ML003740149

Regulatory Gudie 1.175 (Draft Was Issued as DG-1062), an Approach for Plant-Specific, Risk-Informed Decisionmaking: Inservice Testing

ML003740149
Person / Time
Issue date:	08/31/1998
From:	Office of Nuclear Regulatory Research
To:
References
RG-1.175
Download: ML003740149 (24)

Text

U.S. NUCLEAR REGULATORY COMMISSION August 1998 REGULATORY GUIDE OFFICE OF NUCLEAR REGULATORY RESEARCH REGULATORY GUIDE 1.175 (Draft was Issued as DG-1 062)

AN APPROACH FOR PLANT-SPECIFIC, RISK-INFORMED DECISIONMAKING: INSERVICE TESTING A. INTRODUCTON

Background

During the last several years both the U.S. Nuclear Regulatory Commission (NRC) and the nuclear indus try have recognized that probabilistic risk assessment (PRA) has evolved to be more useful in supplementing traditional engineering approaches in reactor regula tion. After the publication of its policy statement (Ref.

1) on the use of PRAin nuclear regulatory activities, the Commission directed the NRC staff to develop a regu latory framework that incorporated risk insights. That framework was articulated in a November 27,1995, pa per to the Commission (Ref. 2). This regulatory guide, which addresses inservice testing (IST) of pumps and valves, and its companion regulatory documents (Refs.

3-8) implement, in part, the Commission policy state ment and the staff's framework for incorporating risk insights into the regulation of nuclear power plants.

The NRC's policy statement on probabilistic risk analysis encourages greater use of this analysis tech nique to improve safety decisionmaking and improve regulatory efficiency. One activity under way in re sponse to the policy statement is the use of PRAin sup port of decisions to modify an individual plant's IST program. Licensee-initiated IST program changes that are consistent with currently approved staff positions (e.g., regulatory guides, standard review plans, branch technical positions) are normally evaluated by the NRC staff using traditional engineering analyses. In such cases, the licensee would not be expected to submit risk information in support of the proposed change.

Licensee-initiated IST program change requests that go beyond current staff positions may be evaluated by the staff using traditional engineering analyses as well as the risk-informed approach set forth in this regulatory guide. A licensee may be requested to submit supple mental risk information if such information is not pro vided in the proposed risk-informed inservice testing (RI-IST) program submitted by the licensee. If risk in formation on the proposed RI-IST program is not pro vided to the staff, the staff will review the information provided by the licensee to determine whether the ap plication can be approved based upon the information provided using traditional methods, and the staff will either approve or reject the application based upon the review. For those licensee-initiated RI-IST program changes that a licensee chooses to support (or is re quested by the staff to support) with risk information, this regulatory guide describes an acceptable method for assessing the nature and impact of proposed RI-IST program changes by considering engineering issues and applying risk insights. Licensees submitting risk USNRC REGULATORY GUIDES The guides ae Issued In the following ten broad divisions:

Regulatory Guides awe Issued to describe and make available to the public auch Wlorma ton as methods acceptable to he NRC staff for Implementing specific parts of the Com-

1. Power Reactors

6. Products mission's regulations, lechniques used by the staff inevaluating specific problemr or pos-

2. Research and Test Reactors

7. Transportation tulated accidents, and data needed by the NRC staff in its review of applications for per-3a Fuels and Materials Facilities

& Occupational Health mits aid licenss. Regulatory guides are not substitutes for regulations, and comprmence

4. Environmental and Sting

9. Antitrust and Frnancial Review with them i not requlred. Methodsnd solutMonsdifferentfrom ho9 setoutIntheguides materials "n Plant Protection 10L General wil be acceptable Ithey provide a basis for the findings requisite to the Issuance or con Unuance of a permit or license by the Commission.

Single copies of regulatory goides may be obtained free of charge by writing the Repro duction and Distribution Services Section, Office of the Chief Information Officer, U.S. Nu This gilds was Isued after consideration of iomments racaived from the public-Corn-dear Regulatory Commission, Washington, DC 20555-0001; or by fax at (301)415-2289; menits end suggestions lor improvements hn thesae guides areencouraged at all times, on or by a-mail to GRWl@NRC.GOV.

deswilbe revised, as appropriate, to accommodate comments and to reflect new In ation or aipennc.

Issued guides may also be purchased from the National Technical Information Service on Written commerts may be aubmitted lo the Rules Review and Directives Branch, ADM, a standing order basis. Details on this service may be obtained by writing NTIS, 5285 Port U.S. Nuclear Regula Commission, Washington, DC 20555-0001.

Royal Road, Springfleld, VA 22161.

information should address each of the principles of risk-informed regulation discussed in Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant Specific Changes to the Licensing Basis" (Ref. 3) and repeated in this guide. Licensees should identify how chosen approaches and methods (whether they are quantitative or qualitative, traditional or probabilistic),

data, and criteria for considering risk are appropriate for the decision to be made.

IST of snubbers was not addressed in this regula tory guide, however, licensees interested in implement ing a RI-IST program for snubbers may submit an alter native to the NRC for consideration.

Relationship to the Maintenance Rule 10 CFR 50.65 The Maintenance Rule, Section 50.65, "Require ments for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," of 10 CFR Part 50, "Domes tic licensing of Production and Utilization Facilities,"

requires that licensees monitor the performance or con dition of structures, systems, or components (SSCs) against licensee-established goals in a manner suffi cient to provide reasonable assurance that such SSCs are capable of fulfilling their intended function. Such goals are to be established, where practicable, com mensurate with safety, and they are.to take into account industrywide operating experience. When the perfor mance or condition of a component does not meet es tablished goals, appropriate corrective actions are to be taken.

Component monitoring that is performed as part of the Maintenance Rule implementation can be used to satisfy monitoring needs for RI-IST, and for such cases, the performance criteria chosen should be compatible with both the Maintenance Rule requirements and guidance and the RI-IST guidance provided in this guide.

Purpose and Scope Current IST programs are performed in com pliance with the requirements of 10 CFR 50.55a(f) and with Section XI of the ASME Boiler and Pressure Ves sel Code (Ref. 9), which are requirements for all plants.

This regulatory guide describes an acceptable alterna tive approach applying risk insights from PRA to make changes to a nuclear power plant's IST program. An ac companying Standard Review Plan (SRP) (Ref. 7) has been prepared for use by the NRC staff in reviewing RI IST applications. Another guidance document, Regula tory Guide 1.174 (Ref. 3), is referenced throughout this report. Regulatory Guide 1.174 provides overall guid-ance on the technical aspects that are common to devel oping acceptable risk-informed programs for all ap plications such as 1ST (this guide), inservice inspection, graded quality assurance, and technical specifications.

This regulatory guide provides application specific details of a method acceptable to the NRC staff for developing RI-IST programs and supplements the information given in Regulatory Guide 1.174. This guide provides guidance on acceptable methods for uti lizing PRA information with established traditional en gineering information in the development of RI-IST programs that have improved effectiveness regarding the utilization of plant resources while still maintaining acceptable levels of quality and safety.

In this regulatory guide, an attempt has been made to strike a balance in defining an acceptable process for developing RI-IST programs without being overly pre scriptive. Regulatory Guide 1.174 identifies a list of high-level safety principles that must be maintained during all risk-informed plant design or operational changes. Regulatory Guide 1.174 and this guide iden tify acceptable approaches for addressing these basic high-level safety principles; however, licensees may propose other approaches for consideration by the NRC staff. It is intended that the approaches presented in this guide be regarded as examples of acceptable practice and that licensees should have some degree of flexibil ity in satisfying regulatory needs on the basis of their accumulated plant experience and knowledge.

Organization This regulatory guide is structured to follow the ap proach given in Regulatory Guide 1.174. The discus sion, Part B, gives a brief overview of a four-element process described in Regulatory Guide 1.174 as applied to the development of an RI-IST program. This process is iterative and generally not sequential. Part C, Regula tory Position, provides a more detailed discussion of the four elements including acceptance guidelines. In Part C, Regulatory Position 1 addresses the first ele ment in the process in which the proposed changes to the IST program are described. This description is needed to determine what supporting information is needed and to define how subsequent reviews will be performed. Regulatory Position 2 contains guidance for performing the engineering evaluation needed to support the proposed changes to the IST program (sec ond process element). Regulatory Position 3 addresses program implementation, performance monitoring, and corrective action (third element). Regulatory Posi tion 4 addresses documentation requirements (fourth element) for licensee submittals to the NRC and identi fies additional information that should be maintained in 1.175-2

the licensee's records in case later review or reference is needed. The appendix contains additional guidance for dealing with certain IST-related issues such as might arise during the deliberations of the licensee in carrying out integrated decisionmaking.

Relationship to Other Guidance Documents This regulatory guide provides detailed guidance on approaches to implement risk insights in IST pro grams that are acceptable to the NRC staff. This application-specific guide makes extensive reference to Regulatory Guide 1.174 (Ref. 3) for general guid ance.

Companion regulatory guides (Refs. 4 and 5) ad dress graded quality assurance and technical specifica tions, and contain guidance similar to that given in this RI-ISTguide. SRP chapters associated with the risk-in formed regulatory guides are available (Refs. 6-8). The SRP chapters are intended for NRC use during the re view of industry requests for risk-informed program changes. SRP Chapter 3.9.7 (Ref. 7) addresses RI-IST and is consistent with the guidance given in this regula tory guide.

In the 1995-1998 period, the industry developed a number of documents addressing the increased use of PRAin nuclear plant regulation. The American Society of Mechanical Engineers (ASME) developed guide lines for risk-based IST (Ref. 10) and later initiated code cases addressing IST component importance ranking and testing of certain plant components using risk insights. The Electric Power Research Institute (EPRI) published its "PSA Applications Guide" (Ref.

11) to provide utilities with guidance on the use of PRA information for both regulatory and nonregulatory ap plications. The Nuclear Energy Institute (NEI) has also been developing guidelines on risk-based IST (Ref.

12). These documents have provided useful viewpoints and proposed approaches for the staff's consideration during the development of the NRC regulatory guid ance documents.

Abbreviations ASME American Society of Mechanical Engi neers CCF CDF EPRI FV GQA HEP HSSC common cause failure core damage frequency Electric Power Research Institute Fussell-Vesely risk importance measure graded quality assurance human error probability high safety-significant component I1.1 ISI IST LERF LSSC MCS NEI NUMARC inservice inspection inservice testing containment large early release frequency low safety-significant component minimal cut set Nuclear Energy Institute Nuclear Utilities Management Research Council O&M Operations and Maintenance (ASME committee)

PRA probabilistic risk assessment PSA probabilistic safety assessment RAW RI-IST SRP SSCs THERP USAR USNRC risk achievement worth risk importance measure risk-informed IST (e.g., RI-IST programs) standard review plan structures, systems, and components Technique for Human Error Rate Predic tion Updated Safety Analysis Report U.S. Nuclear Regulatory Commission The information collections contained in this regu latory guide are covered by the requirements of 10 CFR Part 50, which were approved by the Office of Manage ment and Budget, approval number 3150-0011. The NRC may not conduct or sponsor, and a person is not required to respond to, a collection of information un less it displays a currently valid OMB control number.

B. DISCUSSION Key Safety Principles Regulatory Guide 1.174 (Ref. 3) identifies five key safety principles to be met for all risk-informed applica tions and to be explicitly addressed in risk-informed plant program change applications. As indicated in Regulatory Guide 1.174, while these key principles are stated in traditional engineering terminology, efforts should be made wherever feasible to utilize risk evalua tion techniques to help ensure and to show that these principles are met. These key principles and the loca tion in this guide where each is addressed for RI-IST programs are as follows:

1. The proposed change meets the current regu lations unless it Is explicitly related to a requested exemption or rule change. (This principle is ad dressed in Regulatory Positions 1.1 and 2.1 of this guide.)

.75-3

Figure 1 Principles of Risk-Informed Regulation

2. The proposed change is consistent with the defense-in-depth philosophy. (Regulatory Position 2.2.1)

3. The proposed change maintains sufficient safety margins. (Regulatory Position 2.2.2)

4. When proposed changes result in an increase in core damage frequency or risk, the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement. (Regu latory Positions 2.3, 2.4)

5. The impact of the proposed change should be monitored using performance measurement strategies. (Regulatory Position 3.3)

Regulatory Guide 1.174 gives additional guidance on the key safety principles applicable to all risk informed applications. Figure I of this guide, repeated from Regulatory Guide 1.174, illustrates the consider ation of each of these principles in risk-informed deci sion making.

A Four-Element Approach to Risk-Informed Decisionmaking for Inservice Testing Programs Regulatory Guide 1.174 (Ref. 3) describes a four element process for developing risk-informed regulato ry changes. The process is highly iterative. Thus, the fi nal description of the proposed change to the IST program as defined in Element I depends on both the analysis performed in Element 2 and the definition of the implementation of the IST program performed in Element 3. The Regulatory Position of this guide pro vides guidance on each element.

While IST is, by its nature, a monitoring program, it should be noted that the monitoring referred to in Ele ment 3 is associated with making sure that the assump-tions made about the impact of the changes to the IST program are not invalidated. For example, if the test in tervals are based on an allowable margin to failure, the monitoring is performed to make sure that these mar gins are not eroded. An overview of this process specif ically related to RI-IST programs is given in this sec tion. The order in which the elements are performed may vary or occur in parallel, depending on the particu lar application and the preference of the program devel opers.

Element 1: Define Proposed Changes to the Inservice Testing Program.

The purpose of this element is to identify (1) the particular components that would be affected by the proposed changes in testing practices, including those currently in the IST program and possibly some that are not (if it is determined through new information and in sights such as the PRA that these additional compo nents are important in terms of plant risk) and (2) spe cific revisions to testing schedules and methods for the chosen components. Plant systems and functions that rely on the affected components should be identified.

Regulatory Position 1 gives a more detailed description of Element 1.

Element 2: Perform Engineering Analysis In this element, both traditional engineering and PRA methods are used to help define the scope of the changes to the IST program and to evaluate the impact of the changes on the overall plant risk. Areas that are to be evaluated include the expected effect of the proposed RI-IST program on the design basis and severe acci dents, defense-in-depth attributes, and safety margins.

In this evaluation, the results of traditional engineering and PRA methods are to be considered together in an integrated decision process that will be carried over into 1.175-4

the implementation phase described below in Element

3. PRA results should be used to provide information for the categorization of components into groupings of low safety-significant components (LSSC) and high safety-significant components (HSSQ. Components in the LSSC group would then be candidates for less rigorous testing when compared with those in the HSSC group. When the revised IST plan has been de veloped, the plant-specific PRA should be used to eval uate the effect of the planned program changes on the overall plant risk as measured by core damage fre quency (CDF) and containment large early release fre quency (LERF).

During the integration of all the available informa tion, it is expected that many issues will need to be re solved through the use of a well-reasoned judgment process, often involving a combination of different en gineering skills. This activity has typically been re ferred to in industry documents as being performed by an "expert panel." As discussed further at the end of this section and in the appendix, this important process is the licensee's responsibility and may be accomplished by means other than a formal panel. In any case, the key safety principles discussed in this guide must be ad dressed and shown to be satisfied regardless of the ap proach used for RI-IST program decisionmaking.

Additional application-specific details concerning RI-IST programs and Element 2 are contained in Regu latory Positition 2 of this guide.

Element 3: Define Implementation and Monitoring Program In this element, the implementation plan for the IST program is developed. This involves determining both the methods to be used and the frequency of test ing. The frequency and method of testing for each com ponent is commensurate with the component's safety significance. To the extent practicable, the testing methods should address the relevant failure mecha nisms that could significantly affect component reli ability. In addition, a monitoring and corrective action program is established to ensure that the assumptions upon which the testing strategy has been based contin ue to be valid, and that no unexpected degradation in performance of the HSSCs and LSSCs occurs as a re sult of the change to the IST program. Specific guid ance for Element 3 is given in Regulatory Position 3.

Element 4: Submit Proposed Change The final element involves preparing the documen tation to be included in the submittal and the documen tation to be maintained by the licensee for later refer ence, if needed. The submittal will be reviewed by the NRC according to SRP Chapter 19 and Section 3.9.7 (Refs. 6 and 7). Guidance on documentation require ments for RI-IST programs is given in Regulatory Posi tion 4 of this regulatory guide.

In carrying out this process, the licensee will make a number of decisions based on the best available infor mation. Some of this information will be derived from traditional engineering practice and some will be pro babilistic in nature resulting from PRA studies. It is the licensee's responsibility to ensure that its RI-IST pro gram is developed using a well-reasoned and integrated decision process that considers both forms of input in formation (traditional engineering and probabilistic) in a complementary manner. This important decisionma king process may at times require the participation of special combinations of licensee expertise (licensee staff), depending on the technical and other issues in volved, and may at times also need outside consultants.

Industry documents have generally referred to the use of an expert panel for such decisionmaking. The appen dix to this guide discusses a number of IST-specific is sues such as might arise in expert panel deliberations.

C. REGULATORY POSITION

1.

ELEMENT 1: DEFINE PROPOSED CHANGES TO INSERVICE TESTING PROGRAM In this first element of the process, the proposed changes to the IST program are defined. This involves describing what IST components (e.g., pumps and valves) will be involved and how their testing would be changed. Also included in this element is identification of supporting information and a proposed plan for the licensee's interactions with the NRC throughout the implementation of the RI-IST.

1.1 Description of Proposed Changes A full description of the proposed changes in the IST program is prepared. This description would in clude:

(1) Identification of the aspects of the plant's design, operations, and other activities that require NRC approval that would be changed by the proposed RI-IST program. This will provide a basis from which the staff can evaluate the proposed changes.

(2) Identification of the specific revisions to existing testing schedules and methods that would result from implementation of the proposed program.

(3) Identification of the components in the plant that are directly and indirectly involved with the pro posed testing changes. Any components that are not presently covered in the plant's IST program 1.175-5

but are determined to be important to safety (e.g.,

through PRA insights) should also be identified.

In addition, the particular systems that are affected by the proposed changes should be identified since this information is an aid in planning the supporting engineering analyses.

(4) Identification of the information that will be used in support of the changes. This will include perfor mance data, traditional engineering analyses, and PRA information.

(5) A brief statement describing the way how the pro posed changes meet the objectives of the Commis sion's PRA Policy Statement (Ref. 1).

1.2 Inservice Testing Program Scope IST requirements for certain safety-related pumps and valves are specified in 10 CFR 50.55a. These com ponents are to be tested according to the requirements of Section XI of the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code (the Code) (Ref. 9) or the applicable ASME Operations and Maintenance (O&M) Code (Ref. 13).

For acceptance guidelines, the licensee's RI-IST program would include all components in the current Code-prescribed IST program. In addition, the pro gram should include those non-Code components that the licensee's integrated decisionmaking process cate gorized as HSSC.

1.3 RI-IST Program Changes After Initial Approval This section provides guidance on reporting of pro gram activities. The NRC will formally review the changes proposed to RI-IST programs that have al ready received NRC approval.

The licensee should implement a process for deter mining when proposed RI-IST program changes re quire formal NRC review and approval. Changes made to the NRC-approved RI-IST program that could affect the process and results that were reviewed and ap proved by the NRC staff should be evaluated to ensure that the basis for the NRC staff's prior approval has not been compromised. All changes should be evaluated against the change mechanisms described in the regula tions (e.g., 10 CFR 50.55a, 10 CFR 50.59) to determine whether NRC review and approval is required prior to implementation. If there is a question regarding this is sue, the licensee should seek NRC review and approval prior to implementation.

For acceptance guidelines, licensees can change their RI-IST programs consistent with the process and results that were reviewed and approved by the NRC staff (i.e., as defined in the approved RI-IST program description). Prior to implementation, a process or pro cedures should be in place to ensure that any such changes to the previously approved RI-IST program meet the acceptance guidelines of this section.

The cumulative impact of all RI-IST program changes (initial approval plus later changes) should comply with the acceptance guidelines given in Regu latory Position 2.3.3 below.

Examples of changes to RI-IST programs that would require NRC's review and approval include, but are not limited to, the following:

Changes to the RI-IST program that involve pro grammatic changes (e.g., changes in the accep tance guidelines used for the licensee's integrated decisionmaking process),

Component test method changes that involve devi ation from the NRC-endorsed Code requirements, NRC-endorsed Code Case, or published NRC guidance.

Examples of changes to RI-IST programs that would not require NRC's review and approval include, but are not limited to, the following:

Changes to component groupings, test intervals, and test methods that do not involve a change to the overall RI-IST approach that was reviewed and ap proved by the NRC, Component test method changes that involve the implementation of an NRC-endorsed ASME Code or an NRC-endorsed Code Case, Recategorization of components because of expe rience, PRA insights, or design changes, but not programmatic changes when the process used to recategorize the components is consistent with the RI-IST process and results that were reviewed and approved by the NRC.

2. ELEMENT 2: PERFORM ENGINEERING ANALYSIS As part of defining the proposed change to the li censee's IST program, the licensee should conduct an engineering evaluation of the proposed change using a combination of traditional engineering methods and PRA. The major objective of this evaluation is to con firm that the proposed program change will not com promise defense in depth and other key safety prin ciples described in this guide. Regulatory Guide 1.174 (Ref. 3) provides general guidance for the performance of this evaluation, to be supplemented by the RI-IST specific guidance in this guide.

1.175-6

2.1 Licensing Considerations 2.1.1 Evaluating the Proposed Changes On a component-specific basis, the licensee should determine whether there are instances in which the pro posed IST program change would affect the design, op erations, and other activities at the plant, and the li censee should document the basis for the acceptability of the proposed change by addressing the key prin ciples. In evaluating proposed changes to the plant, the licensee should consider other licensing basis docu ments (e.g., technical specifications, Final Safety Anal ysis Report (FSAR), responses to NRC generic letters) in addition to the IST program documentation.

The principal focus should be on the use of PRA findings and risk insights in support of proposed changes to a plant's design, operation, and other activi ties that require NRC approval. Such changes include (but are not limited to) license amendments under 10 CFR 50.90, requests for use of alternatives under 10 CFR 50.55a, and exemptions under 10 CFR Part 12.

However, the reviewer should note that there are certain docketed commitments that are not related to regula tory requirements (e.g., commitments made by the li censee in response to NRC Generic Letter 89-10 or 96-05) that may be changed by licensees via processes other than as described in NRC regulations (e.g., con sistent with Reference 14).

A broad review of the plant's design, operations, and other activities may be necessary because proposed IST program changes could affect requirements or commitments that are not explicitly stated in the licens ee's FSAR or IST program documentation. Further more, staff approval of the design, operation, and main tenance of components at the facility have likely been granted in terms other than probability, consequences, or margin of safety (i.e., the 10 CFR 50.59 criteria).

Therefore, it may also be appropriate to evaluate pro posed IST program changes against other criteria (e.g.,

criteria used in either the licensing process or to deter mine the acceptability of component design, operation and maintenance).

The Director of the Office of Nuclear Reactor Reg ulation is allowed by 10 CFR 50.55a to authorize alter natives to the specific requirements of this regulation provided that the proposed alternative will ensure an acceptable level of quality and safety. Thus, alterna tives to the acceptable RI-IST approaches presented in this guide may be proposed by licensees so long as sup porting information is provided that demonstrates that the key principles discussed in Chapter 2 of this guide are maintained.

For acceptance guidelines, the licensee should re view applicable documents to identify proposed changes to the IST program that would alter the design, operations, and other activities of the plant. On a com ponent-specific basis, the licensee should (1) identify instances in which the proposed RI-IST program change would affect the design, operations, and other activities of the plant, (2) identify the source and nature of the requirements (or commitments), and (3) docu ment the basis for the acceptability of the proposed re qulrement changes, e.g., by addressing the key prin ciples.

The licensee must comply with 10 CFR 50.59, 50.90, and 50.109 as applicable. The staff recognizes that there are certain docketed commitments that are not related to regulatory requirements that can be changed by licensees via processes other than described in NRC regulations (e.g., consistent with Reference 14).

2.1.2 Relief Requests and Technical Specification Changes The licensee should have included in the RI-IST program submittal the necessary exemption requests, technical specification amendment requests, and relief requests necessary to implement their RI-IST program.

Individual component relief requests are not re quired for adjusting the test interval of individual com ponents that are categorized as having low safety sig nificance (because the licensee's implementation plans for extending specific component test intervals should have been reviewed and approved by the NRC staff as part of the licensee's RI-IST program submittal). Simi larly, if the proposed alternative includes improved test strategies to enhance the test effectiveness of compo nents, additional relief to implement these improved test strategies is not required.

For acceptance guidelines, the following are to be approved by the NRC before implementing the RI-IST program:

A relief request for any component, or group of components, that is not tested in accordance with the licensee's ASME Code of record or NRC approved ASME code case.

A technical specification amendment request for any component, or group of components, if there are changes from technical specification require ments.

2.2 Traditional Engineering Evaluation This part of the evaluation is based on traditional engineering methods (not probabilistic). Areas to be 1.175-7

evaluated from this viewpoint include the potential ef fect of the proposed RI-IST program on defense-in depth attributes and safety margins. In addition, de fense in depth and safety margin should also be evaluated, as feasible, using risk techniques (PRA).

2.2.1 Defense-in-Depth Evaluation Because of its importance, both historically during the evolution of reactor safety practice and for the con tinuation of public health and safety, the concept of de fense in depth has been included in Regulatory Guide 1.174 (Ref. 3) as one of the five key principles. In refer ring to a proposed risk-informed program change, Sec tion 2 of Regulatory Guide 1.174 states that the pro posed change should be consistent with the defense-in-depth philosophy. Furthermore, as stated in Section 2.2.1.1, Consistency with the defense-in-depth philos ophy is maintained if:

A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence miti gation.

Over-reliance on programmatic activities to compensate for weaknesses in plant de sign is avoided.

System redundancy, independence, and di versity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers).

Defenses against potential common cause failures are preserved, and the potential for the introduction of new common cause fail ure mechanisms is assessed.

"* Independence of barriers is not degraded.

"* Defenses against human errors are pre served.

"* The intent of the General Design Criteria in 10 CFR Part 50, Appendix A is maintained.

These defense-in-depth objectives apply to all risk informed applications, and for some of the issues in volved (e.g., no over-reliance on programmatic activi ties and defense against human errors), it is fairly straightforward to apply them to the RI-IST program evaluation. Some specific examples of how certain oth er of these objectives may be met for RI-IST applica tions are as follows. The use of the multiple risk metrics of CDF and LERF and controlling their change result-ing from the RI-IST program will maintain a balance between prevention of core damage, prevention of con tainment failure, and consequence mitigation. Redun dancy, diversity, and independence of safety systems should be considered after the initial choice is made in the categorization of components to ensure that these qualities are not degraded by the categorization. Inde pendence of barriers and defense against common cause failures should also be considered in the review of the categorization. The improved understanding of the relative importance of plant components to risk re sulting from the development of the RI-IST program should promote an improved overall understanding of how the components in the IST program contribute to a plant's defense in depth, and this should be discussed in the application.

2.2.2 Safety Margin Evaluation The maintenance of safety margins is also a very important part of ensuring continued reactor safety and is included as one of the key safety principles in Section 2 of Regulatory Guide 1.174 (Ref. 3). This principle states that the proposed change maintains sufficient safety margins.

In addition, in Section 2.2.1.2, it is stated that with sufficient safety margins:

"* Codes and standards or alternatives ap proved for use by the NRC are met.

Safety analysis acceptance criteria in the li censing basis (e.g., FSAR, supporting anal yses) are met, or proposed revisions pro vide sufficient margin to account for analysis and data uncertainty.

It is possible that the categorization process will identify components that are currently not included in the IST program, and their addition as HSSCs will clearly improve safety margin in terms of CDF and LERF. It is also important that the performance moni toring program be capable of quickly identifying sig nificant degradation in performance so that, if neces sary, corrective measures can be implemented before the margin to failure is significantly reduced. The im proved understanding of the relative importance of plant components to risk resulting from the develop ment of the RI-IST program should promote an im proved understanding of how the components in the IST program contribute to a plant's margin of safety, and this should be discussed in the application.

2.3 Probabilistic Risk Assessment Issues specific to the IST risk-informed process are discussed in this section. Regulatory Guide 1.174 (Ref.

1.175-8

3) contains much of the general guidance that is apl cable for this topic.

In RI-IST, information obtained from a PI should be used in two ways: First, to provide input the categorization of SSCs into HSSC and LS' groupings; and second, to assess the impact of the pi posed change on CDF and LERF. Regulatory Positi 2.3.1 discusses, in general terms, issues related to I quality, scope, and level of detail of a PRA that is us for IST applications. More specific considerations given in Regulatory Positions 2.3.2, and 2.3.3, whi address the use of PRA in categorization and in the sessment of the impact on risk metrics respectively 2.3.1 Scope, Level of Detail, and Quality of Probabilistic Risk Assessments for Inservik Testing Applications For the quantitative results of the PRA to pla3 major and direct role in decision making, there is a ne to ensure that they are derived from "quality" analysi and that the extent to which the results apply is well t derstood. Section 2.2.3 of Regulatory Guide 1.1 (Ref. 3) addresses in general terms the issues related scope, level of detail, and quality of the PRA applied risk-informed applications.

While a full scope PRA that covers all modes of c eration and initiating events is preferred, a lesser sco PRA can be used to provide useful risk informatic However, it must then be supplemented by additior considerations as discussed below.

For the PRA to be useful in the development ol RI-IST program, it is necessary that the PRA model developed to the component level for the systems, i cluding non-safety systems, considered important I prevention of core damage and release of radioactivii A PRA used in RI-IST should be performed c(

rectly and in a manner that is consistent with accept practices. The PRA should reflect the actual desiE construction, operating practices, and operating expe:

ence of the plant. The quality required of the PRA commensurate with the role it plays in the determin tion of test intervals or test methods and with the rc the integrated decisionmaking panel plays in compe sating for limitations in PRA quality. Regulatory Gui 1.174 and SRP Chapter 19 (Refs. 3 and 6) further di cuss the requirements of PRA quality.

To be acceptable for application to RI-IST, PR models must reflect the as-built, as-operated plant, ai they must have been performed in a manner that is co sistent with accepted practices. The quality of the PR has to be shown to be adequate, commensurate with t]

role the PRA results play in justifying changes to t]

,li-test intervals or strategies. The PRA model should be developed to the component level for the systems im RA portant to safety.

to If less than a full-scope PRA is used to support the SC proposed RI-IST program, supplemental information ro-(deterministic and qualitative) must be considered dur

.on ing the integrated decisionmaking process.

the Acceptance guidelines for the required PRA quali ied ty and scope are further defined in Regulatory Guide ire 1.174.

ich s

2.3.2 Categorization of Components The categorization of components is important in the implementation of the RI-IST program since it is an efficient and risk-informed way of providing insights in

,e the areas in which safety margin can be relaxed without unacceptable safety consequences. Thus, categoriza y a dion of components, in addition to the traditional engi ed neering evaluation described in Regulatory Position es, 2.2 and the calculation of change in overall plant risk in-described in Regulatory Position 2.3.3, will provide 74 significant input to the determination of whether the to IST program is acceptable or not.

to The determination of safety significance of com ponents by the use of PRA-determined importance 1p.

measures is important for several reasons.

pe When performed with a series of sensitivity evalu

)n.

ations, it can identify potential risk outliers by aal identifying IST components that could dominate risk for various plant configurations and operation f a al modes, PRA model assumptions, and data and be model uncertainties.

in-Importance measure evaluations can provide a use for ful means to identify improvements to current IST ty.

practices during the risk-informed application pro cess.

)r ed System-or functional-level importance results can PIP provide a high level verification of component-lev ri-el results and can provide insights into the potential is risk significance of IST components that are not a-modeled in the PRA.

le General guidelines for risk categorization of com n-ponents using importance measures and other informa de tion are provided in Regulatory Guide 1.174 (Ref. 3).

is-These general guidelines address acceptable methods for carring out categorization and some of the limita A

dions of this process. Guidelines that are specific to the Wd IST application are given in this section. As used here,

)n-risk categorization refers to the process for grouping A

IST components into LSSC and HSSC categories.

he Components are initially categorized into HSSC he and LSSC groupings based on threshold values for the 1.175-9

importance measures. Depending on whether the PRA is performed using the fault tree linking or event tree linking approach, importance measures can most easily be provided at the component or train level. In either case, the importance measures are applicable to the items taken one at a time, and therefore, as discussed in Regulatory Guide 1.174, while a licensee is free to choose the threshold values of importance measures, it will be necessary to demonstrate that the integrated im pact of the change is such that Principle 4 is met. One acceptable approach is discussed in the next section.

PRA systematically takes credit for non-Code components as providing support, acting as alterna tives, and acting as backups to those components that are within the current Code. Accordingly, to ensure that the proposed RI-IST program will provide an accept able level of quality and safety, these additional risk important components should be included in licensees' RI-IST proposals. Specifically, the licensee's RI-IST program should include those ASME Code Class 1, 2, and 3 and non-Code components that the licensee's in tegrated decisionmaking process categorized as HSSC and thus determined these components to be appropri ate additional candidates for the RI-IST program.

Although PRAs model many of the SSCs involved in the performance of plant safety functions, other SSCs are not modeled for various reasons. However, this should not imply that unmodeled components are not important in terms of contributions to plant risk.

For example, some components are not modeled be cause, certain initiating events may not be modeled (e.g., low power and shutdown events, or some external events); in other cases, components may not be directly modeled because they are grouped together with events that are modeled (e.g., initiating events, operator recov ery events, or within other system or function bound aries); and in some cases, components are screened out from the analysis because of their assumed inherent reliability; or failure modes are screened out because of their insignificant contribution to risk (e.g., spurious closure of a valve). When feasible, adding missing components or missing initiators or plant operating states to the PRA should be considered by the licensee.

When this is not feasible, information based on tradi tional engineering analyses and judgment is used to de termine whether a component should be treated as an LSSC or HSSC. One approach to combining these dif ferent pieces of information is to use what has been re ferred to as an expert panel. Appendices B and C of Standard Review Plan Chapter 19 (Ref. 6) contain staff expectations on the use of expert panels in integrated decisionmaking and SSC categorization respectively.

In classifying a component not modeled in the PRA as LSSC, the expert panel should have determined that:

"* The component does not perform a safety function, or does not perform a support function to a safety function, or does not complement a safety function.

"* The component does not support operator actions credited in the PRA for either proce dural or recovery actions.

"* The failure of the component will not result in the eventual occurrence of a PRA initiat ing event.

"* The component is not a part of a system that acts as a barrier to fission product release during severe accidents.

"* The failure of the component will not result in unintentional releases of radioactive ma terial even in the absence of severe accident conditions.

For acceptance guidelines, when using risk impor tance measures to identify components that are low risk contributors, the potential limitations of these mea sures have to be addressed. Therefore, information to be provided to the licensee's integrated decisionmaking process (e.g., expert panel) must include evaluations that demonstrate the sensitivity of the risk importance results to the important PRA modeling techniques, as sumptions, and data. Issues that the licensee should consider and address when determining low risk con tributors include truncation limit used, different risk metrics (i.e., CDF and LERF), different component failure modes, different maintenance states and plant configurations, multiple component considerations, defense in depth, and analysis of uncertainties (includ ing sensitivity studies to component data uncertainties, common-cause failures, and recovery actions).

While the categorization process can be used to highlight areas in which testing strategy can be im proved and areas in which sufficient safety margins ex ist to the point that testing strategy can be relaxed, it is the determination of the change in risk from the overall changes in the IST program that is of concern in demon strating that Principle 4 has been met. Therefore, no ge nerically applicable acceptance guidelines for the threshold values of importance measures used to cate gorize components as HSSC or LSSC are given here.

Instead, the licensee should demonstrate that the over all impact of the change on plant risk is small as dis cussed in Regulatory Position 2.3.3.

As part of the categorization process, licensees must also address the initiating events and plant operat-1.175-10

ing modes missing from the PRA evaluation. The li censee can do this either by providing qualitative argu ments that the proposed change to the IST program does not result in an increase on risk, or by demonstrat ing that the components significant to risk in these mis sing contributors are maintained as HSSC.

2.3.3 Use of a PRA To Evaluate the Risk Increase from Changes in the IST Program One of the important uses of the PRAis to evaluate the impact of the IST change with respect to the accep tance guidelines on changes in CDF and LERF as dis cussed in Section 2.2.2 of Regulatory Guide 1.174 (Ref. 3). In addition, the PRA can provide a baseline risk profile of the plant, and the extent of analysis of the baseline CDF and LERF depends on the proposed change in CDF and LERF. As discussed in Regulatory Guide 1.174, if the PRA is not full scope, the impact of the change must be considered by supplementing the PRA evaluation by qualitative arguments or by bound ing analyses.

2.3.3.1 Modeling the Impact of Changes in the IST Program. In order for the PRA to support the deci sion appropriately, there should be a good functional mapping between the components associated with IST and the PRA basic event probability quantification.

Part of the basis for the acceptability of the RI-IST pro gram is a quantitative demonstration by use of a PRA that established risk measures are not significantly in creased by the proposed changes to the IST for selected components. To establish this demonstration, the PRA includes models that appropriately account for the change in reliability of the components as a function of the IST program changes. In general, this will include not only changes to the test interval but also the effects of an enhanced testing method. Enhanced testing might be shown to improve or maintain component availabil ity, even if the interval is extended. That is, a better test might compensate for a longer interval between tests.

Licensees who apply for substantial increases in test in terval are expected to address this area, i.e., as appropri ate, consider improvements in testing that would com pensate for the increased intervals under consideration.

One model for the relationship between the com ponent unavailability on demand and the test interval is given in NUREG/CR-6141 (Ref. 16), which assumes a constant rate (k) of transition to the failed state. Refer ence 16 also describes how to account for various test strategies.

In addition to transitions to a failed state that occur between component demands or tests, there is also a demand-related contribution to unavailability, corre sponding to the probability that a component will fail to operate when demanded, even though for some pur poses it would have been considered "good" before be ing subjected to the stress of the demand itself. This would have the effect of adding a constant to the test-in terval-dependent contribution to the component un availability on demand. The assumption that the total unavailability scales linearly with the test interval (i.e.,

doubles when test interval doubles) is conservative in the sense that it scales the test-interval-independent contribution along with the test-interval-dependent contribution, and in that respect tends to overstate the effect of test interval extension. This approximation is therefore considered acceptable; however, it should be noted that guidance aimed at improving the capability of tests to identify loss of performance margin is aimed partly at reducing the "demand" contribution as well, so that improved modeling in this area would appear to have the potential to support further improvements in allocation of safety resources.

This model essentially assumes that failures are random occurrences and that the frequency of these oc currences does not increase as the test interval is in creased. However, as test intervals are extended, there is some concern that the failure rate, X, may increase.

This failure rate, generally assumed constant, is based on data from current IST test intervals and therefore does not include effects that may arise from extended test intervals. It is possible that insidious effects such as corrosion or erosion, intrusion of foreign material into working parts, adverse environmental exposure, or breakdown of lubrication, which have not been encoun tered with the current shorter test intervals, could sig nificantly degrade the component if test intervals be come excessively long. Therefore, unless it can be demonstrated that either degradation is not expected to be significant or that the test would identify degrada tion before failures are likely to occur, use of the constant failure rate model could be nonconservative.

One way to address this uncertainty is to use the PRA insights to help design an appropriate imple mentation and monitoring program, for example, to ap proach the interval increase in a stepwise fashion rather than going to the theoretically allowable maximum in a single step, or to stagger the testing of redundant com ponents (test different trains on alternating schedules) so that the population of components is being sampled relatively frequently, even though individual members of the population are not. By using such approaches, the existence of the above effects can be detected and.com pensatory measures taken to correct the testing of the remaining population members. However, it is impor tant that the monitoring includes enough tests to be relevant, and that the tests are capable of detecting the 1.175-11

time-related degradation (performance monitoring is discussed in Regulatory Position 3.3).

A check should also be performed to determine whether non-IST manipulation has been credited either in IST basic events or in compensating-component ba sic events. If a component is stroked or challenged be tween instances of IST, and if these activities are capa ble of revealing component failure, the effective fault exposure time can be less than the RI-IST interval. It can be appropriate to take credit for this shortening of fault exposure time in the PRA quantification, pro vided that there is assurance that the important failure modes are identified by the stroking or the system chal lenges. This is not always trivial: If a functional success can be achieved by any one of n components in parallel, so that the function succeeds even if n-1 of the compo nents fail, then merely monitoring successful function al response does not show whether all components are operable unless verification of each component's state is undertaken. In addition, some instances of revealing a component fault through challenge have adverse con sequences, including functional failure, and if credit is taken for shortening fault exposure time through func tional challenges, it is necessary to account for this downside in the quantification of accident frequency.

2.3.3.2 Evaluating the Change in CDF and LERF. Once the impact on the individual basic event probabilities has been determined, the change in CDF and LERF can be evaluated. There are some issues that must be carefully considered, which become more im portant the larger the change in basic event probabili ties. When using a fault tree linking approach to PRA, it is preferable that the model be re-solved rather than simply requantifying the CDF and LERF cutset solu tions. In addition, it is important to pay attention to the parametric uncertainty analysis, especially if the change is dominated by cutsets that have multiple LSSCs..The "state of knowledge" correlation effect (Ref. 16) could be significant if there are a significant number of cutsets with similar SSCs contributing to the change in risk. Regulatory Guide 1.174 (Ref. 3) dis cusses the parametric uncertainty analysis in more detail.

In addition, model and completeness uncertainties should be addressed as discussed in Regulatory Guide 1.174. In particular, initiating events and modes of plant operations whose risk impact are not included in the PRA need additional analyses or justification that the proposed changes do not significantly increase the risk from those unmodeled contributors.

23.3.3 Acceptance Guidelines. The change in risk from proposed changes to the IST program should be consistent with the guidelines provided in Section 2.2.4 of Regulatory Guide 1.174. In comparing the cal culated risk to the guidelines, the licensee should ad dress the model and completeness uncertainty as dis cussed in Regulatory Guide 1.174 (Ref. 3). In addition, the licensee should address parameter uncertainty ei ther by propagating the uncertainty during sequence quantification or by demonstrating that the "state-of knowledge correlation" effect is not significant, espe cially in cutsets in which the RI-IST changes affect multiple components that are similar.

In evaluating the change in plant risk from pro posed changes in the IST program, the licensee should perform the following.

"* Evaluate the risk significance of extending the test interval on affected components. This requires that the licensee address the change in component availability as a function of test interval. The analy sis should include either a quantitative considera tion of the degradation of the component failure rate as a function of time, supported by appropriate data and analysis, or arguments that support the conclusion that no significant degradation will oc cur.

"* Consider the effects of enhanced testing to the ex tent needed to substantiate the change.

Other issues that should be addressed in the quanti fication of the change in risk include the following.

"* The impact of the IST change on the frequency of event initiators (those already included in the PRA and those screened out because of low frequency) should be determined. For applications in RI-IST, potentially significant initiators include valve fail ure that could lead to interfacing system loss-of coolant accidents (LOCAs) or to other sequences that fail the containment isolation function.

"* The effect of common cause failures (CCFs) should be addressed either by the use of sensitivity studies or by the use of qualitative assessments that show that the CCF contribution would not become significant under the proposed IST program (e.g.,

by use of phased implementation, staggered test ing, and monitoring for common cause effects).

"* Justification of lST relaxations should not be based on credit for post-accident recovery of failed com ponents (repair or ad hoc manual actions, such as manually forcing stuck valves to open). However, credit may be taken for proceduralized imple mentation of alternative success strategies. For each human action that compensates for a basic event probability increasing as a result of IST re-1.175-12

laxation, there should be a licensee commitment to ensure performance of the function at the level credited in the quantification. Excessively low hu man failure probabilities Qess than 10-3) cannot be accepted unless there is adequate justification and there are adequate training programs, personnel practices, plant policies, etc., to ensure continued licensee performance at that level.

"* The failure rates and probabilities used for compo nents affected by the proposed change in IST should appropriately consider both plant-specific and generic data. The licensee should determine whether individual components affected by the change are performing more poorly than the aver age associated with their class; the licensee should avoid relaxing IST for those components to the point that the unavailability of the poor performers would be appreciably worse than that assumed in the risk analysis. In addition, components that have experienced repeated failures should be reviewed to see whether the testing scheme (interval and methods) would be considered adequate to support the performance credited to them in the risk analysis.

The evaluation should be performed so that the truncation of LSSCs is considered. It is preferred that solutions be obtained from a re-solution of the model, rather than a requantification of CDF and LERF cutsets.

The cumulative impact of all RI-IST program changes (initial approval plus later changes) should comply with the acceptance guidelines given in this section.

safety principles. Because of the importance of these expectations, they will be repeated here.

• All safety impacts of the proposed change are evaluated in an integrated manner as part of an overall risk management ap proach in which the licensee is using risk analysis to improve operational and engi neering decisions broadly by identifying and taking advantage of opportunities for reducing risk, and not just to eliminate re quirements the licensee sees as undesirable.

For those cases when risk increases are pro posed, the benefits should be described and should be commensurate with the proposed risk increases. The approach used to iden tify changes in requirements should be used to identify areas where requirements should be increased, 1 as well as where they could be reduced.

"* The scope and quality of the engineering analyses (including traditional and proba bilistic analyses) conducted to justify the proposed licensing basis change should be appropriate for the nature and scope of the change, should be based on the as-built and as-operated and maintained plant, and should reflect operating experience at the plant.

"* The plant-specific PRA supporting li censee proposals has been subjected to quality controls such as an independent peer review or certification. 2

"* Appropriate consideration of uncertainty is given in analyses and interpretation of find ings, including using a program of monitor-2.4 Integrated Decisionmaking This section discusses the integration of all the technical considerations involved in reviewing submit tals from licensees proposing to implement RI-IST pro grams. General guidance for risk-informed applica tions is given Regulatory Guide 1.174 (Ref. 3) and in the new SRP sections, Chapter 19 (Ref. 6) for general guidance, and Section 3.9.7 (Ref. 7) for IST programs.

These documents discuss a set of regulatory findings that form the basis for the staff to prepare an acceptable safety evaluation report (SER) for a licensee's risk informed application. Specifically, Section 2 of Regu latory Guide 1.174 identifies a set of "expectations" that licensees should follow in addressing the key tTbe NRC staff is aware of but does not endorse guide lines that have been developed (e.g., by NEI/NU MARC) to assist in identifying potentially beneficial changes to requirements.

2As discussed in Section 2.2.3.3 of Regulatory Guide 1.174 (Ref. 3) in its discussion of PRA quality, such a peer review or certification is not a replacement for NRC review. Certification is defined as a mechanism for assuring that a PRA, and the process of developing and maintainingthat PRA, meet aset Oftechnicalstan dards established byadiverse groupofpersonnel expe rienced in developing PRA models, performing PRAs, and performing quality reviews of PRAs. Such a pro cess has been developed and integrated with a peer re viewprocess by, forexample, the BWR Owners Group and implemented for the purpose of enhancing quality of PRAs at several BWR facilities.

1.175-13

ing, feedback, and corrective action to ad dress significant uncertainties.

The use of core damage frequency (CDF) and large early release frequency (LERF)3 as bases for probabilistic risk assessment acceptance guidelines is an acceptable ap proach to addressing Principle 4. Use of the Commission's Safety Goal qualitative health objectives (QHOs) in lieu of LERF is acceptable in principle and licensees may propose their use. However, in practice, im plementing such an approach would require an extension to a Level 3 PRA, in which case the methods and assumptions used in the Level 3 analysis, and associated uncer tainties, would require additional attention.

• Increases in estimated CDF and LERF re sulting from proposed changes will be lim ited to small increments. The cumulative effect of such changes should be tracked and considered in the decision process.

The acceptability of proposed changes should be evaluated by the licensee in an in tegrated fashion that ensures that all prin ciples are met.4 Data, methods, and assessment criteria used to support regulatory decisionmaking must be well documented and available for public review.

These expectations apply to both probabilistic and traditional engineering considerations, which are ad dressed in more detail in this chapter and in Regulatory Guide 1.174 (Ref. 3).

Licensees are expected to review commitments re lated to outage planning and control to verify that they 3In this context, LERF is being used as a surrogate for the early fatality quantitative health objective (QHO).

It isdefined as the frequency of those accidentsleading to significant, unmitigated releases from containment in a time frame prior to effective evacuation of the close-in population such that there is a potential for early health effects. Such accidents generally include unscrubbedreleasesassociatedwithearlycontainment failure at or shortly after vessel breach, containment bypass events, and loss of containment isolation. This definition is consistent with accident analyses used in the safetygoal screening criteria discussed in the Com mission's regulatory analysis guidelines. An NRC con tractor's report (Ref. 15) describes a simple screening approach for calculating LERF.

4One important element of integrated decisionmaking can be the use of an'"expert panel." Such a panel is not a necessary component of risk-informed decisionmak ing; butwhen it is used, the key principles and associat ed decision criteria presented in this regulatory guide still apply and must be shown to have been met or tobe irrelevant to the issue at hand.

are appropriately reflected in the licensee's component grouping. This should include components required to maintain adequate defense in depth as well as compo nents that might be operated as a result of contingency plans developed to support the outage.

Licensees are also expected to review licensing ba sis documentation to ensure that the traditional engi neering related factors mentioned above are adequately modeled or otherwise addressed in the PRA analysis.

When making final programmatic decisions, choices must be made based on all the available infor mation. There may be cases when information is in complete or when conflicts appear to exist between the traditional engineering data and the PRA-generated in formation. It is the responsibility of the licensee in such cases to ensure that well-reasoned judgment is used to resolve the issues in the best manner possible, includ ing due consideration to the safety of the plant. This process of integrated decisionmaking has been dis cussed in various industry documents (Refs. 10 through 12) with reference to the use of an expert panel.

The appendix to this regulatory guide includes some detailed guidance on certain aspects of integrated deci sionmaking specific to RI-IST programs. As discussed in the appendix, it is not intended that an administrative body such as an expert panel must always be formed by the licensee to fulfill this function. Some general accep tance guidelines for this important activity follow, with more specific details given in the appendix.

In summary, acceptability of the proposed change should be determined by using an integrated decision making process that addresses three major areas: (1) an evaluation of the proposed change in light of the plant's licensing basis, (2) an evaluation of the proposed change relative to the key principles and the acceptance criteria, and (3) the proposed plans for implementation, performance monitoring, and corrective action. As stated in the Commission's Policy Statement on the in creased use of PRA in regulatory matters (Ref. 1), the PRA information used to support the RI-IST program should be as realistic as possible, with reduced unnec essary conservatisms, yet include a consideration of uncertainties. These factors are very important when considering the cumulative plant risk and accounting for possible risk increases as well as risk benefits. The licensee should carefully document all of these kinds of considerations in the RI-IST program description, in cluding those areas that have been quantified through the use of PRA, as well as qualitative arguments for those areas that cannot readily be quantified.

The following are acceptance guidelines.

1.175-14 K

The licensee's proposed RI-ISTprogram should be supported by both a traditional engineering analy sis and a PRA analysis.

The licensee's RI-IST program submittal should be consistent with the acceptance guidelines con tained throughout this regulatory guide, specifi cally with the expectations listed in this section, or the submittal should justify why an alternative ap proach is acceptable.

If the licensee's proposed RI-IST program is ac ceptable based on both the deterministic and pro babilistic analyses, it may be concluded that the proposed RI-IST program provides "an acceptable level of quality and safety" [see 10 CFR 50.55a(a)(3)(i)].

3. ELEMENT 3: DEFINE IMPLEMENTATION AND MONITORING PROGRAM Upon approval of an RI-IST program, the licensee should have in place an implementation schedule for testing all HSSCs and LSSCs identified in their pro gram. This schedule should include test strategies and testing frequencies for HSSCs and LSSCs that are with in the scope of the licensee's IST program and compo nents identified as HSSCs that are not currently in the IST program.

3.1 Inservice Testing Program Changes This section discusses the test strategy changes (i.e., component test frequency and methods changes) that licensees should make as part of a RI-IST program.

For acceptance guidelines, the RI-IST program should identify components for which the test strategy (i.e., frequency, methods or both) should be more fo cused as well as components for which the test strategy might be relaxed. The information contained in, and de rived from, the PRA should be used to help construct the testing strategy for components. To the extent prac ticable, components with high safety significance should be tested in ways that are effective at detecting their risk-important failure modes and causes (e.g.,

ability to detect failure, to detect conditions that are pre cursors to failure, and predict end of service life). Com ponents categorized LSSC may be tested less rigor ously than components categorized as HSSC (e.g., less frequent or informative tests).

In some situations, an acceptable test strategy for components categorized HSSC may be to conduct the existing approved Code IST test at the Code-prescribed frequency. In some situations, an acceptable test strat egy for components categorized LSSC may be to con-duct the existing approved Code IST test at an extended interval.

An acceptable strategy for testing components categorized HSSC and LSSC may be defined in NRC approved ASME risk-informed Code Cases. Licensees who choose to pursue RI-IST programs should consid er adopting test strategies developed by ASME and en dorsed by the NRC. Deviations from endorsed Code Cases must be reviewed and approved by the NRC staff as part of the RI-IST program review.

In establishing the test strategy for components, the licensee should consider component design, service condition, and performance, as well as risk insights.

The proposed test strategy should be supported by data that are appropriate for the component. The omission of either generic or plant-specific data should be justified.

The proposed test interval should be significantly less than the expected time to failure assumed in the PRAof the components in question (e.g., an order of magnitude less).5 In addition, the licensee should demonstrate that adequate component capability (margin) exists, above that required during design-basis conditions, such that component operating characteristics over time do not result in reaching a point of insufficient margin before the next scheduled test activity.

The IST interval should generally not be extended beyond once every 6 years or 3 refueling outages (whichever is longer) without specific compelling doc umented justification available on site for review. Ex tensions beyond 6 years or 3 refueling outages (which ever is longer) will be considered as component performance data at extended intervals is acquired.

This is not meant to restrict a licensee from fully imple menting NRC-approved component Code Cases.

Components categorized HSSc that are not in the licensee's current IST program should (where practi cal) be tested in accordance with the NRC-approved ASME risk-informed Code Cases, including com pliance with all administrative requirements. When ASME Section XI or O&M Code testing is not practi cal, alternative test methods should be developed by the licensee to ensure operational readiness and to detect component degradation (i.e., degradation associated with failure modes identified as being important in the licensee's PRA). As a minimum, a summary of these components and their proposed testing should be inclu ded in the RI-IST program.

For components categorized as HSSC that were the subject of a previous NRC-approved relief request (or an NRC-authorized alternative test), the licensee 5Forexample, the MOVexercise requirement (which is comparable to the current stroke time test) should be performed at intervals consid erably smaller than the expected time to failure.

1.175-15 I

should discuss the appropriateness of the relief in light of the safety significance of the component in their RI IST submittal.

If practical, IST components (with the exception of certain check valves and relief valves) should, as a minimum, be exercised or operated at least once every refueling cycle. More frequent exercising should be considered for components in any of the following cate gories, if practical:

"* Components with high risk significance,

"* Components in adverse or harsh environmental conditions, or

"* Components with any abnormal characteristics (operational, design, or maintenance conditions).

The testing strategy for each component (or group of components) in the licensee's RI-IST program should be described in the RI-IST program description.

The RI-IST program description should summarize all testing to be performed on a group of components (e.g.,

MOV testing in response to NRC Generic Letter 96-05, Ref. 18). The specific testing to be done on each com ponent (or group of components) should be delineated in the licensee's IST program plan and is subject to NRC inspection.

3.2 Program Implementation The applicable ASME Code generally requires that safety-related components within the program scope as defined in the current ASME Code be tested on a quar terly frequency regardless of safety significance. The authorization of a risk-informed inservice testing pro gram will allow the extension of certain component testing intervals and modification of certain component testing methods based on the determination of individ ual component importance. The implementation of an authorized program will involve scheduling test inter vals based on the results of probabilistic analysis and deterministic evaluation of each individual component.

The R1-1ST program should distinguish between high and low safety-significant components for testing intervals. Components that are being tested using spe cific ASME Codes, NRC-endorsed Code Cases for RI IST programs, or other applicable guidance should be individually identified in the RI-IST program. The test intervals of the HSSC should be included in the R1-IST program for verification of compliance with the ASME Code requirements and applicable NRC-endorsed ASME Code Cases. Any component test interval or method that is not in conformance with the above should have specific NRC approval. Plant corrective action and feedback programs should be appropriately referenced in the IST program and in the implementing and test procedures to ensure that testing failures are re evaluated for possible adjustment to the component's grouping and test strategy.

It is acceptable to implement RM-IST programs on a phased approach. Subsequent to the approval of a RI IST program, implementation of interval extension for LSSC may begin at the discretion of the licensee and may take place on a component-, train-, or system level. However, it is not acceptable to immediately ad-,

just the test intervals of LSSC to the maximum pro-'

posed test interval. Normally, test interval increases will be done step-wise, with gradual extensions being permitted consistent with cumulative performance data for operation at the extended intervals. The actual test ing intervals for each component in the RI-IST program should be available at the plant site for inspection.

It should be noted that the test described in the cur rent ASME Code may not be particularly effective in detecting the important failure modes and causes of a component or group of components. A more effective test strategy may be to conduct an enhanced test at an extended test interval.

HSSCs that are not in the current IST program should be tested, where practical, in accordance with the ASME Code, including compliance with all admin istrative requirements. When ASME Section XI or O&M testing is not practical, alternative test methods should be developed by the licensee to ensure opera tional readiness and to detect component degradation (i.e., degradation associated with failure modes identi fied as being important in the licensee's PRA). As a minimum, a summary of these components and their proposed testing should be provided to the NRC as part of this review and prior to implementation of the risk informed IST program at the plant.

An acceptable method to extend the test interval for LSSC is to group like components and stagger their testing equally over the interval identified for a specific component based on the probabilistic analysis and de terministic evaluation of each individual component.

Initially, it would be desirable to test at least one com ponent in each group every refueling outage. For exam ple, component grouping should consider valve actua tor type for power operated valves and pump driver type, as applicable. With this method, generic age related failures could be identified while allowing im mediate implementation for some components. For component groups that are insufficient in size to test one component every refueling outage, the imple mentation of the interval should be accomplished in a more gradual step-wise manner, The selected test fre-1.175-16

quency for LSSC that are to be tested on a staggered ba sis should be justified in the RI-IST program.

The following implementation activities are ac ceptable:

For components that will be tested in accordance with the current NRC-approved Code test frequen cy and method requirements, no specific imple mentation schedule is required. The test frequency and method should be documented in the licensee's RI-IST program.

For components that will employ NRC-endorsed ASME Codes or Code Case methods, implementa tion of the revised test strategies (i.e., interval ex tension plan) should be documented in the licens ee's RI-IST program.

For any alternative test strategies proposed by the licensee (i.e., for components within the scope of the current ASME code), the licensee should have specific NRC approval.

The licensee should increase the test interval for components in a step-wise manner (i.e., equal or suc cessively smaller steps, not to exceed one refueling cycle per step). If no significant time-dependent fail ures occur, the interval can be gradually extended until the component is tested at the maximum proposed ex tended test interval. An acceptable approach is to group similar components and test them on a staggered basis.

Guidance on grouping components is contained in Position 2 of NRC Generic Letter 89-04 (Ref. 19) for check valves; Supplement 6 to NRC Generic Letter 89-10 (Ref. 20), and Section 3.5 of ASME Code Case OMN-1 (Ref. 21) for motor-operated valves, or other documents endorsed by the NRC.

3.3 Performance Monitoring Performance monitoring in RI-IST programs re fers to the monitoring of inservice test data for compo nents within the scope of the RI-IST program (i.e., in cluding both HSSC and LSS). The purpose of performance monitoring in a RI-IST program is two fold. First, performance monitoring should help con firm that no insidious failure mechanisms that are re lated to the revised test strategies become important enough to alter the failure rates assumed in the justifica tion of program changes. Second, performance moni toring should, to the extent practicable, ensure that ade quate component capability (i.e., margin) exists, above that required during design-basis conditions, so that component operating characteristics over time do not result in reaching a point of insufficient margin before the next scheduled test activity. Regulatory Guide 1.174 (Ref. 3) provides guidance on performance mon-itoring when testing under design basis conditions is impracticable. In most cases, component-level moni toring will be expected.

Two important aspects of performance monitoring are whether the test frequency is sufficient to provide meaningful data and whether the testing methods, pro cedures, and analysis are adequately developed to en sure that performance degradation is detected. Compo nent failure rates cannot be allowed to rise to unacceptable levels (e.g., significantly higher than the failure rates used to support the change) before detec tion and corrective action take place.

The NRC staff expects that licensees will integrate, or at least coordinate, their monitoring for RI-IST pro gram with existing programs for monitoring equipment performance and other operating experience on their sites and, when appropriate, throughout the industry. In particular, monitoring that is performed as part of the Maintenance Rule (10 CFR 50.65) implementation can be used in the RI-IST program when the monitoring performed under the Maintenance Rule is sufficient for the SSCs in the RI-IST program. As stated in Regulato ry Guide 1.174, if an application requires monitoring of SSCs not included in the Maintenance Rule, or in volves SSCs that need a greater resolution of monitor ing than the Maintenance Rule (e.g., component-level vs. train-or plant-level monitoring), it may be advanta geous for a licensee to adjust the Maintenance Rule monitoring program rather than to develop additional monitoring programs for RI-IST purposes. Therefore, it may be advantageous to adjust the Maintenance Rule performance criteria to meet the acceptance guidelines below.

For acceptance guidelines, monitoring programs should be proposed that are capable of adequately tracking the performance of equipment that, when de graded, could alter the conclusions that were key to supporting the acceptance of the RI-IST program.

Monitoring programs should be structured such that SSCs are monitored commensurate with their safety significance. This allows for a reduced level of moni toring of components categorized as having low safety significance provided the guidance below is still met.

The licensee's performance monitoring process should have the following attributes:

Enough tests are included to provide meaningful

data,

"* The test is devised such that incipient degradation can reasonably be expected to be detected, and

"* The licensee trends appropriate parameters as re quired by the ASME Code or ASME Code Case and as necessary to provide reasonable assurance 1.175-17 f r

that the component will remain operable over the test interval.

Assurance must be established that degradation is not significant for components that are placed on an ex tended test interval, and that failure rate assumptions for these components are not compromised by test data.

It must be clearly established that those test procedures and evaluation methods are implemented that reason ably ensure that degradation will be detected and cor rective action will be taken.

3A Feedback and Corrective Action The licensee's corrective action program for this application should contain a performance-based feed back mechanism to ensure that if a particular compo nent's test strategy is adjusted in a way that is ineffec tive in detecting component degradation and failure, particularly potential common cause failure mecha nisms, the RI-IST program weakness is promptly de tected and corrected. Performance monitoring should be provided for systems, structures, and components with feedback to the RI-IST program for appropriate adjustments when needed.

If component failures or degradation occur at a higher rate than assumed in the basis for the RI-IST pro gram, the following basic steps should be followed to implement corrective action.

"* The causes of the failures or degradation should be determined and corrective action implemented.

The component's test effectiveness should be re evaluated, and the RI-IST program should be mo dified accordingly.

The following are acceptance guidelines.

The licensee's corrective action program evaluates RI-IST components that either fail to meet the test ac ceptance criteria or are otherwise determined to be in a nonconforming condition (e.g., a failure or degraded condition discovered during normal plant operation).

The evaluation:

(1) Complies with Criterion XVI, "Corrective Ac tion," of Appendix B to 10 CFR Part 50.

(2) Promptly determines the impact of the failure or nonconforming condition on system/train oper ability and follows the appropriate technical spec ification when component capability cannot be demonstrated.

(3) Determines and corrects the apparent or root cause of the failure or nonconforming condition (e.g.,

improve testing practices, repair or replace the component). The root cause of failure should be determined for all components categorized as hav ing high safety significance, as well as for compo nents categorized as having low safety signifi cance when the apparent cause of failure may contribute to common cause failure.

(4) Assesses the applicability of the failure ornoncon forming condition to other components in the RI IST program (including any test sample expansion that may be required for grouped components such as relief valves).

(5) Corrects other susceptible RI-IST components as necessary.

(6) Considers the effectiveness of the component's test strategy in detecting the failure or nonconfor ming condition. Adjust the test interval and/or test methods, as appropriate, when the component (or group of components) experiences repeated or age-related failures or nonconforming conditions.

The corrective action evaluations should periodi cally be provided to the licensee's PRA group so that any necessary model changes and re-grouping are done as might be appropriate. The effect of the failures on overall plant risk should be evaluated as well as a con firmation that the corrective actions taken will restore the plant risk to an acceptable level.

The RI-IST program documents should be revised to document any RI-IST program changes resulting from corrective actions taken.

3.5 Periodic Reassessment RI-IST programs should contain provisions whereby component performance data periodically gets fed back into both the component categorization and component test strategy determination (i.e., test in terval and methods) process. These assessments should also take into consideration corrective actions that have been taken on past IST program components. (This pe riodic reassessment should not be confused with the 120-month program updates required by 10 CFR 50.55a(f)(5)(i), whereby the licensee's IST program must comply with later versions of the ASME Code that have been endorsed by the NRC.)

The assessment should:

Review and revise as necessary the models and data used to categorize components to determine whether component groupings have changed.

Reevaluate equipment performance to determine whether the RI-IST program should be adjusted (based on both plant-specific and generic informa tion).

1.175-18

The licensee should have procedures in place to identify the need for more emergent RI-IST program updates (e.g., following a major plant modification or following a significant equipment performance prob lem).

Licensees may wish to coordinate these reviews with other related activities such as periodic PRA up dates, industry operating experience programs, the Maintenance Rule program, and other risk-informed program initiatives.

The acceptance guideline is that the test strategy for RI-IST components should be periodically assessed to reflect changes in plant configuration, component performance, test results, and industry experience.

4. ELEMENT 4: DOCUMENTATION The recommended content of an RP-IST submittal is presented in this Regulatory Postion. The guidance provided below is intended to help ensure the com pleteness of the information provided and should aid in shortening the time needed for the review process. The licensee should refer to the appropriate section of this regulatory guide to ascertain the level of detail of the documentation that should either be submitted to the NRC staff for review or retained onsite for inspection.

To the extent practical the applicable sections of the re gulatory guide have been identified on each list of documents.

4.1 Documentation That Should Be in The Licensee's RI-IST Submittal A request to implement a RI-IST program as an au thorized alternative to the current NRC-endorsed ASME Code pursuant to 10 CFR 50.55a(a)(3)(i).

0 A description of the change associated with the proposed RI-IST program (see Regulatory Posi tion 1.1 above).

0 Identification of any changes to the plant's design, operations, and other activities associated with the proposed RI-IST program and the basis for the ac ceptability of these changes (see Regulatory Posi tion 2.1.1).

A summary of key technical and administrative as pects of the overall RI-IST program that includes:

A description of the process used to identify candidates for reduced and enhanced IST re quirements, including a description of the cate gorization of components using the PRA and the associated sensitivity studies (see Regula tory Position 2.3.2 above),

A description of the PRA used for the catego rization process and for the determination of risk impact, in terms of the process to ensure quality and the scope of the PRA, and how lim itations in quality, scope, and level of detail are compensated for in the integrated decision making process (see Regulatory Position 2.3.1 above),

• A description of how the impact of the change is modeled in the IST components (including a quantitative or qualitative treatment of compo nent degradation) and a description the impact of the change on plant risk in terms of CDF and LERF and how this impact compares with the decision guidelines (see Regulatory Position 2.3.3),

A description of how the key principles were (and will continue to be) maintained (see Reg ulatory Positions 2.2, 2.3, and 2.4),

A description ofthe integrated decisionmaking process used to help define the RI-IST pro gram, including any decision criteria used (see Regulatory Position 2.4),

A general implementation approach or plan (see Regulatory Positions 3.1 and 3.2),

a A description of the testing and monitoring proposed for each component group (see Reg ulatory Position 3.2),

A description of the RI-IST corrective action plan (see Regulatory Position 3.4),

0 A description of the RI-IST program periodic reassessment plan (see Regulatory Position 3.5 above).

A summary of any previously approved relief re quests for components categorized as HSSC along with any exemption requests, technical specifica tion changes, and relief requests needed to imple ment the proposed RI-IST Program (see Regula tory Position 2.1.2).

An assessment of the appropriateness of pre viously approved relief requests.

4.2 Documentation That Should Be Available Onsite For Inspection

"* The overall IST Program Plan

"* Administrative procedures related to RI-IST

"* Component or system design basis documentation

"* Piping and instrument diagrams for systems that contain components in the RI-IST program 1.175-19 I I I

I I

PRA and supporting documentation (see Regula tory Position 2.3)

Categorization results, including the RI-IST pro cess summary sheet for each component or group of components (see Regulatory Position 2.3.2)

Integrated decisionmakingprocess procedures, ex pert panel meeting minutes (if applicable) (see Regulatory Position 2.4)

Detailed implementation plans and schedules (see Regulatory Position 3.2)

Completed test procedures and any supplemental test data related to RI-IST (see Regulatory Position 3.3)

Corrective action procedures (see Regulatory Posi tion 3.4)

Plant-specific performance data (e.g., machinery history) for components in the RI-IST program (see Regulatory Positions 2.3.3 and 3.1)

A description of individual changes made to the RI-IST program after implementation (see Regula tory Position 1.3) 1.175-20

REFERENCES

1.

USNRC, "Use of Probabilistic Risk Assessment Methods in Nuclear Regulatory Activities: Final Policy Statement," Federal Register, Vol. 60, p 42622, August 16, 1995.

2.

USNRC, "Framework for Applying Probabilistic Risk Analysis in Reactor Regulation,"

SECY-95-280, November 27, 1995.1

3.

USNRC, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis,"

Regulatory Guide 1.174, July 1998.2

4.

USNRC "An Approach for Plant-Specific, Risk Informed Decisionmaking: Graded Quality As surance," Regulatory Guide 1.176, August 1998.2

5.

USNRC, "An Approach for Plant-Specific, Risk Informed Decisionmaking: Technical Specifica tions," Regulatory Guide 1.177, August 1998.2

6.

USNRC, "Standard Review Plan for Risk Informed Decision Making," Standard Review Plan, NUREG-0800, Chapter 19, July 1998.2

7.

USNRC, "Standard Review Plan for Risk Informed Decision Making: Inservice Testing,"

Standard Review Plan, NUREG-0800, Chapter 3.9.7, August 1998.2

8.

USNRC, "Standard Review Plan for Risk Informed Decision Making: Technical Specifica tions," Standard Review Plan, NUREG-0800, Chapter 16.1, August 1998.2

9.

American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code,Section XI, ASME.3 1Copies are available for inspection or copying for afee from the NRC Public Document Room at 2120 L Street NW, Washington, DC; the PDR's mailing address is Mail Stop LL-6, Washington, DC 20555; telephone (202)634-3273; fax (202)634-3343.

2Single copies of regulatory guides, both active and draft, and draft NUREG documents may be obtained free of charge by writing the Reproduction and Distribution Services Section, OCIO, USNRC, Washington, DC 20555-0001, or by fax to (301)415-2289, or by email to GRWI@NRC.GOV. Active guides may also be purchased from the National Technical Information Serviceonastandingorderbasis.

Details on this service may be obtained by writing NTIS, 5285 Port Royal Road, Springfield, VA22161. Copiesofactive and draftguides are available for inspection or copying for a fee from the NRC Public Document Room at 2120 L Street NW, Washington, DC; the PDR's mailingaddressisMailStopLL-6,WashingtonDC20555;telephone (202)634-3273; fax (202)634-3343.

3Copiesmaybe obtained fromASME,345 East 47thStreet, NewYork, NY 10017.)

10. American Society of Mechanical Engineers, "Risk-Based Inservice Testing-Development of Guidelines," Research Report (CRDT-Vol. 40-2, Volume 2), 1996.0

11. Electric Power Research Institute, "PSAApplica tions Guide," EPRI TR-105396, August 1995.1

12. Nuclear Energy Institute Draft (Revision B), "In dustry Guidelines for Risk-Based Inservice Test ing," March 19, 1996.1

13. American Society of Mechanical Engineers (ASME) Code for Operations and Maintenance of Nuclear Power Plants, OM Code-1995.3

14. Nuclear Energy Institute, "Guidelines for Manag ing NRC Commitments," Revision 2, Decem ber 19, 1995.1

15. W.T. Pratt et al., "An Approach for Estimating the Frequencies of Various Containment Failure Modes and Bypass Events," Draft NUREG/

CR-6595, December 1997.2

16. P.K. Samanta et al., "Handbook of Methods for Risk-Based Analyses of Technical Specifica tions," NUREG/CR-6141, December 1994.4

17. G.E. Apostolakis and S. Kaplan, "Pitfalls in Risk Calculations," Reliability Engineering, Vol. 2, pages 135-145, 1981.

18. USNRC, "Periodic Verification of Design-Basis Capability of Safety-Related Power-Operated Valves," Generic Letter 96-05, September 18, 1996.1

19. USNRC, "Guidance on Developing Acceptable Inservice Testing Programs," Generic Letter 89-04, April 3, 1989.1

20. USNRC, "Safety-Related (1) Motor-Operated Valve Testing and Surveillance," Generic Letter 89-10, June 28, 1989.1

21. American Society of Mechanical Engineers (ASME) Alternative Rules for Preservice and In service Testing of Certain Electric Motor Oper ated Valve Assemblies in LWR Power Plants, Code Case OMN-1, OM Code-1995; Subsection ISTC.3 4Copiesare available atcurrent ratesfrom the U.S.GovernmentPrint ing Office, P.o. Box 37082, Washington, DC 20402-9328 (telephone (202)512-2249); or from the National Tbchnical Information Service by writing NTIS at 5285 Port Royal Road, Springfield, VA 22161.

Copies are available forinspection orcopyingforafee from the NRC Public Document Room at 2120 L Street NW, Washington, DC; the PDR's mailing address is Mail Stop LL-6, Washington, DC 20555; telephone (202)634-3273; fax (202)634-3343.

1.175-21

APPENDIX A DETAILED GUIDANCE FOR INTEGRATED DECISIONMAKING A.1 Introduction The increased use of probabilistic risk assessment (PRA) in nuclear plant activities such as in risk-in formed inservice testing (IST) programs will require a balanced use of the probabilistic information with the more traditional engineering (sometimes referred to as "deterministic") information. Some structured process for considering both types of information and making decisions will be needed that will allow improvements to be made in plant effectiveness while maintaining ad equate safety levels in the plant. This will be particular ly important during initial program implementation and also for the subsequent early phases of the program.

In some instances, the physical data from the PRA and from the deterministic evaluations may be insufficient to make a clearcut decision. At times, these two forms of information may even seem to conflict. In such cases, it is the responsibility of the licensee to assemble the appropriate skilled utility staff (and in some cases consultants) to consider all the available information in its various forms and to supplement this information with engineeringjudgment to determine the best course of action. The participants involved in this important role have generally been referred to in various industry documents as an "expert panel." In this appendix, this function will be described as being an engineering eval uation without specifying how the evaluation is to be performed administratively. It is not the intention of this guidance to indicate that a special administrative body needs to be formed within the utility to satisfy this role. It is the function that is important and that must be performed in some well-organized, repeatable, and scrutable manner by the licensee. This function is all pervasive in the implementation phase of such activi ties as inservice inspection (ISI) and IST, and accord ingly, the licensee has the responsibility to see that this function is done well.

A.2 Basic Categories of Information To Be Considered Risk-importance measures may be used together with other available information to determine the rela tive risk ranking (and thus categorization) of the com ponents included in the evaluation. Results from all these sources are then reviewed prior to making final decisions about where to focus IST resources.

Although the risk ranking of components can be used primarily as the basis for prioritizing IST at a plant, additional considerations need to be addressed (e.g., defense in depth, common cause, and the single failure criterion), which may be more constraining than the risk-based criteria in some cases. Consideration must be given to these issues and component perfor mance experience before the IST requirements for the various components are determined.

IST experience should contribute an understanding of the important technical bases underlying the existing testing program before it is changed. The critical safety aspects of these bases should not be violated inadver tently in changing over to a RI-IST, and important plant experience gained through the traditional IST should be considered during the change.

The plant-specific PRA information should in clude important perspectives With respect to the limita tions of PRA modeling and analysis of systems, some of which may not be explicitly addressed within the PRA analysis. An understanding should also be pro vided as to how the proposed changes in pump and valve testing could affect PRA estimates of plant risk.

Plant safety experience should provide insights as sociated with the traditional analyses (Chapter 15 of the plant Final Safety Analysis Report) and any effect that proposed changes in testing might have on the tradi tional perspective of overall plant safety.

Plant operational input should supplement the in sights of plant safety with additional information re garding the operational importance of components un der normal, abnormal, and emergency conditions.

There should also be input on operating history, system interfaces, and industry operating experience to supple ment information from the IST.

Maintenance considerations should provide per spectives on equipment operating history, work prac tices, and the implementation of the maintenance rule.

Systems design considerations should include the potential effect of different design configurations (e.g.,

piping, valves, and pumps) on planning for a risk informed IST, particularly if future plant modifications are contemplated or if systems are temporarily taken out of service for maintenance or replacement or repair.

A.3 Specific Areas To Be Evaluated This section addresses some technical and admin istrative issues that are currently believed to be particu larly important for RI-IST applications. Additional is sues of a more general nature that may arise in expert panel deliberations are given in SRP Chapter 19.

1.175-22

It should be confirmed that proper attention has been given to component classifications in systems identified in emergency operating procedures (and other systems) depended upon for operator recov ery actions, primary fission product barriers ex cluded from the PRA due to their inherent reliabil ity (such as the RPV), passive items not modeled in the PRA (such as piping, cable, supports, building or compartment structures such as the spent fuel pool), and systems relied upon to mitigate the ef fects of external events in cases where the PRA considered only internal events.

Failure modes modeled by the PRA may not be all inclusive. Consideration should be given to the failure modes modeled and the potential for the introduction of new failure modes related to the IST application. For example, if valve misposi tioning has been assumed to be a low-probability event because of independent verification and therefore is not included in the PRA assumptions, any changes to such independent verifications should be evaluated for potential impact on the PRA results.

Other qualitative or quantitative analyses that shed light on the relative safety importance of compo nents, such as FMEA, shutdown risk, seismic risk, and fire protection should be included in the re source information base.

Attention should be given to the fact that compo nent performance can be degraded from the effects of aging or harsh environments, and this issue will need to be addressed and documented.

The engineering evaluation should include the choice of new test frequencies, the identification of compensatory measures for potentially important components, and the choice of test strategies for both HSSCs and LSSCs.

Until the ASME recommendations for improved test methods are available, the existing IST test methods should be evaluated prior to choosing the test methods tobe used for the HSSCs and LSSCs, depending on their expected failure modes, service conditions, etc.

"* Because of the importance of maintaining defense in depth, particular attention should be given to identifying any containment systems involving IST components.

"* Step-wise program implementation, as discussed in Regulatory Position 3.2, should be included as part of the licensee's integrated decisionmaking process.

"* The licensee's performance monitoring approach, as discussed in Regulatory Position 3.3, should be included as part of the licensee's decisionmaking process.

Value/Impact Statement A draft value/impact statement was published with the draft of this guide (DG-1062) when it was issued for public comment in June 1997. No significant changes were necessary from the original draft, so a separate value/impact statement for this final guide has not been prepared. A copy of the draft value/impact statement is available for inspection or copying for a fee in the Commission's Public Document Room at 2120 L Street NW, Washington, DC.

1.175-23 I I

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, DC 20555-0001 FIRST CLASS MAIL POSTAGE AND FEES PAID USNRC PERMIT NO. G-67 OFFICIAL BUSINESS PENALTY FOR PRIVATE USE, $300