[Federal Register Volume 68, Number 95 (Friday, May 16, 2003)]
[Proposed Rules]
[Pages 26511-26551]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 03-11696]
========================================================================
Proposed Rules
Federal Register
________________________________________________________________________
This section of the FEDERAL REGISTER contains notices to the public of
the proposed issuance of rules and regulations. The purpose of these
notices is to give interested persons an opportunity to participate in
the rule making prior to the adoption of the final rules.
========================================================================
Federal Register / Vol. 68, No. 95 / Friday, May 16, 2003 / Proposed
Rules
[[Page 26511]]
NUCLEAR REGULATORY COMMISSION
10 CFR Part 50
RIN 3150-AG42
Risk-Informed Categorization and Treatment of Structures, Systems
and Components for Nuclear Power Reactors
AGENCY: Nuclear Regulatory Commission.
ACTION: Proposed rule.
-----------------------------------------------------------------------
SUMMARY: The Nuclear Regulatory Commission (NRC) is proposing to amend
its regulations to provide an alternative approach for establishing the
requirements for treatment of structures, systems and components (SSCs)
for nuclear power reactors using a risk-informed method of categorizing
SSCs according to their safety significance. The proposed amendment
would revise requirements with respect to ``special treatment,'' that
is, those requirements that provide increased assurance (beyond normal
industrial practices) that SSCs perform their design basis functions.
This proposed amendment would permit licensees (and applicants for
licenses) to remove SSCs of low safety significance from the scope of
certain identified special treatment requirements and revise
requirements for SSCs of greater safety significance. In addition to
the rulemaking and its associated analyses, the Commission is also
proposing a draft regulatory guide to implement the rule.
DATES: Submit comments by July 30, 2003. Comments received after this
date will be considered if it is practical to do so, but the Commission
is able to ensure consideration only for comments received on or before
this date.
ADDRESSES: You may submit comments by any one of the following methods.
Please include the following number (RIN 3150-AG42) in the subject line
of your comments. Comments on rulemakings submitted in writing or in
electronic form will be made available to the public in their entirety
on the NRC rulemaking web site. Personal information will not be
removed from your comments.
Mail comments to: Secretary, U.S. Nuclear Regulatory Commission,
Washington, DC 20555-0001, ATTN: Rulemakings and Adjudications Staff.
E-mail comments to: [email protected]. If you do not receive a reply e-
mail confirming that we have received your comments, contact us
directly at (301) 415-1966. You may also submit comments via the NRC's
rulemaking web site at http://ruleforum.llnl.gov. Address questions
about our rulemaking website to Carol Gallagher (301) 415-5905; email
[email protected].
Hand deliver comments to: 11555 Rockville Pike, Rockville, Maryland
20852, between 7:30 am and 4:15 pm Federal workdays. (Telephone (301)
415-1966).
Fax comments to: Secretary, U.S. Nuclear Regulatory Commission at
(301) 415-1101.
Publicly available documents related to this rulemaking may be
examined and copied for a fee at the NRC's Public Document Room (PDR),
Public File Area O1 F21, One White Flint North, 11555 Rockville Pike,
Rockville, Maryland. Selected documents, including comments, can be
viewed and downloaded electronically via the NRC rulemaking web site at
http://ruleforum.llnl.gov.
Publicly available documents created or received at the NRC after
November 1, 1999, are available electronically at the NRC's Electronic
Reading Room at http://www.nrc.gov/NRC/ADAMS/index.html. From this
site, the public can gain entry into the NRC's Agencywide Document
Access and Management System (ADAMS), which provides text and image
files of NRC's public documents. If you do not have access to ADAMS or
if there are problems in accessing the documents located in ADAMS,
contact the NRC Public Document Room (PDR) Reference staff at 1-800-
397-4209, 301-415-4737 or by email to [email protected].
FOR FURTHER INFORMATION CONTACT: Mr. Timothy Reed, Office of Nuclear
Reactor Regulation, U.S. Nuclear Regulatory Commission, Washington, DC
20555-0001; telephone (301) 415-1462; e-mail: [email protected].
SUPPLEMENTARY INFORMATION:
Table of Contents
I. Background
II. Rule Initiation
III. Proposed Regulations
IV. Public Input to the Proposed Rule
V. Section by Section Analysis
VI. Other Topics for Public Comment
VII. Guidance
VIII. Criminal Penalties
IX. Compatibility of Agreement State Regulations
X. Availability of Documents
XI. Plain Language
XII. Voluntary Consensus Standards
XIII. Finding of No Significant Environmental Impact
XIV. Paperwork Reduction Act Statement
XV. Regulatory Analysis
XVI. Regulatory Flexibility Act Certification
XVII. Backfit Analysis
I. Background
The NRC has established a set of regulatory requirements for
commercial nuclear reactors to ensure that a reactor facility does not
impose an undue risk to the health and safety of the public, thereby
providing reasonable assurance of adequate protection to public health
and safety. The current body of NRC regulations and their
implementation are largely based on a ``deterministic'' approach.
This deterministic approach establishes requirements for
engineering margin, quality assurance in design, manufacture, and
construction. In addition, it assumes that adverse conditions can exist
(e.g., equipment failures and human errors) and establishes a specific
set of design basis events (DBEs). The deterministic approach contains
implied elements of probability (qualitative risk considerations), from
the selection of accidents to be analyzed (e.g., reactor vessel rupture
is considered too improbable to be included) to the system level
requirements for emergency core cooling (e.g., safety train redundancy
and protection against single failure). The deterministic approach then
requires that the licensed facility include safety systems capable of
preventing and/or mitigating the consequences of those DBEs to protect
public health and safety. Those SSCs necessary to defend against the
DBEs were defined as ``safety-related,'' and these SSCs were the
subject of many regulatory requirements designed to ensure that they
were of high quality, high reliability, and had capability to perform
during postulated design basis
[[Page 26512]]
conditions. Typically, the regulations establish the scope of SSCs that
receive special treatment using one of three different terms: ``safety-
related,'' ``important to safety,'' or ``basic component.'' The terms
``safety-related'' and ``basic component'' are defined in the
regulations, while ``important to safety'' (used principally in the
general design criteria of Appendix A to 10 CFR part 50) is not
explicitly defined.
These prescriptive requirements as to how licensees were to treat
SSCs, especially those that are defined as ``safety-related,'' are
referred to in the rulemaking as ``special treatment requirements.''
These requirements were developed to provide greater assurance that
these SSCs would perform their functions under particular conditions
(e.g., seismic events, or harsh environments), with high quality and
reliability, for as long as they are part of the plant. These include
particular examination techniques, testing strategies, documentation
requirements, personnel qualification requirements, independent
oversight, etc. In many instances, these ``special treatment''
requirements were developed as a means to gain assurance when more
direct measures, e.g., testing under design basis conditions or routine
operation, could not show that SSCs were functionally capable.
Special treatment requirements are imposed on nuclear reactor
applicants and licensees through numerous regulations that have been
issued since the 1960's. These requirements specify different scopes of
equipment for different special treatment requirements depending on the
specific regulatory concern, but are derived from consideration of the
deterministic DBEs.
Treatment for an SSC, as a general term and as it will be used in
this rulemaking, refers to activities, processes, and/or controls that
are performed or used in the design, installation, maintenance, and
operation of structures, systems, or components as a means of (1)
specifying and procuring SSCs that satisfy performance requirements;
(2) verifying over time that performance is maintained; (3) controlling
activities that could impact performance; and (4) providing assessment
and feedback of results to adjust activities as needed to meet desired
outcomes. Treatment includes, but is not limited to, quality assurance,
testing, inspection, condition monitoring, assessment, evaluation, and
resolution of deviations. The distinction between ``treatment'' and
``special treatment'' is the degree of NRC specification as to what
must be implemented for particular SSCs or for particular conditions.
Defense-in-depth is an element of the NRC's safety philosophy that
employs successive measures to prevent accidents or mitigate damage if
a malfunction, accident, or naturally caused event occurs at a nuclear
facility. Defense-in-depth is a philosophy used by the NRC to provide
redundancy as well as the philosophy of a multiple-barrier approach
against fission product releases. The defense-in-depth philosophy
ensures that safety will not be wholly dependent on any single element
of the design, construction, maintenance, or operation of a nuclear
facility. The net effect of incorporating defense-in-depth into design,
construction, maintenance, and operation is that the facility or system
in question tends to be more tolerant of failures and external
challenges.
A probabilistic approach to regulation enhances and extends the
traditional deterministic approach by allowing consideration of a
broader set of potential challenges to safety, providing a logical
means for prioritizing these challenges based on safety significance,
and allowing consideration of a broader set of resources to defend
against these challenges. Until the accident at Three Mile Island
(TMI), the NRC only used probabilistic criteria in specialized areas,
such as for certain man-made hazards and for natural hazards (with
respect to initiating event frequency). The major investigations of the
TMI accident recommended that probabilistic risk assessment (PRA)
techniques be used more widely to augment traditional nonprobabilistic
methods of analyzing plant safety.
In contrast to the deterministic approach, PRAs address credible
initiating events by assessing the event frequency. Mitigating system
reliability is then assessed, including the potential for common cause
failures. The probabilistic treatment goes beyond the single failure
requirements used in the deterministic approach. The probabilistic
approach to regulation is therefore considered an extension and
enhancement of traditional regulation by considering risk in a more
coherent and complete manner.
The primary need for improving the implementation of defense-in-
depth in a risk-informed regulatory system is guidance to determine how
many measures are appropriate and how good these should be. Instead of
merely relying on bottom-line risk estimates, defense-in-depth is
invoked as a strategy to ensure public safety given there exists both
unquantified and unquantifiable uncertainty in engineering analyses
(both deterministic and risk assessments).
Risk insights can make the elements of defense-in-depth clearer by
quantifying them to the extent practicable. Although the uncertainties
associated with the importance of some elements of defense may be
substantial, the fact that these elements and uncertainties have been
quantified can aid in determining how much defense makes regulatory
sense. Decisions on the adequacy of, or the necessity for, elements of
defense should reflect risk insights gained through identification of
the individual performance of each defense system in relation to
overall performance.
The Commission published a Policy Statement on the Use of
Probabilistic Risk Assessment (PRA) on August 16, 1995 (60 FR 42622).
In the policy statement, the Commission stated that the use of PRA
technology should be increased in all regulatory matters to the extent
supported by the state of the art in PRA methods and data, and in a
manner that supports the NRC's traditional defense-in-depth philosophy.
The policy statement also stated that in making regulatory judgments,
the Commission's safety goals for nuclear power reactors and subsidiary
numerical objectives (on core damage frequency and containment
performance) should be used with appropriate consideration of
uncertainties.
To implement this Commission policy, the staff developed guidance
on the use of risk information for reactor license amendments and
issued Regulatory Guide (RG) 1.174. This RG provided guidance on an
acceptable approach to risk-informed decision-making consistent with
the Commission's policy, including a set of key principles. These
principles include:
(1) Be consistent with the defense-in-depth philosophy;
(2) Maintain sufficient safety margins;
(3) Any changes allowed must result in only a small increase in
core damage frequency or risk, consistent with the intent of the
Commission's Safety Goal Policy Statement; and
(4) Incorporate monitoring and performance measurement strategies.
Regulatory Guide 1.174 states that consistency with the defense-in-
depth philosophy will be preserved by ensuring that:
(1) A reasonable balance is preserved among prevention of
accidents, prevention of barrier failure, and mitigation of
consequences;
(2) An over-reliance on programmatic activities to compensate for
weaknesses
[[Page 26513]]
in equipment or device design is avoided;
(3) System redundancy, independence, and diversity are preserved
commensurate with the expected frequency, consequences of challenges to
the system, and uncertainties (e.g., no risk outliers);
(4) Defenses against potential common cause failures are preserved,
and the potential for the introduction of new common cause failure
mechanisms is assessed;
(5) The independence of barriers is not degraded; and
(6) defenses against human errors are preserved.
II. Rule Initiation
In addition to RG 1.174, the NRC also issued other regulatory
guides on risk-informed approaches for specific types of applications.
These included RG 1.175, Risk-informed Inservice Testing, RG 1.176,
Graded Quality Assurance, RG 1.177, Risk-informed Technical
Specifications, and RG 1.178, Risk-informed Inservice Inspection. In
this respect, the Commission has been successful in developing and
implementing a regulatory means for considering risk insights into the
current regulatory framework. One such risk-informed application, the
South Texas Project (STP) submittal on graded quality assurance, is
particularly noteworthy.
In March 1996, STP Nuclear Operating Company (STPNOC) requested
that the NRC approve a revised Operations Quality Assurance Program
(OQAP) that incorporated the methodology for grading quality assurance
(QA) based on PRA insights. The STP graded QA proposal was an extension
of the existing regulatory framework. Specifically, the STP approach
continued to use the traditional safety-related categorization, but
allowed for gradation of safety significance within the ``safety-
related'' categorization (consistent with 10 CFR Part 50 Appendix B)
through use of a risk-informed process. Following extensive discussions
with the licensee and substantial review, the staff approved the
proposed revision to the OQAP on November 6, 1997. Subsequent to NRC's
approval, STPNOC identified implementation difficulties associated with
the graded QA program. Despite the reduced QA requirement applied for a
large number of SSCs in which the licensee judged to be of low safety
significance, other regulatory requirements such as environmental
qualification, the American Society of Mechanical Engineers (ASME)
Boiler and Pressure Vessel Code, or seismic continue to impose
substantial burdens. As a result, the replacement of such a low safety
significant component needs to satisfy other special requirements
during a procurement process. These requirements prevented STPNOC from
realizing the full potential reduction in unnecessary regulatory burden
for SSCs judged to have little or no safety importance. In an effort to
achieve the full benefit of the graded QA program (and in fact go
beyond the staff's previous approval of graded QA), STPNOC submitted a
request, dated July 13, 1999, asking for an exemption from the scope of
numerous special treatment regulations (including 10 CFR 50 Appendix B)
for SSCs categorized as low safety significant or as non-risk
significant. STPNOC's exemption was ultimately approved by the staff in
August 2001 (further discussed in Section IV.4).
The experience with graded QA was a principal factor in the NRC's
determination that rule changes would be necessary to proceed with some
activities to risk-inform requirements. The Commission also believes
that the development of PRA technology and decision-making tools for
using risk information together with deterministic information
supported rulemaking activities to allow the NRC to refocus certain
regulatory requirements using this type of information.
Under Option 2 of SECY-98-300, ``Options for Risk-Informed
Revisions to 10 CFR Part 50--`Domestic Licensing of Production and
Utilization Facilities,' '' dated December 23, 1998, the NRC staff
recommended that risk-informed approaches to the application of special
treatment requirements be developed as one application of risk-informed
regulatory changes. Option 2 (also referred to as RIP50 Option 2)
addresses the implementation of changes to the scope of SSCs needing
special treatment while still providing assurance that the SSCs will
perform their design functions. Changes to the requirements pertaining
to the design of the plant or the design basis accidents are not
included in Option 2. These technical risk-informed changes are
addressed under Option 3 of SECY-98-300. The Commission approved
proceeding with Option 2 in a staff requirements memorandum (SRM) dated
June 8, 1999.
The stated purpose of the ``Option 2'' rulemaking was to develop an
alternative regulatory framework that enables licensees, using a risk-
informed process for categorizing SSCs according to their safety
significance (i.e., a decision that considers both traditional
deterministic insights and risk insights), to reduce unnecessary
regulatory burden for SSCs of low safety significance by removing these
SSCs from the scope of special treatment requirements. As part of this
process, those SSCs found to be of risk-significance would be brought
under a greater degree of regulatory control through the requirements
being added to the rule designed to maintain consistency between actual
performance and the performance considered in the assessment process
that determines their significance. As a result, both the NRC staff and
industry should be able to better focus their resources on regulatory
issues of greater safety significance.
The Commission directed the staff to evaluate strategies to make
the scope of the nuclear power reactor regulations that impose special
treatment risk-informed. SECY-99-256, ``Rulemaking Plan for Risk-
Informing Special Treatment Requirements,'' dated October 29, 1999, was
sent to the Commission to obtain approval for a rulemaking plan and
issuance of an Advance Notice of Proposed Rulemaking (ANPR). By SRM
dated January 31, 2000, the Commission approved publication of the ANPR
and approved the rulemaking plan. The ANPR was published in the Federal
Register on March 3, 2000 (65 FR 11488) for a 75-day comment period,
which ended on May 17, 2000. In the rulemaking plan, the NRC proposed
to create a new section within part 50, referred to as Sec. 50.69, to
contain these alternative requirements.
The Commission received more than 200 comments in response to the
ANPR. The staff sent the Commission SECY-00-194 ``Risk-Informing
Special Treatment Requirements,'' dated September 7, 2000, which
provided the staff's preliminary views on the ANPR comments and
additional thoughts on the preliminary regulatory framework for
implementing a rule to revise the scope of special treatment
requirements for SSCs. The comments from the ANPR are further discussed
in Section IV.1.0 below.
The concept developed for this proposed rule, discussed at length
in the ANPR, was to apply treatment requirements based upon the safety-
significance of SSCs, determined through consideration of both risk
insights and deterministic information. Thus, the risk-informed
approach discussed in this proposed rule for establishing an
alternative scope of SSCs subject to special treatment requirements
uses both risk and traditional deterministic methods in a blended
``risk-informed'' approach. The Commission finds the risk-informed
[[Page 26514]]
approach outlined in RG 1.174 is appropriate for use in this
rulemaking.
It is important to note that this rulemaking effort, while intended
to ensure that the scope of special treatment requirements imposed on
SSCs is risk-informed, is not intended to allow for the elimination of
SSC functional requirements, or to allow equipment that is required by
the deterministic design basis to be removed from the facility (i.e.,
changes to the design of the facility must continue to meet the current
requirements governing design change, most notably Sec. 50.59).
Instead, this rulemaking should enable licensees and the staff to focus
their resources on SSCs that make a significant contribution to plant
safety by restructuring the regulations to allow an alternative risk-
informed approach to special treatment. Conversely, for SSCs that do
not significantly contribute to plant safety, this approach should
allow an acceptable, though reduced, level of assurance that these SSCs
will satisfy functional requirements.
III. Proposed Regulations
The Commission is proposing to establish Sec. 50.69 as an
alternative set of requirements whereby a licensee may undertake
categorization of its SSCs using risk insights and adjust treatment
requirements based upon their resulting significance. Under this
approach, a licensee would be allowed to reduce special treatment
requirements for SSCs that are determined to be of low safety
significance and would enhance requirements for treatment of other SSCs
that are found to be safety significant. The proposed requirements
would establish a process by which a licensee would categorize SSCs
using a risk-informed process, adjust treatment requirements consistent
with the relative significance of the SSC, and manage the process over
the lifetime of the plant. To implement these requirements, a risk-
informed categorization process would be employed to determine the
safety significance of SSCs and place the SSCs into one of four risk-
informed safety class (RISC) categories. It is important that this
categorization process be robust to enable the Commission to remove
requirements for SSCs determined to be of low safety significance. The
determination of safety significance would be performed by an
integrated decisionmaking process which uses both risk insights and
traditional engineering insights. The safety functions would include
both the design basis functions (derived from the ``safety-related''
definition, which includes external events), as well as functions
credited for severe accidents (including external events). Treatment
requirements for the SSCs are applied as necessary to maintain
functionality and reliability, and are a function of the category into
which the SSC is categorized. Finally, assessment activities would be
conducted to make adjustments to the categorization and treatment
processes as needed so that SSCs continue to meet applicable
requirements. The proposed rule also contains requirements for
obtaining NRC approval of the categorization process and for
maintaining plant records and reports.
III.1.0 Categorization of SSCs
Section 50.69 would define four RISC categories into which SSCs are
categorized. Four categories were chosen because it is the simplest
approach for transitioning between the previous SSC classification
scheme and the new scheme used in the proposed Sec. 50.69. The
depiction in Figure 1 provides a conceptual understanding of the new
RISC categories. The figure depicts the current safety-related versus
nonsafety-related SSC categorization scheme with an overlay of the new
risk-informed categorization. In the traditional deterministic
approach, SSCs were generally categorized as either ``safety-related''
(as defined in Sec. 50.2) or nonsafety-related. This division is shown
by the vertical line in the figure. Risk insights, including
consideration of severe accidents, can be used to identify SSCs as
being either safety-significant or low safety-significant (shown by the
horizontal line). Hence, the application of a risk-informed
categorization results in SSCs being grouped into one of four
categories as represented by the four boxes in Figure 1.
Box 1 of Figure 1 depicts safety-related SSCs that a risk-informed
categorization process determines are significant contributors to plant
safety. These SSCs are termed RISC-1 SSCs. RISC-2 SSCs are nonsafety-
related, and the risk-informed categorization determines them to be
significant contributors to plant safety. The third category are those
SSCs that are safety-related SSCs and that a risk-informed
categorization process determines are not significant contributors to
plant safety. These SSCs are termed RISC-3 SSCs. Finally, there are
SSCs that are nonsafety-related and that a risk-informed categorization
process determines are not significant contributors to plant safety.
These SSCs are termed RISC-4 SSCs.
Section 50.69 would define the terminology ``safety-significant
function'' as functions whose loss or degradation could have a
significant adverse effect on defense-in-depth, safety margins or risk.
This definition was chosen to be consistent with the concepts described
in RG 1.174. The proposed rule would impose greater treatment
requirements on SSCs that perform safety-significant functions (RISC-1
and RISC-2 SSCs) to ensure that defense-in-depth and safety margins are
maintained. The proposed rule would also require that the change in
risk associated with implementation of proposed Sec. 50.69 be small.
III.2.0 Methodology for Categorization
The cornerstone of proposed Sec. 50.69 is the establishment of a
robust, risk-informed categorization process that provides high
confidence that the safety significance of SSCs is correctly determined
considering all relevant information. As such, all the categorization
requirements incorporated into proposed Sec. 50.69 are to achieve this
objective. Essentially the process is structured to ensure that all
relevant information pertaining to SSC safety significance is
considered by a panel that has the expertise and capabilities for
making a sound decision regarding the SSC's categorization, and that
information is considered in a manner that ensures the Commission's
criteria for risk-informed applications are satisfied (i.e., that
defense-in-depth is maintained, safety margins are maintained, any risk
change is small, and a monitoring and performance assessment strategy
is used). This process enables SSCs to be placed in the correct RISC
category such that the appropriate treatment requirements will be
applied commensurate with their safety significance. A safety-
significant SSC is an SSC that performs a safety-significant function.
The proposed rule would require that SSC safety significance be
determined using quantitative information from an up-to-date PRA
reasonably representing the current plant configuration, which as a
minimum covers internal events at full power, and other available risk
analyses and traditional engineering information to supplement the
quantitative PRA results.
[[Page 26515]]
[GRAPHIC][TIFF OMITTED]TP16MY03.031
Section 50.69 would contain requirements to ensure that the PRA is
adequate for this application. The proposed rule would require that as
part of the categorization process defense-in-depth is considered, and
that the revised treatment applied to RISC-3 SSCs be considered for its
potential impact on risk. As an example, the Commission's position is
that the containment and its systems are important in the preservation
of the defense-in-depth philosophy (in terms of both large early and
large late releases). As part of meeting the defense-in-depth
principle, a licensee must demonstrate that the function of the
containment as a barrier (including fission product retention and
removal) is not significantly degraded when SSCs that support the
functions are moved to RISC-3. Thus, the rule contains requirements for
the IDP to consider defense-in-depth as part of the categorization
process.
The risk insights and other traditional information are required to
be evaluated by an Integrated Decision-Making Panel (IDP) comprised of
expert, plant-knowledgeable members whose expertise includes PRA,
safety analysis, plant operation, design engineering, and system
engineering. Because the IDP makes the final determination about the
safety significance of an SSC, it is important that the membership
include a variety of expertise about the plant, how it is operated, and
the safety analyses (both deterministic and probabilistic), so that all
pertinent information is considered. Hence the available deterministic
and probabilistic information pertaining to SSC safety significance is
considered in the decision process. The information considered must
reflect the as-built and as-operated plant, so that the decisions are
based upon correct information, leading to proper categorization. Where
applicable, the information is to come from a PRA that is adequate for
this application (i.e., categorization of SSC safety significance).
From this perspective, the IDP decision process can be viewed as an
extension of the previous process for determining SSC safety
classification (i.e., safety-related or nonsafety-related), in that it
is making use of relevant risk information which was either not
considered, or not available when the SSCs were initially classified.
The IDP makes the final determination of the safety significance of
SSCs using a process that takes all this information into
consideration, in a structured, documented manner. The structure
provides consistency to decisions that may be made over a period of
time, and the documentation
[[Page 26516]]
gives both the licensee and the NRC the ability to understand the basis
for the categorization decision, should questions arise at a later
date.
The proposed rule would contain general requirements for
consideration of SSCs, modes of operation or initiating events not
modeled in the PRA. As a result, the implementing guidance plays a
significant role in effective implementation, and bolsters the need for
NRC review and approval of the categorization process before
implementation. As noted in the ANPR, the Commission could include more
requirements in the rule itself, rather than only being in the
guidance. Public comment is requested on the merits of placing the
additional detail shown in the guidance and discussed in Section V.4 of
the Statement of Considerations (SOC) in the rule.
Implementation of the categorization process relies heavily on the
skills, knowledge, and experience of the people that implement the
process, in particular on the qualifications of IDP members. Therefore,
the Commission concludes that requirements are necessary for the
composition of the panel to be experienced personnel who possess
diverse knowledge and insights in plant design and operation and who
are capable in the use of deterministic knowledge and risk insights in
making SSC classifications.
The PRA used to provide the risk information to the categorization
process is required to be subjected to a peer review. The peer review
focuses on the PRA completeness and technical adequacy for determining
importance of particular SSCs, including consideration of the scope,
level of detail, and technical quality of the PRA model, the
assumptions made in the development of the results, and the
uncertainties that impact the analysis. This provides assurance that
for IDP decisions that utilize PRA information that the results of the
categorization process provide a valid representation of the risk
importance of SSCs.
Before implementation of Sec. 50.69, the NRC will approve the
categorization process, through a license amendment, because of the
importance of the PRA and categorization process to successful
implementation of the proposed rule. This review will determine whether
the licensee's application satisfies the Sec. 50.69 requirements, and
consider the adequacy of the PRA, focusing on the results of the peer
review and the actions taken by the licensee to address any peer review
findings. The Commission has determined that a focused NRC staff review
of the PRA is necessary because there are key assumptions and modeling
parameters that can have a significant enough impact on the results
such that NRC review of their adequacy for this application is
considered necessary to verify that the overall categorization process
will yield acceptable decisions.
Section 50.69(c)(iv) would require that a licensee or applicant
provide reasonable confidence that for SSCs categorized as RISC-3,
sufficient safety margins are maintained and that any potential changes
in core damage frequency (CDF) and large early release frequency (LERF)
resulting from the implementation of Sec. 50.69 are small. That is,
plants with total baseline CDF of 10-4 per year or less
would be permitted CDF increases of up to 10-5 per year, and
plants with total baseline CDF greater than 10-4 per year
would be permitted CDF increases of up to 10-6 per year.
Plants with total baseline LERFs of 10-5 per year or less
would be permitted LERF increases of up to 10-6 per year,
and plants with total baseline LERFs greater than 10-5 per
year would be permitted LERF increases of up to 10-7 per
year. However, if there is an indication that the baseline CDF or LERF
may be considerably higher than these values, the focus of the licensee
should be on finding ways to reduce risk and the licensee may be
required to present arguments as to why steps should not be taken to
reduce risk in order to consider the reduction in special treatment
requirements. This is consistent with the guidance in Section 2.2.4 of
RG 1.174. It should be noted that this allowed increase shall be
applied to the overall categorization process, even for those licensees
that will implement Sec. 50.69 in a phased manner. Thus, the allowable
potential increase in risk must be determined in a cumulative way for
all the SSCs being recategorized.
Section 50.69 contains requirements for maintaining the design
basis of the facility. These requirements, considered in conjunction
with the requirements to maintain the potential change in risk as small
(as discussed above), ensure that safety margins are maintained. The
performance of candidate RISC-3 SSCs should not be significantly
degraded by the removal of special treatment. This is because the
licensee is required to implement processes that provide reasonable
confidence that SSCs remain functional, that is, remain capable of
performing their function with a reliability that is not significantly
degraded to such an extent that there will be a significant number of
failures that can lead to unacceptable increases in CDF or LERF.
The proposed rule would require applicants and licensees to perform
evaluations to assess the potential impact on risk from changes to
treatment. For SSCs modeled in the PRA, this would likely be
accomplished by sensitivity studies to assess the impact of changes in
SSC failure probabilities or reliabilities that might occur due to the
revised treatment. For example, a licensee would be expected to
increase the failure rates of RISC-3 SSCs by appropriate factors to
understand the potential effect of applying reduced treatment to these
SSCs (e.g., reduced maintenance, testing, inspection, and quality
assurance). For other SSCs, other types evaluations would be used to
provide the basis for concluding that the potential increase in risk
would be small. A licensee will need to submit its basis to support
that the evaluations are bounding estimates of the potential change in
risk and that programs already in existence or implemented for proposed
Sec. 50.69 can provide sufficient information that any potential risk
change remains small over the lifetime of the plant. A licensee is
required to consider potential effects of common-cause interaction
susceptibility and potential impacts from known degradation mechanisms.
To meet this requirement, a licensee would need to: (a) Maintain an
understanding of common-cause effects and degradation mechanisms and
their potential impact on RISC-3 SSCs; (b) maintain an understanding of
the programmatic activities that provide defenses against common cause
failures (CCFs) and failures resulting from degradation; and (c) factor
this knowledge into the treatment applied to the RISC-3 SSCs.
The proposed rule focuses on common-cause effects because
significant increases in common-cause failures could invalidate the
evaluations, such as sensitivity studies, performed to show a small
change in risk due to implementation of Sec. 50.69. With respect to
known degradation mechanisms, this is an acknowledgment that certain
treatment requirements have evolved over time to deal with such
mechanisms (e.g., use of particular inspection techniques or
frequencies), and that when contemplating changes to treatment, the
lessons from this experience are to be taken into account.
For SSCs categorized by means other than PRA models, the licensee
would need to provide a basis to conclude that the small increase in
risk requirement would still be met in light of potential changes in
treatment. All of these requirements are included in Sec. 50.69 so
that a licensee has a basis for
[[Page 26517]]
concluding that the evaluations performed to show a small change in
risk remain valid.
In addition, the rule would require that implementation be done for
an entire system or structure and not for selected components within a
system or structure. This required scope ensures that all safety
functions associated with a system or structure are properly identified
and evaluated when determining the safety significance of individual
components within a system or structure and that the entire set of
components that comprise a system or structure are considered and
addressed.
III.3.0 Treatment Requirements
Treatment requirements are applied to SSCs commensurate with SSC
safety significance and as a function of the RISC category into which
the SSCs are categorized.
III.3.1 RISC-1 and RISC-2 Treatment
For SSCs determined by the IDP to be safety-significant (i.e.,
RISC-1 and RISC-2 SSCs), Sec. 50.69 would maintain the current
regulatory requirements (i.e., it does not remove any requirements from
these SSCs) for special treatment. These current requirements are
adequate for addressing design basis performance of these SSCs.
Additional requirements are being added to these SSCs to ensure that
their performance remains consistent with the assumed performance in
the categorization process (including the PRA) for beyond design basis
conditions. For example, in developing the PRA model, a licensee will
make assumptions regarding the availability, capability, and
reliability of RISC-1 and RISC-2 SSCs in performing specific functions
under various plant conditions. These functions may be beyond the
design basis for individual SSCs. Further, the conditions under which
those functions are assumed to be performed may exceed the design-basis
conditions for the applicable SSCs. In the proposed rule, a licensee
would be required to ensure that the treatment applied to RISC-1 and
RISC-2 SSCs is consistent with the performance credited in the
categorization process. This includes credit with respect to prevention
and mitigation of severe accidents. In some cases, licensees might need
to enhance the treatment applied to RISC-1 or RISC-2 SSCs to support
the credit taken in the categorization process, or conversely adjust
the categorization assumptions to reflect actual treatment practices.
In addition, requirements exist for monitoring and adjustment of
treatment processes (or categorization decisions) as needed based upon
performance.
III.3.2 RISC-3 Treatment
For RISC-3 SSCs, Sec. 50.69 would impose requirements which are
intended to maintain their design basis capability. Although
individually RISC-3 SSCs are not significant contributors to plant
safety, they do perform functions necessary to respond to certain
design basis events of the facility. Thus, collectively, RISC-3 SSCs
can be safety-significant and it is important to maintain their design
basis functional capability. Maintenance of RISC-3 design basis
functionality is important to ensuring that defense-in-depth and safety
margins are maintained. As a result, Sec. 50.69(d)(2) would require
licensees or applicants to have processes in place that provide
reasonable confidence in the capability of RISC-3 SSCs to perform their
safety-related functions under design basis conditions throughout the
service life. The proposed rule contains high-level requirements for
the treatment of RISC-3 SSCs with respect to design control;
procurement; maintenance, inspection, test, and surveillance; and
corrective action. These alternative treatment requirements for RISC-3
SSCs represent a relaxation of those special treatment requirements
that are removed for RISC-3 SSCs by the proposed rule. For example, the
alternative treatment requirements for RISC-3 SSCs in proposed Sec.
50.69 are less detailed than provided in the special treatment
requirements, and allow significantly more flexibility by licensees in
treating RISC-3 SSCs. The Commission is allowing greater flexibility
and a lower level of assurance to be provided for RISC-3 SSCs in
recognition of their low safety significance, and this recognition
includes a consideration for the potential change in reliability that
might occur when treatment is reduced from what had previously been
required by the special treatment requirements.
The Commission is proposing to specify four processes that must be
controlled and accomplished for RISC-3 SSCs: Design Control;
Procurement; Maintenance, Inspection, Testing, and Surveillance; and
Corrective Action. The high level RISC-3 requirements are structured to
address the various key elements of SSC functionality by focusing in
these areas. When SSCs are replaced, RISC-3 SSCs must remain capable of
performing design basis functions. Hence, the high level requirements
focus on maintaining this capability through design control and
procurement requirements. During the operating life of a RISC-3 SSC, a
sufficient level of confidence is necessary that the SSC continues to
be able to perform its design basis function; hence, the inclusion of
high level requirements for maintenance, inspection, test, and
surveillance. Finally, when data is collected, it must be fed back into
the categorization and treatment processes, and when important
deficiencies are found, they must be corrected; hence, requirements are
also provided in these areas.
In devising these requirements, the Commission has focused upon
those critical aspects of the various processes that must exist to
provide assurance of performance. Thus, in the design area, for
instance, the design conditions under which equipment is expected to
perform, such as environmental conditions or seismic conditions, are
still to be met. As another example, in the procurement area, procured
items are to satisfy their design requirements. These steps provide the
basis for concluding that a newly designed and procured replacement
item will be capable of meeting its design requirements, even though
the special treatment requirements that previously existed are no
longer being required.
In implementing the processes required by the proposed rule,
licensees will need to obtain data or information sufficient to make a
technical judgement that RISC-3 SSCs will remain capable of performing
their safety-related functions under design basis conditions. These
requirements are necessary because they require the licensee to obtain
the data necessary to continue to conclude that RISC-3 SSCs remain
capable of performing design basis functions, and to enable the
licensee to take actions to restore equipment performance consistent
with corrective action requirements included in the proposed rule.
Effective implementation of the treatment requirements provides
reasonable confidence in the capability of RISC-3 SSCs to perform their
safety function under normal and design basis conditions. This level of
confidence is both less than that associated with RISC-1 SSCs, which
are subject to all special treatment requirements, and consistent with
their low safety significance.
It is noted that changes that affect any non-treatment aspects of
an SSC (e.g., changes to the SSC design basis functional requirements)
are still required to be evaluated in accordance with other regulatory
requirements such as Sec. 50.59. Section 50.69(d)(2)(i), which focuses
upon design control, is intended to draw a distinction between
treatment (managed through Sec. 50.69) and design changes (managed
through other processes such as Sec. 50.59). As
[[Page 26518]]
previously noted, this rulemaking is only risk-informing the scope of
special treatment requirements. The process and requirements
established in Sec. 50.69 do not extend to making changes to the
design basis of SSCs.
III.3.3 RISC-4 Treatment
Section Sec. 50.69 would not impose treatment requirements on
RISC-4 SSCs. Instead RISC-4 SSCs are simply removed from the scope of
any applicable special treatment requirements. This is justified in
view of their low significance considering both safety-related and risk
information. Any changes (beyond changes to special treatment
requirements) must be made per existing design change control
requirements including Sec. 50.59 as applicable.
III.4.0 Removal of RISC-3 and RISC-4 SSCs From the Scope of Special
Treatment Requirements
RISC-3 and RISC-4 SSCs, through the application of Sec. 50.69, are
removed from the scope of specific special treatment requirements
listed in proposed Sec. 50.69. These requirements were initially
identified in the ANPR based upon a set of criteria as to whether the
regulation imposed requirements relating to quality assurance,
qualification, documentation, testing, etc., that were intended to add
assurance to performance of SSCs.
The special treatment requirements were originally imposed to
provide a very high level of assurance that safety-related SSCs would
perform when called upon with high reliability. As previously noted,
the requirements include extensive quality assurance requirements,
qualification testing requirements, as well as inservice inspection and
testing requirements. These requirements can be quite demanding and
expensive, as indicated in the data provided in the regulatory analysis
on procurement costs. For those SSCs that this new categorization
identifies as most safety-significant (RISC-1 and RISC-2), the existing
special treatment requirements are being maintained because the
Commission still desires a high level of assurance. However, the
Commission concluded that for the less significant SSCs, it was no
longer necessary to have the same high level of assurance that they
would perform as specified. This is because some increased likelihood
of failure can be tolerated without significantly impacting safety.
Thus, the Commission decided to remove the RISC-3 and RISC-4 SSCs from
those detailed, specific requirements that provided the very high level
of assurance. However, the functional requirements for these SSCs
remain. As an example, a RISC-3 component must still be designed to
withstand any harsh environment it would experience under a design
basis event, but the NRC will not require that this capability be
demonstrated by a qualification test. Further, the performance (and
treatment) of these RISC-3 SSCs remain under regulatory control, but in
a different way. Instead of the special treatment requirements, the
Commission has set forth more general requirements by which a licensee
is to maintain functionality. These requirements give the licensee more
latitude in applying its treatment processes to achieve performance
objectives. The more general requirements that the Commission is
specifying for the RISC-3 SSCs include steps to procure SSCs suitable
for the conditions under which they are to perform, to conduct
performance and/or condition monitoring and to take corrective action,
as a means of maintaining functionality. As discussed elsewhere in this
notice, the Commission concludes that the requirements in Sec. 50.69
maintain adequate protection of public health and safety. Hence,
implementation of Sec. 50.69 should result in a better focus for both
the licensee and the regulator on issues that pertain to plant safety,
and is consistent with the Commission's policy statement for the use of
PRA.
In some cases, the Commission concluded that the RISC-3 and RISC-4
SSCs could be totally removed from the scope of specific special
treatment requirements while in other cases the Commission concluded
that only partial removal was appropriate. The reduced assurance for
the RISC-3 SSC would be provided by the alternative requirements being
added by this proposed rule. Finally, there was a set of requirements
initially identified as special treatment for which the Commission is
not proposing to remove RISC-3 and RISC-4 SSCs from their scopes. These
requirements are discussed at the end of this section (III.4.9).
III.4.1 Reporting Requirements Under 10 CFR Part 21 and Sec. 50.55(e)
Section 206 of the Energy Reorganization Act of 1974 (ERA) requires
the directors and responsible officers of nuclear power plant licensees
and firms supplying ``components of any facility or activity * * *
licensed or otherwise regulated by the Commission'' to ``immediately
report'' to the Commission if they have information that ``such
facility, activity, or basic components supplied to such facility or
activity either fails to comply with the AEA, or Commission rule,
regulation, order or license ``relating to substantial safety
hazards,'' or contains a ``defect which could create a substantial
safety hazard * * *.'' Id., paragraph (a). Congress adopted Section 206
to ensure that individuals, and responsible directors and officers of
licensees and firms supplying important components to nuclear power
plants notify the NRC in a timely fashion of potentially significant
safety problems or non-compliance with NRC requirements. The NRC then
may assess the reported information and take any necessary regulatory
action in a timely fashion to protect public health and safety or
common defense and security. Congress did not include definitions for
the terms, ``components,'' ``basic components,'' or ``substantial
safety hazard,'' in Section 206, but instead directed the Commission to
promulgate regulations defining these terms.
The Commission's regulations implementing Section 206 are set forth
in 10 CFR Part 21 and Sec. 50.55(e) for license holders and
construction permit holders, respectively. The definitions of ``basic
component,'' ``defect,'' and ``substantial safety hazard'' in Part 21
were established by the Commission based upon the premise that the
deterministic regulatory paradigm embedded in the Commission's
regulations would continue to be the appropriate basis for determining
the safety significance of an SSC, and therefore the extent of the
reporting obligation under Section 206. This is most evident in the
Sec. 21.3 definition of ``basic component,'' which is very similar to
the definition of ``safety-related'' SSCs in Sec. 50.2 (originally
embodied in Sec. 50.49). Part 21 also recognizes that Congress did not
intend that every potential noncompliance or ``defect'' in a component
raises such significant safety issues that the NRC must be informed of
every identified or potential noncompliance or defect. Instead,
Congress limited the Section 206 reporting requirement to those
instances of noncompliance and defects which represent a ``substantial
safety hazard.'' Thus, Part 21 limits the reporting requirement to
instances of noncompliance and defects representing ``substantial
safety hazard,'' which Part 21 defines as:
A loss of safety function to the extent there is a major
reduction in the degree of protection afforded to public health and
safety for any facility or activity licensed, other than for export,
pursuant to parts 30, 40, 50, 60, 61, 63, 70, 71, or 72 of this
chapter.
[[Page 26519]]
Finally, part 21 establishes that a licensee or vendor should
``immediately report'' potential noncompliance or defects to the NRC in
a telephonic ``notification'' (see Sec. 21.3) within two (2) days of
receipt of information identifying a noncompliance or defect in a basic
component (see Sec. 21.21(d)). In addition, part 21 requires that
vendors/suppliers of basic components must make notifications to
purchasers or licensees of a reportable noncompliance or defect within
five (5) working days of completion of evaluations for determining
whether noncompliance or defect constitutes a substantial safety hazard
(see Sec. 21.21(b)). Thus, Part 21 establishes a reporting scheme for
immediate reporting of the most safety-significant noncompliances and
defects, as contemplated by Section 206 of the ERA.
Section 50.69 would substitute a risk-informed approach for
regulating nuclear power plant SSCs for the current deterministic
approach. Therefore, it is necessary from the standpoint of regulatory
coherence to determine: (1) What categories of SSCs (i.e., RISC-1,
RISC-2, RISC-3 and RISC-4) should be subject to Part 21 and Sec.
50.55(e) reporting under proposed Sec. 50.69, and whether changes to
Part 21 and/or Sec. 50.55(e) are necessary to ensure proper reporting
of substantial safety hazards; and (2) the appropriate reporting
obligations of licensees and vendors under proposed Sec. 50.69, and
whether changes to Part 21 and/or Sec. 50.55(e) are necessary to
impose the intended reporting obligations on these entities under
proposed Sec. 50.69.
III.4.1.1 RISC-1, RISC-2, RISC-3, and RISC-4 SSCs
After consideration of the underlying purposes of Section 206 and
the risk-informed approach embodied in Sec. 50.69 (which blends both
deterministic and risk information), the Commission believes that RISC-
1 SSCs should be subject to the reporting requirements in Part 21 and
Sec. 50.55(e) because of their high safety significance. The NRC
should be informed of any potential defects or noncompliance with
respect to RISC-1 SSCs, so that it may evaluate the significance of the
defects or noncompliance and take appropriate action. The fact that
properly-categorized RISC-1 SSCs in all likelihood fall within the
Commission's definition of ``basic components'' and are currently
subject to Part 21 and Sec. 50.55(e) provides confirmation that the
Commission's determination is prudent.
Similarly, the Commission believes that SSCs which are categorized
as RISC-4 should continue to be beyond the scope of, and not be subject
to, Part 21 and Sec. 50.55(e). SSCs properly categorized as RISC-4
have little or no risk significance, and it is highly unlikely that any
significant regulatory action would be taken by the NRC based upon
information on defects or instances of noncompliance in RISC-4 SSCs.
Inasmuch as no regulatory purpose would be served by reporting for
RISC-4 SSCs, the Commission proposes that RISC-4 SSCs should not be
subject to part 21 or Sec. 50.55(e). Again, the fact that SSCs
properly categorized as RISC-4 do not otherwise fall within the
definition of ``basic component'' and, therefore, are not subject to
Part 21 and Sec. 50.55(e), provides some confirmation of the prudence
of the Commission's determination.
Thus, the most problematic issue from the standpoint of regulatory
coherence, is determining the appropriate scope of reporting for RISC-2
and RISC-3 SSCs. For the reasons discussed below, the Commission
proposes that neither RISC-2 nor RISC-3 SSCs be subject to part 21 and
Sec. 50.55(e) reporting requirements.
The Commission begins by considering the regulatory objective of
Part 21 and Sec. 50.55(e) reporting under Section 206, and believes
that there are two parallel regulatory purposes inherent in these
reporting schemes. The first objective is to ensure that the NRC is
immediately informed of a potentially significant noncompliance or
defect in supplied components (in the broad sense of ``basic
components'' as defined in Sec. 21.3), so that the NRC may make a
determination as to whether such a safety hazard requires that
immediate NRC regulatory action at one or more nuclear power plants be
taken to ensure adequate protection to public health and safety or
common defense and security. The second is to ensure that nuclear power
plant licensees are immediately informed of a potentially significant
noncompliance or defect in supplied components. Such reporting allows a
licensee using such components to immediately evaluate the
noncompliance or defect to determine if a safety hazard exists at the
plant, and take timely corrective action as necessary. In both cases,
the regulatory objective is limited to components which have the
highest significance with respect to ensuring adequate protection to
public health and safety and common defense and security, and whose
failure or lack of proper functioning could create an imminent safety
hazard such that immediate evaluation of the situation and
implementation of necessary corrective action is necessary to ensure
adequate protection. In the context of a construction permit, the
safety hazard is two-fold: First, that a non-compliance or defect could
be incorporated into construction where it could never be detected; and
second, that a noncompliance or defect would, upon initial operation
and without prior indications of failure, create a substantial safety
hazard.
The Commission believes that the regulatory objectives embodied in
Part 21 and Sec. 50.55(e) reporting remain the same regardless of
whether the nuclear power plant is operating under the existing,
deterministic regulatory system or the proposed alternative, risk-
informed system embodied in Sec. 50.69. In both cases, the reporting
scheme should focus on immediate reporting to the NRC and licensee of
potentially significant noncompliances and defects that could create a
safety hazard requiring immediate evaluation and corrective action to
ensure continuing adequate protection. Accordingly, in determining
whether RISC-2 and RISC-3 SSCs should be subject to part 21 reporting,
the Commission assessed whether failure or malfunction of these SSCs
could reasonably lead to a safety hazard such that immediate evaluation
of the situation and implementation of necessary corrective action is
necessary to ensure adequate protection.
For RISC-2 SSCs, the Commission does not believe their failure or
malfunction could reasonably lead to a safety hazard such that
immediate licensee and NRC evaluation of the situation and
implementation of necessary corrective action is necessary to ensure
adequate protection. Although a RISC-2 SSC may be of significance for
particular sequences and conditions, for the reasons discussed below,
the Commission believes that no RISC-2 SSC, in and of itself, is of
such significance that its failure or lack of function would
necessitate immediate notification and action by licensees and the NRC.
The categorization process embodied in Sec. 50.69 determines the
relative significance of SSCs, with those in RISC-1 and RISC-2 being
more significant than those in RISC-3 or RISC-4. This does not mean
that any RISC-2 SSC would rise to the level of necessitating immediate
action if defects were identified.
Those SSCs that are viewed as being of sufficient safety
significance to require Part 21 reporting are RISC-1 SSCs. It is the
capability provided by these RISC-1 SSCs for purposes of satisfying
safety-related functional requirements that also leads to RISC-1 SSCs
as being safety-significant, as these
[[Page 26520]]
are key functions in prevention and mitigation of severe accidents.
Thus, RISC-1 SSCs are generally significant for a range of events and
conditions and as the primary means of accident prevention and
mitigation, the Commission wants to continue to achieve the high level
of quality, reliability, preservation of margins, and assurance of
performance of current regulatory requirements.
By contrast, RISC-2 SSCs are less important than RISC-1 SSCs
because they do not play a role in prevention and mitigation of design
basis events (i.e., the SSCs that maintain integrity of fission product
barriers, that provide or support the primary success paths for
shutdown, or that prevent or mitigate accidents that could lead to
potential offsite exposures). They are not part of the reactor
protection system or engineered safety features that perform critical
safety functions such as reactivity control, inventory control and heat
removal. When viewed from a deterministic standpoint, RISC-2 SSC are
not considered to rise to the level of a potential substantial safety
hazard. From the risk-informed perspective, SSCs may end up classified
as RISC-2 for a number of reasons. The classification might occur
because they: (i) Contribute to plant risk by initiating transients
that could lead to severe accidents (if multiple failures of other
mitigating SSCs were to occur), or (ii) they can reduce risk by
providing backup mitigation to RISC-1 SSCs in response to an event. The
Commission recognizes that, on its face, noncompliance by or defects in
RISC-2 SSCs, which could increase risk, such as by more frequent
initiation of a transient, may appear to constitute a ``substantial
safety hazard.'' However, upon closer examination, the Commission
believes otherwise. The risk significance of such ``transient
initiating'' RISC-2 SSCs depends upon their frequency of initiation,
with resultant consequences depending upon the failure of multiple
other components of varying types in different systems. Further, their
risk significance, as identified by the categorization process, is a
result of the reliability (failure rates) currently being achieved for
these SSC being treated as commercial-grade components, which includes
the possibility of noncompliances and defects. Because requirements on
RISC-2 SSCs are not being reduced, there is no reason to believe that
their performance would degrade as a result of implementation of Sec.
50.69. In fact, by better understanding of their safety significance,
and through the added requirements in this rule for RISC-2 SSCs for
consistency between the categorization assumptions and how they are
treated, performance should only be enhanced. As discussed in Sections
III.3 and III.5 of this SOC, the Commission is proposing that
additional regulatory controls be imposed on RISC-2 SSCs to prevent
their performance from degrading. In addition, the Commission is
proposing that licensees evaluate treatment being applied for
consistency with key categorization assumptions, monitor the
performance of these SSCs, take corrective actions, and report when a
loss of a safety-significant function occurs. The requirements of the
maintenance rule (Sec. 50.65 (a)(1) through (a)(3)) also continue to
apply to these SSCs. Thus, there are requirements for corrective action
by the licensee if noncompliances involving these SSCs are identified.
The Commission concludes that these requirements are sufficient because
no RISC-2 SSC is so significant as to necessitate immediate Commission
(or licensee) action.
For RISC-2 SSCs that provide backup mitigation to RISC-1 SSCs, the
Commission also finds it prudent and desirable from a risk-informed
standpoint to provide an enhanced level of assurance that RISC-2 SSCs
can perform their safety-significant functions, but the failure or
malfunction of such RISC-2 SSCs also does not raise a concern about
imminent safety hazards.
Moreover, over the last several years, the current fleet of power
reactors have been subjected to a number of risk studies, including
WASH-1400 (Reactor Safety Study), and other generic and plant-specific
reviews. While some safety improvements have been identified as a
result of these reviews, none has been of such significance as to
require immediate action. This essentially means that no SSCs that
would be categorized as RISC-2 SSC would rise to the level of
significance that their failure or lack of functionality would
constitute a substantial safety hazard requiring immediate regulatory
action. For example, in the case of two key risk scenarios, Station
Blackout and Anticipated Transient without Scram, the Commission
imposed regulatory requirements to reduce risk from these events;
however, the rules were promulgated as cost-beneficial safety
improvements. The equipment used for station blackout or anticipated
transients without scram would generally fall within the RISC-2
category. The Commission believes its conclusion about the relative
significance of RISC-2 SSC is also supported by plant-specific risk
studies, such as the IPE and IPEEE \1\, conducted to identify (and
correct) any plant-specific vulnerabilities to severe accident risk.
NRC's review of the responses to the licensee submittals has not
identified any situations requiring immediate action for protection of
public health and safety. In addition, as part of license renewal
reviews, the NRC reviews severe accident mitigation alternatives, to
identify and evaluate plant design changes with the potential for
improving severe accident safety performance. In the license renewals
completed to date, only a few candidate SAMAs were found to be cost-
beneficial (and none were considered necessary to provide adequate
protection of public health and safety).
---------------------------------------------------------------------------
\1\ In Generic letter 88-20, dated November 23, 1988, licensees
were requested to perform individual plant examinations to identify
plant-specific vulnerabilities to severe accidents that might exist
in their facilities and report the results to the Commission. As
part of their review and report, licensees were asked to determine
any cost-beneficial improvements to reduce risk. In supplement 4 to
the generic letter dated June 28, 1991, this request was extended to
include external events (earthquakes, fires, floods). The NRC staff
reviewed the plant-specific responses and prepared a staff
evaluation report on each submittal. Further, the set of results
were presented in NUREG-1560, IPE Program: Perspectives on Reactor
Safety and Plant Performance. A similar report on IPEEE results was
issued as NUREG-1742. In addition, as discussed in SECY-00-0062, the
staff has conducted IPE follow-up activities with owners groups and
licensees to confirm that identified improvements have been
implemented and if any other actions were warranted.
---------------------------------------------------------------------------
In sum, the Commission believes that in light of risk assessments
and actions that have already been implemented, there would be no SSCs
categorized under 50.69 as RISC-2 whose failure would represent a
significant and substantial safety concern such that immediate
notification and action is required. Accordingly, the results of these
risk assessments provide additional confidence to the Commission that
Part 21 requirements need not be imposed on RISC-2 SSCs.
The Commission believes that the multiple simultaneous failures of
either RISC-2 or RISC-3 components, in the same or in different
systems, is not a concern such that Part 21 reporting is necessary.
Even for components of the same type, it is not likely that the
installed components are identical in terms of their specific
characteristics or operating and maintenance history such that a defect
would lead to simultaneous failure of multiple components at the same
time. For both RISC categories, there are requirements to collect data
about performance of the SSCs, to review the data to determine if
adverse performance is occurring and to take
[[Page 26521]]
appropriate action (e.g., correct failures and adjust treatment
processes). Thus, it would be expected that degradation or problems
affecting a component type would be detected and dealt with before
multiple failures becomes likely. For many RISC-2 SSCs, failures tend
to be self-revealing (as it is initiation of a transient as a result of
failure of many RISC-2 SSC that makes them significant). For RISC-3
SSCs, requirements exist for design and procurement for any replacement
components to meet their design conditions, thus making it unlikely
that unsuitable components would be installed. Further, for the RISC-3
SSCs, evaluations will be performed, assuming significantly increased
failure rates for large number of components occurring simultaneously
to show that there is no more than a small (potential) change in risk.
Therefore, the Commission believes appropriate regulatory attention has
been given to the potential for multiple simultaneous failures.
The Commission also considered the question as to whether
notification of component defects should be required from the
perspective of other potentially-affected licensees. The set of SSCs
that are RISC-2 would vary from site to site, because it depends upon
specifics of plant design and operation, particularly for the balance-
of-plant which typically differs more from plant to plant than does the
nuclear steam supply part. Further, the suppliers of these components
would then also vary. Therefore, the specific type of notifications
under Part 21, for the purposes of NRC assessment of generic
implications of component defects and to assure notification of
licensees with the same components in service, would not fulfill a
useful regulatory function. The Commission notes that although Part 21
and Sec. 50.55(e) (component defect) reporting will not be required
for RISC-2 SSCs, proposed Sec. 50.69(g) contains enhanced reporting
requirements applicable to loss of system function attributable to,
inter alia, failure or lack of function of RISC-2 SSCs. This is
discussed in greater detail in Section III.5.
The Commission does not believe that any changes to Part 21 are
necessary to accomplish the Commission's proposal, and that this
proposal is consistent with the statutory requirements in Section 206
of the ERA. Section 206 does not contain any definition of
``substantial safety hazard,'' but contains a direction to the
Commission to define this term by regulation. Nothing in the
legislative history suggests that Congress had in mind a fixed and
unchanging concept of ``substantial safety hazard,'' or that the term
was limited to deterministic regulatory principles. Hence, the
Commission has broad discretion and authority to determine the
appropriate scope of reporting under Section 206. The Commission
believes that the current definition of ``substantial safety hazard''
in Sec. 21.3 is broadly written to permit the Commission to determine
that a RISC-2 SSC does not represent a ``substantial safety hazard'' as
defined in Sec. 21.3 in the context of a risk-informed regulatory
approach.
Therefore, because of the more supporting role that the RISC-2 SSCs
play with respect to ensuring critical safety functions, a
noncompliance or defect in a RISC-2 SSC would not result in a safety
hazard such that immediate licensee and NRC evaluation of the situation
and implementation of necessary corrective action is necessary to
ensure adequate protection. Thus, the Commission believes that a
noncompliance or defect in a RISC-2 SSC does not constitute a
substantial safety hazard for which reporting is necessary under Part
21. Accordingly, the Commission proposes that reporting requirements to
comply with Section 206 of the ERA are not necessary for RISC-2 SSCs
and that the scope of part 21 and Sec. 50.55(e) reporting requirements
should exclude RISC-2 SSCs.
The Commission also proposes that RISC-3 SSCs should not be subject
to part 21 and Sec. 50.55(e) reporting. A failure of a properly-
categorized RISC-3 SSC should result in, at most, only a small change
in risk, and should not result in a major degradation of essential
safety-related equipment (see NUREG-0302, Rev. 1).\2\ As discussed
above, the body of regulatory requirements (the retained requirements
and the requirements contained in this proposed rule) are sufficient
such that simultaneous failures in multiple systems (as would be
necessary to lead to a substantial safety hazard involving RISC-3 SSCs)
would not occur. Thus, there is little regulatory need for the NRC to
be informed of instances of noncompliance and defects with RISC-3 SSCs.
This is consistent with the NRC's current position that a ``substantial
safety hazard'' involves a major degradation of essential safety-
related equipment (see NUREG-0302). Accordingly, the Commission
proposes that RISC-3 SSCs should not be subject to reporting
requirements of part 21 and Sec. 50.55(e).
---------------------------------------------------------------------------
\2\ NUREG-0302, ``Remarks Presented (Questions and Answers
Discussed) At Public Regional Meetings to Discuss Regulations (10
CFR part 21) for Reporting of Defects and Noncompliances.'' Copies
of NUREGs may be purchased from the Superintendent of Documents,
U.S. Government Printing Office, P.O. Box 37082, Washington DC
20013-7082. Copies are also available from the National Technical
Information Service, 5285 Port Royal Road, Springfield, VA 22161. A
copy is also available for inspection and/or copying for a fee at
the NRC Public Document Room, One White Flint North, 11555 Rockville
Pike, Public File Area O1-F21, Rockville, MD.
---------------------------------------------------------------------------
In sum, the Commission proposes that part 21 reporting requirements
should extend only to SSCs classified as RISC-1 SSCs, since these SSCs
are those that are important in ensuring public health and safety and
minimizing risk. RISC-2 SSCs should not be subject to reporting because
play a lesser role than RISC-1 SSC in protection of public health and
safety and no regulatory purpose would be served by part 21 reporting
(as discussed above). RISC-3 and RISC-4 SSCs have little or no risk
significance and no regulatory purpose would be served by subjecting
RISC-3 and RISC-4 SSCS to part 21 and Sec. 50.55(e).
The Commission does not believe that any changes to part 21 or
Sec. 50.55(e) are necessary to accomplish the Commission's proposals
with respect to RISC-2 and RISC-3 SSCs, and that this proposal is
consistent with the statutory requirements in Section 206 of the ERA.
As discussed above, Section 206 does not contain any definition of
``substantial safety hazard,'' but contains a direction to the
Commission to define this term by regulation. Nothing in the
legislative history suggests that Congress had in mind a fixed and
unchanging concept of ``substantial safety hazard,'' or that the term
was limited to deterministic regulatory principles. Hence, the
Commission has broad discretion and authority to determine the
appropriate scope of reporting under Section 206. The Commission
believes that the current definition of ``substantial safety hazard''
in Sec. 21.3 is broadly written to permit the Commission to interpret
it as applying, in the context of a risk-informed regulatory approach,
only to RISC-1 SSCs. As discussed earlier, Sec. 50.69 embodies a risk-
informed regulatory paradigm which is different in key respects from
the Commission's historical deterministic approach, and applies the
risk-informed approach to classifying a nuclear power plant's SSCs
according to the SSC's risk significance. SSCs that are classified as
RISC-1 are those that represent the most important SSCs from both a
risk and deterministic standpoint: They perform the key functions of
preventing, controlling and mitigating accidents and controlling risk.
Failure of RISC-1 SSCs represent, from a risk-informed regulatory
perspective, the most important and significant safety concerns (i.e.,
a
[[Page 26522]]
``substantial safety hazard).'' Therefore, the Commission believes
that, in the context of the risk-informed regulatory approach embodied
in Sec. 50.69, it is reasonable for the Commission to interpret
``substantial safety hazard'' as applying to RISC-1 SSCs and that
reporting under Section 206 may be limited to RISC-1 SSCs.
The Commission considered two alternative approaches for limiting
the reporting requirements in part 21 and Sec. 50.55(e) to RISC-1
SSCs: (i) Interpreting ``basic component'' to encompass a risk-informed
view of what SSCs the term encompasses, and (ii) including a second
definition of ``basic component'' in Sec. 21.3, which would apply only
to those portions of a plant which have been categorized in accordance
with Sec. 50.69, and would be defined as an SSC categorized as RISC-1
under Sec. 50.69.
The Commission does not believe that the part 21 definition of
``basic component'' may easily be read as simultaneously permitting
both a deterministic concept of basic component and risk-informed
concept, inasmuch as the part 21 definition was drawn from, and was
intended to be consistent with the definition of ``safety-related SSC''
in Sec. 50.2. The Sec. 50.2 definition of ``safety-related SSC''
refers to the ability of the SSC to remain functional during ``design
basis events.'' The term, ``design basis events'' in Commission
practice has referred to the deterministic approach of defining the
events and conditions (e.g., shutdown, normal operation, accident) for
which an SSC is expected to function (or not fail). Identification of
design basis events is inherently different conceptually when compared
to a risk-informed approach, which attempts to identify all possible
outcomes (or a reasonable surrogate) and assign a probability to each
outcome and consequence before integrating the probability of the total
set of outcomes. The Commission rejected the second approach of
adopting an alternative definition of ``basic component,'' because a
change to the definition in Sec. 21.3 could be misunderstood as a
change to the reporting requirements for licensees who choose not to
comply with Sec. 50.69.
III.4.1.2 Reporting Obligations of Vendors for RISC-3 SSCs
The reporting requirements of Section 206 apply to individuals,
directors and responsible officers of a firm constructing, owning,
operating or supplying the basic components of any NRC-licensed
facility or activity. Nuclear power plant licensees and nuclear power
plant construction permit holders are subject to reporting under
Section 206, and part 21 and Sec. 50.55(e) will continue to provide
for such reporting by those entities. Section 206 also imposes a
reporting obligation on ``vendors'' (i.e., firms who supply basic
components to nuclear power plant licensees and construction permit
holders). The Commission does not intend to change the reporting
obligations under part 21 or Sec. 50.55(e) for licensees, construction
permit holders, or vendors with respect to RISC-1 SSCs, and the
Commission does not intend to require reporting under part 21 and Sec.
50.55(e) for RISC-2, RISC-3 or RISC-4 SSCs.
Thus, a vendor who supplied a safety-related component to a
licensee that was subsequently classified by the licensee as RISC-3
would no longer be legally obligated to comply with part 21 or Sec.
50.55(e) reporting requirements. However, as a practical matter that
vendor would likely continue to comply with part 21 or Sec. 50.55(e).
Vendors are informed of their part 21 or Sec. 50.55(e) obligations as
part of the contract supplying the basic component to the licensee/
construction permit holder. Vendors supplying basic components that
have been categorized as RISC-3 at the time of contract ratification
would know that they have no part 21 or Sec. 50.55(e) obligations.
However, vendors that provide (or in the past provided) safety-related
SSCs would not know, absent communication from the licensee or
construction permit holder implementing Sec. 50.69, whether the SSCs
which they provided under contract as safety-related are now
categorized as RISC-3, thereby removing the vendor's reporting
obligation under either part 21 or Sec. 50.55(e). Failing to inform a
vendor that a safety-related SSC which it provided is no longer subject
to part 21 or Sec. 50.55(e) reporting because of its reclassification
as a RISC-3 SSC could result in unnecessary reporting to the licensee
and the NRC. It may also result in unnecessary expenditure of resources
by the vendor in determining whether a problem with a supplied SSC
rises to the level of a reportable defect or noncompliance under the
existing provisions of part 21 and Sec. 50.55(e).
To address the potential for unnecessary reporting under proposed
Sec. 50.69, the Commission considered including a new requirement in
either proposed Sec. 50.69, or part 21 and Sec. 50.55(e). The new
provision would require the licensee or construction permit holder to
inform a vendor that a safety-related SSC which it provided has been
categorized as RISC-3. After consideration, the Commission believes
that it is unlikely that such a provision would result in any great
reduction in the potential scope of reporting by vendors. The NRC does
not receive many part 21 reports, so the overall reporting burden to be
reduced may be insubstantial. Furthermore, the Commission believes that
the proposal could cause confusion, inasmuch as a vendor may supply
many identical components to a licensee/holder, with some of the items
intended for use in SSCs categorized as RISC-3, and other items
intended in non-safety-related applications. A vendor would have some
difficulty in determining whether the problem with the supplied SSC
potentially affects the SSC recategorized as RISC-3 (as opposed to the
supplied SSC used in nonsafety-related applications). The Commission
also believes there may be some value in notification of the NRC when
defects are identified, as they may reveal issues about the quality
processes, or implications for basic components at other facilities.
Finally, the NRC notes that the vendor has already been compensated by
the licensee for the burden associated with part 21 and Sec. 50.55(e)
as part of the initial procurement process. For these reasons, the
Commission does not propose to adopt a provision in Sec. 50.69, part
21 or Sec. 50.55(e) requiring a licensee or construction permit holder
to inform a vendor of safety-related SSCs that its SSCs have been
categorized as RISC-3.
III.4.1.3 Criminal Liability Under Section 223.b. of the AEA
As discussed earlier, Section 206 of the AEA authorizes the
imposition of civil penalties for a licensee's and vendor's failure to
report instances of noncompliance or defects in ``basic components''
that create a ``substantial safety hazard.'' However, in addition to
the civil penalties authorized by Section 206, criminal penalties may
be imposed under Section 223.b. of the AEA on an individual director,
officer or employee of a firm that supplies components to a nuclear
power plant, that knowingly and willfully violate regulations that
results (or could have resulted) in a ``significant impairment of a
basic component * * *.'' Licensees, applicants and vendors should note
the difference in the definition of ``basic component'' in part 21,
versus the definition set forth in Section 223.b:
For the purposes of this subsection, the term ``basic component''
means a facility structure, system, component or part thereof necessary
to assure--
(1) The integrity of the reactor coolant pressure boundary,
[[Page 26523]]
(2) The capability to shut-down the facility and maintain it in a
safe shut-down condition, or
(3) The capability to prevent or mitigate the consequences of
accidents which could result in an unplanned offsite release of
quantities of fission products in excess of the limits established by
the Commission.
The U.S. Department of Justice is responsible for prosecutorial
decisions involving violations of Section 223.b.
III.4.1.4 Posting Requirements
Both AEA Section 223.b and ERA Section 206 require posting of their
statutory requirements at the premises of all licensed facilities. This
is implemented through 10 CFR Parts 19 and 21.
As a result of implementation of Sec. 50.69, rights and
responsibilities of licensee workers would be slightly different. For
instance, SSCs categorized as RISC-3 would no longer be subject to Part
21. However, RISC-1 SSCs (and ``safety-related'' SSCs not yet
categorized per Sec. 50.69), are subject to the Part 21 requirements.
No additional responsibilities for identification or notification are
involved. The supporting information such as procedures to be made
available to workers would need to reflect the reduction in scope of
requirements. For the reasons already mentioned, the Commission
concludes that there would be no impact on vendors with respect to
posting requirements in that these changes in categorization would be
``transparent'' to them as suppliers.
III.4.2 Section 50.49 Environmental Qualification of Electrical
Equipment
The general requirement that certain SSCs be designed to be
compatible with environmental conditions associated with postulated
accidents is contained in GDC-4. Section 50.49 was written to provide
specific programmatic requirements for a qualification program and
documentation for electrical equipment, and thus, is a special
treatment requirement.
Section 50.49(b), imposes requirements on licensees to have an
environmental qualification program that meets the requirements
contained therein. It defines the scope of electrical equipment
important to safety that must be included under the environmental
qualification program. Further, this regulation specifies methods to be
used for qualification of the equipment for identified environmental
conditions and documentation requirements.
RISC-3 and RISC-4 SSCs would be removed from the scope of the
requirements of Sec. 50.49 through Sec. 50.69(b)(2)(ii). For SSCs
categorized as RISC-3 or RISC-4, the Commission has concluded that for
low safety-significant SSCs, additional assurance, such as that
provided by the detailed provisions in Sec. 50.49 for testing,
documentation files and application of margins, are not necessary (see
Section III.4.0). The requirements from GDC-4 as they relate to RISC-3
and RISC-4 SSCs, and the design basis requirements for these SSCs,
including the environmental conditions such as temperature and
pressure, remain in effect. Thus, these SSCs must continue to remain
capable of performing their safety-related functions under design basis
environmental conditions.
III.4.3 Section 50.55a(f), (g), and (h) Codes and Standards
Section 50.69(b)(2)(iv), would remove RISC-3 SSCs from the scope of
certain provisions of Sec. 50.55a, relating to Codes and Standards.
The provisions being removed are those that relate to ``treatment''
aspects, such as inspection and testing, but not those pertaining to
design requirements established in Sec. 50.55a. Each of the
subsections being removed is discussed in the paragraphs below.
Section 50.55a(f) incorporates by reference provisions of the ASME
Code as endorsed by NRC that contains inservice testing requirements.
These are special treatment requirements. Through this proposed
rulemaking, RISC-3 SSCs would be removed from the scope of these
requirements, and instead would be subject to the requirements in Sec.
50.69(d)(2)(iii). For the reasons discussed in Section III.4.0, the
Commission has determined that for low safety-significant SSCs, it is
not necessary to impose the specific detailed provisions of the Code,
as endorsed by NRC, and these requirements can be replaced by the more
``high-level'' alternative treatment requirements, which allow greater
flexibility to licensees in implementation.
Section 50.55a(g) incorporates by reference provisions of the ASME
Code as endorsed by NRC that contains the inservice inspection, and
repair and replacement requirements for ASME Class 2 and Class 3 SSCs.
The Commission will not remove the repair and replacement provisions of
the ASME BPV Code required by Sec. 50.55a(g) for ASME Class 1 SSCs,
even if they were categorized as RISC-3, because those SSCs constitute
principal fission product barriers as part of the reactor coolant
system or containment. For Class 2 and 3 SSCs that are shown to be of
low safety-significance if categorized as RISC-3, the additional
assurance from the specific provisions of the ASME Code is not
considered necessary.
Section 50.55a(h) incorporates by reference the requirements in
either Institute of Electrical and Electronics Engineers (IEEE) 279,
``Criteria for Protection Systems for Nuclear Power Generating
Stations,'' or IEEE 603-1991 ``IEEE Standard Criteria for Safety
Systems for Nuclear Power Generating Stations.'' Within these IEEE
standards are special treatment requirements. Specifically, sections
4.3 and 4.4 of IEEE 279 and sections 5.3 and 5.4 of IEEE 603-1991
contain quality and environmental qualification requirements. RISC-3
SSCs are being removed from the scope of this special treatment
requirement consistent with the Commission decision already discussed.
III.4.4 Section 50.65 Monitoring the Effectiveness of Maintenance
The Commission is proposing to remove RISC-3 and RISC-4 SSCs from
the scope of the requirements of Sec. 50.65 (except for paragraph
(a)(4)). The basis for this includes Section III.4.0 and the following
discussion.
Section 50.65, referred to as the Maintenance Rule, imposes
requirements for licensees to monitor the effectiveness of maintenance
activities for safety-significant plant equipment to minimize the
likelihood of failures and events caused by the lack of effective
maintenance. Specifically, Sec. 50.65 requires the performance of SSCs
defined in Sec. 50.65(b) to be monitored against licensee established
goals, in a manner sufficient to provide confidence that the SSCs are
capable of fulfilling their intended functions. The rule further
requires that where performance does not match the goals, appropriate
corrective action shall be taken. Included within the scope of Sec.
50.65(b) are SSCs that are relied upon to remain functional during
design basis events or in emergency operating procedures, and
nonsafety-related SSCs whose failure could result in the failure of a
safety function or cause a reactor scram or activation of a safety-
related system.
Sections 50.65(a)(1), (a)(2), and (a)(3) impose documentation and
action requirements; thus, they are special treatment requirements.
Upon implementation of Sec. 50.69, a licensee would not be required to
apply maintenance rule monitoring, goal setting, corrective action,
alternate demonstration, or periodic evaluation treatments required by
Sec. Sec. 50.65(a)(1), (a)(2), and (a)(3) to RISC-3 and RISC-4
[[Page 26524]]
SSCs. The proposed rule does include in Sec. 50.69(e)(3) provisions
for a licensee to use performance information to feedback into its
processes to adjust treatment (or categorization) when results so
indicate. However, this requirement does not require the specific
monitoring and goal setting as required in Sec. 50.65, in
consideration of the lesser safety-significance of these SSCs.
RISC-1 and RISC-2 SSCs that are currently within the scope of Sec.
50.65(b) would remain subject to existing maintenance rule
requirements. Any RISC-1 or RISC-2 function not currently within the
scope of Sec. 50.65(b) would be added to the scope of the maintenance
rule (as a result of the requirement in Sec. 50.69(e)(2) that requires
monitoring, evaluation and appropriate action for these SSCs).
The proposed removal of RISC-3 and 4 SSCs from the scope of
requirements does not include Sec. 50.65(a)(4), which contains
requirements to assess and manage the increase in risk that may result
from proposed maintenance activities. The requirements in Sec.
50.65(a)(4) remain in effect. It is noted that Sec. 50.65(a)(4)
already includes provisions by which a licensee can limit the scope of
the assessment required to SSCs that a risk-informed evaluation process
has shown to be significant to public health and safety. Thus, there is
no need to revise the requirements to permit a licensee to apply
requirements commensurate with safety-significance.
III.4.5 Sections 50.72 and 50.73 Reporting Requirements
This proposed rule would remove the requirements in Sec. Sec.
50.72 and 50.73 for RISC-3 and RISC-4 SSCs. The basis for this removal
follows.
Sections 50.72 and 50.73 contain requirements for licensees to
report events involving certain SSCs. These reporting requirements are
special treatment requirements . NRC requires event reports in part so
that it can follow-up on corrective action for these circumstances.
Through this rulemaking, the Commission proposes to remove RISC-3 and
RISC-4 SSCs from the scope of these requirements. The low safety-
significance of these SSCs does not warrant the burden associated with
reporting events or conditions only affecting such SSCs, for the
reasons already discussed.In particular, under NRC's risk-informed
inspection process, NRC follow-up of corrective action will be focused
upon safety-significant situations.
III.4.6 10 CFR Part 50 Appendix B Quality Assurance Requirements
This proposed rule would remove RISC-3 SSCs from the scope of
requirements in Appendix B to 10 CFR Part 50. These requirements are
currently not applicable to RISC-4 SSCs so there is no change for these
SSCs. Appendix B contains requirements for a quality assurance program
meeting specified attributes. While many of the general attributes are
still appropriate for RISC-3 SSCs (and in some instances are included
within the high-level requirements in Sec. 50.69(d)(2)), it was
considered simpler to remove RISC-3 SSCs from the scope of the existing
requirements in Appendix B (with its attendant set of guidance and
implementing documents), and to add back the minimum set of
requirements viewed as necessary for RISC-3 SSCs, rather than to
subdivide the existing Appendix B requirements for this purpose.
The intent of Appendix B to 10 CFR Part 50, and the complementary
regulations is to provide quality assurance requirements for the
design, construction, and operation of nuclear power plants. The
quality assurance requirements of Appendix B are to provide adequate
confidence that an SSC will perform satisfactorily in service; these
requirements were developed to apply to safety-related SSCs. In the
implementation of Appendix B, a licensee is bound to detailed and
prescriptive quality requirements to apply to activities affecting
those SSCs. As such, these requirements meet the Commission's
definition of special treatment requirements. These requirements are
removed from application to RISC-3 and RISC-4 SSCs because their low
safety-significance does not warrant the level of quality requirements
that currently exist with Appendix B.
III.4.7 10 CFR Part 50, Appendix J Containment Leakage Testing
The proposed rule would remove a subset of RISC-3 and RISC-4 SSCs
from the scope of the requirements in Appendix J to Part 50 that
pertain to containment leakage testing. Specifically, RISC-3 and RISC-4
SSCs that meet specified criteria would be removed from the scope of
the requirements for Type B and Type C testing. The basis for the
removal is described below.
One of the conditions of all operating licenses for water-cooled
power reactors as specified in Sec. 50.54(o) is that primary reactor
containments shall meet the containment leakage test requirements set
forth in Appendix J to 10 CFR Part 50. These test requirements provide
for preoperational and periodic verification by tests of the leak-tight
integrity of the primary reactor containment, and systems and
components which penetrate containment of water-cooled power reactors,
and establish the acceptance criteria for these tests. As such, these
tests are special treatment requirements. The purposes of the tests are
to assure that (a) leakage through the primary reactor containment, or
through systems and components penetrating primary containment, shall
not exceed allowable leakage rate values as specified in the technical
specifications, and (b) periodic surveillance of reactor containment
penetrations and isolation valves is performed so that proper
maintenance and repairs are made during the service life of the
containment, and systems and components penetrating primary
containment. Appendix J includes two Options, Option A and Option B.
Option A includes prescriptive requirements while Option B identifies
performance-based requirements and criteria for preoperational and
subsequent periodic leakage-rate testing. A licensee may choose either
option for meeting the requirement of Appendix J.
The discussion contained in Appendix J to 10 CFR Part 50 can be
divided into two categories. Parts of Appendix J contain testing
requirements. Other parts contain information, such as definitions or
clarifications, necessary to explain the testing requirements. A review
of Appendix J did not identify any technical requirements other than
those describing the methods of the required testing. Therefore,
Appendix J was considered to be, in its entirety, a special treatment
requirement.
The NRC believes that risk-informing this appendix may lead to less
testing and therefore would reduce unnecessary regulatory burden on the
licensees. Although the 1995 revision to Appendix J was characterized
as risk-informed, the changes were not as extensive as those expected
in the risk-informed Part 50 effort. The revision primarily decreased
testing frequencies, whereas risk-informing the scope of SSCs that are
subject to Appendix J testing would remove some components from testing
(i.e., to the extent that defense-in-depth is maintained in accordance
with the risk-informed categorization process).
The proposed rule would exclude certain identified containment
isolation valves from Type C testing. For RISC-3 components, which
includes containment isolation valves, leak testing is not required.
The reliability
[[Page 26525]]
strategy is to monitor and restore component functions once they are
identified through the corrective action program or the periodic
feedback process. Similarly, requirements for Type B testing of certain
penetrations would not be required. The relief from testing is limited
to components meeting specified criteria such that acceptable results
for large early release and defense-in-depth are maintained.
III.4.7.1 Types of Tests Required by Appendix J
Appendix J testing is divided into three types: Type A, Type B, and
Type C. Type A tests are intended to measure the primary reactor
containment overall integrated leakage rate after the containment has
been completed and is ready for operation, and at periodic intervals
thereafter. Type B tests are intended to detect local leaks and to
measure leakage across each pressure-containing or leakage-limiting
boundary. Primary reactor containment penetrations required to be Type
B tested are identified in Appendix J. Type C tests are intended to
measure containment isolation valve leakage rates. The containment
isolation valves required to be Type C tested are identified in
Appendix J.
III.4.7.2 Reduction in Scope for Appendix J Testing
Type A Testing: The Commission concludes that Type A testing should
continue to be required as described in Appendix J.
Type B Testing: The Commission concludes that Type B testing should
continue to be required for air lock door seals, including door
operating mechanism penetrations which are part of the containment
pressure boundary and doors with resilient seals or gaskets except for
seal-welded doors. Type B testing is not necessary for other
penetrations that are determined to be of low safety significance and
that meet one or both of the following criteria:
1. Penetrations pressurized with the pressure being continuously
monitored.
2. Penetrations less than 1 inch in equivalent diameter.
Type C Testing: The Commission concludes that Type C testing is not
necessary for valves that are determined to be of low safety
significance and that meet one or more of the following criteria:
1. The valve is required to be open under accident conditions to
prevent or mitigate core damage events.
2. The valve is normally closed and in a physically closed, water
filled system.
3. The valve is in a physically closed system whose piping pressure
rating exceeds the containment design pressure rating and that is not
connected to the reactor coolant pressure boundary.
4. The valve size is 1-inch nominal pipe size or less.
III.4.7.3 Basis for Reduction of Scope
The first criterion for Type B testing deals with penetrations that
are pressurized with the pressures in the penetrations being
continuously monitored by licensees. The pressurization itself
establishes a leak tight barrier, for such penetrations. The monitoring
of the pressures in the penetrations, in conjunction with the proposed
requirements for RISC 3 SSCs (including taking corrective action when
an SSC fails) provide sufficient assurance, without the need for Type B
testing, to ensure that these penetrations are functional.
The second criterion for reducing the scope of Type B testing
(i.e., penetrations less than 1 inch in equivalent diameter) is
essentially the same as the fifth criterion for reducing the scope of
Type C testing (i.e., valve size is 1-inch or less). By definition
penetrations of this size do not contribute to large early release.
The Commission finds that these criteria for reducing the scope of
the Type C testing requirements are reasonable in that, even without
Type C testing, the probability of significant leakage during an
accident (that is, leakage to the extent that public health and safety
is affected) is small. This is true even though some of the valves that
satisfy these criteria may be fairly large.
Appendix J to 10 CFR part 50 deals only with leakage rate testing
of the primary reactor containment and its penetrations. It assumes
that containment isolation valves are in their safe position. No
failure is assumed that would cause the containment isolation valves to
be open when they are supposed to be closed. The valve would be open if
needed to transmit fluid into or out of containment to mitigate an
accident or closed if not needed for this purpose. For purposes of this
evaluation, if a valve is open, it is assumed to be capable of being
closed. Testing to ensure the capability of containment isolation
valves to reach their safe position is not within the scope of Appendix
J, and as such is not within the scope of this evaluation. Therefore,
the valves addressed by this evaluation are considered to be closed,
but may be leaking. The increase in risk due to this proposed revision
affecting Appendix J is negligible.
Past studies (e.g., NUREG-1150, ``Severe Accident Risks: An
Assessment for Five U.S. Nuclear Power Plants; Final Summary Report,''
dated December 1990) show that the overall reactor accident risks are
not sensitive to variations in containment leakage rate. This is
because reactor accident risk is dominated by accident scenarios in
which the containment either fails or is bypassed. These very low
probability scenarios dominate predicted accident risks due to their
high consequences.
The Commission examined in more detail the effect of containment
leakage on risk as part of the Appendix J to 10 CFR Part 50, Option B,
rulemaking. The results of these studies are applicable to this
evaluation. NUREG-1493, ``Performance-Based Containment Leak-Test
Program,'' dated September 1995, calculated the containment leakage
necessary to cause a significant increase in risk and found that the
leakage rate must typically be approximately 100 times the Technical
Specification leak rate, La. It is improbable that even the
leakage of multiple valves in the categories under consideration would
exceed this amount. Operating experience shows that most measured leaks
are much less than 100 times La. A more direct estimate of
the increase in risk for the proposed revision to Appendix J can be
obtained from the Electric Power Research Institute (EPRI) report TR-
104285, ``Risk Impact Assessment of Revised Containment Leak Rate
Testing Intervals,'' dated August 1994. This report examined the change
in the baseline risk (as determined by a plant's IPE risk assessment)
due to extending the leakage rate test intervals. For the pressurized
water reactor (PWR) large dry containment examined in the EPRI report,
for example, the percent increase in baseline risk from extending the
Type C test interval from 2 years to 10 years was less than 0.1
percent. While this result was for a test interval of 10 years vs. the
current proposal to do no more Type C testing of the subject valves for
the life of a plant, the analysis may reasonably apply to this
situation because it contains several conservative assumptions which
offset the 10-year time interval. These assumptions include the
following:
1. The study used leakage rate data from operating plants. Any
leakage over the plant's administrative leakage limit was considered a
leakage failure. An administrative limit is a utility's internal limit
and does not imply violation of any Appendix J limits. Therefore, the
probability of a leakage failure is overestimated.
2. Failure of one valve to meet the administrative limit does not
imply that the penetration would leak because
[[Page 26526]]
containment penetrations typically have redundant isolation valves.
While one valve may leak, the other may remain leak-tight. The study
assumed that failure of one valve in a series failed the penetration;
however, the probability of failure was that for a single valve.
3. The analysis assumed possible leakage of all valves subject to
Type C testing, not just those subject to the proposed revision.
According to this analysis, the proposed revision would not have a
significant effect on risk. The NUREG-1493 analysis shows that the
amount of leakage necessary to significantly increase risk is two
orders of magnitude greater than a typical Technical Specification
leakage rate limit. Therefore, the risk to the public will not
significantly increase due to the proposed relief from the requirements
of Appendix J to 10 CFR part 50.
III.4.8 Appendix A to 10 CFR Part 100 (and Appendix S to 10 CFR Part 50
(Seismic Requirements))
The proposed rule would remove RISC-3 and RISC-4 SSCs from the
requirement in Appendix A to Part 100 to demonstrate that SSCs are
designed to withstand the safe shutdown earthquake (SSE) by
qualification testing or specific engineering methods. GDC 2 requires
that SSCs ``important to safety'' be capable of withstanding the
effects of natural phenomena such as earthquakes. The requirements of
10 CFR Part 100 pertain to reactor site criteria and its Appendix A
addresses seismic and geologic siting criteria used by the Commission
to evaluate suitability of plant design bases in consideration of these
characteristics. Sections VI(a)(1) and (2) of Appendix A to 10 CFR Part
100 address the engineering design for the SSE and Operating Basis
Earthquake (OBE), respectively. The rule change would exclude RISC-3
and RISC-4 SSCs from the scope of the requirements of sections VI(a)(1)
and (2) of Appendix A to 10 CFR Part 100, only to the extent that the
rule requires testing and specific types of analyses to demonstrate
that safety-related SSCs are designed to withstand the SSE and OBE. It
is only these aspects of Appendix A to 10 CFR Part 100 that are
considered special treatment. As discussed in Section III.4.0, because
of the low safety significance of the RISC-3 and RISC-4 SSCs, the
additional assurance provided by qualification testing (or engineering
analyses) is not considered necessary.
For current operating reactors, Appendix A to part 100 is
applicable. For new plant applications, the seismic design requirements
are set forth in Appendix S to Part 50. The NRC has determined that
Appendix S does not need to be included in the proposed Sec. 50.69
because the wording of the requirements with respect to
``qualification'' by testing or specific types of analysis is not
present in this rule. Therefore, a rule change would not be necessary
to permit a licensee to implement means other than qualification
testing or the specified methods to demonstrate SSC capability.
III.4.9 Requirements Not Removed by Sec. 50.69(b)(1)
In the following paragraphs, the Commission discusses certain rules
that were considered as candidates for removal as requirements for
RISC-3 and RISC-4 SSCs during development of this rulemaking. These
rules were identified as candidate rules in SECY-99-256. They are not
part of this rulemaking for the reasons presented.
III.4.9.1 Section 50.34 Contents of Applications
Section 50.34 identifies the required information that applicants
must provide in preliminary and final safety analysis reports. Because
Sec. 50.69 contains the documentation requirements for licensees and
applicants who choose to implement Sec. 50.69, and these requirements
do not conflict with Sec. 50.34, it is not necessary to revise Sec.
50.34 to implement Sec. 50.69.
III.4.9.2 Section 50.36 Technical Specifications
Section 50.36 establishes operability, surveillance, limiting
conditions for operation and other requirements on certain SSCs. To the
extent that this rule specified testing and related requirements, it
was considered as a candidate for being ``special treatment''. However,
the Commission concluded that it was not appropriate to revise Sec.
50.36 for several reasons. First, risk-informed criteria have already
been established in Sec. 50.36 for determining which SSCs should have
TS requirements. Improved standard TS have already resulted in
relocation of requirements for less important SSCs to other documents.
Further, other improvement efforts are underway that could be
implemented by individual licensees to make their plant-specific
requirements more risk-informed. Thus, no changes to this rule (or its
implementation) are necessary as part of Sec. 50.69 to make the TS
risk-informed or to accommodate the revised requirements of this
proposed rule.
III.4.9.3 Section 50.44 Combustible Gas Control
Certain provisions within Sec. 50.44 were identified as containing
special treatment requirements in that they specified conformance with
Appendix B for particular design features, specified requirements for
qualification, and related statements. The Commission notes that a
separate rulemaking is underway to ``rebaseline'' the requirements in
Sec. 50.44 using risk insights (see August 2, 2002; 67 FR 50374).
Therefore, the NRC believes that there is no need to include those
sections of (existing) Sec. 50.44 as being removed for RISC-3 SSC. If
portions of Sec. 50.44 that were identified as special treatment
requirements are retained, and/or relocated to other rules (and they
are not necessary for RISC-3 SSCs), then there may be a need to
reference these rules within Sec. 50.69(b)(1) when Sec. 50.69 is
issued as a final rule.
III.4.9.4 Section 50.48 (Appendix R and GDC 3) Fire Protection
Initially, fire protection requirements were considered to be
within the scope of this rulemaking effort. There are augmented quality
provisions applied to fire protection systems and these augmented
quality provisions are considered special treatment requirements.
However, these provisions are not contained in the rules themselves.
The Commission has developed a proposed rulemaking (see November 1,
2002; 67 FR 66578) to allow licensees to voluntarily adopt National
Fire Protection Association (NFPA)-805 requirements in lieu of other
fire protection requirements. NFPA-805 would permit a licensee to
implement a risk-informed fire protection program as a voluntary
alternative to compliance with Sec. 50.48 and 10 CFR Part 50, Appendix
R. Accordingly, changes to these regulations were not included in the
scope of the Sec. 50.69 rulemaking.
III.4.9.5 Section 50.59 Changes, Tests and Experiments
The Commission does not believe that a Sec. 50.59 evaluation need
be performed when a licensee implements Sec. 50.69 by changing the
special treatment requirement for RISC-3 and RISC-4 SSCs. Accordingly,
Sec. 50.69(f)(iii) contains language that removes the requirement for
a Sec. 50.59 evaluation of the changes in special treatment as part of
implementation. The process of adjusting treatment for RISC-3 and RISC-
4 SSCs does not need to be subject to Sec. 50.59 because the
rulemaking already provides the decision process
[[Page 26527]]
for recategorization and determination of revision to requirements
resulting from the categorization. Thus, subjecting the implementation
steps as they relate to changes to treatment from what was described in
the final safety analysis report (FSAR), to determine if NRC approval
is needed of those changes, is an unnecessary step. Since it is only in
the area of treatment for RISC-3 and RISC-4 SSCs that might be viewed
as involving a reduction in requirements, these are the only aspects
for which this rule provision would have any effect. As required by
Sec. 50.69(f)(ii), the licensee/applicant will be required to update
the FSAR appropriately to reflect incorporation of its treatment
processes into the FSAR.
However, it is important to recognize that changes that affect any
non-treatment aspects of an SSC (e.g., changes to the SSC design basis
functional requirements) are required to be evaluated in accordance
with the requirements of Sec. 50.59. Section 50.69(d)(2)(i), which
focuses upon design control, is intended to draw a distinction between
treatment (managed through Sec. 50.69) and design changes (managed
through other processes such as Sec. 50.59). As previously noted, this
rulemaking is only risk-informing the scope of special treatment
requirements. The process and requirements established in Sec. 50.69
do not extend to making changes to the design basis of SSCs.
III.4.9.6 Appendix A to 10 CFR Part 50 General Design Criteria (GDC)
The NRC has concluded that the GDC of Appendix A to 10 CFR Part 50
do not need to be revised because they specify design requirements and
do not specify special treatment requirements. Because this rulemaking
is not revising the design basis of the facility, the GDC should remain
intact and are not within the scope of Sec. 50.69. This subject is
discussed in more detail in the NRC's action on the South Texas
exemption request, in which their request for exemption from certain
GDCs was denied as being unnecessary to accomplish what was proposed
(see Section IV.4.0).
III.4.9.7 10 CFR Part 52 Early Site Permits, Standard Design
Certifications and Combined Operating Licenses
Part 52 contains, by cross-reference, regulations from other parts
of Chapter 10 of the Code of Federal Regulations, most notably Part 50.
Therefore, it was initially considered for inclusion in the rulemaking
effort. However, with the proposed ``applicability'' paragraph (Sec.
50.69(b)) extending to applicants for a facility license or design
certification under Part 52, the Commission presently sees no need for
revisions to Part 52 itself.
III.4.9.8 10 CFR Part 54 License Renewal
In SECY-99-256, 10 CFR part 54, which provides license renewal
requirements, was identified as a candidate regulation for removal from
scope of applicability to low significance SSCs. The aging management
requirements could be viewed as being special treatment requirements in
that they provide assurance that SSCs will continue to meet their
licensing basis requirements during the renewed license period. Section
54.4 explicitly defines the scope of the license renewal rule using the
traditional deterministic approach. Part 54 imposes aging management
requirements in Sec. 54.21 on the scope of SSCs meeting Sec. 54.4.
In SECY-00-0194, the NRC staff provided its preliminary view that
RISC-3 SSCs should not be removed from the scope of part 54, and that
licensees can renew their licenses in accordance with part 54 by
demonstrating that the Sec. 50.69 treatment provides adequate aging
management in accordance with Sec. 54.21. The NRC staff suggested that
no changes are necessary to part 54 to implement Sec. 50.69 either
prior to renewing a licensing or after license renewal.
The goal of the license renewal program is to establish a stable,
predictable, and efficient license renewal process. The Commission
believes that a revision of part 54 at this time could have a
significant effect on the stability and consistency of the processes
established for preparation of license renewal applications, and for
NRC staff review. Further, as discussed below, the Commission believes
that the requirements in part 54 are compatible with the Sec. 50.69
approach, including use of risk information in establishing treatment
(aging management) requirements. Refer to Section V.3.0 for additional
discussion regarding the implementation of Sec. 50.69 for a facility
that has already received a renewed license. Thus, part 54 requires no
changes at this time. However, in the future, the Commission will
consider whether revisions to the scope of part 54 are appropriate.
The use of risk in establishing the scoping criteria within part 54
was addressed by the Commission on May 8, 1995 (60 FR 22461), when
amending part 54. In the 1995 amendment, the Commission stated that the
current licensing basis for current operating plants is largely based
on deterministic engineering criteria. Consequently, there was
considerable logic in establishing license renewal scoping criteria
that recognized the deterministic nature of a plant's licensing basis.
Without the necessary regulatory requirements and appropriate controls
for plant-specific PRAs, the Commission concluded that it was
inappropriate to establish a license renewal scoping criterion that
relied on plant-specific probabilistic analyses. Therefore, the
Commission concluded further that within the construct of the final
rule, PRA techniques were of very limited use for license renewal
scoping (60 FR 22468).
The 1995 amendment to part 54 excluded active components to
``reflect a greater reliance on existing licensee programs that manage
the detrimental effects of aging on functionality, including those
activities implemented to meet the requirements of the maintenance
rule,'' (60 FR 22471). Although Sec. 50.69 would remove RISC-3
components from the scope of the maintenance rule requirements in Sec.
50.65(a)(1), (a)(2), and (a)(3), a licensee is required under the
proposed Sec. 50.69(d)(2) to provide confidence in the capability of
RISC-3 SSCs to perform their safety-related functions under design-
basis conditions when challenged. The SOC for part 54 also indicated
the Commission's recognition that risk insights could be used in
evaluating the robustness of an aging management program (60 FR 22468).
The NRC staff has received and accepted one proposal (Arkansas Unit 1)
for a risk-informed program for small-bore piping which demonstrates
that risk arguments can be used to a degree.
III.4.9.9 Other Requirements
In the ANPR and related documents, the staff and stakeholders
suggested a number of other regulatory requirements that might be
candidates for inclusion in Sec. 50.69. These included Sec. 50.12
(exemptions), Sec. 50.54(a), (p), and (q) (plan change control), and
Sec. 50.71(e) (FSAR updates). As the rulemaking progressed, the
Commission concluded that these requirements did not need to be changed
to allow a licensee to adopt Sec. 50.69 as it is being proposed.
III.5.0 Evaluation and Feedback, Corrective Action and Reporting
Requirements
The validity of the categorization process relies on ensuring that
the performance and condition of SSCs continues to be maintained
consistent with applicable assumptions. Changes in the level of
treatment applied to an SSC might result in changes in the
[[Page 26528]]
reliability of the SSCs which are used in the categorization process.
Additionally, plant changes, changes to operational practices, and
industry operational experience may impact the categorization
assumptions. Consequently, the proposed rule contains requirements for
updating the categorization and treatment processes when conditions
warrant to assure that continued SSC performance is consistent with the
categorization process and results.
Specifically the proposed rule would require licensees to review in
a timely manner but no longer than every 36 months, the changes to the
plant, operational practices, applicable industry operational
experience, and, as appropriate, update the PRA and SSC categorization.
In addition, licensees would be required to obtain sufficient
information on SSC performance to verify that the categorization
process and its results remain valid. For RISC-1 SSCs, much of this
information may be obtained from present programs for inspection,
testing, surveillance, and maintenance. However for RISC-2 SSCs and for
RISC-1 SSCs credited for beyond design basis accidents, licensees would
need to ensure that sufficient information is obtained. For RISC-3
SSCs, there is a relaxation of requirements for obtaining information
when compared to the applicable special treatment requirements; however
sufficient information would need to be obtained, and rule requirements
are being proposed to consider performance data, see if adverse changes
in performance might occur, and to make necessary adjustments such that
desired performance is achieved so that the evaluations conducted to
meet Sec. 50.69(c)(1)(iv) remain valid. The feedback and adjustment
process is crucial to ensuring that the SSC performance is maintained
consistent with the categorization process and its results.
Taking timely corrective action is an essential element for
maintaining the validity of the categorization and treatment processes
used to implement proposed Sec. 50.69. For safety-significant SSCs,
all current requirements would continue to apply and, as a consequence,
Appendix B corrective action requirements would be applied to RISC-1
SSCs to ensure that conditions adverse to quality are corrected. For
both RISC-1 and RISC-2 SSCs, requirements would be included in Sec.
50.69(e)(2) for monitoring and for taking action when SSC performance
degrades.
When a licensee or applicant determines that a RISC-3 SSC does not
meet its established acceptance criteria for performance of design
basis functions, the proposed rule would require that a licensee
perform timely corrective action (Sec. 50.69(d)(2)(iv)). Further, as
part of the feedback process, review of operational data may reveal
inappropriate assumptions for reliability or performance and a licensee
would need to re-visit the findings made in the categorization process
or modify the treatment for the applicable SSCs (Sec. 50.69(e)(3)).
These provisions would then restore the facility to the conditions that
were considered in the categorization, and would also restore the
capability of SSCs to perform their functions.
Finally, the proposed rule would require reports of events or
conditions that would have prevented RISC-1 and RISC-2 SSCs from being
able to perform their safety-significant functions. A new reporting
requirement would be added in Sec. 50.69(g) for events or conditions
that would prevent RISC-2 SSCs from performing their safety-significant
functions (if not otherwise reportable). Because the categorization
process has determined that RISC-2 SSCs are of safety significance, NRC
is interested in reports about circumstances where the safety-
significant function would have been prevented because of events or
conditions. This reporting will enable NRC to be aware of situations
impacting those functions found to be significant under Sec. 50.69,
such that NRC can take any actions deemed appropriate.
Properly implemented, these requirements would ensure that validity
of the categorization process and results are maintained throughout the
operational life of the plant.
III.6.0 Implementation Process Requirements
The proposed rule would also contain requirements specifying how a
licensee (or applicant) would be able to use the alternative
requirements in lieu of the existing requirements. The rule would
specify applicability requirements as well as requirements on the
Commission approval process for implementation.
The Commission is making the provisions of Sec. 50.69 available to
both applicants for licenses or design certification rules and to
holders of facility licenses for light-water reactors. The proposed
rule would be limited to light-water reactors because it was developed
to risk-inform the scope of special treatment requirements which are
applied to light-water reactors. Consequently, the technical aspects of
the rule (e.g., providing reasonable confidence that risk increases
(e.g., changes in CDF and LERF are small) including the implementation
guidance, are specific to light-water reactor designs.
Proposed Sec. 50.69 would rely on robust categorization to provide
high confidence that the safety significance of SSCs is correctly
determined. To ensure a robust categorization is employed, proposed
Sec. 50.69 would require the categorization process to be reviewed and
approved prior to implementation of Sec. 50.69 either by following the
license amendment process of Sec. 50.90 or as part of the license
application review. While detailed regulatory guidance has been
developed to provide guidance for implementing categorization
consistent with the proposed rule requirements, the Commission
concluded that a prior review and approval was still necessary to
enable the NRC staff to review the scope and quality of the plant-
specific PRA taking into account peer review results. The NRC staff
would also review other evaluations and approaches to be used such as
margins-type analyses. Additionally, this review would examine any
aspects of the proposed categorization guidance that are not consistent
with the staff's regulatory guidance for implementing Sec. 50.69.
Thus, the proposed rule would require that a licensee who wishes to
implement Sec. 50.69 submit an application for license amendment to
the NRC containing information about the categorization process and
about the peer review process employed. An applicant would submit this
information as part of its license application. The Commission will
approve, by license amendment, a request to allow a licensee to
implement Sec. 50.69 if it is satisfied that the categorization
process to be used meets the requirements in Sec. 50.69. Commission
action on an applicant's request would be part of the Commission
decision on the license application.
The Commission is proposing that the approval for a licensee to
implement Sec. 50.69 be by license amendment. As discussed above,
prior NRC review and approval of the licensee's proposed PRA, basis for
sensitivity studies and evaluations, and results of PRA review process
is required. This review will involve substantial professional judgment
on the part of NRC reviewers, inasmuch as the rule does not contain
objective, non-discretionary criteria for assessing the adequacy of the
PRA process, PRA review results and sensitivity studies. Consistent
with the
[[Page 26529]]
Commission's decision in Cleveland Electric Illuminating Co. (Perry
Nuclear Power Plant, Unit 1), CLI-96-13, 44 NRC 315 (1996), the
proposed rule would require NRC approval to be provided by issuance of
a license amendment. The Nuclear Energy Institute (NEI) submitted a
paper, ``License Amendments: Analysis of Statutory and Legal
Requirements'' (NEI Analysis) in a July 10, 2002, letter to the
Director of NRR. In this analysis, NEI contends that approval of a
licensee's/applicant's request to implement Sec. 50.69 need not be
accomplished by a license amendment. NEI essentially argues that the
proposed rule does not increase the licensee's operating authority, but
merely provides a ``different means of complying with the existing
regulations * * *'' Id., p.8. The Commission disagrees with this
position, inasmuch as proposed Sec. 50.69 would permit the licensee/
applicant, once having obtained approval from the NRC, to depart from
compliance with the ``special treatment'' requirements set forth in
those regulations delineated in Sec. 50.69. NEI also argues that the
NRC's review and approval of the SSC categorization process under
proposed Sec. 50.69 is analogous to the review and approval process in
Perry, which the Commission determined did not require a license
amendment. Unlike the Perry case, where the license already provided
for the possibility of material withdrawal schedule changes and the
governing American Society for Testing and Materials (ASTM) standard
set forth objective, non-discretionary criteria for changes to the
withdrawal schedule, Sec. 50.69 does not contain such criteria for
assessing the adequacy of the PRA process, PRA review results, and the
sensitivity studies. Hence, the NRC's approval of a request to
implement Sec. 50.69 will involve substantial professional judgment
and discretion. In sum, the Commission does not agree with NEI's
assertion that the NRC's approval of a request to implement Sec. 50.69
may be made without a license amendment in accordance with the Perry
decision.
The Commission does not believe it necessary to perform a prior
review of the treatment processes to be implemented for RISC-3 SSCs in
lieu of the special treatment requirements. Instead, the NRC has
developed proposed Sec. 50.69 to contain requirements that ensure the
categorization is robust to provide high confidence that SSC safety
significance is correctly determined; sufficient requirements on RISC-3
SSCs to provide a level of assurance that these SSCs remain capable of
performing their design basis functions commensurate with their low
safety significance; and requirements for obtaining sufficient
information concerning the performance of these SSCs to enable
corrective actions to be taken before RISC-3 SSC reliability degrades
beyond the values used in the evaluations conducted to satisfy Sec.
50.69(c)(1)(iv). The NRC concludes that compliance with these
requirements, in conjunction with inspection of Sec. 50.69 licensees
is a sufficient level of regulatory oversight for these SSCs.
The Commission recognizes that this proposed rule may have
implications with respect to NRC's reactor oversight process including
the inspection program, significance determination process, and
enforcement approach. In its final decision on this rulemaking, the
Commission proposes to document its conclusions as to whether new or
revised inspection or enforcement guidance is necessary.
The Commission included requirements in the proposed rule for
documenting categorization decisions to facilitate NRC oversight of a
licensee's or applicant's implementation of the alternative
requirements. The proposed rule would also include provisions to have
the FSAR and other documents updated to reflect the revised
requirements and progress in implementation. These requirements will
allow the NRC and other stakeholders to remain knowledgeable about how
a licensee is implementing its regulatory obligations as it transitions
from past requirements to the revised requirements in Sec. 50.69. As
part of these provisions, the Commission has concluded that requiring
evaluations under Sec. 50.59 (for changes to the facility or
procedures as described in the FSAR) or under Sec. 50.54(a) (for
changes to the quality assurance plan) is not necessary for those
changes directly related to implementation of Sec. 50.69. For
implementation of treatment processes for low safety-significant SSC,
in accordance with the rule requirements contained in Sec. 50.69, the
Commission concludes that requiring further review as to whether NRC
approval might be required for such changes is unnecessary burden. If a
licensee is satisfying the rule requirements, as applied to RISC-3 SSC,
the Commission could not postulate circumstances under which NRC
approval of such changes would be required. Thus, a licensee would be
permitted to make changes concerning treatment requirements that might
be contained in these documents. The Commission is limiting this relief
to changes directly related to implementation (with respect to
treatment processes). Changes that affect any non-treatment aspects of
an SSC (e.g., changes to the SSC design basis functional requirements)
are still required to be evaluated in accordance with other regulatory
requirements such as Sec. 50.59. This rulemaking is only risk-
informing the scope of special treatment requirements. The process and
requirements established in Sec. 50.69 do not extend to making changes
to the design basis of SSCs.
III.7.0 Adequate Protection
The Commission believes that reasonable assurance of adequate
protection of public health and safety will be provided by applying the
following principles in the development and implementation of proposed
Sec. 50.69:
(1) The net increase in plant risk is small;
(2) Defense-in-depth is maintained;
(3) Safety margins are maintained; and
(4) Monitoring and performance assessment strategies are used.
As described previously, these principles were established in RG
1.174, which provided guidance on an acceptable approach to risk-
informed decision-making consistent with the 1995 Commission policy on
the use of PRA. Proposed Sec. 50.69 was developed to incorporate these
principles, both to ensure consistency with Commission policy, and to
ensure that the proposed rule maintains adequate protection of public
health and safety.
The following discusses how proposed Sec. 50.69 meets the four
criteria, and as a result, maintains adequate protection of public
health and safety.
III.7.1 Net Increase In Risk is Small
Proposed Sec. 50.69 requires the use of a robust, risk-informed
categorization process that ensures that all relevant information
concerning the safety significance of an SSC is considered by a
competent and knowledgeable panel who makes the final determination of
the safety significance of SSCs. The review and approval of the
categorization process ensures that it meets the requirements of Sec.
50.69(c) and that as a result, the correct SSC safety significance is
determined with high confidence. Correctly determining safety
significance of an SSC provides confidence that special treatment
requirements are only removed from SSCs with low safety significance,
and that these requirements continue to be satisfied for SSCs of safety
significance. The proposed rule requires that the
[[Page 26530]]
potential net increase in risk from implementation of proposed Sec.
50.69 be assessed, and that this risk change is small. These
requirements to provide reasonable confidence that the net change in
risk is small as part of the categorization decision, in conjunction
with the proposed rule requirements for maintaining design basis
functions, and the processes noted below for feedback and adjustment
over time, all contribute to preventing risk from increasing beyond the
ranges that the Commission has determined to be appropriate. As a
result, these requirements are a contributing element for maintaining
adequate protection of public health and safety.
III.7.2 Defense-in-Depth Is Maintained
Section 50.69 would require that the defense-in-depth philosophy be
maintained as part of the categorization requirements of Sec.
50.69(c)(1) and as a result, defense-in-depth is considered explicitly
in the categorization process. Thus, SSCs that are important to
defense-in-depth, as outlined in the implementation guidance, will be
categorized as safety-significant (and will retain their treatment
requirements). For safety-significant SSCs (i.e., RISC-1 and RISC-2
SSCs), all current special treatment requirements would remain (i.e.,
the proposed rule does not remove any of these requirements) to provide
high confidence that they can perform design basis functions, and
additionally requires sufficient treatment be applied to support the
credit taken for these SSCs for beyond design basis events. For RISC-3
SSCs, proposed Sec. 50.69 would impose high level treatment
requirements that when effectively implemented, maintain the capability
of RISC-3 SSCs to perform their design basis functions. Thus, the
complement of SSCs installed at the facility that provide the defense-
in-depth will continue to be available. The proposed rule does not
change the design basis of the facility, which was established based
upon defense-in-depth considerations. Accordingly, the Commission
concludes that the proposed rule maintains defense-in-depth.
III.7.3. Safety Margins Are Maintained
Proposed Sec. 50.69 maintains sufficient safety margins by a
combination of:
(1) Maintaining all existing functional and treatment requirements
on RISC-1 and RISC-2 SSCs and additionally ensuring that any credit for
these SSCs for beyond design basis conditions is valid and maintained;
(2) maintaining the design basis of the facility for all SSCs,
including RISC-3 SSCs as described above; and (3) requiring a licensee
to have reasonable confidence that the overall increase in risk that
may result due to implementation of proposed Sec. 50.69 is small.
Maintaining current requirements on RISC-1 and RISC-2 SSCs, and
ensuring that credit taken for these SSCs in the PRA for beyond design
basis events is maintained, provides assurance that the safety-
significant SSCs continue to perform as assumed in the categorization
process. Maintaining the design basis ensures that SSCs continue to be
designed to criteria that ensure the SSCs perform their design basis
functions, and therefore are nominally capable of performing their
design basis functions. Because the only requirements that are relaxed
are those related to treatment, existing safety margins for SSCs
arising from the design technical and functional requirements would
remain. The proposed rule would also require (through monitoring
requirements) that the SSCs must be maintained such that they continue
to be capable of performing their design basis functions. The reduction
in treatment applied to RISC-3 SSCs may result in an increase in RISC-3
failure rates (i.e., a reduction in RISC-3 reliability). To address how
this relates to safety margin, proposed Sec. 50.69 would require that
there be reasonable confidence that any potential increases in CDF and
LERF be small from assumed changes in reliability resulting from the
treatment changes permitted by the proposed rule. As a result,
individual SSCs continue to be capable of performing their design basis
functions, as well as to perform any beyond design basis functions
consistent with the categorization process and results. Therefore, the
Commission concludes that the proposed rule preserves sufficient safety
margins.
III.7.4 Monitoring and Performance Assessment Strategies Are Used
Proposed Sec. 50.69(e) would contain requirements that ensure that
the risk-informed categorization and treatment processes are
maintained, and reflect operational practices, the facility
configuration, and SSC performance. In addition, proposed Sec.
50.69(g) would contain requirements that reports are made to NRC of
conditions preventing SSCs from performing their safety-significant
functions. Together, these requirements maintain the validity of the
risk-informed categorization and treatment processes such that the
above criteria will continue to be satisfied over the life of the
facility.
III.7.5 Summary and Conclusions
Proposed Sec. 50.69 would contain requirements such that the net
risk increase from implementation of its requirements is small;
defense-in-depth is maintained; safety margins are maintained; and
monitoring and performance assessment strategies are used. Together,
these requirements result in a proposed Sec. 50.69 that is consistent
with Commission policy on the use of PRA, and that maintains adequate
protection of public health and safety.
IV. Public Input to the Proposed Rule
IV.1.0 Advance Notice of Proposed Rulemaking (ANPR) Comments
The Commission published an ANPR (March 3, 2000; 65 FR 11488) to
solicit public input on the direction and scope of this rulemaking. A
number of comments were received. The NRC staff provided its
preliminary responses to the issues raised by the commenters in SECY-
00-194, dated September 7, 2000. The Commission has considered these
issues in developing the proposed rule. More detailed discussion of the
comments and the Commission's preliminary positions are contained in a
separate document (see Section X, Availability of Documents). A summary
of some of the more substantive issues follows.
IV.1.1 Need for Prior NRC Review and PRA ``Quality''
As originally envisioned in the ANPR, with development of a
detailed Appendix T to contain the categorization process requirements,
implementation of Sec. 50.69 could be undertaken without a prior NRC
review and approval. As the rulemaking, guidance development, and pilot
reviews progressed, it became apparent that some degree of NRC review
would be necessary to determine that the PRA was technically adequate
to support its use in the categorization process. While the completion
of documents such as the ASME Standard for Probabilistic Risk
Assessments for Nuclear Power Plant Applications and completion of peer
reviews can lead to improved PRAs, there is still some lack of
definitive guidance on preparation of PRAs that would allow use of PRA
results in the manner anticipated without some degree of NRC review of
the PRA itself. Concerns were also raised that excessive detail in the
rule might be problematic and require exemptions. Thus, the approach
that has been developed is for a rule with the minimum elements of the
categorization process defined in the rule, a
[[Page 26531]]
requirement for NRC review and approval of the categorization process
(including PRA peer review information) to be used, and detailed
implementation guidance (in the form of a regulatory guide).
IV.1.2 Treatment Attributes
Many of the ANPR comments focused on what treatment requirements
should be established for various RISC categories of SSC. For example,
there were comments that the requirements should not be ``added-on'' to
existing requirements, but should reflect the significance of the SSCs.
The Statement of Considerations of this rulemaking provides details
about the decisions the Commission has made concerning the appropriate
treatment requirements to include for the various categories of SSCs.
IV.1.3 Selective Implementation
The Commission received a number of comments on selective
implementation, both during the ANPR process and later. The Commission
concludes that selective implementation of Sec. 50.69 should be
allowed to permit a licensee/applicant to depart from compliance with a
limited set of the special treatment rules delineated in Sec.
50.69(b)(1). This topic is discussed further in Section V.5.1. Because
of the existing requirements that would remain in place, a licensee
could choose not to revise requirements for all of the rules within the
scope of Sec. 50.69(b). However, there is no selective implementation
for the overall requirements in Sec. 50.69. Thus for example, a
licensee could not elect to adopt paragraph (b)(1) and not (d)(2).
The other question was whether selective implementation with
respect to the scope of SSCs to be categorized should be allowed. The
Commission has determined that selective implementation on a system
basis should be allowed, but not for components within a system. The
rule includes specific language about this limitation. This required
scope ensures that all safety functions associated with a system or
structure are properly identified and evaluated when determining the
safety significance of individual components within a system or
structure and that the entire set of components that comprise a system
or structure are considered and addressed. As further discussed in
Section III.2, the implementation, including the categorization process
must address an entire system or structure, not selected components
within a system.
With respect to the question about categorizing only some systems,
because the process of categorization of individual components within
the systems can be time-consuming, categorization will occur over a
period of time. In theory, certain systems might not be categorized at
all. Initially there was some reservation that a licensee might only
choose to categorize in systems where they anticipated relief from
requirements (i.e., with a large set of RISC-3 SSCs) and would not
categorize a system that would have RISC-2 SSCs. The Commission notes
that requirements remain for RISC-3 SSCs until they are recategorized,
and both sets of requirements are intended to maintain the design basis
functions of RISC-3 SSCs. However, in categorizing any SSC, the
categorization process may result in making assumptions about other
SSCs in the plant (through the PRA modeling and in the IDP). In other
words, for some SSCs to be of low safety significance, it is necessary
for other SSCs to be safety-significant. For example, a RISC-2 SSC may
be credited in the categorization process and subsequently another SSC
becomes RISC-3 (low safety-significant). If a licensee wants to
selectively implement Sec. 50.69 just for the system in which a
particular RISC-3 SSC resides, then the licensee would also have to
assure that the credit for the RISC-2 SSC is maintained also. To ensure
that the categorization process is valid, such assumptions and credit
must be retained over time, as determined by the PRA update process.
Because the NRC will be reviewing the categorization process before
implementation, NRC can determine if the categorization process is
compatible with this approach.
IV.2.0 Draft Rule Comments
On November 29, 2001 (66 FR 59546), the NRC staff released draft
rule language for proposed Sec. 50.69, in response to guidance from
the Commission dated August 2, 2001. The draft rule language was
released to stakeholders as a means of obtaining early input from
stakeholders about the rulemaking and how it would be implemented. The
NRC staff received ten sets of comments from stakeholders in response
to the FR notice. The NRC staff revised the draft rule and re-issued
the revised language on April 5, 2002, taking into account the issues
raised by the stakeholders. A third draft of the rule was made publicly
available on August 2, 2002. Some revisions to the rule resulted from
the input provided by the stakeholders and others were taken into
account in the development of the SOC. The remaining discussion
identifies the significant comments which resulted in changes to the
draft rule.
Many of the comments received related to the way in which the high-
level treatment requirements for RISC-3 SSCs were organized and worded.
Based upon these comments, the NRC reduced the number of separate
subsections (from 8 to 4), and simplified the wording by removing
duplication of phrases. Suggested simplifications that were accepted
were the deletion of details of the types of maintenance (corrective,
predictive), and deletion of the words ``design inputs.'' Some
stakeholders, such as the NEI, stated that the requirements were overly
prescriptive and were not consistent with the concept of removing SSCs
from the scope of NRC special treatment requirements. The issue about
level of detail is the topic that drew the most comment during the
draft rule language process. At the same time, comments and input from
other stakeholders (including the Advisory Committee on Reactor
Safeguards (ACRS), were resulting in strengthening of the
categorization process such that any individual SSC categorized as
RISC-3 is of very low safety significance. Specific consideration was
also added in the rule requirements to deal with potential common-cause
failures. Based upon this evolution, concerns about prescriptiveness as
stated in these comments led the Commission to simplify the
requirements on treatment for RISC-3 SSCs.
Another part of the draft rule that drew comment was the
requirement for monitoring of RISC-3 SSCs. Some of the comments
indicated that this was not necessary for low safety-significant SSCs,
and was inconsistent with the removal of maintenance rule monitoring
(by removing Sec. 50.65(a)(1) through (3) as requirements). In the
proposed rule, the Commission has clarified that the type of monitoring
of availability and failures under the maintenance rule is not
necessary and that the type of monitoring appropriate for RISC-3 SSCs
is the performance monitoring specified in Sec. 50.69(d)(2)(iii) and
the feedback specified in Sec. 50.69(e)(3).
Other comments proposed that the scope of rules being removed
should be expanded to include the requirements in Sec. 50.55a (ASME
code requirements), and Appendix A to Part 100. Rule language was added
to accomplish this by listing specific subsections of Sec. 50.55a and
Appendix A to Part 100 in the list of requirements removed, and through
other changes to the rule designed to maintain the necessary
reliability of SSCs. The ASME provided comments on the draft rule
language
[[Page 26532]]
stating that the risk-informed Code Cases and Standards developed by
ASME should not be directly referenced in the rule, but that there
should be a framework developed to ensure that the Code Cases are used,
and that partial use does not occur. The proposed rule permits, but
does not require, use of the Code Cases for purposes of meeting rule
requirements. The Commission notes that these Code Cases cover both
categorization and treatment requirements in the areas of inservice
inspection, inservice testing, and repair/replacement. The Commission
expects licensees will utilize the ASME Code Cases as part of their
implementation of Sec. 50.69.
Another commenter stated that the rule should be made applicable to
applicants as well as license holders, and NRC agreed that this was
appropriate and made revisions to the rule language to accommodate
this. Another commenter stated that the wording of the requirement to
``assure risk is small from changes to treatment'' set an impossible
standard, and that the rule wording should be revised to allow use of
sensitivity studies to provide confidence that the risk is small. The
NRC agreed with this comment and revised the rule wording in the manner
suggested that the licensee provide reasonable confidence that the
increase in risk is small through performance of appropriate
evaluations, such as sensitivity studies for SSCs modeled in the PRA.
A commenter thought it was unnecessary to require that a schedule
or scope of systems to be categorized be part of the submittal. It was
noted that implementation of the rule would of necessity occur over
time, and that existing requirements would remain in effect until SSCs
were categorized. Thus, the commenter believes that a licensee should
not be held to any particular schedule for implementation. The NRC's
intent in requesting a schedule and scope was for informational
purposes to know what requirements would be in effect, but agrees that
a firm commitment to a schedule is not required. This part of the rule
was removed, and instead there is a requirement to update the FSAR, in
accordance with Sec. 50.71(e), to reflect implementation as it occurs
for particular systems.
IV.3.0 Pilot Plants
To aid in the development of the proposed rule and associated
implementation guidance, several plants volunteered to conduct pilot
activities with the objective of exercising the proposed NEI
implementation guidance and using the feedback and lessons-learned to
improve both the implementation guidance and the governing regulatory
framework. The pilot effort was supported by three of the industry
owners groups who identified pilots for their reactor types and
participated by piloting sample systems using the draft NEI
implementation guidance. Supporting the pilot effort were the
Westinghouse Owners Group with lead plants Wolf Creek and Surry, the
BWR Owners Group with lead plant Quad Cities, and the CE Owners Group
with lead plant Palo Verde. The B&W Owners Group did not participate,
but did follow the pilot activities.
The NRC staff's participation and principal point of interaction in
the pilot effort was primarily in observation of the deliberations of
the integrated decision-making panel (IDP). By observing the IDP, the
NRC staff was able to view the culmination of the categorization effort
and gain good insights regarding both the robustness of the
categorization process in general, and the IDP decision-making process
specifically. Following each of the pilot IDPs, the staff developed and
issued a trip report containing the staff's observations.
The following points set forth the principal lessons learned and
key feedback from the NRC staff's observations of the pilot activities.
[sbull] Potential treatment changes and their potential effects
need to be understood by the IDP as part of the deliberations on
categorization.
[sbull] The pilots showed the importance of documentation of the
IDP decisions and the basis. The rule contains a requirement for the
categorization basis to be documented (and records retained) in Sec.
50.69(f).
[sbull] The pilots experienced difficulty in explicit consideration
about safety margins, especially in view of the fact that functionality
must be retained. In the first draft rule language posted, requirements
were included for the IDP to consider safety margins in its
deliberations. Based upon the pilot experience, NRC adjusted its
approach to margins to include this in the section of the rule that
requires consideration of effects of changes in treatment and the use
of evaluations as the means of providing reasonable confidence safety
margins are maintained.
[sbull] The need for a number of improvements to the implementation
guidance in NEI 00-04 were noted, for instance, improvement in a
defense-in-depth matrix presented therein, and the need for more
specific guidance on making decisions where quantitative information is
not available. These lessons-learned were factored into the revised
version of NEI 00-04.
[sbull] During the pilot activity, pressure boundary (``passive'')
functions were also categorized using the draft version of an ASME Code
Case on categorization available at that time. A separate
categorization process was used for these passive functions because it
was recognized by pilot participants that the approach for these SSCs
must be somewhat different than for ``active'' functions because of
such considerations as spatial interaction. Specifically, if a pressure
boundary SSC failed, the resulting high-energy release or flooding
might impact other equipment in physical proximity, so the process
needed to account for those effects in addition to the significance of
the SSC that initially failed. Improvements to the ASME Code Case for
categorization of piping (and related components) were identified and
fed back into the code development process.
[sbull] The pilot experiences also revealed the intricacies of the
relationship between ``functions'' (which play a role in decisions on
safety significance) and ``components'' (importance measures are
associated with components and treatment is also generally applied on a
component basis). Because a particular component may support more than
one function, the categorization of the component needs to correspond
with the most significant function and means must be provided for a
licensee to ``map'' the components to the functions they support.
[sbull] At each pilot, the NRC noted that the IDP needed to include
consideration of long term containment heat removal in characterizing
SSCs. The NRC considers retention of long term containment heat removal
capability important to defense-in-depth for light water reactors.
[sbull] Finally, a number of lessons were learned about how to
conduct the IDP process, such as training needs, materials to be
provided to the panel, etc. As a result of this feedback, NEI revised
NEI 00-04 and developed draft revision C of the implementation guidance
(discussed in Section VI).
IV.4.0 South Texas Exemption as Proof-of-Concept
A major element of the rulemaking plan described in SECY-99-256 was
the review of the South Texas Project Nuclear Operating Company
(STPNOC) exemption request. The review of the STPNOC exemption request
was viewed as a proof-of-concept prototype for this rulemaking rather
than a pilot because it preceded development of draft rule
[[Page 26533]]
language or related implementation guidance.
By letter dated July 13, 1999, STPNOC requested approval of
exemption requests to enable implementation of processes for
categorizing the safety significance of SSCs and treatment of those
SSCs consistent with its categorization process. The STPNOC process
included many similar elements to that described in this rulemaking,
but with some differences. Their process identified SSCs as being
either high, medium, low or not risk-significant. The scope of the
exemptions requested included only those safety-related SSCs that have
been categorized as low safety-significant or as nonrisk significant
using STPNOC's categorization process. The licensee indicated that the
categorization and treatment processes would be implemented over the
remaining licensed period of the facility. Thus, the basis for the
exemptions granted was the staff's approval of the licensee's
categorization process and alternative treatment elements, rather than
a comprehensive review of the final categorization and treatment of
each SSC (review of the process rather than the results is also the
approach planned under the rulemaking). As a result of discussions with
the NRC staff on a number of topics, STPNOC submitted a revised
exemption request on August 31, 2000.
On November 15, 2000, the NRC staff issued a draft safety
evaluation (SE), based on the revised exemption requests. Following the
licensee's response to the draft SE, the staff prepared SECY-01-0103
dated June 12, 2001, to inform the Commission of the staff's finding
regarding the STPNOC exemption review. The staff approved the STPNOC
exemption requests by letter dated August 3, 2001 (ADAMS accession
number ML011990368).
The NRC has applied lessons learned from the review of the STPNOC
exemption request in developing proposed Sec. 50.69 and the
description of intended implementation of the rule in this SOC. For
example, in the STPNOC review, the NRC staff reviewed the
categorization process proposed by the licensee in detail. With respect
to proposed Sec. 50.69, the NRC continues to require a robust
categorization with a detailed staff review.
The proposed rule specifies the requirement that the licensee
provide reasonable confidence in functionality and further specifies
some high-level requirements for SSC treatment. Under proposed Sec.
50.69, the NRC does not plan to review each licensee's plan for SSC
treatment in detail. Licensees will have to establish appropriate
performance-based SSC treatment processes to maintain the validity of
the categorization process and its results. The proposed rule would
require that licensees adjust the categorization or treatment
processes, as appropriate, in response to the SSC performance
information obtained as part of the treatment process.
V. Section by Section Analysis
V.1.0 Section 50.8 Information Collection
This proposed rule includes a revision to Sec. 50.8(b). This
section pertains to approval by the Office of Management and Budget
(OMB) of information collection requirements associated with particular
NRC requirements. Because the new Sec. 50.69 includes information
collection requirements, a conforming change to Sec. 50.8(b) is
necessary to list Sec. 50.69 as one of these rules. See also Section
XIII of the SOC for discussion about information collection
requirements of Sec. 50.69.
V.2.0 Section 50.69(a) Definitions
Section 50.69(a) provides the definition for the four RISC
categories and the definition of the term ``safety-significant
function.'' As discussed in Section II of the SOC, RISC-1 SSCs are
those SSCs that are safety-related (as defined in Sec. 50.2) and that
are found to be safety-significant (using the risk-informed
categorization process being established by this rule). RISC-2 SSCs are
SSCs that do not meet the safety-related definition, but which are
safety-significant. RISC-3 SSCs are safety-related but are low safety-
significant. Finally, RISC-4 SSCs are not safety-related and are low
safety-significant. The NRC selected the terms ``safety-significant''
and ``low safety-significant'' as the best representations of their
meaning. Every component (if categorized) is either safety-significant
or low safety-significant. The ``low'' category could include those
SSCs that have no safety significance, as well as some SSCs that
individually are not safety-significant, but collectively can have a
significant impact on plant safety (and hence the need for maintaining
the design basis capability of these SSCs). Similarly, within the
category of ``safety-significant,'' some SSCs are of more importance
than others; so it did not appear appropriate to call them all ``high
safety-significant.'' The RISC definitions of paragraph (a) are used in
subsequent paragraphs of Sec. 50.69 where the treatment requirements
are applied to SSCs as a function of RISC category.
The definitions provided in paragraph (a) are written in terms of
SSCs that perform functions. In the categorization process, it is the
various functions performed by systems that are assessed to determine
their safety significance. For those functions of significance, the
structures and components that support that function are then
designated as being of that RISC category. Then, the treatment
requirements are specified for the SSCs that perform those functions.
Where an SSC performs functions that fall in more than one category,
the treatment requirements derive from the more safety-significant
function (i.e., if a component has both a RISC-1 and a RISC-3 function,
it is treated as RISC-1).
The rule also contains a definition of ``safety-significant''
function. NRC selected the term ``safety-significant'' instead of
``risk-significant'' because the categorization process employed in
Sec. 50.69 considers both probabilistic and deterministic information
in the decision process. Thus, it is more accurate to represent the
outcome as a determination of overall safety significance, including
risk significance, and not just ``risk-significant.''
Those functions that are not determined to be safety-significant
are considered to be low safety-significant. The determination as to
which functions are safety-significant is done by following the
categorization process outlined in paragraph (c), as implemented
following the guidance in DG-1121, ``Guidelines for Categorizing
Structures, Systems, and Components in Nuclear Power Plants According
to their Safety Significance.''
V.3.0 Section 50.69(b) Applicability
Section Sec. 50.69(b) provides that the rule may be voluntarily
implemented by:
(1) Holders of Sec. 50.21(b) or Sec. 50.22 light water reactor
(LWR) operating licenses;
(2) Holders of Part 54 renewed LWR licenses;
(3) A person seeking a design certification under Part 52 of this
chapter; or
(4) Applicants for a LWR license under Sec. 50.22 or under Part
52.
For current licensees, implementation will be through a license
amendment as set forth in Sec. 50.90. Until the request is approved, a
licensee would continue to follow existing requirements. Upon approval
of the categorization process (and review of the supporting PRA), the
licensee can begin implementation by performing categorization of SSCs
and revising treatment requirements accordingly.
[[Page 26534]]
Applicants would be permitted to implement the treatment
requirements, although the process involved for them would likely be
different, depending upon the stage at which they seek approval. An
applicant would have to categorize its SSCs into the four RISC
categories, which would first require the applicant to design the
facility to meet the Part 50 requirements including classifying SSCs
according to the safety-related definition of Part 50. The applicant
could then use the provisions of Sec. 50.69 (upon NRC approval) to
categorize SSCs into the four RISC categories, and this in turn would
enable the applicant to initially procure these SSCs to meet the
applicable Sec. 50.69 requirements.
For Part 54 license holders, implementation is the same as that for
a holder of an operating license under Part 50, that is, to apply for
an amendment to the (renewed) license. In the development of Sec.
50.69, questions have been received regarding what would be the impact
to licensees that implement the proposed Sec. 50.69 and then apply to
renew their license. Because Part 54 includes scoping criteria that
bring safety-related components within its scope, these components
could not be exempted without amending Part 54 to allow for their
exclusion. However, there are still options available to applicants for
renewal that have implemented Sec. 50.69 first. Because Sec. 50.69
includes alternative treatment requirements for RISC-3 components, an
applicant may be able to provide an evaluation that justifies why these
alternative treatment criteria (Sec. 50.69(d)(2)) provide a sufficient
demonstration that aging management of the components will be achieved
during the renewal period to ensure the functionality of the structure,
system, or component. In addition, in the 1995 amendment to Part 54,
the Commission recognized that risk insights could be used in
evaluating the robustness of an aging management program. The NRC staff
has already received and accepted one proposal (Arkansas Unit 1) for a
risk-informed program for small-bore piping which demonstrates that
risk arguments can be used to a degree.
For the case where a licensee renewed its license first and then
implemented Sec. 50.69, a licensee might revise some aging management
programs for RISC-3 SSCs, consistent with the requirements of Sec.
50.69. The Commission considers that there should be little or no
impediment for doing so because the categorization process that allows
for the reduction in the special treatment requirements for RISC-3
components is expected to provide an appropriate level of safety for
the respective structures, systems and components.
Adopting the proposed Sec. 50.69 requirements for an applicant
that has not obtained a Sec. 50.21(b) or Sec. 50.22 operating license
(e.g. for a construction permit holder), is not as straightforward, and
requires that the applicant first design the facility to meet the
current Part 50 requirements. Specifically, to use the proposed Sec.
50.69 requirements requires that SSCs first be classified into the
traditional safety-related and nonsafety-related classifications. This
establishes the design basis for the facility, which as previously
stated, the proposed Sec. 50.69 is not changing. Once the SSC
categorization has been done consistent with the safety-related
definition in Sec. 50.2, then proposed Sec. 50.69 can be used to re-
categorize SSCs into RISC-1, RISC-2, RISC-3, and RISC-4, and the
alternative treatment requirements of proposed Sec. 50.69 implemented.
A new applicant who chooses to adopt these proposed Sec. 50.69
requirements, must seek approval of the categorization process as part
of its license application, and following NRC approval, would be able
to procure RISC-3 SSCs to proposed Sec. 50.69 requirements before
initial plant operation. An applicant who references a certified design
and wishes to implement Sec. 50.69 would include the specified
information as part of its application for a license. This does not
mean that an applicant would actually construct the facility per all
Part 50, and 100 requirements first, before applying Sec. 50.69.
Instead, the facility needs to be designed per these requirements, but
following approval of application of Sec. 50.69, RISC-3 SSCs could be
procured per the requirements of Sec. 50.69(d).
The rule provisions were devised to provide means for licensees and
applicants for light water reactors to implement Sec. 50.69. In view
of some of the specific provisions of the rule, for example, ``safety-
related'' definition and use of CDF/LERF metrics, the Commission is
making this rule only applicable to light-water reactor designs.
An applicant for a design certification could request to implement
Sec. 50.69 with respect to categorizing SSCs. Because the rule
requirements in Sec. 50.69 include elements of procurement and
installation, as well as inservice activities, implementation of the
rule by a holder of a manufacturing license or by a design
certification applicant would have implications for the eventual
operator of the facility. The entity that actually constructs and
operates the facility would also have to implement Sec. 50.69 to
maintain consistency with the categorization process and feedback
requirements. Otherwise, the operator would be required to meet other
Part 50 requirements, such as Appendix B or Sec. 50.55a, which may not
be compatible with the facility as manufactured by the manufacturing
licensee. However, applicability of this proposed rule is not excluded
for manufacturing licenses or design certificate applicants.
V.3.1 Section 50.69(b)(1) Removal of RISC-3 and RISC-4 SSCs From the
Scope of Treatment Requirements
Section 50.69 (b)(1) of the proposed rule lists the specific
special treatment requirements from whose scope the RISC-3 and RISC-4
SSCs are being removed through the application of Sec. 50.69. In this
paragraph, each of the rule requirements (or portions thereof) that are
being removed by this rulemaking are listed in a separate item,
numbered from Sec. 50.69(b)(1)(i) through (ix). The basis for removal
of these requirements was discussed earlier. These requirements are
being removed due to the low safety significance of RISC-3 and RISC-4
SSCs as determined by an approved risk-informed categorization process
meeting the requirements of Sec. 50.69(c). The special treatment
requirements for RISC-3 SSCs are replaced with the high level
requirements in Sec. 50.69(d)(2), which when effectively implemented
by licensees to provide a sufficient level of confidence that RISC-3
SSCs continue to be capable of performing their safety-related
functions under design basis conditions. Note that special treatment
requirements are not removed from any SSCs until a licensee (or
applicant) has categorized those SSCs using the requirements of Sec.
50.69(c) to provide the documented basis for the decision that they are
of low safety significance.
V.3.2 Section 50.69 (b)(2) Application Process
Proposed Sec. 50.69(b)(2) would require a licensee who voluntarily
seeks to implement Sec. 50.69 to submit an application for a license
amendment pursuant to Sec. 50.90 that contains the following
information:
(i) A description of the categorization process that meets the
requirements of Sec. 50.69(c).
(ii) A description of the measures taken to assure that the quality
and level of detail of the systematic processes that evaluate the plant
for internal and external events during normal operation, low power,
and shutdown (including the plant-specific PRA, margins-type
approaches, or other systematic evaluation techniques used
[[Page 26535]]
to evaluate severe accident vulnerabilities) are adequate for the
categorization of SSCs.
(iii) Results of the PRA review process to be conducted to meet
Sec. 50.69(c)(1)(i).
(iv) A description of, and basis for acceptability of, the
evaluations to be conducted to satisfy Sec. 50.69(c)(1)(iv). The
evaluations shall include the effects of common cause interaction
susceptibility, and the potential impacts from known degradation
mechanisms for both active and passive functions, and address
internally and externally initiated events and plant operating modes
(e.g., full power and shutdown conditions).
Regarding the categorization process description, the NRC expects
that most licensees and applicants will commit to draft regulatory
guide DG-1121 which endorses NEI 00-04, with some conditions and
exceptions. If a licensee or applicant wishes to use a different
approach, the submittal would need to provide sufficient description of
how the categorization would be conducted. As part of the submittal, a
licensee or applicant is to describe the measures they have taken to
assure that the plant-specific PRA, as well as other methods used, are
adequate for application to proposed Sec. 50.69. The measures
described would include such items as any peer reviews performed, any
actions taken to address peer review findings that are important to
categorization, and any efforts to compare the plant-specific PRA to
the ASME PRA standard. The NRC has developed reviewer guidance
applicable to these submittals and this is described below in Section
VI.2. The licensee/applicant would also describe what measures they
have used for the methods other than a PRA to determine their adequacy
for this application.
Further, the licensee (or applicant) would be required to include
information about the evaluations they intend to conduct to provide
reasonable confidence that the increase in risk would be small. This
would include any sensitivity studies for RISC-3 SSCs, including the
basis for whatever change in reliability being assumed for these
analyses. A licensee would need to provide sufficient information for
the NRC describing the sensitivity studies and other evaluations, and
the basis for their acceptability as appropriately representing the
potential increase in risk from implementation of the revised
requirements in this proposed rule.
As discussed elsewhere, the RISC-3 SSCs have low safety
significance under Sec. 50.69. The Commission expects licensees and
applicants to implement effective treatment processes to maintain RISC-
3 functionality that comply with Sec. 50.69(d). Those processes do not
need to be described to the NRC as part of the proposed Sec. 50.69
submittal under Sec. 50.69(b)(2).
V.3.3 Section 50.69(b)(3) Approval for Licensees
Section 50.69(b)(3) would further provide that the Commission will
approve a licensee's implementation of this section by license
amendment if it determines that the proposed process for categorization
of RISC-1, RISC-2, RISC-3, and RISC-4 SSCs satisfies the requirements
of Sec. 50.69(c).
The NRC will review the description of the categorization process
set forth in the application to confirm that it contains the elements
required by the rule. The NRC will also review the information provided
about the plant-specific PRA, including the peer review process to
which it was subjected, and methods other than a PRA relied upon in the
categorization process. The NRC intends to use review guidance
(discussed in more detail in Section VI) for this purpose. The NRC will
approve the licensee's use of Sec. 50.69 by issuing a license
amendment.
V.3.4 Section 50.69(b)(4) Process for Applicants
Section 50.69(b)(4) would require that an applicant for a license
(or for a design certification) that chooses to implement proposed
Sec. 50.69 must submit the information listed in Sec. 50.69(b)(2) as
part of its application for a license. As previously discussed, the
rule is structured to transition from the ``safety-related''
classification (and related treatment requirements) to a safety-
significant classification. Thus, an applicant would first need to
design the facility to meet applicable Part 50 design requirements, and
then apply the requirements of Sec. 50.69. The above-cited information
must be submitted in addition to other technical information necessary
to meet Sec. 50.34. The NRC will provide its approval of
implementation of Sec. 50.69, if it concludes that the rule
requirements would be met, as part of its action on the application for
a license or the design certification rule. As noted in Section V.3.0,
an applicant referencing a certified design that implemented Sec.
50.69 would need to adopt the remaining provisions of Sec. 50.69 or
apply the other requirements in Part 50 to its processes.
V.4.0 Section 50.69(c) Categorization Process Requirements
Section 50.69(c) would establish the requirements for the risk-
informed categorization process including requirements for the
supporting PRA. Licensees or applicants who wish to adopt the
requirements of Sec. 50.69 will need to make a submittal (per Sec.
50.69(b)(2) or Sec. 50.69(b)(4)) that discusses how their proposed
categorization process, supporting PRA, and evaluations meet the Sec.
50.69(c) requirements. As described above in Section III.2.0, these
requirements are intended to ensure that the risk-informed Sec. 50.69
categorization process determines the safety significance of SSCs with
a high level of confidence. The introductory paragraph states that SSCs
must be categorized as RISC-1, 2, 3, or 4 by a process that determines
whether the SSC performs one or more safety-significant functions and
identifies those functions.
V.4.1 Section 50.69(c)(1)(i) Results and Insights From a Plant-Specific
Probabilistic Risk Assessment
Section 50.69(c)(1)(i) contains the requirements for the PRA
itself, and how it is to be used in the categorization process. The PRA
must have sufficient capability and quality to support the
categorization of the SSCs. How this is to be accomplished is discussed
in Section V.4.1.1. The PRA and associated sensitivity studies are used
primarily in the categorization of the SSCs as to their safety
significance as discussed in Section V.4.1.2, and the PRA is also used
to perform evaluations to assess the potential risk impact of the
proposed change in treatment of the RISC-3 SSCs as discussed in Section
V.4.4.
V.4.1.1 Scope, Capability, and Quality of the PRA to Support the
Categorization Process
As required in Sec. 50.69(c)(1)(ii), initiating events from
sources both internal and external to the plant, and for all modes of
operation, which would include low power and shutdown modes, must be
considered when performing the categorization of SSCs. It is recognized
that few licensees have fully developed PRA models that cover such a
scope. However, as a minimum, the PRA to be used to support
categorization under Sec. 50.69(c)(1) must model internal initiating
events occurring at full power operations. The PRA will have to be able
to calculate both core damage frequency and large early release
frequency in order to meet the requirement in Sec. 50.69(c)(iv). The
PRA must reasonably represent the current configuration and operating
practices at the plant to meet Sec. 50.69(c)(1)(ii). The PRA model
should be of sufficient technical quality and level of detail to
support the categorization process. This means that
[[Page 26536]]
it represents a coherent, integrated model, and have sufficient detail
to support the initial categorization of SSCs into the safety-
significant, and low safety-significant categories.
The quality and scope of the plant-specific PRA will be assessed by
the NRC taking into account appropriate standards and peer review
results. The NRC has also prepared a draft regulatory guide (DG-1122)
on determining the technical adequacy of PRA results for risk-informed
activities. As one step in the assurance of technical quality, the PRA
must have been subjected to a peer review process assessed against a
standard or set of acceptance criteria that is endorsed by the NRC.
Thus, the NRC staff would use the NEI Peer Review Process as modified
in the NRC's approval, or the ASME/ANS Peer Review Process, as modified
in the NRC's approval. As discussed in Section VI, NRC has developed
review guidelines for considering the sufficiency of a PRA that was
subjected to the NEI peer review process, as it would be used in
implementation of Sec. 50.69. The submittal requirements listed in
Sec. 50.69(b)(2) include a requirement to provide information about
the quality of the PRA analysis and about the peer review results.
V.4.1.2 Risk Categorization Process Based on PRA Information
For SSCs modeled in the PRA, the categorization process relies on
the use of importance measures as a screening method to assign the
preliminary safety significance of SSCs. (Other methodologies such as
success path identification methodologies can also be used, however,
this discussion will focus on the use of importance measures because
these are the most commonly used tools to identify safety significance
of SSCs, for example, in the implementation of Sec. 50.65.) In
addition to being a useful tool to help prioritize NRC staff and
licensee resources, use of importance measures can provide a systematic
means to identify improvements to current plant practices. The
determination of the safety significance of SSCs by importance measures
is also important because it can identify potential risk outliers and
therefore, changes that exacerbate these outliers can be avoided; and
it can facilitate IDP deliberations of SSCs that are not modeled in the
PRA, for example, events from the ranked list can be used as surrogates
for those SSCs that are not modeled or are only implicitly modeled in
the PRA.
For SSCs modeled in the PRA, SSC importance must be determined
based on both CDF and LERF. Importance measures should be chosen so
that results can provide the IDP with information on the relative
contribution of an SSC to total risk. Examples of importance measures
that can accomplish this are the Fussell-Vesely (F-V) importance and
the Risk Reduction Worth (RRW) importance. Importance measures should
also be used to provide the IDP with information on the margin
available should an SSC fail to function. The Risk Achievement Worth
(RAW) importance and the Birnbaum importance are example measures that
are suitable for this purpose.
In choosing screening criteria to be used with the PRA importance
measures, it should be noted that importance measures do not directly
relate to changes in the absolute value of risk. Therefore, the final
criteria for categorizing SSCs into the safety-significant and the low
safety-significant categories must be based on an assessment of the
potential overall impact of SSC categorization and a comparison of this
potential impact to the acceptance criteria for changes in CDF and
LERF. However, typically in the initial screening stages, an SSC with
F-V < 0.005 based on CDF and LERF, and RAW < 2 based on CDF and LERF
can be considered as potentially low safety-significant. IDP
consideration of Sec. Sec. 50.69(c)(1)(ii), (c)(1)(iii), and
(c)(1)(iv) should be carried out to confirm the low safety significance
of these SSCs.
In determining the importance of SSCs, consideration should be
given to the potential for the multiple failure modes for the SSC. PRA
basic events represent specific failure events and failure modes of
SSCs. The calculation of SSC importance should take into account the
combined effects of all associated basic PRA events (such as failure to
start and failure to run), including indirect contributions through
associated common cause failure (CCF) event probabilities.
Another concern that arises because importance measures are
typically evaluated on the basis of individual events is that single-
event importance measures have the potential to dismiss all elements of
a system or group, despite the system or group having a high importance
when taken as a whole. (Conversely, there may be grounds for screening
out groups of SSCs, owing to the unimportance of the systems of which
they are elements.) One approach around this problem is to first
determine the importance of system functions performed by the selected
plant systems. If necessary, each component in a system is then
evaluated to identify the system function(s) supported by that
component. SSCs may be initially assigned the same category as the most
limiting system function they support. System operating configuration,
reliability history, recovery time available, and other factors can
then be considered when evaluating the effect on categorization from an
SSC's redundancy or diversity. The primary consideration in the process
is whether the failure of an SSC will fail or severely degrade the
safety function. If the answer is no, then a licensee may factor into
the categorization the SSC's redundancy, as long as the SSC's
reliability assumed in the categorization process and that of its
redundant counterpart(s) have been taken into account.
When the PRA used in the importance analyses includes models for
external initiating events and/or plant operating modes other than full
power, caution should be used when considering the results of the
importance calculations. The PRA models for external initiating events
(e.g., events initiated by fires or earthquakes), and for low power and
shutdown plant operating modes may be more conservative and have a
greater degree of uncertainty than for internal initiating events. Use
of conservative models can influence the calculation of importance
measures by moving more SSCs into the low safety significance category.
Therefore, when PRA models for external event initiators and for the
low power and shutdown modes of operation are available, the importance
measures should be evaluated for each analysis separately, and the
results of the analyses should be provided to the IDP.
As part of the demonstration of PRA adequacy, the sensitivity of
SSC importance to uncertainties in the parameter values for component
availability/reliability, human error probabilities, and CCF
probabilities should be evaluated. Results of these sensitivity
analyses should be provided to the IDP. In IDP deliberations on the
sensitivity study results, the following should be considered:
(1) The change in event importance when the parameter value is
varied over its uncertainty range for the event probability can in some
cases provide SSC categorization results that are different. Therefore,
in considering the sensitivity of component categorization to
uncertainties in the parameter values, the IDP should ensure that SSC
categorization is not affected by data uncertainties.
(2) PRAs typically model recovery actions, especially for dominant
accident sequences. Estimating the
[[Page 26537]]
success probability for the recovery actions involves a certain degree
of subjectivity. The concerns in this case stem from situations where
very high success probabilities are assigned to a sequence, resulting
in related components being ranked as low risk contributors.
Furthermore, it is not desirable for the categorization of SSCs to be
impacted by recovery actions that sometimes are only modeled for the
dominant scenarios. Sensitivity analyses should be used to show how the
SSC categorization would change if recovery actions were removed. The
IDP should ensure that the categorization is not unduly impacted by the
modeling of recovery actions.
(3) CCFs are modeled in PRAs to account for dependent failures of
redundant components within a system. CCF probabilities can impact PRA
results by enhancing or obscuring the importance of components. A
component may be ranked as a high risk contributor mainly because of
its contribution to CCFs, or a component may be ranked as a low risk
contributor mainly because it has negligible or no contribution to
CCFs. The IDP should ensure that the categorization is not unduly
impacted by the modeling of CCFs. The IDP should also be aware that
removing or relaxing requirements may increase the CCF contribution,
thereby changing the risk impact of an SSC.
V.4.2 Section 50.69(c)(1)(ii) Integrated Assessment of SSC Function
Importance
Section 50.69(c)(1)(ii) contains requirements for an integrated,
systematic process to address events including those not modeled in the
PRA, including both design basis and severe accident functions. For
various reasons, many SSCs in the plant will not be modeled explicitly
in the PRA. Therefore, the categorization process must determine the
safety significance of these SSCs by other means, as discussed below.
Because importance measures are not available for use as screening,
other criteria or considerations must be used by the IDP to determine
the significance. To provide the necessary structure, the Commission is
setting forth guidance on how these deliberations should be conducted;
this information will also be included in the regulatory guidance for
this proposed rule. These considerations were selected based upon NRC
experience about what functions are important to prevention of core
damage or large early release.
The proposed rule would also include requirements that all aspects
of the processes used to categorize SSC must reasonably reflect the
current plant configuration, operating practices and applicable
operating experience. The terminology of ``reasonably reflect'' was
selected to allow for appropriate PRA modeling and also to make clear
that the PRA and processes do not need to be instantaneously revised
when a plant change occurs (see also requirements in Sec. 50.69(e)(1)
on PRA updating).
V.4.2.1 Initiating Events and Plant Operating Modes Not Modeled in the
PRA
When initiating events with frequencies of greater than
10-\6\ per year are not modeled in the PRA, or when the low
power and shutdown plant operating modes are not modeled in the PRA,
other means are needed to determine the safety significance to meet
Sec. 50.69(c)(1). The proposed implementation guidance contains
information about how this can be accomplished by the IDP assessments.
The licensee should demonstrate that the relaxation of regulatory
requirements will not unacceptably degrade plant response capability
and will not introduce risk vulnerabilities for the unmodeled
initiating events or plant operating modes. For these unmodeled events,
the IDP assessment should consider whether an SSC has an impact on the
plant's capability to:
(1) Prevent or mitigate accident conditions,
(2) Reach and/or maintain safe shutdown conditions,
(3) Preserve the reactor coolant system pressure boundary
integrity,
(4) Maintain containment integrity, or
(5) Allow monitoring of post-accident conditions.
In determining the importance of SSCs for each of these functions,
the following factors should be considered:
[sbull] Safety function being satisfied by SSC operation
[sbull] Level of redundancy existing at the plant to fulfill the
SSC's function
[sbull] Ability to recover from a failure of the SSC
[sbull] Performance history of the SSC
[sbull] Use of the SSC in the Emergency Operating Procedures or
Severe Accident Management Guidelines
The licensee or applicant (through the IDP) must document the basis
for the assignment of an SSC as RISC-3 based on the above
considerations. Insights and results from risk assessment and risk
management methodologies (for example the fire and external events
screening methodologies, the seismic margins analyses, or the shutdown
safety management models) may be used to help form this basis.
V.4.2.2 SSCs Not Modeled in the PRA
In addition to being safety-significant in terms of their
contribution to CDF or LERF, SSCs can also be safety-significant in
terms of other risk metrics or conditions. Therefore, for SSCs not
modeled explicitly in the PRA, the IDP should verify low safety
significance based on traditional engineering analyses and insights,
operational experience, and information from licensing basis documents
and design basis accident analyses. The IDP should assess the safety
significance of these SSCs by determining if:
(1) Failure of the SSC will significantly increase the frequency of
an initiating event, including those initiating events originally
screened out in the PRA.
(2) Failure of the SSC will compromise the integrity of the reactor
coolant pressure boundary. It is expected that a sufficiently robust
categorization process would result in the reactor coolant pressure
boundary being categorized as RISC-1.
(3) Failure of the SSC will fail a safety-significant function,
including SSCs that are assumed to be inherently reliable in the PRA
(e.g., piping and tanks) and those that may not be explicitly modeled
(e.g., room cooling systems, and instrumentation and control systems).
For example, it is expected for PWRs that a sufficiently robust
categorization process would categorize high energy ASME Section III
Class 2 piping of the main steam and feedwater systems as RISC-1.
(4) The SSC supports important operator actions required to
mitigate an accident, including the operator actions taken credit for
in the PRA.
(5) Failure of the SSC will result in failure of safety-significant
SSCs (e.g., through spatial interactions or through functional reliance
on another SSC).
(6) Failure of the SSC will impact the plant's capability to reach
and/or maintain safe shutdown conditions.
(7) The SSC is one of a redundant set that can be justifiably
identified as a common cause failure group.
(8) The SSC is a part of a system that acts as a barrier to fission
product release during severe accidents. It is expected that a
sufficiently robust categorization process would result in fission
product barriers (e.g., the containment shell or liner) being
categorized as RISC-1.
(9) The SSC is depended upon in the Emergency Operating Procedures
or the Severe Accident Management Guidelines.
(10) Failure of the SSC will result in unintentional releases of
radioactive
[[Page 26538]]
material in excess of 10 CFR part 100 guidelines even in the absence of
severe accident conditions.
(11) The SSC is relied upon to control or to mitigate the
consequences of transients and accidents.
If any of these conditions is true, the IDP should use a
qualitative evaluation process to determine the impact of relaxing
requirements on SSC reliability and performance. This evaluation should
include identifying the functions being supported by SSC operation, the
relationship between the SSC's failure modes and the functions being
supported, the SSC failure modes for which the failure rate may
increase, and the SSC failure modes for which detection could become or
are more difficult. The IDP can then justify low safety significance of
the SSC by demonstrating the following:
[sbull] The categorization is consistent with the defense-in-depth
philosophy (per Section V.4.3 below).
[sbull] Operating experience indicates that degradation mechanisms
(e.g., for piping flow accelerated corrosion or microbiologically-
induced corrosion), for passive and active SSCs are not present,
relaxing the requirements will have minimal impact on the failure rate
increase, and degradation in the ability of the SSC to perform its
safety function can be detected in a timely fashion.
[sbull] Relaxing the requirements will have a minimal impact on the
expected onsite occupational or offsite doses from transients and
accidents that do not contribute to CDF or LERF.
V.4.3 Section 50.69(c)(1)(iii) Maintaining Defense-in-Depth Philosophy
Section 50.69(c)(1)(iii) requires that the categorization process
maintain the defense-in-depth philosophy. To satisfy this requirement,
when categorizing SSCs as low safety-significant, the IDP must
demonstrate that the defense-in-depth philosophy is maintained.
Defense-in-depth is considered adequate if the overall redundancy and
diversity among the plant's systems and barriers is sufficient to
ensure the risk acceptance guidelines discussed below in Section V.4.4
are met, and that:
[sbull] Reasonable balance is preserved among prevention of core
damage, prevention of containment failure or bypass, and mitigation of
consequences of an offsite release.
[sbull] System redundancy, independence, and diversity is preserved
commensurate with the expected frequency of challenges, consequences of
failure of the system, and associated uncertainties in determining
these parameters.
[sbull] There is no over-reliance on programmatic activities and
operator actions to compensate for weaknesses in the plant design, and
[sbull] Potential for common cause failures is taken into account.
The Commission's position is that the containment and its systems
are important in the preservation of the defense-in-depth philosophy
(in terms of both large early and large late releases). Therefore, as
part of meeting the defense-in-depth principle, a licensee should
demonstrate that the function of the containment as a barrier
(including fission product retention and removal) is not significantly
degraded when SSCs that support the functions are moved to RISC-3
(e.g., containment isolation or containment heat removal systems). The
concepts used to address defense-in-depth for functions required to
prevent core damage may also be useful in addressing issues related to
those SSCs that are required to preserve long-term containment
integrity. One way to do this would be to show that these SSCs are not
relied on to prevent late containment failure during core damage
accidents. An alternative method would be to demonstrate that a
potential decrease in reliability of RISC-3 SSCs that support the
containment function does not have significant impact on the estimate
of late containment failure probability. In essence, what the NRC
expects is for a plant-specific understanding of the effects of
containment systems on large late releases and an understanding of the
credit given to these systems in maintaining the conditional
probability for these releases. A licensee or applicant can
qualitatively argue that an SSC is not relied upon to prevent large
late containment failure and is thus low safety-significant from this
standpoint. If an SSC plays a role in supporting the containment
function in terms of large late releases, and if the licensee wants to
categorize these SSCs as low safety-significant (for example, because
of available redundant systems or trains or because failure is
dominated by factors not related to the SSC), NRC would find acceptable
the use of sensitivity studies to show that the effects on (i.e.,
change in) the late containment failure probability is small (i.e.,
less than a 10 percent increase from the base value) and that factors
such as common cause failures or other dependencies are not important.
Where a licensee categorizes containment isolation valves or
penetrations as RISC-3, the licensee will need to address the impact of
the proposed change in treatment on a case-by-case basis to ensure that
the defense-in-depth principle continues to be satisfied.
V.4.4 Section 50.69(c)(1)(iv) Include Evaluations To Provide Reasonable
Confidence That Sufficient Safety Margins Are Maintained and That Any
Potential Increases in CDF and LERF Resulting From Changes in Treatment
Permitted by Implementation of Sec. 50.69(b)(1) and Sec. 50.69(d)(2)
Are Small
Section 50.69(c)(1)(iv) specifies that the categorization process
include evaluations to provide reasonable confidence that as a result
of implementation of revised treatment permitted for RISC-3 SSC,
sufficient safety margins are maintained and any potential increases in
CDF and LERF are small. Safety margins can be maintained if the
licensee maintains the functionality of the SSCs following
implementation of the revised requirements and if periodic maintenance,
inspection, tests, and surveillance activities are adequate to prevent,
detect and correct significant SSC performance and reliability
degradation. Later sections of this SOC provide discussion on the
proposed treatment processes the licensee will implement to provide
reasonable confidence that RISC-3 SSCs remain capable of performing
their safety functions under design basis conditions. The requirements
of the rule to show that sufficient safety margins are maintained and
that potential increases in risk are small are discussed below.
As part of their submittal, a licensee (or applicant) is to
describe the evaluations to be conducted for purposes of meeting the
requirement that there would be no more than a small (potential)
increase in risk. For SSCs included in the PRA, the Commission expects
that sensitivity studies (evaluations) would be done to provide a basis
for concluding that even if reliability of these SSC should degrade
because of the changes in treatment, the potential risk increase would
be small. Satisfying the rule requirement that the risk increase is
small presumes that the increase in failure rates assumed in the PRA
sensitivity study bounds any reasonable estimate of the increase that
may be expected as a result of the proposed changes in treatment.
The categorization process encompasses both active and passive
functions of SSCs. Section 50.69(b)(2)(iv) includes the requirement
that the change-in-risk evaluations performed to satisfy Sec.
50.69(c)(1)(iv) must include potential impacts from known degradation
mechanisms on both active and passive functions. It is
[[Page 26539]]
necessary for a licensee to consider the impact that a change in
treatment (as a result of removal of special treatment requirements)
might have on the ability of the SSC to perform its design basis
function and on reliability of SSCs. The purpose is to provide an
understanding of the new treatment requirements and their effects on
RISC-3 SSCs due to removal of special treatment requirements. This will
help form the basis for the change-in-risk evaluations and will support
developing a technical basis for concluding that SSC performance is
consistent with the categorization process and its results and with
those evaluations performed to show that there is a no more than a
small increase in risk associated with implementation of Sec. 50.69.
The basis supporting the evaluations that examine potential SSC
reliability changes due to treatment changes may be either qualitative
or quantitative.
One mechanism that could lead to large increases in CDF/LERF is
extensive, across system common cause failures. However, for such
extensive CCFs to occur would require that the mechanisms that lead to
failure, in the absence of special treatment, were sufficiently rapidly
developing or are not self-revealing that there would be few
opportunities for early detection and corrective action. Thus, when
deciding how much to assume that SSC reliability might change, the
applicant or licensee is expected to consider potential effects of
common-cause interaction susceptibility, including cross-system
interactions and potential impacts from known degradation mechanisms.
Those aspects of treatment that are necessary to prevent SSC
degradation or failure from known degradation mechanisms, to the extent
that the results of the evaluations are invalidated, must be retained.
Identifying those aspects will involve an understanding of what the
degradation mechanisms are and what elements of treatment are
sufficient to prevent the degradation. As an example of how this would
be implemented, the known existence of certain degradation mechanisms
affecting pressure boundary SSC integrity might support retaining the
current requirements on inspections or examinations or use of the risk-
informed ASME Code Cases, as accepted by the NRC regulatory process. An
alternative might be to relax certain elements of treatment, but retain
those that were assessed to be the most effective in negating the
degradation mechanisms. As another example, changing levels of
treatment on several similar components that might be sensitive to CCF
potential would require consideration as to whether the planned
monitoring and corrective action program, or other aspects of
treatment, would be effective in sufficiently minimizing CCF potential
such that the evaluations remain bounding.
The treatment for all RISC-3 SSCs may not need to be the same. As
an example, motor operated valves (MOVs) operating in a severe
environment (e.g., in the steam tunnel) would be more susceptible to
failure because of grease degradation if they were not regularly
maintained and tested. However, not all MOVs, even if they have the
same design and are identical in other respects, will be exposed to the
same environment. Therefore the other MOVs may not be as susceptible to
failure as those in the steam tunnel and less frequent maintenance and
testing would be acceptable. While it may be simpler to increase the
unreliability or unavailability of all the RISC-3 SSCs by a certain
bounding factor to demonstrate that the change in risk is small and
acceptable, the above example suggests that it may also be appropriate
to use different factors for different groups of SSCs depending on the
impact of reducing treatment on those SSCs.
Section 50.69(c)(1)(iv) requires that the increase in the overall
plant CDF and LERF resulting from potential decreases in the
reliability of RISC-3 SSCs as a result of the changes in treatment be
small. The rule further requires the licensee (or applicant) to
describe the evaluations to be performed to meet this requirement. The
Commission regards ``small'' changes for plants with total baseline CDF
of 10-4 per year or less to be CDF increases of up to
10-5 per year, and plants with total baseline CDF greater
than 10-4 per year to be CDF increases of up to
10-6 per year. However, if there is an indication that the
CDF may be considerably higher than 10-4 per year, the focus
of the licensee should be on finding ways to decrease rather than
increase CDF and the licensee may be required to present arguments as
to why steps should not be taken to reduce CDF in order for the
reduction in special treatment requirements to be considered. For
plants with total baseline LERFs of 10-5 per year or less,
small LERF increases are considered to be up to 10-6 per
year, and for plants with total baseline LERFs greater than
10-5 per year, LERF increases of up to 10-7 per
year. Similarly, if there is an indication that the LERF may be
considerably higher than 10-5 per year, the focus of the
licensee should be on finding ways to decrease rather than increase
LERF and the licensee may be required to present arguments as to why
steps should not be taken to reduce LERF in order for the reduction in
special treatment requirements to be considered. This is consistent
with the guidance in Section 2.2.4 of RG 1.174. It should be noted that
this allowed increase shall be applied to the overall categorization
process, even for those licensees that will implement Sec. 50.69 in a
phased manner.
The licensee can choose a factor for the increase on unreliability
such that the corrective action and feedback processes discussed in
Sec. Sec. 50.69(d)(2) and 50.69(e)(3) would provide sufficient data to
substantiate that the increased unreliability used in the evaluations
is not exceeded.
If a PRA model does not exist for the external initiating events or
the low power and shutdown operating modes, justification should be
provided, on the basis of bounding analyses or qualitative
considerations, that the effect on risk (from the unmodeled events or
modes of operation) is not significant and that the total effect on
risk from modeled and unmodeled events and modes of operation is small,
consistent with Section 2.2.4 of RG 1.174.
V.4.5 Section 50.69(c)(1)(v) System or Structure Level Review
Section 50.69(c)(1)(v) specifies that the categorization be done at
the system or structure level, not for selected components within a
system. A licensee or applicant is allowed to implement Sec. 50.69 for
a subset of the plant systems and structures (i.e., partial
implementation) and to phase in implementation over a period of time.
However, the implementation, including the categorization process, must
address entire systems or structures; not selected components within a
system or structure.
V.4.6 Section 50.69(c)(2) Use of Integrated Decision-Making Panel (IDP)
Section 50.69(c)(2) sets forth the requirements for using an IDP to
make the determination of safety significance, and for the composition
of the IDP. The fundamental requirement for the categorization process
(as stated in Sec. 50.69 (c)(1)(ii)) is that it include use of an
integrated systematic process. The determination of safety significance
of SSCs is to be performed as part of an integrated decision-making
process, which uses both risk insights and traditional engineering
insights. In categorizing SSCs as low safety-significant, it should be
demonstrated that the defense-in-depth philosophy is maintained, that
sufficient safety margin is maintained, and that increases in risk
[[Page 26540]]
(if any) are small. To account for each of these factors and to account
for risk insights not found in the plant-specific PRA, Sec.
50.69(c)(2) requires that the final categorization of each SSC be
performed using an integrated decision-making panel (IDP). A structured
and systematic process using documented criteria shall be used to guide
the decision-making process. Categorization is an iterative process
based on expert judgment to integrate the qualitative and quantitative
elements that impact SSC safety significance. The insights and varied
experience of IDP members are relied on to ensure that the final result
reflects a comprehensive and justifiable judgment.
The panel must be composed of experienced personnel who possess
diverse knowledge and insights in plant design and operation and who
are capable in the use of deterministic knowledge and risk insights in
making SSC classifications. The NRC places significant reliance on the
capability of a licensee to implement a robust categorization process
that relies heavily on the skills, knowledge, and experience of the
people that implement the process, in particular on the qualification
of members of the IDP. The IDP should be composed of a group of at
least five experts who collectively have expertise in plant operation,
design (mechanical and electrical) engineering, system engineering,
safety analysis, and probabilistic risk assessment. At least three
members of the IDP should have a minimum of five years experience at
the plant, and there should be at least one member of the IDP who has
worked on the modeling and updating of the plant-specific PRA for a
minimum of three years.
The IDP should be trained in the specific technical aspects and
requirements related to the categorization process. Training should
address at a minimum the purpose of the categorization; present
treatment requirements for SSCs including requirements for design basis
events; PRA fundamentals; details of the plant-specific PRA including
the modeling, scope, and assumptions, the interpretation of risk
importance measures, and the role of sensitivity studies and the
change-in-risk-evaluations; and the defense-in-depth philosophy and
requirements to maintain this philosophy.
The licensee or applicant (through the IDP) shall document its
decision criteria for categorizing SSCs as safety-significant or low
safety-significant pursuant to Sec. 50.69(f)(1). Decisions of the IDP
should be arrived at by consensus. Differing opinions should be
documented and resolved, if possible. If a resolution cannot be
achieved concerning the safety significance of an SSC, then the SSC
should be classified as safety-significant. SSC categorization shall be
revisited by the licensee or applicant (through the IDP) when the PRA
is updated or when the other criteria used by the IDP are affected by
changes in plant operational data or changes in plant design or plant
procedures. Requirements for PRA updating are contained in Sec.
50.69(e)(1).
V.5.0 Section 50.69(d) Requirements for Structures, Systems, and
Components
After SSCs are categorized as either RISC-1, RISC-2, RISC-3, or
RISC-4, then the Sec. 50.69(d) requirements, which provide the
treatment requirements applicable to each RISC category, are applied.
Until a structure or system is categorized using this process, the
existing requirements on SSCs in that structure or system are retained.
Section 50.69(d) contains two sub-items. The first contains the
requirements being imposed on RISC-1 and RISC-2 SSCs. The second
section contains the ``high-level'' requirements that are being added
for RISC-3 SSCs to provide necessary confidence that design basis
capability will be retained for these SSCs. The list of existing
special treatment requirements that are being removed through this
rulemaking for RISC-3 and RISC-4 SSCs is contained in Sec.
50.69(b)(1).
V.5.1 Section 50.69(d)(1) RISC-1 and RISC-2 Treatment
Section 50.69 (d)(1) requires that a licensee or applicant ensure
that RISC-1 and RISC-2 SSCs perform their functions consistent with
categorization process assumptions by evaluating treatment being
applied to these SSCs to ensure that it supports the key assumptions in
the categorization process that relate to their assumed performance. To
meet this, a licensee should first evaluate the treatment being applied
in light of the credit being taken in the categorization process, with
appropriate adjustment of treatment or categorization to achieve
consistency as necessary. For SSCs categorized as RISC-1 or RISC-2, all
existing applicable requirements continue to apply. This includes any
applicable special treatment requirements. The rule language notes that
this evaluation is to focus upon those key assumptions in the PRA that
relate to performance of particular SSCs. For example, if a relief
valve was being credited with capability to relieve water (as opposed
to its design condition of steam), such an evaluation would look at
whether the component has been designed or otherwise determined to be
able to perform as assumed. Other examples might be for the failure
rates used in the PRA model. As a general matter, for those SSCs
modeled in the PRA, conformance with industry standards on PRAs would
also result in such evaluation steps being accomplished in order to
help assure the PRA represents the facility.
If a Sec. 50.69 licensee chooses to categorize a selective set of
SSCs as RISC-3, and the categorization of SSCs as RISC-3 is based on
credit taken for the performance of other plant SSCs (that would be
RISC-1 or RISC-2, whether or not these SSCs are within the selective
implementation set), then the licensee must ensure that consistency of
performance with what was credited in the categorization. As discussed
in Section V.4.5, selective implementation of components within a
system is not permitted. This applies to credit taken in: 1) PRA
models, inputs and assumptions; 2) screening and margin analyses; and
3) IDP deliberations. This implies that the licensee must ensure that
the credited (RISC-2) SSCs perform their functions per Sec.
50.69(d)(1), and the performance of these SSCs must be monitored per
Sec. 50.69(e)(2).
V.5.2 Section 50.69(d)(2) RISC-3 Treatment
Section 50.69(d)(2) contains, as an overall requirement for the
treatment of RISC-3 SSCs, that licensees shall have processes to
control the design; procurement; inspection, maintenance, testing, and
surveillance; and corrective action, for RISC-3 SSCs to provide
reasonable confidence in the capability of RISC-3 SSCs to perform their
safety-related functions under design basis conditions throughout their
service life. In other words, the Commission expects licensees to have
sufficient treatment controls in place to have reasonable confidence
that RISC-3 SSCs will be capable of performing their safety functions
if they were called upon to perform those functions. Licensees may
decide to apply current practices at their facilities or may establish
new practices for the treatment of RISC-3 SSCs, provided the
requirements of Sec. 50.69 are satisfied.
During its review of the South Texas exemption request, the NRC
staff identified several instances where the licensee's interpretation
of the extent to which treatment could be relaxed for low-risk safety-
related SSCs was not consistent with the staff's expectations under
Option 2 of the NRC's risk-informed rulemaking initiative (i.e., that
[[Page 26541]]
design basis functions be maintained). To ensure more consistent
implementation of Sec. 50.69, the SOC discusses some of these areas
for the implementation of proposed Sec. 50.69 about how the treatment
processes for low-risk safety-related SSCs should be conducted. The
Commission is also giving examples of what it considers good practice
to achieve confidence of functionality. The Commission does not believe
that it is necessary to include these ``expectations'' as specific
requirements because there may be other means of achieving the
specified outcome and failure to implement a particular expectation
would not, by itself, be a regulatory concern. The Commission's intent
is to place on the licensee the responsibility to determine the
necessary treatment to maintain functionality without the Commission
having to establish prescriptive requirements.
The categorization process assumes that the functionality of SSCs
in performing their safety functions will be retained, although the
treatment applied to RISC-3 SSCs may be reduced under proposed Sec.
50.69. Further, the categorization process may include specific
reliability assumptions for plant SSCs in performing their intended
functions. Therefore, when establishing the performance-based treatment
process for RISC-3 SSCs, the licensee should take these assumptions
into account to support the evaluations of small increase in risk
resulting from implementation of the changes in treatment. It is
important to obtain sufficient information on SSC performance to allow
the results of the categorization process to remain valid. The
Commission considers the risk-informed, performance-based ASME Code
Cases (as endorsed in Sec. 50.55a) to be one acceptable method of
establishing treatment processes that are consistent with the
categorization process.
Proposed Sec. 50.69 identifies four processes that must be
controlled and accomplished for RISC-3 SSCs: Design Control;
Procurement; Maintenance, Inspection, Testing, and Surveillance; and
Corrective Action. The high level RISC-3 requirements are structured to
address the various key elements of SSC functionality by focusing in
several areas. When SSCs are replaced, RISC-3 SSCs must remain capable
of performing design basis functions; hence, the high level
requirements focus on maintaining this capability through design
control and procurement requirements. During the operating life of a
RISC-3 SSC, a sufficient level of confidence is necessary that the SSC
continues to be able to perform its design basis functions; hence, the
inclusion of high level requirements for maintenance, inspection, test,
and surveillance. Finally, when data is collected, it must be fed back
into the categorization and treatment processes, and when important
deficiencies are found, they must be corrected; hence, requirements are
also provided in these areas.
The Commission notes that use of voluntary consensus standards is
an effective means of establishing treatment requirements to achieve
functionality. As an example, ASME risk-informed Code Cases have been
developed with the purpose of determining appropriate treatment
requirements for low safety-significant SSCs in their specific
functional areas. Further, the Commission expects that related
standards (such as ASME Code Cases N-658 and N-660 on SSC
categorization and treatment for purposes of repair and replacement) be
used in conjunction with each other as intended by the accredited
standards writing body. Where suitable standards do not exist or
available standards are not sufficient, the Commission expects the
licensee to establish sufficient controls to provide reasonable
confidence in the functionality of RISC-3 SSCs, based upon such factors
as operating experience and vendor recommendations. However, the
Commission also notes that use of a voluntary consensus standard in and
of itself might not be sufficient to maintain functionality for
particular SSCs under certain service conditions, and that the licensee
might need to supplement its processes to achieve the desired results.
The proposed rule would require the treatment processes for RISC-3
SSCs be implemented to provide reasonable confidence in the capability
of RISC-3 SSCs to perform their safety-related functions under design
basis conditions. That is to say, the pertinent requirements identified
in Sec. 50.69 for each process must be satisfied for RISC-3 SSCs
unless the requirements are clearly not applicable or are not necessary
in the particular circumstance to achieve functionality of the SSC. As
an example, a licensee might determine that it is more efficient and
effective to replace a particular component before the end of its
design life rather than conducting maintenance to repair the component.
Further, a licensee might determine that some maintenance activities
are within the skill of the craft (such as replacing missing bolts on
motor-operated valve switch compartments), such that detailed work
orders would not be necessary. On the other hand, an activity to
procure a replacement component with active functions that is not the
same as the one being replaced would necessitate use of most of the
specified processes, with a greater need for documentation and
independent review to achieve the expected result.
As part of the high level requirement that RISC-3 SSCs be capable
of performing their safety-related functions under design basis
conditions, the Commission emphasizes that implementation of the
processes must provide reasonable confidence of the future capability
of the SSC (i.e., not just confidence that the SSC works at a certain
point in time but rather provides confidence that the component will
work when called upon). The level of confidence can be less than was
provided by the special treatment requirements listed in Sec.
50.69(b)(1). As an example, exercising of a valve or simply starting a
pump does not provide reasonable confidence in design basis capability,
will not detect service-induced aging or degradation that could prevent
the component from performing its design basis functions in the future,
and is insufficient by itself to satisfy the intent of the rule.
A licensee implementing Sec. 50.69 is responsible for implementing
the treatment requirements for RISC-3 SSCs in an effective manner to
maintain the capability to perform the safety functions under design
basis conditions. A licensee should address the potential impact on the
functionality of RISC-3 SSCs as a result of the changes to testing
programs, such that the categorization process assumptions and results
remain valid. To provide a basis to conclude that the potential
increase in risk would be small, a licensee is required to conduct
evaluations that assume failure rates that might occur as a result of
the revisions to treatment. These evaluations would need to consider,
for instance, any planned alteration in a licensee's program for
diagnostic testing of motor-operated valves. If a likely result of a
contemplated change in treatment is an increase in failure rate,
outside the bounds of the evaluations, that change in treatment would
not be acceptable under proposed Sec. 50.69 because the criterion in
Sec. 50.69(c)(i)(iv) about providing reasonable confidence of a small
increase in risk would not be met.
V.5.2.1 Section 50.69(d)(2)(i) Design Control Process
Section 50.69(d)(2)(i) specifies that the functional requirements
and bases for RISC-3 SSCs be maintained and controlled. The functional
requirements
[[Page 26542]]
and bases continue to apply unless they are specifically changed in
accordance with the appropriate regulatory change control process
(e.g., Sec. 50.59). The rule further states that RISC-3 SSCs must be
capable of performing their safety-related functions under design basis
conditions including (any applicable) design requirements for
environmental conditions (temperature, pressure, humidity, chemical
effects, radiation, and submergence), effects (aging and synergisms ),
and seismic conditions (design load combinations of normal and accident
conditions with earthquake motions).
It is recognized that the level of confidence in the design basis
capability of RISC-3 SSCs may be less than the confidence provided in
the capability of RISC-1 SSCs to perform their safety functions. The
proposed treatment requirements for the control of the design of RISC-3
SSCs are included, in part, to provide a basis for the assumption in
the categorization process that these SSCs will continue to be capable
of performing their safety-related functions under design basis
conditions throughout their service life. The implementation of an
effective design control process is crucial to the maintenance of the
functionality of safety-related SSCs because many SSCs cannot be
monitored or tested to demonstrate design basis capability or to
identify potential degradation as part of normal plant operations. For
instance, if the SSC were modified or replaced, the design control
processes are important means by which the required capability is
installed and maintained over the life of the component. Further,
because it is not possible to test or monitor some SSCs under the
conditions that they might experience in service, other means, such as
control of design and procurement of SSCs, and condition monitoring,
are used such that the SSCs are capable of performing their functions.
The proposed rule would require that licensees have a design control
process that maintains and applies design requirements to ensure that
RISC-3 SSCs will be capable of performing their safety-related
functions under design basis conditions. To meet this performance
objective, the licensee's design control process would be expected to
specify appropriate quality standards; select suitable materials,
parts, and equipment; control design interfaces; coordinate
participation of design organizations; verify design adequacy; and
control design changes. The manner in which the design control
requirements for RISC-3 SSCs are accomplished would be the
responsibility of the licensees adopting Sec. 50.69. The proposed rule
would allow flexibility for licensees to focus their resources on the
SSCs that are most safety-significant while implementing an effective
design control process for RISC-3 SSCs. For example, licensees might
provide design control for RISC-3 SSCs through application of (1) the
process established under Criterion III of 10 CFR Part 50, Appendix B;
(2) an augmented quality assurance program such as might have been
established in response to regulatory guidance issued in conjunction
with Sec. 50.62 (for SSCs used to comply with anticipated transients
without a plant scram; or (3) a plant-specific process currently in
place or established to satisfy the treatment requirements of Sec.
50.69.
The design control process under Sec. 50.69 is intended to provide
assurance that the proposed rule is satisfying the principle that the
design requirements of RISC-3 SSCs would not be changed under Sec.
50.69. For example, the design provisions of Section III of the ASME
Boiler and Pressure Vessel Code (BPV Code) required by Sec. 50.55a(c),
(d), and (e) for RISC-3 SSCs are not affected by the proposed rule.
Another example is a requirement for fracture toughness of particular
materials that is part of a licensee's design requirements; such a
requirement would continue to apply when repair or replacement of
affected components is undertaken. Licensees would continue to be
required by Sec. 50.59 to evaluate proposed modifications to design
requirements for safety-related SSCs, including those categorized as
RISC-3.
For RISC-3 SSCs, the proposed rule would remove the requirements
for a program for environmental qualification of electric equipment
specified in Sec. 50.49, ``Environmental Qualification of Electric
Equipment Important to Safety for Nuclear Power Plants.'' However, the
proposed rule would not eliminate the requirements in 10 CFR part 50,
Appendix A, ``General Design Criteria for Nuclear Power Plants,'' that
electric equipment important to safety be capable of performing their
intended functions under the applicable environmental conditions. For
example, Criterion 4 of 10 CFR part 50, Appendix A, ``General Design
Criteria for Nuclear Power Plants,'' requires that SSCs important to
safety be designed to accommodate the effects of and to be compatible
with the environmental conditions associated with normal operation,
maintenance, testing, and postulated accidents. In accordance with
Sec. 50.69(d)(2), the licensee is required to design, procure,
install, maintain, and monitor electric equipment important to safety
such that they are capable of performing their intended functions under
the environmental conditions listed in Sec. 50.69(d)(2)(i) throughout
their service life. Further, if RISC-3 electrical equipment is relied
on to perform its safety-related function beyond its design life,
licensees should have a basis justifying the continued capability of
the equipment under adverse environmental conditions.
RISC-3 and RISC-4 SSCs would continue to be required to function
under design basis seismic conditions, but would not be required to be
qualified by testing or specific engineering methods in accordance with
the requirements stated in 10 CFR part 100, Appendix A. A licensee who
adopts the proposed rule would no longer be required to meet certain
requirements in Appendix A to part 100, Sections VI(a)(1) and VI(a)(2),
to the extent that those requirements have been interpreted as
mandating qualification testing and specific engineering methods to
demonstrate that RISC-3 SSCs are designed to withstand the Safe
Shutdown Earthquake and Operating Basis Earthquake. The proposed rule
does not remove the design requirements related to the capability of
RISC-3 SSCs to remain functional considering Safe Shutdown Earthquake
and Operating Basis Earthquake seismic loads, including applicable
concurrent loads. These continue to be part of the design basis
requirements or procurement requirement for replacement SSCs. The
proposed rule would not change the design input earthquake loads
(magnitude of the loads and number of events) or the required load
combinations used in the design of RISC-3 SSCs. For example, for the
replacement of an existing safety-related SSC that is subsequently
categorized as RISC-3, the same seismic design loads and load
combinations would still apply. The proposed rule would permit
licensees to select a technically defensible method to show that RISC-3
SSCs will remain functional when subject to design earthquake loads.
The level of confidence for the design basis capability of RISC-3 SSCs,
including seismic capability, may be less than the confidence in the
design basis capability of RISC-1 SSCs. The use of earthquake
experience data has been mentioned as a potential method to demonstrate
SSCs will remain functional during earthquakes. However, it would be
difficult to rely on earthquake experience alone to demonstrate
[[Page 26543]]
functionality of SSCs if the design basis includes multiple earthquake
events or combinations of loadings unless these specific conditions
were enveloped by the experience data. Additionally, if the SSC is
required to function during or after the earthquake, the experience
data would need to contain explicit information that the SSC actually
functioned during or after the design basis earthquake events as
required by the SSC design basis. The successful performance of an SSC
after the earthquake event does not demonstrate it would have
functioned during the event. Qualification testing of an SSC would be
necessary if no suitable alternative method is available for showing
that the SSC will perform its design basis function during an
earthquake.
Licensees are responsible for proper installation and post-
installation testing of RISC-3 SSCs as part of design control and other
treatment processes to provide reasonable confidence in the capability
of SSCs to perform their functions. The Commission also expects
licensees to control special processes associated with installation,
such as welding, to provide reasonable confidence in the design basis
capability of RISC-3 SSCs. Licensees would be expected to perform
sufficient post-installation testing to verify that the installed SSC
is operating within expected parameters and is capable of performing
its safety functions under design basis conditions. In performing post-
installation testing, licensees may apply engineering analyses to
extrapolate the test data to demonstrate design basis capability.
V.5.2.2 Section 50.69(d)(2)(ii) Procurement Process
Section 50.69(d)(2)(ii) specifies that procured RISC-3 SSCs satisfy
their design requirements. In order to obtain components that meet the
requirements, the licensee would be expected to specify the technical
requirements (including applicable design basis environmental and
seismic conditions) for items to be procured. Further, the Commission
expects licensees to use established methods (e.g., vendor
documentation, equivalency evaluation, technical evaluation, technical
analysis, or testing) to develop a technical basis for the
determination that the procured item can perform its safety-related
function under design basis conditions, including applicable design
basis environmental conditions (temperature, pressure, humidity,
chemical effects, radiation, and submergence), and effects (aging and
synergisms), and seismic conditions (design load combinations of normal
and accident conditions with earthquake motions). In addition to
appropriately specifying in the procurement the desired component, the
licensee/applicant would also be expected to conduct activities upon
receipt to confirm that the received component is what was ordered.
The proposed rule would allow more flexibility in the
implementation of the procurement process for RISC-3 SSCs than
currently provided by 10 CFR part 50, Appendix B. Nevertheless,
licensees will continue to be responsible for implementing an effective
procurement process for RISC-3 SSCs. Differences constituting a design
change are expected to be documented and addressed under the licensee's
design control process. As an example of one acceptable procurement
process, a licensee might use an approach similar to that described
below:
Vendor Documentation--Vendor documentation could be used when the
performance characteristics for the SSC, as specified in vendor
documentation (e.g., catalog information, certificate of conformance),
satisfy the SSC's design requirements. If the vendor documentation does
not contain this level of detail, the design requirements could be
provided in the procurement specifications. The vendor's acceptance of
the stated design specifications provides sufficient confidence that
the RISC-3 SSC would be capable of performing its safety-related
functions under design basis conditions. Equivalency Evaluation--An
equivalency evaluation could be used when it is sufficient to determine
that the procured SSC is equivalent to the SSC being replaced (e.g., a
like-for-like replacement).
Engineering Evaluation--For minor differences, a technical
evaluation could be performed to compare the differences between the
procured SSC and the design requirements of the SSC being replaced and
determines that differences in areas such as material, size, shape,
stressors, aging mechanisms, and functional capabilities would not
adversely affect the ability to perform the safety-related functions of
the SSC under design basis conditions.
Engineering Analysis--In cases involving substantial differences
between the procured SSC and the design requirements of the SSC being
replaced, a technical analysis could be conducted to determine that the
procured SSC can perform its safety-related function under design basis
conditions. The technical analysis would be based on one or more
engineering methods that include, as necessary, calculations, analyses
and evaluations by multiple disciplines, test data, or operating
experience to support functionality of the SSC over its expected life.
Testing--Testing under simulated design basis conditions could be
performed on the SSC.
V.5.2.3 Section 50.69(d)(2)(iii) Maintenance, Inspection, Test, and
Surveillance Process
Section 50.69(d)(2)(iii) specifies that periodic maintenance,
inspections, tests, and surveillance activities be established and
conducted, and their results evaluated using prescribed acceptance
criteria to determine that the RISC-3 SSCs will remain capable of
performing their safety-related functions under design basis conditions
until their next scheduled activity.
To meet this requirement, licensees are expected to establish the
scope, frequency, and detail of predictive, preventive, and corrective
maintenance activities (including post-maintenance testing) to support
the determination that RISC-3 SSCs will remain capable of performing
their safety-related functions under design basis conditions throughout
their service life. For a RISC-3 SSC in service beyond its design life,
the Commission expects licensees to have a basis to determine that the
SSC will remain capable of performing its safety-related function.
Following maintenance activities that affect the capability of an SSC
to perform its safety-related function, licensees would be expected to
perform post-maintenance testing to verify that the SSC is performing
within expected parameters and is capable of performing its safety
function under design basis conditions. Licensees may apply engineering
analyses to extrapolate the test data to demonstrate design basis
capability as part of post-maintenance testing. The Commission expects
licensees to identify the preventive maintenance needed to preserve the
capability of RISC-3 SSCs to perform their safety-related functions
under applicable design basis environmental and seismic conditions for
their expected service life.
To have reasonable confidence that SSCs can perform their
functions, licensees must implement effective processes for inspection,
testing, and surveillance of RISC-3 SSCs; they may apply their own
individual approaches such that the requirements of Sec. 50.69 are
satisfied. As an example, the provisions for risk-informed inspection
and testing in applicable ASME Code Cases would constitute one
effective approach in satisfying the Sec. 50.69 requirements. To
prevent the occurrence of common-
[[Page 26544]]
cause problems that might invalidate the categorization process
assumptions and results, effective implementation would include a
determination of the functionality of safety-related SSCs checked using
measuring and test equipment that was later found to be in error or
defective.
With respect to RISC-3 pumps and valves, the Commission expects
licensees to implement periodic testing or inspection, and evaluation
of performance data, sufficient to provide reasonable confidence that
these pumps and valves will be capable of performing their safety
function under design basis conditions. To determine that SSC will
remain capable until the next scheduled activity, a licensee would have
to obtain sufficient operational information or performance data to
provide reasonable confidence that the RISC-3 pumps and valves will be
capable of performing their safety function if called upon to function
under operational or design basis conditions over the interval between
periodic testing or inspections. A licensee may develop the type and
frequency of the test or inspection for RISC-3 pumps and valves where
sufficient to conclude that the pump or valve will perform its safety
function. These tests or inspections may be less rigorous and less
frequent than those performed on RISC-1 pumps and valves. For example,
a licensee might establish more relaxed criteria for grouping of
similar RISC-3 components, or might apply less stringent test
acceptance criteria for RISC-3 pumps and valves, than specified for
RISC-1 components. The licensee could apply staggered test intervals
for the RISC-3 components to provide confidence that the relaxed
grouping or acceptance criteria had not resulted in SSC performance
that is inconsistent with the categorization process or its
assumptions. Licensees should note that performance data obtained for
pumps and valves operating under normal conditions may not be capable
of predicting their capability to perform safety functions under design
basis conditions without additional evaluation or analysis. This does
not mean that pumps and valves must be tested or inspected under design
basis conditions. Methods exist for collecting performance data at
conditions different than design basis conditions that can be used to
reach conclusions regarding the design basis capability of components.
Examples of such methods are described in Regulatory Guide 1.175, An
Approach for Plant-Specific, Risk-Informed Decision making: Inservice
Testing, and applicable risk-informed ASME Code Cases (e.g., OMN-1,
OMN-4, OMN-7, OMN-12) as accepted by 10 CFR 50.55a.
V.5.2.4 Section 50.69(d)(2)(iv) Corrective Action Process
Section 50.69(d)(2)(iv) would specify that conditions that could
prevent a RISC-3 SSC from performing its safety-related functions under
design basis conditions be identified, documented, and corrected in a
timely manner. A licensee may obtain information from the inspection,
test and surveillance activities discussed above, or from other
sources, such as operating experience, that indicates that an SSC is
not capable of performing its required functions and thus identifies
that corrective action is needed.
In meeting proposed Sec. 50.69, licensees may implement a
corrective action process for RISC-3 SSCs that is different than the
process established to satisfy 10 CFR Part 50, Appendix B. This more
general requirement would allow a graded approach, as well as less
stringent timeliness requirements. The Commission believes an effective
corrective action process is crucial to maintaining the capability of
RISC-3 SSCs to perform their safety-related functions because of the
reduction in requirements for other processes for design control;
procurement; and maintenance, inspection, test, and surveillance. For
example, effective implementation of the corrective action process
would include timely response to information from plant SSCs, overall
plant operations, and industry generic activities that might reveal
performance concerns for RISC-3 SSCs on both an individual and common-
cause basis.
V.6.0 Section 50.69(e) Feedback and Process Adjustment
Section 50.69(e)(1) requires the updating of the PRA. The PRA
configuration control program must incorporate a feedback process to
update the PRA model. The program must require that plant data, design,
and procedure changes that affect the PRA models or input parameters be
incorporated into the model. This update is to account for plant-
specific operating experience as well as general industry experience.
In particular, the proposed rule would require the licensee to review
changes to the plant, operational practices, applicable industry
operational experience, and, as appropriate, update the PRA and SSC
categorization in a timely manner but no longer than every 36 months
for RISC-1, RISC-2, RISC-3 and RISC-4 SSCs. Changes must be evaluated
with respect to the impact on CDF and LERF. If the change would result
in a significant increase in the CDF or LERF or might change the
categorization of SSCs, the PRA must be updated in a timely manner; in
this context it would clearly not be timely to wait to update the PRA
if there would be a significant change in risk. Other changes are to be
incorporated within 36 months. The results of the updated PRA and the
associated risk categorizations based on the updated PRA information
should be used as part of the feedback and corrective action process,
and SSCs must be re-categorized as needed.
Section 50.69(e)(2) and (e)(3) contains the requirements for
feeding back into the categorization process SSC performance
information and data, and for adjusting the categorization and
treatment processes as appropriate, with the goal that the validity of
the categorization process and its results are maintained. Further, the
proposed rule would require the licensee to monitor the performance of
RISC-1 and RISC-2 SSCs and make adjustments as necessary to either the
categorization or treatment processes. To meet this requirement, the
Commission expects licensees to monitor all functional failures (i.e.,
not just maintenance preventable unavailabilities and failures as is
currently required by Sec. 50.65) so that they can determine when
adjustments are needed. Licensee monitoring programs will also need to
include the monitoring of SSCs that support beyond design basis
functions (if applicable) that are not necessarily included in the
scope of an existing maintenance rule monitoring program.
If a licensee chooses to categorize a selective set of SSCs as
RISC-3, and the categorization of SSCs as RISC-3 is based on credit
taken for the performance of other plant SSCs (whether or not these
SSCs are within the selective implementation set), then the licensee
must maintain the credited performance. This applies to credit taken
in: (1) PRA models, inputs and assumptions; (2) screening and margin
analyses; and (3) IDP deliberations. This implies that the licensee
must ensure that the credited SSCs perform their functions per Sec.
50.69(d)(1), and the performance of these SSCs must be monitored per
Sec. 50.69(e)(2).
For RISC-3 SSCs, the proposed rule would require the licensee to
consider the performance data required by Sec. 50.69(d)(2)(iii) to
determine whether there are any adverse changes in performance such
that the SSC unreliability values approach or exceed the values used in
the evaluations conducted to meet Sec. 50.69(c)(iv) and make
adjustments as necessary to either
[[Page 26545]]
the categorization or treatment processes, to maintain categorization
process results valid. Section 50.69(d)2)(iii) requires periodic
maintenance, testing and surveillance activities for RISC-3 SSCs. Based
upon review of this information, if SSC reliability degrades to the
point that the evaluations done to show that the potential risk was
small are no longer bounding, action is necessary to either adjust the
treatment (to improve reliability) or to perform the categorization
process again (to determine if any changes in categorization of SSC are
necessary).
V.7.0 Section 50.69(f) Program Documentation and Change Control and
Records
Section 50.69(f) contains administrative requirements for keeping
information current, for handling planned changes to programs and
processes and for records. Each subparagraph is discussed below.
Section 50.69(f)(1) states that the licensee or applicant shall
document the basis for categorization of SSCs in accordance with this
section before removing any requirements. The documentation is expected
to address why a component was determined to be either safety-
significant or low safety-significant based upon the requirements in
Sec. 50.69(c).
The Commission is not, except in limited instances, specifying
particular records to retain. Since the licensee is responsible for
compliance with the requirements, subject to NRC oversight and
inspection, the licensee (or applicant) would need to be able to show
that they have established the processes required by the rules and
conducted activities sufficient to provide reasonable confidence in
functionality of SSCs under design basis conditions.
Section 50.69(f)(2) specifies that the licensee must update its
FSAR to reflect which systems have been categorized using the
provisions of Sec. 50.69, and thus, may have revised treatment applied
to the structures and components within that system. This provision is
included to maintain clear information, at a minimum level of detail,
about which requirements a licensee is satisfying; detailed information
about particular SSCs is not required to be submitted. For an
applicant, this updating would be expected to be either part of the
original application or as a supplement to the FSAR under Sec. 50.34.
For licensees, the updating must be in accordance with the provisions
of Sec. 50.71(e) for licensees.
Once the NRC has completed its review of a licensee's Sec. 50.69
submittal as it relates to categorization, the licensee or applicant
would be able to adjust its treatment processes provided that the rule
requirements are met. NRC does not plan to perform a pre-implementation
review of the revised treatment requirements under Sec. 50.69(d).
However, the Commission recognizes that existing information in the
quality assurance (QA) plan or in the FSAR may need to be revised to
reflect the changes to treatment that would be made as a result of
implementation of Sec. 50.69. Any revisions to these documents are to
be submitted in accordance with the existing requirements of Sec.
50.54(a)(2) and Sec. 50.71(e) respectively. For instance, Sec.
50.71(e) states that the FSAR is to contain the latest information
developed and is to reflect information submitted to the Commission
since the last update. The regulations further state in the cited
sections how a licensee is to submit to the NRC revisions to the QA
plan or to the FSAR. Information in these documents that would no
longer be accurate upon implementation of Sec. 50.69 must be updated.
Details of the processes would be expected to be contained in plant
procedures, procurement documents, surveillance records, etc.
Section 50.69(f)(3) specifies that for initial implementation of
the rule, changes to the FSAR for implementation of this proposed rule
need not include a supporting Sec. 50.59 evaluation of changes
directly related to implementation. Future changes to the treatment
processes and procedures for Sec. 50.69 implementation may be made,
provided the requirements of the rule and Sec. 50.59 continue to be
met. While the licensee is to update its programs to reflect
implementation of Sec. 50.69, the Commission concluded that no
additional review under Sec. 50.59 is necessary for such changes, to
these parts of the FSAR that might occur.
Section 50.69(f)(4) specifies that for initial implementation of
the rule, changes to the quality assurance plan for implementation of
this proposed rule need not include a supporting Sec. 50.54(a) review
of changes directly related to implementation. Future changes to the
treatment processes and procedures for Sec. 50.69 implementation may
also be made, provided the requirements of the rule and Sec. 50.54(a)
continue to be met. While the licensee is to update its programs to
reflect implementation of Sec. 50.69, the Commission concluded that no
additional review under Sec. 50.54(a) is necessary for changes to
these parts of the QA plan.
No specific change control process is being established for the
categorization process outlined by Sec. 50.69(c). Because the NRC is
reviewing and approving a submittal containing the licensee or
applicant's commitments for categorization, changes that would
invalidate their submittal would also invalidate the approval. However,
provided any revised process continues to conform with what was
submitted or committed to (such as through a commitment to follow a
particular RG), NRC review would not be needed of lower-tier changes
(such as to implementing procedures) that might arise.
No explicit requirements are included in Sec. 50.69 for the period
for retention of records. The proposed rule would specify only a few
specific types of records that must be prepared, e.g., those for the
basis for categorization in Sec. 50.69(f)(1). In accordance with Sec.
50.71(c), these records are to be maintained until the Commission
terminates the facility license.
V.8.0 Section 50.69(g) Reporting
Section 50.69(g) provides a new reporting requirement applicable to
events or conditions that would have prevented a RISC-1 or RISC-2 SSCs
from performing a safety-significant function. Most events involving
these SSCs will meet existing Sec. 50.72 and Sec. 50.73 reporting
criteria. However, it is possible for events and conditions to arise
that impact whether RISC-1 or RISC-2 SSCs would perform beyond design
basis functions consistent with the assumptions made in the
categorization process. This reporting requirement is intended to
capture these situations. The reporting requirement is contained in
Sec. 50.69, rather than as a revision of Sec. 50.73 so that its
applicability only to those facilities that have implemented Sec.
50.69 is clear. The existing reporting requirements in Sec. 50.72 and
Sec. 50.73 would no longer apply to RISC-3 (and RISC-4) SSCs under the
proposed rule.
VI. Other Topics for Public Comment
VI.1.0 Additional Potential Requirements for Public Comment
The cornerstone of proposed Sec. 50.69 is a robust, risk-informed
categorization process that provides high confidence that the safety
significance of SSCs is correctly determined considering all relevant
information. The categorization requirements incorporated into the
proposed rule achieve this objective. The Commission proposes to remove
[[Page 26546]]
the RISC-3 and RISC-4 SSCs from the scope of special treatment
requirements delineated in Sec. 50.69(b)(1), and instead require the
licensee to comply with more general, high level requirements for
maintaining functionality. The proposed rule would allow appropriate
flexibility for implementation while continuing to provide reasonable
confidence that the SSCs will remain functional. As discussed elsewhere
in this notice, the Commission concludes that the requirements in
proposed Sec. 50.69 would maintain adequate protection of public
health and safety. Previous drafts of this proposed rule posted to the
NRC web site, contained more detailed requirements in Sec. 50.69(d)(2)
for RISC-3 SSCs. The Commission believes that this level of detail is
beyond what is necessary to provide reasonable confidence in RISC-3
design basis capability in light of the robust categorization
requirements incorporated into proposed Sec. 50.69. However, the
Commission recognizes that some stakeholders may disagree and invites
public comment on this matter. To facilitate public comment, example
language is provided below that identifies (in quotations and brackets)
those requirements that were considered for inclusion in Sec. 50.69
(as well as where they would have appeared in the rule).
(2) RISC-3 SSCs. The licensee or applicant shall develop and
implement processes to control the design; procurement; inspection,
maintenance, testing, and surveillance; and corrective action for RISC-
3 SSCs to provide reasonable confidence in the capability of RISC-3
SSCs to perform their safety-related functions under design basis
conditions throughout their service life. [``These processes must meet
voluntary consensus standards which are generally accepted in
industrial practice, and address applicable vendor recommendations and
operational experience. The implementation of these processes and the
assessment of their effectiveness must be controlled and accomplished
through documented procedures and guidelines. The treatment processes
must be consistent with the assumptions credited in the categorization
process.''] The processes must meet the following requirements, as
applicable: (i)Design Control. Design functional requirements and bases
for RISC-3 SSCs must be maintained and controlled, [``including
selection of suitable materials, methods, and standards; verification
of design adequacy; control of installation and post-installation
testing; and control of design changes'']. RISC-3 SSCs must be [``have
a documented basis to demonstrate that they are''] capable of
performing their safety-related functions including design requirements
for environmental conditions (i.e., temperature and pressure, humidity,
chemical effects, radiation, and submergence) and effects (i.e., aging
and synergism); and seismic conditions (design load combinations of
normal and accident conditions with earthquake motions).
[``Replacements for ASME Class 2 and Class 3 SSCs or parts must meet
either: (1) The requirements of the ASME Boiler & Pressure Vessel (BPV)
Code; or (2) the technical and administrative requirements, in their
entirety, of a voluntary consensus standard that is generally accepted
in industrial practice applicable to replacement. ASME Class 2 and
Class 3 SSCs and parts shall meet the fracture toughness requirements
of the SSC or part being replaced.'']
(ii) Procurement. Procured RISC-3 SSCs must satisfy their design
requirements. [``Upon receipt, the licensee shall verify that the item
received is the item that was ordered.'']
(iii) Maintenance, Inspection, Testing, and Surveillance. Periodic
maintenance, inspection, testing, and surveillance activities must be
established and conducted using prescribed acceptance criteria, and
their results evaluated to determine that RISC-3 SSCs will remain
capable of performing their safety-related functions under design basis
conditions until the next scheduled activity.
(iv) Corrective Action. Conditions that could prevent a RISC-3 SSC
from performing its safety-related functions under design basis
conditions must be identified, documented, and corrected in a timely
manner. [``In the case of significant conditions adverse to quality,
measures shall assure that the cause of the condition is determined and
corrective action taken to preclude repetition.''] The Commission is
requesting comment as to whether any of these requirements (or other
requirements) are necessary to provide reasonable confidence of SSC
functionality commensurate with the safety significance of the RISC-3
SSC, i.e., whether the requirements on categorization are sufficiently
robust that the level of detail contained in the proposed rule on
treatment is appropriate.
VI.2.0 Questions for Public Input
In addition to seeking comment on the proposed rule and its
supporting documents, the Commission is also specifically seeking
public comment on the following questions. Comments should be submitted
as noted in the ADDRESSES section of this notice.
VI.2.1 PRA Requirements
The proposed rule requires as a minimum, a PRA that includes
internal events, at power, which has been subjected to a peer review
process. The PRA (for that scope) must be capable of determining both
CDF and LERF (i.e., provide level 2-type results). Proposed Sec. 50.69
allows licensees to use non-PRA methods to address other modes and
hazards in the categorization process (see in particular NEI 00-04 and
DG-1121). The proposed rule requires the licensee to submit information
about its PRA and these other methods, including information about the
quality and level of detail about all of the methods to be used.
The Commission is seeking comment as to whether the NRC should
amend the requirements in Sec. 50.69(c) to require a level 2 internal
and external initiating events, all-mode, peer-reviewed PRA that must
be submitted to, and reviewed by, the NRC. Thus, instead of employing
other methods to account for the contribution from modes and events not
modeled in the PRA, this more comprehensive PRA would allow for
quantification of the contribution from these scenarios. This approach
would involve substantive changes in the implementing guidance as well.
The Commission is interested in both the benefits of this approach as
well as any implications for this specific application of risk
insights. The Commission is also seeking comment on whether a different
set of PRA requirements, from either of the alternatives described
above, should be required for this application.
VI.2.2 Review and Approval of Treatment for RISC-3 SSCs
In the proposed rule, the Commission is proposing to review and
approve the categorization process to be used by the licensee. For
treatment requirements, the proposed rule sets forth high-level
requirements, and does not require NRC review and approval of specific
processes a licensee would implement to meet these requirements.
Another way to structure the rule would be to require NRC review and
approval of the licensee's proposed treatment program for RISC-3 SSCs.
The Commission is interested in any benefits of this approach as well
as any implications for this rulemaking and its associated guidance.
VI.2.3 Inspection and Enforcement
As discussed above, the Commission recognizes that the final rule
may have implications with respect to NRC's
[[Page 26547]]
reactor oversight process including the inspection program, and
enforcement. In its final decision on this rulemaking, the Commission
proposes to document its conclusions as to whether or not new or
revised inspection or enforcement guidance is necessary. Public comment
is requested on whether or not changes are needed in our inspection and
enforcement programs to enable NRC to exercise the appropriate degree
of regulatory oversight of these aspects of the facility operation.
VI.2.4 Operating Experience
One of the areas of uncertainty associated with this rulemaking has
been the potential effects of changes in treatment on SSC reliability
and common-cause failure potential. This is reflected in the
requirement for evaluations (sensitivity studies) to provide reasonable
confidence that any potential increase in risk would be small, with a
basis provided for the factors to be assumed in these evaluations.
Further, the rule requires the licensee to consider performance
information to determine whether there are any adverse changes such
that SSC unreliability values approach the values used in these
evaluations, and to make necessary adjustments to the categorization
and treatment processes. As discussed in Section VII.2, below, draft RG
(DG-1121) provides some discussion about techniques that might be used
in determining the factors for these evaluations. The Commission is
interested in the role that relevant operational experience could play
in reducing the uncertainty associated with the effects of treatment on
performance and specifically seeks public comment as to what
information might be available and how it could be used to support
implementation of this rulemaking.
VII. Guidance
VII.1 Regulatory Guide and Implementation Guidance for Sec. 50.69
The Nuclear Energy Institute (NEI) submitted a proposed
implementation guide for this rulemaking in the form of NEI 00-04, ``10
CFR 50.69 SSC Categorization Guideline.'' As part of the effort to
develop the proposed rule, the NRC staff reviewed drafts of this
document and in addition, NEI 00-04 was used in the pilot program
discussed earlier. The objective of the staff's review was to determine
the acceptability of the proposed implementing guidance with the intent
that the NEI guidance could be endorsed in an NRC regulatory guide. The
version of NEI 00-04, dated June 28, 2002, forms the basis for the
draft regulatory guide.
The NRC staff's review of NEI 00-04 resulted in several areas where
the staff would find it necessary to identify exceptions to NEI
guidance or to include further guidance to supplement the document, as
it is currently written. These areas are discussed in an attachment to
the draft regulatory guide, DG-1121, ``Guidelines for Categorizing
Structures, Systems and Components in Nuclear Power Plants According to
Their Safety Significance.'' Through this document, the Commission is
also seeking public comment on the DG and the identified issues.
Comments should be submitted as discussed under the ADDRESSES section.
Availability of this document is noted in Section X.
VII.2 Review Guidance Concerning PRA Quality and Peer Review
The NRC has prepared a draft regulatory guide DG-1122, ``An
Approach for Determining the Technical Adequacy of Probabilistic Risk
Assessment Results for Risk-Informed Activities.'' This guide provides
guidance on the NRC position on voluntary consensus standards for PRA
(in particular on the ASME standard for internal events PRAs) and
industry PRA documents (e.g., NEI 00-02, ``Probabilistic Risk
Assessment Peer Review Process Guideline''). Further, this guide will
be modified to address PRA standards on fire, external events, and low
power and shutdown modes, as they become available. The NRC has also
developed a draft supporting Standard Review Plan, SRP 19.1, to provide
guidance to the staff on how to determine whether a PRA providing
results being used in a decision is technically adequate.
In a letter dated April 24, 2000, NEI requested the NRC staff
review the suitability of the peer review process described in NEI 00-
02 to address PRA quality issues for this application. NRC issued a
request for additional information on September 19, 2000, to which NEI
responded by letter dated January 18, 2001. By letter dated April 2,
2002 (ADAMS accession number ML020930632), the NRC staff sent to NEI,
draft staff review guidance that was developed as a result of its
review of NEI 00-02, for intended use for Sec. 50.69 applications.
The staff review guidance is for a focused review of the plant-
specific PRA based on a review of NEI 00-02 and NEI 00-04. In order to
reach the conclusion that the PRA results support the proposed
categorization, the review guidance is structured to lead the staff
reviewer to either look for evidence that the impact of a given peer
review issue on PRA results has been adequately addressed in the peer
review report and, when necessary, has been identified for
consideration by the IDP, or to request further information from the
licensee.
VIII. Criminal Penalties
For the purposes of Section 223 of the Atomic Energy Act, as
amended, the Commission is issuing the proposed rule to add Sec. 50.69
under one or more of sections 161b, 161i, or 161o of the AEA. Willful
violations of the rule would be subject to criminal enforcement.
Criminal penalties, as they apply to regulations in Part 50 are
discussed in Sec. 50.111.
IX. Compatibility of Agreement State Regulations
Under the ``Policy Statement on Adequacy and Compatibility of
Agreement States Programs,'' approved by the Commission on June 20,
1997, and published in the Federal Register (62 FR 46517, September 3,
1997), this rule is classified as compatibility ``NRC.'' Compatibility
is not required for Category ``NRC'' regulations. The NRC program
elements in this category are those that relate directly to areas of
regulation reserved to the NRC by the AEA or the provisions of Title 10
of the Code of Federal Regulations, and although an Agreement State may
not adopt program elements reserved to NRC, it may wish to inform its
licensees of certain requirements via a mechanism that is consistent
with the particular State's administrative procedure laws, but does not
confer regulatory authority on the State.
X. Availability of Documents
The NRC is making the documents identified below available to
interested persons through one or more of the following methods as
indicated.
Public Document Room (PDR). The NRC Public Document Room is located
at 11555 Rockville Pike, Rockville, Maryland.
Rulemaking Website (Web). The NRC's interactive rulemaking Website
is located at http://ruleforum.llnl.gov. These documents may be viewed
and downloaded electronically via this Website.
NRC's Public Electronic Reading Room (PERR). The NRC's public
electronic reading room is located at www.nrc.gov/reading-rm.html.
[[Page 26548]]
----------------------------------------------------------------------------------------------------------------
Document PDR Web PERR
----------------------------------------------------------------------------------------------------------------
Comments on the ANPR......................... X X Available.
Comments on the draft rule language.......... X X Available.
ANPR Comment Resolution...................... X X ML022630030.
Environmental Assessment..................... X X ML022630050.
Regulatory Analysis.......................... X X ML022630028.
OMB Supporting Statement..................... X X ML031000685.
Industry Implementation Guidance............. X X ML021910534.
Draft Regulatory Guide....................... X X ML022630041.
----------------------------------------------------------------------------------------------------------------
XI. Plain Language
The Presidential memorandum dated June 1, 1998, entitled ``Plain
Language in Government Writing'' directed that the Government's writing
be in plain language. This memorandum was published on June 10, 1998
(63 FR 31883). The NRC requests comments on the proposed rule
specifically with respect to the clarity and reflectiveness of the
language used. Comments should be sent to the address listed under the
ADDRESSES caption of the preamble.
XII. Voluntary Consensus Standards
The National Technology Transfer and Advancement Act of 1995,
Public Law 104-113, requires that Federal agencies use technical
standards that are developed or adopted by voluntary consensus
standards bodies unless using such a standard is inconsistent with
applicable law or is otherwise impractical. In this proposed rule, the
NRC proposes to use the following Government-unique standard (Draft NRC
Regulatory Guide DG-1121, August 2002). The Commission notes the
development of voluntary consensus standards on PRAs, such as an ASME
Standard on Probabilistic Risk Assessment for Nuclear Power Plant
Applications. DG-1121 and DG-1122 (PRA Technical Adequacy) discuss how
this standard could be used for the purpose of the internal events,
full-power PRA. In addition, the Commission acknowledges development of
risk-informed Code cases by the ASME on categorization of certain
components, particularly with respect to pressure boundary
considerations. DG-1121 explicitly notes such Code cases and that they
could be proposed by a licensee or applicant as part of the means for
satisfying the rule requirements. The government standards would allow
use of these voluntary consensus standards, but would not require their
use. The Commission does not believe that these other standards are
sufficient to provide the overall construct for the alternative
approach to categorization and treatment of SSCs that is the goal of
this rulemaking. For example, the current standards do not address all
types of components that might be recategorized. PRA requirements for
all initiating events and modes of operation, nor other parts of the
approach laid out such as determining the basis for the evaluations to
show a small increase in risk. The NRC is not aware of any voluntary
consensus standard that could be used instead of the proposed
Government-unique standards. The NRC will consider using a voluntary
consensus standard if an appropriate standard is identified. If a
voluntary consensus standard is identified for consideration, the
submittal should explain how the voluntary consensus standard is
comparable and why it should be used instead of the proposed standard.
XIII. Finding of No Significant Environmental Impact: Environmental
Assessment: Availability
The Commission has determined under the National Environmental
Policy Act of 1969, as amended, and the Commission's regulations in
Subpart A of 10 CFR part 51, that this rule, if adopted, would not be a
major Federal action significantly affecting the quality of the human
environment and, therefore, an environmental impact statement is not
required.
The determination of this environmental assessment is that there
will be no significant offsite impact to the public from this action.
However, the general public should note that the NRC is seeking public
participation; availability of the environmental assessment is provided
in Section X. Comments on any aspect of the environmental assessment
may be submitted to the NRC as indicated under the ADDRESSES heading.
The NRC has sent a copy of the environmental assessment and this
proposed rule to every State Liaison Officer and requested their
comments on the environmental assessment.
XIV. Paperwork Reduction Act Statement
This proposed rule contains information collection requirements
that are subject to the Paperwork Reduction Act of 1995 (44 U.S.C.
3501, et seq.). This rule has been submitted to the Office of
Management and Budget for review and approval of the information
collection requirements.
The burden to the public for these information collections is
estimated to average 1032 hours per response, including the time for
reviewing instructions, searching existing data sources, gathering and
maintaining the data needed, and completing and reviewing the
information collection. The U.S. Nuclear Regulatory Commission is
seeking public comment on the potential impact of the information
collections contained in the proposed rule and on the following issues:
1. Is the proposed information collection necessary for the proper
performance of the functions of the NRC, including whether the
information will have practical utility?
2. Is the estimate of burden accurate?
3. Is there a way to enhance the quality, utility, and clarity of
the information to be submitted?
4. How can the burden of the information collection be minimized,
including the use of automated collection techniques?
Send comments on any aspect of these proposed information
collections, including suggestions for reducing the burden, to the
Records Management Branch (T-6 E6), U. S. Nuclear Regulatory
Commission, Washington DC 20555-0001, or by Internet electronic mail to
[email protected]; and to the Desk Officer, Office of Information
and Regulatory Affairs, NEOB-10202, (3150-0011), Office of Management
and Budget, Washington DC 20503.
Comments to OMB on the information collections or on the above
issues should be submitted by June 16, 2003. Comments received after
this date will be considered if it is practical to do so, but assurance
of consideration cannot be given to comments received after this date.
Public Protection Notification
The NRC may not conduct or sponsor, and a person is not required to
respond to, a request for information or an
[[Page 26549]]
information collection requirement unless the requesting document
displays a currently valid OMB control number.
XV. Regulatory Analysis
The Commission has prepared a draft regulatory analysis on this
proposed regulation. The analysis examines the costs and benefits of
the alternatives considered by the Commission. The Commission requests
public comment on the draft regulatory analysis. Availability of the
regulatory analysis is provided in Section X. Comments on the draft
analysis may be submitted to the NRC as indicated under the ADDRESSES
heading.
XVI. Regulatory Flexibility Certification
In accordance with the Regulatory Flexibility Act (5 U.S.C.
605(b)), the Commission certifies that this rule will not, if
promulgated, have a significant economic impact on a substantial number
of small entities. This proposed rule affects only the licensing and
operation of nuclear power plants. The companies that own these plants
do not fall within the scope of the definition of ``small entities''
set forth in the Regulatory Flexibility Act or the size standards
established by the NRC (10 CFR 2.810).
XVII. Backfit Analysis
The NRC has determined that the backfit rule does not apply to this
proposed rule; therefore, a backfit analysis is not required for this
proposed rule. As a voluntary alternative to existing requirements,
these amendments do not impose more stringent safety requirements on 10
CFR Part 50 licensees or applicants and thus do not constitute a
backfit pursuant to Sec. 50.109.
List of Subjects in 10 CFR Part 50
Antitrust, Classified information, Criminal penalties, Fire
protection, Intergovernmental relations, Nuclear power plant and
reactors, Radiation protection, Reactor siting criteria, Reporting and
recordkeeping requirements.
For the reasons set out in the preamble and under the authority of
the Atomic Energy Act of 1954, as amended; the Energy Reorganization
Act of 1974, as amended; and 5 U.S.C. 553, the NRC is proposing to
adopt the following amendments to 10 CFR Part 50.
PART 50--DOMESTIC LICENSING OF PRODUCTION AND UTILIZATION
FACILITIES
1. The authority citation for Part 50 continues to read as follows:
Authority: Secs. 102, 103, 104, 105, 161, 182, 183, 186, 189,
68 Stat. 936, 938, 948, 953, 954, 955, 956, as amended, sec. 234, 83
Stat. 444, as amended (42 U.S.C. 2132, 2133, 2134, 2135, 2201, 2232,
2233, 2239, 2282); secs. 201, as amended, 202, 206, 88 Stat.1242, as
amended, 1244, 1246 (42 U.S.C. 5841, 5842, 5846).
Section 50.7 also issued under Pub. L. 95-601, sec. 10, 92 Stat.
2951, as amended by Pub. L. 102-486, sec. 2902, 106 Stat. 3123 (42
U.S.C. 5851). Sections 50.10 also issued under secs. 101, 185, 68
Stat. 936, 955, as amended (42 U.S.C. 2131, 2235); sec. 102, Pub. L.
91-190, 83 Stat. 853 (42 U.S.C. 4332). Sections 50.13, 50.54(dd),
and 50.103 also issued under sec. 108, 68 Stat. 939, as amended (42
U.S.C. 2138). Sections 50.23, 50.35, 50.55, and 50.56 also issued
under sec. 185, 68 Stat. 955 (42 U.S.C. 2235). Sections 50.33a,
50.55a, and Appendix Q also issued under sec. 102, Pub. L. 91-190,
83 Stat. 853 (42 U.S.C. 4332). Sections 50.34 and 50.54 also issued
under Pub. L. 97-415, 96 Stat. 2073 (42 U.S.C. 2239). Sections 50.78
also issued under sec. 122, 68 Stat. 939 (42 U.S.C. 2152). Sections
50.80, 50.81 also issued under sec. 184, 68 Stat. 954, as amended
(42 U.S.C. 2234). Appendix F also issued under sec. 187, 68 Stat.
955 (42 U.S.C. 2237).
2. Section 50.8(b) is revised to read as follows:
Sec. 50.8 Information collection requirements: OMB approval.
(b) The approved information collection requirements contained in
this part appear in Sec. Sec. 50.30, 50.33, 50.33a, 50.34, 50.34a,
50.35, 50.36, 50.36a, 50.36b, 50.44, 50.46, 50.47, 50.48, 50.49, 50.54,
50.55, 50.55a, 50.59, 50.60, 50.61, 50.62, 50.63, 50.64, 50.65, 50.66,
50.68, 50.69, 50.71, 50.72, 50.74, 50.75, 50.80, 50.82, 50.90, 50.91,
50.120, and appendices A, B, E, G, H, I, J, K, M, N,O, Q, R, and S to
this part.
3. Part 50 is amended by adding a new Sec. 50.69 to read as
follows:
Sec. 50.69 Risk-informed categorization and treatment of structures,
systems and components for nuclear power reactors
(a) Definitions.
``Risk-Informed Safety Class (RISC)-1 structures, systems, and
components (SSCs)'' means safety-related SSCs that perform safety-
significant functions.
``Risk-Informed Safety Class (RISC)-2 structures, systems and
components (SSCs)'' means nonsafety-related SSCs that perform safety-
significant functions.
``Risk-Informed Safety Class (RISC)-3 structures, systems and
components (SSCs)'' means safety-related SSCs that perform low safety-
significant functions.
``Risk-Informed Safety Class (RISC)-4 structures, systems and
components (SSCs)'' means nonsafety-related SSCs that perform low
safety-significant functions.
``Safety-significant function'' means a function whose degradation
or loss could result in a significant adverse effect on defense-in-
depth, safety margin, or risk.
(b) Applicability and scope of risk-informed treatment of SSCs and
submittal/approval process.
(1) A holder of a license to operate a light water reactor (LWR)
nuclear power plant under Sec. Sec. 50.21(b) or 50.22, a holder of a
renewed LWR license under Part 54 of this chapter; a person seeking a
design certification under Part 52 of this chapter, or an applicant for
a LWR license under Sec. 50.22 or under Part 52, may voluntarily
comply with the requirements in this section as an alternative to
compliance with the following requirements for RISC-3 and RISC-4 SSCs:
(i) 10 CFR part 21.
(ii) 10 CFR 50.49.
(iii) 10 CFR 50.55(e).
(iv) The inservice testing requirements in 10 CFR 50.55a(f); the
inservice inspection, and repair and replacement, requirements for ASME
Class 2 and Class 3 SSCs in 10 CFR 50.55a(g); and the electrical
component quality and qualification requirements in Section 4.3 and 4.4
of IEEE 279, and sections 5.3 and 5.4 of IEEE 603-1991, as incorporated
by reference in 10 CFR 50.55a(h).
(v) 10 CFR 50.65, except for paragraph (a)(4).
(vi) 10 CFR 50.72.
(vii) 10 CFR 50.73.
(viii) Appendix B to 10 CFR part 50.
(ix) The Type B and Type C leakage testing requirements in both
Options A and B of Appendix J to 10 CFR Part 50, for penetrations and
valves meeting the following criteria:
(A) Containment penetrations that are either 1-inch nominal size or
less, or continuously pressurized.
(B) Containment isolation valves that meet one or more of the
following criteria:
(1) The valve is required to be open under accident conditions to
prevent or mitigate core damage events;
(2) The valve is normally closed and in a physically closed, water-
filled system;
(3) The valve is in a physically closed system whose piping
pressure rating exceeds the containment design pressure rating and that
is not connected to the reactor coolant pressure boundary; or
(4) The valve is 1-inch nominal size or less.
(x) Appendix A to Part 100, sections VI(a)(1) and VI(a)(2), to the
extent that these regulations require qualification testing and
specific engineering methods to demonstrate that SSCs are designed to
withstand the Safe
[[Page 26550]]
Shutdown Earthquake and Operating Basis Earthquake.
(2) A licensee voluntarily choosing to implement this section shall
submit an application for license amendment pursuant to Sec. 50.90
that contains the following information:
(i) A description of the process for categorization of RISC-1,
RISC-2, RISC-3 and RISC-4 SSCs.
(ii) A description of the measures taken to assure that the quality
and level of detail of the systematic processes that evaluate the plant
for internal and external events during normal operation, low power,
and shutdown (including the plant-specific probabilistic risk
assessment (PRA), margins-type approaches, or other systematic
evaluation techniques used to evaluate severe accident vulnerabilities)
are adequate for the categorization of SSCs.
(iii) Results of the PRA review process conducted to meet Sec.
50.69 (c)(1)(i).
(iv) A description of, and basis for acceptability of, the
evaluations to be conducted to satisfy Sec. 50.69(c)(1)(iv). The
evaluations shall include the effects of common cause interaction
susceptibility, and the potential impacts from known degradation
mechanisms for both active and passive functions, and address
internally and externally initiated events and plant operating modes
(e.g., full power and shutdown conditions).
(3) The Commission will approve a licensee's implementation of this
section if it determines that the process for categorization of RISC-1,
RISC-2, RISC-3, and RISC-4 SSCs satisfies the requirements of Sec.
50.69(c) by issuing a license amendment approving the licensee's use of
this section.
(4) An applicant for a license voluntarily choosing to implement
this section shall include the information in Sec. 50.69(b)(2) as part
of application for a license. The Commission will approve an
applicant's implementation of this section if it determines that the
process for categorization of RISC-1, RISC-2, RISC-3, and RISC-4 SSCs
satisfies the requirements of Sec. 50.69(c).
(c) SSC Categorization Process. (1) SSCs must be categorized as
RISC-1, RISC-2, RISC-3, or RISC-4 SSCs using a categorization process
that determines whether an SSC performs one or more safety-significant
functions and identifies those functions. The process must:
(i) Consider results and insights from the plant-specific PRA. This
PRA must at a minimum model severe accident scenarios resulting from
internal initiating events occurring at full power operation. The PRA
must be of sufficient quality and level of detail to support the
categorization process, and must be subjected to a peer review process
assessed against a standard or set of acceptance criteria that is
endorsed by the NRC.
(ii) Determine SSC functional importance using an integrated,
systematic process for addressing initiating events (internal and
external), SSCs, and plant operating modes, including those not modeled
in the plant-specific PRA. The functions to be identified and
considered include design bases functions and functions credited for
mitigation and prevention of severe accidents. All aspects of the
integrated, systematic process used to characterize SSC importance must
reasonably reflect the current plant configuration and operating
practices, and applicable plant and industry operational experience.
(iii) Maintain the defense-in-depth philosophy.
(iv) Include evaluations that provide reasonable confidence that
for SSCs categorized as RISC-3, sufficient safety margins are
maintained and that any potential increases in core damage frequency
(CDF) and large early release frequency (LERF) resulting from changes
in treatment permitted by implementation of Sec. 50.69(b)(1) and Sec.
50.69(d)(2) are small.
(v) Be performed for entire systems and structures, not for
selected components within a system or structure.
(2) The SSCs must be categorized by an Integrated Decision-making
Panel (IDP) staffed with expert, plant-knowledgeable members whose
expertise includes, at a minimum, PRA, safety analysis, plant
operation, design engineering, and system engineering.
(d) Alternative treatment requirements. (1) RISC-1 and RISC 2 SSCs.
The licensee or applicant shall ensure that RISC-1 and RISC-2 SSCs
perform their functions consistent with the categorization process
assumptions by evaluating treatment being applied to these SSCs to
ensure that it supports the key assumptions in the categorization
process that relate to their assumed performance.
(2) RISC-3 SSCs. The licensee or applicant shall develop and
implement processes to control the design; procurement; inspection,
maintenance, testing, and surveillance; and corrective action for RISC-
3 SSCs to provide reasonable confidence in the capability of RISC-3
SSCs to perform their safety-related functions under design basis
conditions throughout their service life. The processes must meet the
following requirements, as applicable:
(i) Design control. Design functional requirements and bases for
RISC-3 SSCs must be maintained and controlled. RISC-3 SSCs must be
capable of performing their safety-related functions including design
requirements for environmental conditions (i.e., temperature and
pressure, humidity, chemical effects, radiation and submergence) and
effects (i.e., aging and synergism); and seismic conditions (design
load combinations of normal and accident conditions with earthquake
motions);
(ii) Procurement. Procured RISC-3 SSCs must satisfy their design
requirements;
(iii) Maintenance, Inspection, Testing, and Surveillance. Periodic
maintenance, inspection, testing, and surveillance activities must be
established and conducted using prescribed acceptance criteria, and
their results evaluated to determine that RISC-3 SSCs will remain
capable of performing their safety-related functions under design basis
conditions until the next scheduled activity; and
(iv) Corrective Action. Conditions that could prevent a RISC-3 SSC
from performing its safety-related functions under design basis
conditions must be identified, documented, and corrected in a timely
manner.
(e) Feedback and process adjustment. (1) RISC-1, RISC-2, RISC-3 and
RISC-4 SSCs. In a timely manner but no longer than every 36 months, the
licensee shall review changes to the plant, operational practices,
applicable industry operational experience, and, as appropriate, update
the PRA and SSC categorization.
(2) RISC-1 and RISC-2 SSCs. The licensee shall monitor the
performance of RISC-1 and RISC-2 SSCs. The licensee shall make
adjustments as necessary to either the categorization or treatment
processes so that the categorization process and results are maintained
valid.
(3) RISC-3 SSCs. The licensee shall consider data collected in
Sec. 50.69(d)(2)(iii) for RISC-3 SSCs to determine whether there are
any adverse changes in performance such that the SSC unreliability
values approach or exceed the values used in the evaluations conducted
to satisfy Sec. 50.69 (c)(1)(iv). The licensee shall make adjustments
as necessary to either the categorization or treatment processes so
that the categorization process and results are maintained valid.
(f) Program documentation, change control and records. (1) The
licensee or applicant shall document the basis for its categorization
of any SSC under
[[Page 26551]]
paragraph (c) of this section before removing any requirements under
Sec. 50.69(b)(1) for those SSCs.
(2) Following implementation of this section, licensees and
applicants shall update their final safety analysis report (FSAR) to
reflect which systems have been categorized in accordance with Sec.
50.71(e).
(3) When a licensee first implements this section for a SSC,
changes to the FSAR for the implementation of the changes in accordance
with Sec. 50.69(d) need not include a supporting Sec. 50.59
evaluation of the changes directly related to implementation.
Thereafter, changes to the programs and procedures for implementation
of Sec. 50.69(d), as described in the FSAR, may be made if the
requirements of this section and Sec. 50.59 continue to be met.
(4) When a licensee first implements this section for a SSC,
changes to the quality assurance plan for the implementation of the
changes in accordance with Sec. 50.69(d) need not include a supporting
Sec. 50.54(a) review of the changes directly related to
implementation. Thereafter, changes to the programs and procedures for
implementation of Sec. 50.69(d), as described in the quality assurance
plan may be made if the requirements of this section and Sec. 50.54(a)
continue to be met.
(g) Reporting. The licensee shall submit a licensee event report
under Sec. 50.73(b) for any event or condition that would have
prevented RISC-1 or RISC-2 SSCs from performing a safety-significant
function.
Dated at Rockville, Maryland this 6th day of May, 2003.
For the Nuclear Regulatory Commission.
Annette L. Vietti-Cook,
Secretary of the Commission.
[FR Doc. 03-11696 Filed 5-15-03; 8:45 am]
BILLING CODE 7590-01-U