TECHNICAL BASIS DOCUMENT

MAINTENANCE RISK ASSESSMENT AND RISK MANAGEMENT

SIGNIFICANCE DETERMINATION PROCESS

I. INTRODUCTION

This document provides the basis for IMC 609, Appendix K for the
assessment of licensee performance deficiencies related to licensee
assessment and management of the risk associated with performing
maintenance activities. Oversight of licensee performance in assessing
and managing the risk of plant maintenance activities is conducted
principally by baseline inspection procedure (IP) 71111.13, "Maintenance
Risk Assessment and Emergent Work Control," or supplemental inspection
IP 62709, "Configuration Risk Assessment and Risk Management Process."

II\. BASIS

The NRC requirements in this area are set forth in paragraph (a)(4) of
10 CFR 50.65, "Requirements for Monitoring the Effectiveness of
Maintenance at Nuclear Power Plants," effective November 28, 2000.

The intent of paragraph (a)(4) is to have licensees appropriately assess
the risks of proposed maintenance activities that will (1) directly, or
may inadvertently, result in equipment being taken out of service, (2)
involve temporary alterations or modifications that could impact
structure, system, or component (SSC) operation or performance, (3) be
affected by other maintenance activities, plant conditions, or
evolutions, and/or (4) be affected by external events, internal
flooding, or containment integrity. Paragraph (a)(4) requires management
of the resultant risk using insights from the assessment. Therefore,
licensee risk assessments should properly determine the risk impact of
planned maintenance configurations to allow effective implementation of
RMAs to limit any potential risk increase when maintenance activities
are actually being performed. Although the level of complexity in an
assessment would be expected to differ from plant to plant, as well as
from configuration to configuration within a given plant, it is expected
that licensee risk assessments would provide insights for identifying
risk-significant activities and minimizing their durations.

II BACKGROUND

During the initial implementation phase of the reactor oversight process
(ROP), a task group was formed to review the adequacy of the reactor
safety SDP to assess the significance of maintenance rule (MR) related
inspection findings. The task group, consisted of staffs from NRR and
the regions, recommended that the existing reactor SDP did not address
issues related to risk assessment and risk management associated with
performance of maintenance activities and a new SDP be developed to
assess the risk significance of these findings. This recommendation was
based on the following reasons: (1) existing SDP phase 1 worksheet may
inappropriately screen risk-significant plant maintenance configurations
to "green," (2) phase 2 site-specific inspection notebooks lack the
necessary level of detail and completeness to assess maintenance
configurations with multiple equipment out-of-service, and (3) licensees
are already using phase 3 type analyses (and tools) to assess the
at-power risks of maintenance configurations. The task group developed a
draft SDP to evaluate the significance of MR (a)(4) issues, such as (1)
failure to perform an adequate risk assessment, and (2) failure to
manage risk. The proposed SDP concept was first discussed with industry
groups in a public workshop held on March 2001and further SDP
refinements were discussed during routine ROP public meetings to obtain
industry feedback. The subject SDP incorporated internal and external
feedback and recommendations. The appendix K is to be used as a Phase 2
Significance Determination Process (SDP) tool for assessing the
significance of inspection findings related to compliance with
Maintenance Rule (a)(4) requirements.

III\. METRICS USED

The incremental core damage probability deficit (ICDPD) and the
incremental large early release probability deficit (ILERPD) are the
metrics used to evaluate the magnitude of the error in the licensee's
inadequate risk assessment of the temporary risk increases due to
maintenance activities/configurations. Note that this SDP uses
Incremental Core Damage Probability (ICDP) metric rather than ∆CDF
(annualized risk increase) used in other reactor SDPs. The incremental
plant risk (ICDP) is a function of the amount of the time in which the
plant configuration change exists (time dependent). Thus the risk
increase of a configuration can be best represented in terms of
probability metric.

IV . DEFINITIONS USED

The following are definitions of terms used throughout this SDP .

[Incremental Core Damage Frequency (ICDF)]{.underline}. The ICDF is the
difference between the actual (adequately/accurately assessed)
maintenance risk (configuration-specific CDF) and the zero-maintenance
CDF. The configuration-specific CDF or ICDF is the annualized risk
estimate with the out-of-service or otherwise affected SSCs considered
unavailable. The term, "Incremental Core Damage Frequency" is also
equivalently referred to as delta CDF, or change in CDF.

[Incremental Core Damage Probability (ICDP)]{.underline}. The ICDP is
the product of the incremental CDF and the annual fraction of the
duration of the configuration \[ i.e., ICDP = ICDF x (duration in
hours)÷(8760 hours per reactor year)\]. Note that the ICDP is sometimes
expressed as the integrated or integral ICDP ( i.e., the delta CDF or
ICDF integrated over the time of its duration which increases as the
elevated-risk configuration persists). Figure 1 is a graphical
representation of this concept.

[Incremental Core Damage Frequency Deficit (ICDFD)]{.underline}. The
ICDFD is that portion of the ICDF defined as the difference between the
actual maintenance-configuration-specific CDF (called ICDF**~actual~**
for purposes of this definition) and the maintenance-related ICDF as
originally and inadequately assessed (flawed) by the licensee
(ICDF**~flawed~**). Therefore, the ICDFD=ICDF**~actual~** -
ICDF**~flawed~**. Note that if the licensee has failed to assess
maintenance risk entirely when required ( i.e., there is no licensee
risk assessment), then the ICDFD will be equal to the entire value of
the ICDF. The safety significance of the ICDFD ( i.e., the magnitude of
the licensee's underestimate (or lack of estimate) of the risk) is
determined by means of this SDP.

[Incremental Core Damage Probability Deficit (ICDPD)]{.underline}. The
ICDPD is the product of the ICDFD and the Exposure (i.e., the annual
fraction of the duration of the unassessed or inadequately assessed
configuration, or that portion of the annual fraction of the duration of
the maintenance configuration during which its risk remained unassessed
or inadequately assessed). Thus the ICDPD = ICDFD x (exposure in hours)
÷ (8760 hours per reactor-year). Note that similar to the ICDFD, the
ICDPD equals the ICDP when there is no risk assessment, rather than a
flawed risk assessment. Note also that Exposure equals Duration if the
risk remained unassessed or inadequately assessed for the entire
duration of the configuration. The safety significance of the ICDPD (
i.e., the magnitude of the licensee's underestimate (or lack of
estimate) of the risk (in terms of ICDP)), may also be determined by
means of this SDP. Figure 2 is a graphical representation of this
concept.

[Incremental Large Early Release Frequency (ILERF).]{.underline} The
ILERF is the difference between the actual, adequately determined
maintenance activity/configuration-specific LERF and the zero
maintenance LERF, if determinable. Note that LERF and ILERF are
determinable only if the plant has a Level-II probabilistic risk
analysis/probabilistic safety assessment (PRA/PSA) and a risk tool or
process capable of quantitatively assessing Level-II risk beyond a
qualitative assessment of the impact of containment integrity. If
calculated, the ILERF may also be referred to as the delta LERF or LERF
difference.

[Incremental Large Early Release Frequency Deficit
(ILERFD)]{.underline}. The ILERFD is used to evaluate the significance
of a finding under the following conditions (1) an impact on containment
integrity from or concurrent with the maintenance activity occurs, (2)
this impact is/was not qualitatively assessed, and (3) the impact is/was
quantitatively assessed, but not adequately. Then the ILERFD is
meaningful and is that portion of the ILERF defined as the difference
between the actual maintenance-configuration-specific LERF (called
ILERF**~actual~** for purposes of this definition) and the
maintenance-related ILERF as originally and inadequately assessed by the
licensee (ILERF**~flawed~**). Therefore, the ILERFD=ILERF**~actual~**−
ILERF**~flawed~**. Note that if the licensee has failed to assess
maintenance risk entirely when required (i.e., there is no licensee risk
assessment) and there is an impact on containment integrity from or
concurrent with the maintenance activity, this impact can be neither
qualitatively nor quantitatively assessed. Therefore, the ILERFD will be
equal to the entire value of the ILERF. The safety significance of the
licensee's underestimate (or lack of estimate) of the Level-II risk (
i.e., ILERFD) may also be determined by means of this SDP, if
appropriate.

[Incremental Large Early Release Probability (ILERP)]{.underline}. The
ILERP is the product of the incremental large early release frequency
(ILERF) and the annual fraction of the duration of the configuration.
The ILERP=(ILERF x duration in hours)÷(8760 hours per reactor-year).

[Incremental Large Early Release Probability Deficit
(ILERPD)]{.underline}. The ILERPD is the product of the ILERFD with the
annual fraction of the duration of the unassessed or inadequately
assessed configuration, or that portion of the annual fraction of the
duration of the maintenance configuration during which its risk (in
terms of ILERF or ILERP) remained unassessed or inadequately assessed.

NOTE: Although an adequate maintenance risk assessment is expected to
include the impact of containment integrity, at least qualitatively,
there is no regulatory requirement for a quantitative risk assessment
using a Level-II PRA. Paragraph (a)(4) of 10 CFR 50.65 neither prohibits
nor explicitly discourages incurring maintenance risk. It only requires
that the risk of maintenance activities be assessed (which can be done
qualitatively, quantitatively, or, as is often the case, in a blended
fashion) and managed.

[Loss of Function]{.underline}. This is the condition in which an SSC
becomes incapable of performing its intended purpose. This can mean a
complete functional failure or impaired or degraded performance or
condition such that the affected SSC is incapable of meeting its
functional success criteria. Functional success criteria include having
the required trains, adequate speed, flow, pressure, load, startup time,
mission time, etc. These are defined or assumed in the design and/or
licensing bases (i.e., updated final safety evaluation report, license
conditions, or technical specifications and/or their bases). For the
purposes of determining risk/safety significance, the functional success
criteria of particular interest would be those assumed in the plant's
PRA and/or the licensee's risk assessment tool.

In some cases SSCs out of service for testing are considered
unavailable, unless the test configuration is automatically overridden
by a valid starting signal, or the function can be promptly restored
either by an operator in the control room or by a dedicated operator
stationed locally for that purpose. Restoration actions must be
contained in a written procedure, must be uncomplicated (a single action
or a few simple actions), and must not require diagnosis or repair.
Credit for a dedicated local operator can be taken only if (s)he is
positioned at the proper location throughout the duration of the test
for the purpose of restoration of the train should a valid demand occur.
The intent of this paragraph is to allow licensees to take credit for
restoration actions that are virtually certain to be successful (i.e.,
probability nearly equal to 1) during accident conditions.

If the restoration actions are virtually certain to be successful due to
emergent conditions, the risk assessment may consider the time necessary
for restoration of the SSC\'s function, with respect to the time at
which performance of the function would be needed.

[Zero-Maintenance CDF(Risk)]{.underline}. The CDF estimate of plant
baseline configuration where all SSCs modeled in PRA are considered
available.

[Baseline CDF(Risk)]{.underline}. The CDF estimate derived from a PRA
model that considers average annual maintenance (preventive and
corrective maintenance) unavailability data, and plant specific
reliability data (failure rates).

Note that inadequate risk assessment or risk management for work not yet
started is not an (a)(4) violation, but it still represents a licensee
performance deficiency and may be indicative of deficiencies in previous
risk assessments, RMAs and/or in the licensee\'s (a)(4) program. This
SDP is not suited for determining the significance of this type of
performance deficiency. This issue will be screened to Green in
accordance with Reactor SDP Phase 1 screening.

V. SDP METHODOLOGY

Once an inspection finding satisfies the Inspection Manual Chapter (IMC)
0612 minimum threshold process, the finding can then be evaluated using
the following Table (Table 1) or SDP flowcharts in IMC 0609, Appendix K.
The input to the maintenance rule (a)(4) Significance Determination
Process (SDP) is an inspection finding that has some significance due to
the licensee\'s underestimate of plant risk or lack of risk assessment
from ongoing or completed maintenance activities and/or the licensee\'s
ineffective implementation of risk management actions (RMAs).

The SDP methodology described below does not directly apply to those
licensees who perform qualitative analyses of plant configuration risk
due to maintenance activities. When performance deficiencies are
identified with qualitative assessments, the inspector should determine
significance of the deficiency by an internal NRC management review
using risk insights where possible. Use of risk insights may include an
independent NRC quantitative risk assessment (e.g., use of plant
specific Standardized Plant Analysis Risk model). It is expected that
most licensees will perform quantitative assessments for at-power
conditions but not necessarily for plant shutdown conditions. In
addition, quantitative risk assessments for the large early release
frequency (LERF) and external events (e.g., fire, seismic) risk effects
are not normally performed due to the lack of probabilistic risk tools
for these effects. For these risk effects, a qualitative assessment is
more common and the approach described above should also be used to
determine significance. Therefore, this guidance does not apply to the
following situations: (1) those licensees who only perform qualitative
analyses of plant configuration risk due to maintenance activities, or
(2) performance deficiencies related to maintenance activities affecting
SSCs needed for fire or seismic mitigation. When performance
deficiencies are identified with either 1 or 2 above, the significance
of the deficiencies must be determined by an internal NRC management
review using risk insights where possible in accordance with IMC 612,
"Power Reactor Inspection Reports."

Underestimating or not estimating the risk of maintenance activities may
not significantly increase the expected overall plant risk, in terms of
core damage frequency (CDF) or LERF. However, underestimating the risk
may result in lack of risk awareness that could preclude RMAs and allow
a high-risk configuration to persist unrecognized and uncompensated.
Allowing a high-risk configuration with an unassessed CDF increase to
persist longer than necessary, or desirable, may increase the exposure
time and hence the incremental (integrated) core damage probability
(ICDP) and/or the incremental large early release probability (ILERP).
Finally, unawareness of unassessed or inadequately assessed risk may
allow actions or events to occur that could directly increase risk or
hamper recovery from accidents or transients.

Licensees who have adopted RMA color thresholds that are not ICDP or
ILERP based, may need to have performance converted to correspond to a
probability unit of measure.

When the inspector has identified that the licensee has performed an
inadequate risk assessment (or none at all), the actual maintenance risk
(configuration-specific core damage frequency \[CDF\]) must first be
adequately or accurately assessed. The inspector should discuss the
results of the risk assessment with the licensee before proceeding with
any further risk assessment. The new risk assessment value may be
obtained in several ways including having the licensee perform the
omitted maintenance risk assessment; or re-perform it, correcting those
errors and/or omissions that rendered its original risk assessment
inadequate. Alternatively, the inspector may request the regional senior
reactor analyst(s) or the headquarters risk analyst(s) to independently
evaluate the risk using the plant-specific SPAR model or other tools.
For this, the inspector needs to provide information as shown in the
SDP. For findings that have significance preliminarily determined to be
White, Yellow or Red, an SRA may perform a Phase 3 analysis, if
necessary.

The original flawed risk assessment value is subtracted from the
actual/correct ICDF to obtain the risk deficit or ICDFD. The ICDFD is
converted into ICDPD. Note that ICDPD is equal to ICDP when there was no
risk assessment performed by the licensee. If ICDP is significantly
greater than 1E-6 (i.e., one order of magnitude or greater), the net
risk impact must be assessed by subtracting 1E-6 from the risk deficit
(ICDPD) as determined above, prior to determining an SDP color. This is
because licensees are not normally expected to take RMAs for ICDP,1E-6.
Therefore, the net risk deficit that should be considered for
quantitative significance determination should be that portion of the
ICDPD that is in excess of 1E-6. The safety significance of the
licensee's underestimate (or lack of estimate) of the risk is then
determined by entering Table 1 or flowchart 1(IMC 0609, Appendix K) with
the value of ICDPD as determined above and finding the matching color.
The color of the ILERPD, if applicable, is determined in a similar
fashion.

In general, the following two types of licensee performance deficiencies
in meeting (a)(4) requirements can be defined.

a.  [Failure to Perform an Adequate Risk Assessment]{.underline}. The
    failure to perform an adequate risk assessment in accordance with 10
    CFR 50.65 (a)(4) prior to the conduct of maintenance activities
    includes the following deficiencies which result in underestimating
    the risk.

    1.  failure to perform a risk assessment for maintenance
        configuration changes.

    2.  failure to update a risk assessment for changes in the assessed
        plant conditions (e.g., changes in maintenance activities or
        emergent conditions). However, performance or re-evaluation of
        the assessment should not interfere with, or delay, the operator
        and/or maintenance crew from taking timely actions to restore
        the equipment to service or take compensatory actions. If the
        plant configuration is restored prior to conducting or
        re-evaluating the assessment, the assessment need not be
        conducted, or re-evaluated if already performed.

    3.  failure to perform a complete risk assessment including all
        affected/involved SSCs within the scope of SSCs required for
        (a)(4) assessments, and considering (or adequately considering)
        all plant-relevant plant conditions or evolutions, external
        events, internal flooding, and/or containment integrity

    4.  failure to consider maintenance activities which have
        historically had a high likelihood of introducing a transient
        leading to an initiating event that would result in
        risk-significant configurations

    5.  Improper use of the risk assessment tool or process (i.e.,
        beyond its capabilities or limitations, or under plant
        conditions for which it was neither designed nor in accordance
        with site procedures)

    6.  deficient risk-informed evaluation process for limiting the
        scope of SSCs to be included in (a)(4) risk assessments as
        identified by NRC inspection in accordance with IP 62709

    7.  flawed risk assessment tool or process as identified by NRC
        inspection in accordance with IP 62709

b.  [Failure to Manage Risk]{.underline}. Failure to manage the risk
    impacts of proposed maintenance activities means a failure to
    implement, in whole or in part, the key elements of the licensee's
    risk management program. However, this deficiency will not result in
    an additional risk increase to the assessed risk of the maintenance
    configuration in terms of CDF or LERF, unless an event actually
    occurs that results in additional risk impacts. Measures to minimize
    the duration of the risk associated with a maintenance
    activity/configuration are a principal RMA. Nevertheless, failure to
    implement such measures when they are possible and practicable will
    allow the ICDP and/or the ILERP to increase further as the elevated
    risk condition persists. Appropriate and suitable RMAs can only
    reduce the risk incurred from a given configuration change.

> RMAs should be implemented in a graduated manner, commensurate with
> various increases above the plant's baseline risk, to control the
> overall risk impact of an assessed maintenance configuration. However,
> licensees use a variety of methods for categorizing risk significance
> and managing the risk according to the category.
>
> In Regulatory Guide 1.182, the NRC endorsed the RMA levels or
> categories/bands prescribed in the revised Section 11 of NUMARC 93-01,
> Revision 2, and subsequently incorporated in Revision 3 of NUMARC
> 93-01. These risk bands are defined in terms of the ICDP, making them
> readily comparable to the risk levels used in determining the
> significance of the risk deficits. For licensees that have adopted
> this guidance, normal work controls are allowed by site procedures for
> ICDPs less than 1 E-6. For ICDPs of 1E-6 or greater, RMAs are
> prescribed. Section 11 of NUMARC 93-01 states that maintenance risk
> configurations above ICDP value of 1E-5 should not be entered
> voluntarily. Site procedures will typically prohibit this activity
> entirely or will allow it only with fairly rigorous restrictions that
> typically include the plant manager's written permission along with
> extensive RMAs. Site procedures may further define specific detailed
> RMAs or plans for routinely allowable risk categories as well. It
> should be noted that when evaluating the adequacy of a licensee's
> RMAs, the inspector should consider only those actions that could have
> potential risk implications and required by the licensee's procedures,
> such as working around the clock, installing backup equipment, and
> reducing duration of maintenance activity for effective implementation
> of RMAs.

Table 1

SDP Matrix for Quantitative Risk Assessment

+-----------------+----------------------+----------------------------+
| Risk Results    |                      | SDP Colors for Licensee    |
|                 |                      | Performance Deficiency     |
+-----------------+----------------------+----------------------------+
| Incremental     | Incremental Large    | Failure to Perform an      |
| Core Damage     | Early Release        | Adequate Risk Assessment   |
| Probability     | Probability Deficit  | (without any mitigation    |
|                 | (ILERPD)             | for risk management)       |
| Deficit (ICDPD) |                      |                            |
+-----------------+----------------------+----------------------------+
| \< 1E-6         | \< 1E-7              | GREEN                      |
+-----------------+----------------------+----------------------------+
| \>1E-6 \~       | \>1E-7 \~ \<1E-6     | WHITE                      |
| \<1E-5          |                      |                            |
+-----------------+----------------------+----------------------------+
| \>1E-5 \~       | \>1E-6 \~ \<1E-5     | YELLOW                     |
| \<1E-4          |                      |                            |
+-----------------+----------------------+----------------------------+
| \> 1E-4         | \> 1E-5              | RED                        |
+-----------------+----------------------+----------------------------+

VI\. RISK MANAGEMENT ACTIONS

In accordance with licensee procedures, RMAs should be implemented in a
graduated manner, commensurate with various increases above the plant\'s
zero maintenance risk. However, the risk reduction benefits of these
actions are generally not quantifiable. These actions are aimed at
increasing the risk awareness of key plant personnel, providing more
rigorous planning and control of maintenance activities, and controlling
the duration and magnitude of the increased risk. RMAs should be
considered in the development of work schedules in accordance with the
licensee\'s program and procedures. RMAs can include (but are not
limited to) the following:

1.  [Actions to provide increased risk awareness and
    control]{.underline}

    -   Discussion of planned maintenance activity with the affected
        operating shift(s). Ensuring operator awareness of risk level,
        RMAs, protected SSCs, contingency plans, etc., and obtain
        operations approval. Documenting risk information in logs, on
        status boards, etc

    -   Conducting pre-job briefing of maintenance personnel,
        emphasizing risk aspects of planned maintenance evolution

    -   Requesting system engineers to be present for the maintenance
        activity, or for applicable portions of the activity

    -   Obtaining plant management approval of the proposed activity

    -   Ensuring risk and RMA information on all work schedules, plans,
        etc.

    -   Announcing the plant risk band in effect and what
        risk-significant activities are in progress on the public system
        (e.g., Gaitronics) periodically and when changes occur.

2.  [Actions to reduce duration of maintenance activity]{.underline}

    -   Pre‑staging parts, materials, tools and other equipment

    -   Walking down tagouts, equipment lineups (e.g., valves and
        switches) and the maintenance activity prior to starting work

    -   Conducting training on mockups to familiarize maintenance
        personnel with the activity (similar to ALARA strategies)

    -   Working jobs during back shifts as well as day shift

    -   Establishing contingency plan to restore out‑of‑service
        equipment (or functions) rapidly if needed

3.  [Actions to minimize magnitude of risk increase]{.underline}

    -   Minimizing other work in areas that could affect initiators
        (e.g., reactor protection system areas, switchyard, emergency
        diesel generator rooms, switchgear rooms) to decrease the
        frequency of initiating events that are mitigated by the
        function performed/supported by the out‑of‑service SSC

    -   Minimizing other work in areas that could affect other redundant
        systems (e.g., high pressure coolant injection/reactor core
        isolation cooling rooms, auxiliary feedwater pump rooms)

    -   Establishing alternate success paths for performance of the
        safety function of the out‑of‑service SSC (note: equipment used
        to establish these alternate success paths need not be within
        the scope of the maintenance rule). Use of administrative
        controls to ensure that backup equipment is protected.

    -   Establishing other compensatory measures

    -   Re-prioritizing and/or rescheduling maintenance activities

4.  A final action threshold should be established so that risk
    significant configurations are not normally entered voluntarily.

Because the benefits of these RMAs are generally not readily
quantifiable, the approach chosen for quantitatively determining the
significance of failure to manage risk is to assign some credit to the
effectiveness of these actions in reducing the risk impact of the
assessed configuration. Therefore, the simple screening rule used in
this SDP is to assign a credit of half-decade reduction in risk to the
correctly calculated risk if the licensee effectively implemented one or
two categories of the RMAs to control risk. If the licensee effectively
implemented three or more categories of the RMAs, an order of magnitude
reduction in risk can be credited against the actual maintenance risk.
This approach allows the significance of failure to manage risk to be
expeditiously determined without using quantitative approaches that may
require intensive resources. Flowchart 2 (IMC0609, App. K) is to used
for evaluating the significance of failure to implement RMAs when the
maintenance risks are adequately assessed.

If inspection staff needs assistance from the Agency technical experts
in determining the adequacy of RMAs, follow the guidance in inspection
procedure 71111.13, "Maintenance Risk Assessments and Emergent Work
Control."

VII\. EXAMPLES OF (a)(4) FINDINGS

**The following examples are provided to illustrate the use of the
subject SDP using flow charts 1 and 2 for inspection findings that
involve failure to perform an adequate risk assessment and failure to
manage risk. These examples neither represent risk assessments of actual
configurations nor actual examples of any MR findings.**

**I.** During the period January 14-16, 2003, plant "X" was operating at
75 percent power with a Division 1 partial outage in which the residual
heat removal (RHR) heat exchanger "A," ESW "A" 4.16-kV switchgear
breaker, and Division 1 emergency diesel generator (EDG) had already
been assessed for the risk of their removal from service for up to 100
hours. The licensee calculated the ICDF ( ∆CDF ) as 8.76E-4. ( ICDF or
∆CDF = CDF~actual~ - CDF~zero-maintenance~ = 8.77E-4 - 1.0E-6).

ICDP = ICDF x \[100 hrs/(8760hrs/reactor-year)\]. Therefore, the
resultant ICDP in this case was about 1.0E-5.

The inspectors reviewed work orders, control room logs, and risk
assessments for the maintenance activities performed during the above
period. The inspector noted that the licensee failed to consider the
following maintenance ongoing work activities for the above risk
assessment (1) maintenance on switchyard breakers and relays by the
offsite group, and (2) routine maintenance on train "B" Class 1E Battery
system. In addition, during this time, the licensee's contractors were
working near the switchyard with cranes and other heavy equipment which
had the potential for causing a loss-of-offsite power. Also, the
licensee's Division 1 partial outage was extended for an additional 18
hours (from the original schedule) due to the unavailability of parts
and other documentation issues.

The SRA reassessed the risk with the above conditions and found the
actual ICDF to be about 6.09E-3. The corresponding ICDP was 8.2 E-5.

The inspector reviewed licensee's risk management actions for the above
maintenance configurations and note the following deficiencies.

-   The RMAs did not contain actions to provide increased risk awareness
    and control, such as coordinating switchyard and other yard work
    activities that could affect the availability of offsite power
    sources; obtaining management review and approval of the proposed
    maintenance work; coordinating work activities with those assigned
    to offsite organizations; and requiring risk assessments prior to
    conducting maintenance activities and applicable risk management
    guidance.

-   The RMAs did not contain actions to reduce the duration of
    maintenance activity, such as verifying and pre-staging parts,
    materials, tools and other equipment; encouraging the performance of
    maintenance work during back shifts, as well as day shifts; and
    establishing contingency plans to restore out‑of‑service equipment
    (or functions) rapidly, if needed.

-   The RMAs did not contain actions to reduce the magnitude of a risk
    increase, such as minimizing work that could affect the frequency of
    initiating events which are mitigated by out-of-service SSCs;
    establishing alternate success paths for performance of the safety
    function of the out‑of‑service SSC; minimizing work that could
    affect redundant systems; developing administrative controls to
    ensure that backup equipment is protected; establishing other
    compensatory measures; and reprioritizing and/or rescheduling
    maintenance activities.

-   The RMAs did not establish risk thresholds so that risk significant
    configurations could not be normally entered voluntarily.

The inspectors reviewed this issue against the guidance contained in
Appendix B, "Issue Dispositioning Screening," of Inspection Manual
Chapter (IMC) 0612, "Power Reactor Inspection Reports." The inspectors
concluded that the issue was more than minor since the licensee's risk
assessment failed to consider unavailable SSC during the maintenance.
This finding is associated with inadequate 10 CFR 50.65 (a)(4) risk
assessment/management and it impacted the mitigation system cornerstone.
Accordingly, the inspectors determined the significance of the finding
using IMC 0609,

Appendix K, \"Maintenance Risk Assessment and Risk Management
Significance Determination Process."

The following steps should be followed to determine the significance of
the finding using this SDP (IMC 0609, Appendix K).

1\. Calculate the risk deficit (ICDPD) as follows :

Actual lCDP - original flawed ICDP-1E-6 = 8.2 E-5 - 1.0 E-5 - 1.0 E-6 =
7.1 E-5.

2\. In order to determine the significance of this value (SDP color),
use flowchart1 in IMC 0609, Appendix K.

> For ICDPD = 7.1 E-5, the SDP color is Yellow. (Decision blocks "Is
> Risk Deficit \> 1E-6\", and "Is Risk Deficit \>1E-5?" were answered
> "Yes" and decision block "Is Risk Deficit \>1E-4?" is answered
> "No"with no RMAs taken).

3\. Next, use flowchart-1, follow the decision block "Is Risk Deficit
\>1 E-4\" path "No" to determine whether any RMA credit should be
applied to the risk deficit.

Section 4.3 of this SDP lists the following categories of appropriate
RMAs..

-   increased risk awareness and control

```{=html}
<!-- -->
```
-   reducing duration of maintenance activity

```{=html}
<!-- -->
```
-   Minimizing magnitude of risk increase

```{=html}
<!-- -->
```
-   establishing other compensatory measures to provide alternate
    success paths for maintaining the safety function of the
    out-of-service SSC (e.g., using diverse means of accomplishing the
    intended safety function).

Based on the deficiencies identified in all four RMA categories, no
credit is given to the licensee for RMAs. Therefore, the final
significance color is Yellow.

This example illustrates a case where the licensee assessed the risk,
but the risk assessment was flawed (incomplete or inadequate). This is
because the licensee did not include the following in their risk
assessment: all out-of-service components, additional hours due to
extension of the maintenance, increased risk of a plant trip from
switchyard work. The risk deficit was recalculated as shown above. The
risk deficit value was assigned an SDP color "Yellow" using flowchart 1.
The significance color remained the same (did not get any credit)
because the licensee did not implement any risk management actions.

**II.** On August 2, 2000, the inspectors questioned the licensee's
overall risk assessment of plant XY due to several maintenance
activities. The licensee had evaluated the increase in risk (ICDF) due
to maintenance activities as 1.18E-5 using their Plant Risk Analysis
Program (ORAM/SENTINEL) tool. The corresponding ICDP was 1E-6. The
licensee implemented only the normal work controls because the ICDP was
not \>1E-6.

Based on plant status review the inspectors noted that the licensee had
taken RCIC system out of service for maintenance and were on an LCO. The
inspectors identified that the licensee had not accurately input the
RCIC system maintenance activity for 12 days in their risk assessment.
The inspectors asked the licensee to perform the overall risk assessment
using ORAM/SENTINEL with the RCIC system unavailable since that was the
plant configuration and it was credited for accident mitigation. When
the licensee made the RCIC system unavailable in the ORAM/SENTINEL
program, the overall risk (ICDF) changed to 6.36E-5.

The inspectors reviewed this issue against the guidance contained in
Appendix B, "Issue

Dispositioning Screening," of Inspection Manual Chapter (IMC) 0612,
"Power Reactor

Inspection Reports." The inspectors concluded that the issue was more
than minor since

the licensee's risk assessment failed to consider unavailable SSC during
the maintenance. This finding is associated with inadequate 10 CFR 50.65
(a)(4) risk assessment/management and it impacted the mitigation system
cornerstone. Accordingly, the inspectors determined the significance of
the finding using IMC 0609, Appendix K, \"Maintenance Risk Assessment
and Risk Management Significance Determination Process."

The following steps should be followed to determine the significance of
the finding using this SDP.

1\. If not already done, covert actual incremental core damage frequency
(ICDF~actual~) to actual incremental core damage probability
(ICDP~actual~ )

> i.e., ICDP~actual~ = ICDF~actual~ x \[12x24
> hrs/(8760hrs/reactor-year)\]
>
> ICDP~actual~ =6.36E-5 x \[12x24 hrs/(8760hrs/reactor-year)\]. = 2.09
> E-6.

2\. Calculate the risk deficit (ICDPD) as follows :

> Actual lCDP - original flawed ICDP= 2.09E-6 - 1E-6=1.09E-6

3\. In order to determine the significance (SDP color) of this value,
use flowchart1 in IMC 0609, Appendix K. For ICDPD = 1.09 E-6, the SDP
color is **White**. (The decision block"Is Risk Deficit \>1E-6?" was
answered "Yes"; the decision block "Is Risk Deficit \>1E-5?" was
answered "No"; and no RMAs were taken).

This example illustrates a case where the licensee's risk assessment was
flawed (incomplete or inadequate), and the licensee had not taken any
risk management actions because they did not realize the actual risk was
above 1E-6. Also, note that in this example ICDP was not significantly
greater than 1E-6 (i.e., one order of magnitude or greater). Therefore,
the net risk impact remained the same (did not subtract 1 E-6 from the
risk deficit prior to determining an SDP color).

**III.** The online risk was evaluated by the licensee for plant YY to
be at an elevated level (ORANGE) during a designated work window for
preventive maintenance on the 2A EDG and other scheduled maintenance
work including a surveillance test on the Unit 2 Solid State Protection
System. The inspectors questioned operators and the work week manager
concerning the plant configuration and the published risk condition for
that maintenance. The licensee assessed the increase in risk (ICDP)
associated with the maintenance activities to be 4.1 E-6. The inspectors
verified the risk assessment to be adequate and it reflected the actual
plant configurations. However, the inspectors noted that this
configuration would not have been allowed by plant risk procedure
PRK-001without implementing appropriate risk management actions. The
inspectors reviewed the licensee's risk management actions for the above
maintenance configurations. The licensee had taken the following risk
management actions: conducted pre-job briefing of maintenance personnel,
obtained plant management approval of the proposed activity, ensuring
risk and RMA information are highlighted on all work schedules,
pre-staged parts, performed walkdown of affected systems and hung and
verified boundary and caution tags. The inspectors determined that the
licensee has taken adequate RMAs to provide increased risk awareness and
control and actions to reduce duration of the maintenance activity, but
did not take actions to minimize the magnitude of risk increase as
specified in the licensee's procedure.

The inspectors reviewed this issue against the guidance contained in
Appendix B, "Issue

Dispositioning Screening," of Inspection Manual Chapter (IMC) 0612,
"Power Reactor

Inspection Reports." The inspectors concluded that the issue was more
than minor since

the licensee did not adequately manage the increase in risk due to
maintenance activities. This finding is associated with inadequate 10
CFR 50.65 (a)(4) risk management and it impacted the mitigation system
cornerstone. Accordingly, the inspectors determined the significance of
the finding using IMC 0609, Appendix K, \"Maintenance Risk Assessment
and Risk Management Significance Determination Process."

The following steps should be followed to determine the significance of
the finding using this SDP.

Since the finding is related to RMAs only, go to SDP flowchart 2.

For ICDP= 4.1E-6, the SDP color is determined as **Green.** (The
decision block "Is Risk Deficit \>1E-6?" was answered "Yes"; the
decision block "Is Risk Deficit \>1E-5?" was answered "No"; the decision
block "3 or RMAs taken" was answered "No"; the decision block "1or 2
RMAs taken" was answered "Yes"; and the decision block "Is ICDP\< 5E-6\"
was answered as "Yes").

This example illustrates a case where the licensee's risk assessment was
adequate, but the licensee had not implemented all required risk
management actions. Since the licensee had effectively implemented 2
RMAs and the risk increase was \<5E-6, the significance was mitigated
from a potential White finding to a Green finding.

VIII\. REFERENCES

Section 50.65 of Part 50 of Title 10 of the *Code of Federal
Regulations* (10 CFR 50.65), \"Requirements for Monitoring the
Effectiveness of Maintenance at Nuclear Power Plants\"

Regulatory Guide 1.160, \"Monitoring the Effectiveness of Maintenance at
Nuclear Power Plants\"

Regulatory Guide 1.182, \"Assessing and Managing Risk Before Maintenance
Activities at Nuclear Power Plants\"

Regulatory Guide 1.187, \"Guidance for Implementation of 10 CFR 50.59,
Changes, Tests and Experiments,\" November 2000

Inspection Procedure 71111.13, "Maintenance Risk Assessments and
Emergent Work Control"

The Nuclear Energy Institute\'s (NEI\'s), NUMARC 91-06, \"Industry
Guideline for Shutdown Operations\"

NUMARC 93‑01, \"Industry Guideline for Monitoring the Effectiveness of
Maintenance at Nuclear Power Plants\"

Revised Section 11, dated February 22, 2000, "Assessment of Risk
Resulting from Performance of Maintenance Activities," of NUMARC 93‑01

END