete cracking and spalling, excessive deflection or deformation

of structures, water leakage, corrosion of rebar, cracked welds, corrosion of steel members,

corrosion of anchor bolts, bent anchor bolt(s) or structural bolting of a structure or component

may be evaluated in accordance with generally accepted industry standards and guidance

documents. Where consensus standards or guidance documents are not consistent with the

physical condition (e.g., alkali-silica reaction (ASR)) the NRC inspector should consult with NRR

staff.

Later versions of ACI-318, ACI-349, ACI-359, ASME Section III, Division 1 and Division 2,

American National Standards Institute (ANSI) N-690, American Society of Civil Engineers

(ASCE) /SEI 43-05, ASCE 4, or American Institute of Steel Construction (AISC)

codes/standards may be used for operability/functionality evaluations, in lieu of the versions

specified in the design basis documents, provided all additional requirements are met, as

applicable. Additional codes/standards, recognized technical reports, or regulatory guidance

may be used; however, the licensee must justify the use of additional codes/standards or

guidance for the specific application.

ODs may rely on as-built material properties when the properties of the materials are

established based on test data and a sound statistical basis, for example:

a. Structural steel yield and tensile strength from Certified Material Test Reports may be used in lieu of the specified minimum yield and tensile strength.

b. Concrete compressive strength from cylinder tests may be used in lieu of the specified minimum design strength.

ODs may apply current regulatory guidance to reduce design basis conservatism, if applicable.

For example:

• Damping values from Regulatory Guide 1.61, “Damping Values for Seismic Design of Nuclear Power Plants” and

• Tornado and tornado missile characteristics from Regulatory Guide 1.76, “Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants.”

The NRR staff is available to support NRC inspector reviews of ODs and plant licensing bases

as necessary.

An operability evaluation that relies on methodology, modeling, or assumptions that are outside

the licensing basis, implies a condition that should be addressed in a reasonably timely manner

consistent with requirements in 10 CFR 50, Appendix B, Criterion XVI.

0326-09 REFERENCES

• 10 CFR 2, “Agency Rules of Practice and Procedure”

• 10 CFR 19, “Notices, instructions and reports to workers: inspection and investigations”

• 10 CFR 20, “Standards for protection against radiation”

• 10 CFR 21, “Reporting of defects and noncompliance”

• 10 CFR 26, “Fitness for duty programs”

• 10 CFR 30, “Rules of general applicability to domestic licensing of byproduct material”

• 10 CFR 40, “Domestic licensing of source material”

• 10 CFR 50, “Domestic licensing of production and utilization facilities”

• 10 CFR 50, Appendix A, “General Design Criteria for Nuclear Power Plants”

• 10 CFR 50, Appendix B, “Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants”

• 10 CFR 50.2, “Definitions”

• 10 CFR 50.36, “Technical specifications”

• 10 CFR 50.49, “Environmental qualification of electric equipment important to safety for nuclear power plants”

• 10 CFR 50.54, “Conditions of licenses”

• 10 CFR 50.55, “Conditions of construction permits, early site permits, combined licenses, and manufacturing licenses”

• 10 CFR 50.59, “Changes, tests and experiments”

• 10 CFR 50.63, “Loss of all alternating current power”

• 10 CFR 50.71, “Maintenance of records, making of reports”

• 10 CFR 51, “Environmental protection regulations for domestic licensing and related regulatory functions”

• 10 CFR 52, “Licenses, certifications, and approvals for nuclear power plants”

• 10 CFR 54, “Requirements for renewal of operating licenses for nuclear power plants”

• 10 CFR 55, “Operator's licenses”

• 10 CFR 70, “Domestic licensing of special nuclear material”

• 10 CFR 72, “Licensing requirements for the independent storage of spent nuclear fuel and high-level radioactive waste, and reactor- related greater than Class C waste”

• 10 CFR 73, “Physical protection of plants and materials”

• 10 CFR 100, “Reactor site criteria”

• ASME Code, Sections III and XI

• Atomic Energy Act, Section 182

• COM-106, “Control of Task Interface Agreements”

• GDC 17, “Electric Power Systems”

• GDC 21, “Protection System Reliability and Testability”

• GDC 34, “Residual Heat Removal”

• GDC 35, “Emergency Core Cooling”

• GDC 38, “Containment Heat Removal”

• GDC 41, “Containment Atmosphere Cleanup”

• GDC 44, “Cooling Water”

• GL 89-04, “Guidance on Developing Acceptable Inservice Testing Programs”

• GL 90-05, “Guidance for Performing Temporary Non-Code Repair of ASME Code Class 1, 2, and 3 Piping”

• LIC 504, “Integrated Risk-Informed Decision-Making Process for Emergent Issues”

• MD 9.27, “Organization and Functions, Office of Nuclear Reactor Regulation”

• MD 9.29, “Organization and Functions, Regional Offices”

• MD 10.158, “NRC Non-Concurrence Process”

• MD 10.159, “NRC Differing Professional Opinion Program”

• MD 10.160, “Open Door Policy”

• NEI 96-07, “Guidelines for 10 CFR 50.59 Evaluations”

• NEI 97-04, “Design Bases Program Guidelines”

• NRC Enforcement Manual, Section I-3 “Use of Enforcement Discretion”

• NUREG 1430, “Standard Technical Specifications — Babcock and Wilcox Plants”

• NUREG 1431, “Standard Technical Specifications — Westinghouse Plants”

• NUREG 1432, “Standard Technical Specifications — Combustion Engineering Plants”

• NUREG 1433, “Standard Technical Specifications — General Electric Plants (BWR/4)”

• NUREG 1434, “Standard Technical Specifications — General Electric Plants (BWR/6)”

• NUREG 1482, “Guidelines for Inservice Testing at Nuclear Power Plants - Inservice Testing of Pumps and Valves and Inservice Examination and Testing of Dynamic Restraints (Snubbers) at Nuclear Power Plants - Final Report”

• NUREG 2194, “Standard Technical Specifications, Westinghouse Advanced Passive 1000 (AP 1000) Plants”

• RG 1.147, “Inservice Inspection Code Case Acceptability, ASME Section XI, Division 1”

• RG 1.186, “Guidance and Examples for Identifying 10 CFR 50.2 Design Bases”

• RG 1.187, “Guidance for Implementation of 10 CFR 50.59, Changes, Tests, and Experiments”

• RG 1.199, “Anchoring Components and Structural Supports in Concrete”

• RG 1.61, “Damping Values for Seismic Design of Nuclear Power Plants”

• RG 1.76, “Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants”

• RIS 2001-09, “Control of Hazard Barriers”

• TSTF-505, “Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b”

• TSTF-529, “Clarify Use and Application Rules”

Attachment 1 - Revision History for IMC 0326, “Operability Determinations”

”

Commitment

Tracking

Number

Accession

Number

Issue Date

Change Notice

Description of Change Descriptio

n of

Training

Required

and

Completio

n Date

Comment

Resolution and

Closed Feedback

Form Accession

Number

(Pre-Decisional,

Non-Public

Information)

None ML12345A578

01/31/14

CN 14-004

TG Part 9900 Technical Guidance STSODP “Operability

Determinations & Functionality Assessments for Resolution of

Degraded or Nonconforming Conditions Adverse to Quality or

Safety” is updated and reissued as IMC 0326, “Operability

Determinations & Functionality Assessments For Conditions

Adverse To Quality Or Safety.” The pertinent changes includes

the following:

• Scope of SSCs for Operability Determinations. The

parenthetical reference to the support systems (diesel fuel oil,

lube oil and starting air) in the guidance is replaced with Nuclear

Service Water and Station Battery examples in a footnote. The

footnote discussion states that all design functions may not be

within the scope of an operability determination but may be

within the scope of a Functionality Assessment.

• Definition Functional – Functionality. CLB function(s) of SSCs

not controlled by TS may include the ability to perform a

necessary and related support function for an SSC(s) controlled

by TS. Definition Operable/Operability.

Plant-specific operability definitions may refer to either “specified

functions” or “specified safety functions” when describing the

CLB of a structure, system or component and that these are

descriptive terms that have the same meaning when used in

operability determinations

Incorporated

into iLearn

Operability

Refresher

Training

None

Issue Date: 09/30/19 Att 1-2 0326

Commitment

Tracking

Number

Accession

Number

Issue Date

Change Notice

Description of Change Description

of

Training

Required and

Completion

Date

Comment

Resolution and

Closed Feedback

Form Accession

Number

(Pre-Decisional,

Non-Public

Information)

• Definition Specified Function/Specified Safety Function.

Refers to the “specified safety functions” in the facility CLB.

• Operability Determination Process. “PRA functional” is used

to calculate risk-informed Completion Times but the term

does not apply to operability determinations.

• Assessing Potential Degraded or Nonconforming Conditions.

The time required should be limited to the time necessary to

understand the known or expected extent of degradation or

nonconforming condition and that an extended delay to

complete an investigation or cause analysis is not appropriate.

• Presumption of Operability. Includes performing TS

surveillances to assure the necessary quality of systems and

components is maintained, that facility operation will be within

safety limits, and that the limiting conditions for operation will be

met.

• Functionality Assessments. Functionality assessments are

appropriate whenever a review, TS surveillance, or other

information calls into question the ability of an SSC not

required to be operable by TS to perform its CLB function(s).

A CLB function(s) may also perform a necessary and related

TS support function for a SSC controlled by TS.

• Enforcement Discretion. Revised to be consistent with MC 0410.

Issue Date: 09/30/19 Att 1-3 0326

Commitment

Tracking

Number

Accession

Number

Issue Date

Change Notice

Description of Change Description

of

Training

Required and

Completion

Date

Comment

Resolution and

Closed Feedback

Form Accession

Number

(Pre-Decisional,

Non-Public

Information)

• Compensatory Measures. Used to restore inoperable SSCS to

operable but degraded status should be documented in a

prompt operability determination. Compensatory measures may

include temporary facility or procedure changes that impact

other aspects of the facility which may require applying the

requirements of 10 CFR 50.59.

• Missed Technical Specifications Surveillance. Revised to clarify

use of SR 3.0.3 does not apply when a TS Surveillance has never

been performed.

• Relationship Between the General Design Criteria and the

Technical Specifications. Revised to address recent staff

licensing issues on the need to clarify the relation between TS

and the GDC.

• Single Failures. Revised to complete the list of applicable GDC

and to clarify its language.

Issue Date: 09/30/19 Att 1-4 0326

Commitment

Tracking

Number

Accession

Number

Issue Date

Change Notice

Description of Change Description

of Training

Required

and

Completion

Date

Comment

Resolution and

Closed Feedback

Form Accession

Number

(Pre-Decisional,

Non-Public

Information)

None ML15237A077

11/05/15

CN 15-023

Added Appendix C.07 to allow the use of Seismic Margin Analyses

Appendix C.13, “Structural Requirements” is revised to include

reinforced concrete and steel structural components inspection

acceptance criteria guidance for operability determinations and

functionality assessments. This change is proposed by Reactor

Oversight Program Feedback Form 9900 ─ 1794.

None ML15236A055

9900-1794

ML15308A230

ML15328A099

12/03/15

CN 15-028

This is an ERRATA to correct the inadvertent release of a previous

version.

None ML15236A055

9900-1794

ML15308A230

ML16306A386

11/20/17

CN 17-026

Appendixes C.12 and C.13 are revised to clarify expectations with

focus on methodologies acceptable for NRC when evaluating

operational leakage and timing of relief request. A new section on

heat exchanger tube leakage is added. A general revision of IMC 0326 was made to improve clarity and flow.

None ML16309A001

0326-2281

ML17324A409

ML19197A133 Draft revision of IMC 0326 to be discussed during 8/1/19 public

meeting.

None N/A

ML19273A878

10/01/19

CN 19-032

Complete re-write. Title changed to “Operability Determinations.”

New sections added to bring the format consistent with other IMCs

(Objectives (0326-02), Responsibilities and Authorities (0326-05),

and Reference (0326-09) Items removed (Functionality

Assessment, Anything CAP related, Immediate and Prompt

Operability Determinations, Appendix B, and Attachments 1 and 2)

Items relocated (Appendix A is now Section 0326-07 and

Appendix C is now Section 0326-08)

Training to

be held in

October

2019

ML19269D278

0326-2304

ML19273A079