NUREG-0800

UNITED STATES NUCLEAR REGULATORY COMMISSION

1 tSTANDARD REVIEW PLAN

8 , OFFICE OF NUCLEAR REACTOR REGULATION

3.9.7 RISK-INFORMED INSERVICE TESTING

REVIEW RESPONSIBILITIES

Primary - Mechanical Engineering Branch (EMEB)

Secondary - Probabilistic Safety Assessment Branch (SPSB)

INTRODUCTION

The NRC's policy statement on probabilistic risk analysis (PRA)(Ref. 1) encourages greater use

of this analysis technique to improve safety decisionmaking and improve regulatory efficiency.

One activity under way in response to the policy statement is the use of PRA in support of

decisions to modify an individual plant's inservice testing (IST) program. Licensee-initiated IST

Program changes which are consistent with currently approved staff positions [e.g., regulatory

guides, standard review plans, branch technical positions] are normally evaluated by the staff

using traditional, engineering analyses. In such cases, a licensee would not be expected to

submit risk information in support of the proposed change. Licensee-initiated IST program

change requests that go beyond current staff positions may be evaluated by the staff using

traditional engineering analyses as well as the risk-informed approach set forth in Regulatory

Guide 1.175, "An Approach for Plant-Specific Risk-informed Decisionmaking: Inservice

Testing," (Ref. 3). A licensee may be requested to submit supplemental risk information if such

information is not provided in the proposed risk-informed inservice testing (RI-IST) program

submittal by the licensee. If risk information on the proposed RI-IST program is not provided to

the staff, the staff will review the information provided by the licensee to determine whether the

application can be approved based upon the information provided using traditional methods and

will either approve or reject the application based upon the review. For those licensee-initiated

USNRC STANDARD REVIEW PLAN

Standard review plans are prepared for the guidance of the Office of Nuclear Reactor Regulation staff responsible for the

review of applications to construct and operate nuclear power plants. These documents are made available to the public as

part of the Commission s policy to inform the nuclear industry and the general public of regulatory procedures and policies. Standard review plans are not substitutes for regulatory guides or the Commission's regulations and compliance with them is

not required. The standard review plan sections are keyed to the Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants. Not all sections of the Standard Format have a corresponding review plan.

Published standard review plans will be revised periodically, as appropriate, to accommodate comments and to reflect new

information and experience.

Comments and suggestions for improvement will be considered and should be sent to the U.S. Nuclear Regulatory Commission, Office of Nuclear Reactor Regulation, Washington, D.C. 20555.

3.9.7-1 Rev. 0 -August 1998
RI-IST Program changes which a licensee chooses to support (or is requested by the staff to

support) with risk information, Regulatory Guide 1.175 describes an acceptable method for

assessing the nature and impact of proposed RI-IST Program changes by considering

engineering issues and applying risk insights. Licensees submitting risk information should

address each of the principles of risk-informed regulation discussed in Regulatory Guide 1.175.

Licensees should identify how chosen approaches and methods (whether they are quantitative

or qualitative, and traditional or probabilistic), data, and criteria for considering risk are

appropriate for the decision to be made.

In this Standard Review Plan (SRP) section, the NRC staff describes procedures and

acceptance guidelines (referred to as Regulatory Positions in Regulatory Guide 1.175) for its

reviews of proposed plant-specific, risk-informed changes to a licensee's inservice testing (IST)

program. The review procedures herein are consistent with acceptable methods for

implementing a risk-informed IST (RI-IST) program consistent with Regulatory Guide 1.174 and

Regulatory Guide 1.175 (Ref. 2 and Ref. 3).

The licensee's RI-IST submittal should define the proposed changes to the IST program. The

licensee should have identified changes to the design, operation, and other activities at the

plant that would be changed by the proposed RI-IST program. The principal focus should be

on the use of PRA findings and risk insights in support of those proposed changes to a plant's

design, operation, and other activities that require NRC approval. Such changes include (but

are not limited to) license amendments under 10 CFR 50.90, requests for use of alternatives

under 10 CFR 50.55a, and exemptions under 10 CFR 12. However, the reviewer should note

that there are certain docketed commitments that are not related to regulatory requirements

that may be changed by licensees via processes other than as described in NRC regulations

(e.g., consistent with reference 9). The reviewer will need to evaluate the acceptability of

proposed changes to docketed commitments identified by the licensee (e.g., any changes to

commitments made by the licensee in response to NRC Generic Letter 89-10 or 96-05). The

licensee should have identified the particular components that would be affected by the

proposed changes to the IST program. This should include all of the components currently in

the licensee's IST program as well as any other components that the licensee's integrated

decisionmaking process categorized as being highly safety significant (HSSC). The method

used by the licensee to categorize components should be described. There should also be a

detailed description of how the proposed RI-IST program affects the design, operation, and

other activities at the plant and why these proposed changes are acceptable. If exemptions

from specific regulations, technical specification amendments, or relief requests are required to

implement the licensee's proposed RI-IST program, the appropriate requests should

accompany the licensee's submittal. Revisions to testing schedules and methods should be

described. The implementation and monitoring approach should be included. Details of the RIIST implementation plans and schedules should be available onsite for inspection.

The licensee should also have described the proposed IST program change in terms of how it

conforms to the objectives of the Commission's PRA Policy Statement, concerning enhanced

decisionmaking, more efficient use of resources, and reduction of unnecessary burden. The

description may consider such benefits from the change as reduced fiscal and personnel

resources and reduced radiation exposure, as well as increased reactor safety.

3.9.7-2 Rev. 0-August 1998
The reviewer should become familiar with the licensee's entire submittal before beginning the

detailed review described in the sections that follow. In short, the reviewer should develop an

understanding of the proposed change in terms of:

* the particular components that would be affected by proposed changes to the IST

program

* the plant systems involved with the proposed changes

* the change in testing strategy (i.e., test frequency and methods) proposed for each

component or group of components

* the affect of proposed changes on plant design, operation, and other activities

* the affect of proposed changes on the defense in depth philosophy and safety margins

* the effect of the changed testing strategy on overall plant risk

* the proposed implementation and monitoring strategies

In Regulatory Position 4 of Regulatory Guide 1.175 the staff describes in more detail the

documentation that the licensee should have submitted in conjunction with its proposed RI-IST

program.

1. AREAS OF REVIEW

A. ENGINEERING EVALUATION

1. Evaluation of Proposed Changes

For all components affected by the proposed RI-IST program change, the licensee should have

determined the acceptability of the proposed RI-IST program changes in light of the plant's

design, operation, and other activities.

2. IST Program Scope

The RI-IST program scope should include, in addition to components (e.g., pumps or valves) in

the current code-prescribed program, any other components categorized HSSC that were

identified as such as part of the PRA or licensee's integrated decision-making process (e.g.,

expert panel).

3. Changes To Component Test Requirements

This section discusses test strategy changes (i.e., changes to component test frequency,

methods, or both) that licensees should make as part of a RI-IST program.

3.9.7-3 Rev. 0-August 1998
4. Relief Requests and Technical Specification Amendments

Although implementation of the licensee's RI-IST program (i.e., in lieu of implementing an 1ST

program that is totally consistent with the ASME Code as endorsed in 10 CFR 50.55a) may be

authorized by exemption from the regulations or via NRC authorizing an alternative pursuant to

10 CFR 50.55(a)(3), specific details of the licensee's RI-IST program may require exemptions

from other regulations, technical specification changes, or require relief from provisions of NRC

approved Codes. The licensee should have included in the RI-IST program submittal the

necessary exemption requests, technical specification amendment requests, and relief requests

necessary to implement their RI-IST program.

5. Scope, Level of Detail, and Quality of the PRA for 1ST Application

The quality of a PRA required for RI-IST is commensurate with the role the PRA plays in the

determination of test strategies. The licensee's submittal should document how this quality is

assured. In addition, the submittal should document why the PRA quality, level of detail, and

scope are appropriate for the analysis, and how the integrated decision process compensates

for potential limitations in this quality, level of detail or scope.

6. Categorization of Components

The identification of components as potential candidates for changes in IST intervals or test

methods should be done using PRA importance measures to classify components into high and

low risk contributors. The results from this importance analysis should be one of the inputs to

the licensee's integrated decision-making process to help determine the safety significance of

the IST components.

In addition to the determination of risk importance contribution for input to the licensee's

integrated decision-making process, the determination of potential risk contribution from

components by PRA importance determination is useful for the following reasons:

* When performed with a series of sensitivity evaluations, the PRA importance

determination can identify potential risk outliers by identifying components which could

dominate risk for various plant configurations and operational modes, PRA model

assumptions, and data and model uncertainties.

* Importance categorization can provide a useful means to identify improvements to

current IST practices during the risk-informed application process by identifying

components that are high risk contributors which may benefit from more frequent tests

or enhanced testing methods.

7. Evaluating the Effect of Proposed Changes on Overall Plant Risk

One element in the approval of RI-IST changes is that proposed increases in core damage

frequency (CDF) and large early release frequency (LERF) are small and consistent with the

intent of the Commission's Safety Goal Policy Statement. In calculating this change in risk, the

licensee should have accounted for changes in component reliability/availability as a function of

test intervals and test methods. In addition, the affects of program changes on initiating event

3.9.7-4 Rev. 0-August 1998
frequency and common cause failures should have been considered. The use of appropriate

data (including generic and plant-specific component failure rates, and human error

probabilities and recovery probabilities) should have been justified as part of the calculation of

the risk change.

8. Integrated Decisionmaking

Justification of changes to the IST program should be based on results from both traditional

and probabilistic engineering analyses. These analyses should reflect the current plant design

and operating experience. Uncertainties in analysis models should be addressed by a stepwise implementation plan, and a performance monitoring and corrective action plan. The

proposed change will be acceptable when all these elements are combined in a complementary

fashion to show that an acceptable level of quality and safety is provided.

B. IMPLEMENTATION, PERFORMANCE MONITORING, AND CORRECTIVE ACTION

1. Program Implementation

The licensee should have an implementation plan and schedule established for testing all high

and low safety significant components identified in its RI-IST program. The staff should verify

that the plan contains test strategies (i.e., frequencies and methods) for high and low safety

significant components that are within the scope of the licensee's RI-IST program, including

those components identified as HSSCs that are not currently in the IST program. The

licensee's RI-IST program should not allow the immediate increase of the test interval of all low

safety significant components (LSSCs) to their maximum. Instead, a step-wise approach

should be employed.

One step-wise method to extend the test interval for LSSCs is to group similar components

based on component type, size, manufacturer, model, and service condition and staggering the

testing of the components in a group over an extended interval. Initially, it would be desirable to

test at least one component in each group every refueling outage. For component groups

which are insufficient in size to test one component every refueling outage, the implementation

of the interval extension should be accomplished in a step-wise manner. Components whose

test interval is to be extended via staggering should be identified along with their staggered

frequency over the test interval. Components should also be identified that are to have their

test frequency extended using some other step-wise approach. The final test interval of these

components should also be noted in the submittal.

2. Performance Monitoring of IST Component

Performance monitoring in RI-IST programs refers to the monitoring of inservice test data for

components within the scope of the RI-IST program including both HSSC and LSSC. The

purpose of performance monitoring in a RI-IST program is twofold. First, the performance

monitoring should help confirm that no unexpected failure mechanisms that are related to the

revised test strategy become important enough to alter the failure rates assumed in the

justification of proposed changes. Second, performance monitoring should, to the extent

practicable, ensure that adequate component capability margin exists, above that required

during design-basis conditions, so that component operating characteristics over time do not

3.9.7-5 Rev. 0-August 1998
result in reaching a point of insufficient margin before the next scheduled test activity.

Regulatory Guide 1.175 provides guidance on performance monitoring when testing under

design-basis conditions is impracticable. In most cases, component-level monitoring will be

expected.

Two important aspects of performance monitoring are whether the test frequency is sufficient to

provide meaningful data and whether the testing methods, procedures, and analysis are

adequately developed to ensure that performance degradation is detected. Component failure

rates should not be allowed to rise to unacceptable levels (e.g., significantly higher than the

failure rates used to support the change) before they are detected and corrected.

3. Feedback and Corrective Action Program

A performance-based corrective action program should be a part of the licensee's proposed

implementation and monitoring plan.

4. Periodic Reassessment

The reviewer should examine the licensee's RI-IST program to ensure that it contains

provisions whereby the overall program is periodically evaluated and component performance

data gets fed back into both the component categorization and component test strategy

determination (i.e., test frequency and methods) process. These assessments should also take

into consideration corrective actions that have been taken on past IST program components.

[This periodic reassessment should not be confused with the 120-month program updates

required by 10 CFR 50.55a(f)(5)(i), whereby the licensee's IST program must comply with later

versions of the ASME Code that have been endorsed by the NRC.]

5. RI-IST Program Changes After Initial Approval

The reviewer should examine the licensee's proposed RI-IST program to determine whether it

appropriately describes the types of changes that the licensee can make without prior NRC

approval and the types of changes that require NRC approval before implementation.

11. ACCEPTANCE GUIDELINES

A. ENGINEERING EVALUATION

1. Evaluation of Proposed Changes

The licensee should have reviewed applicable documents to identify proposed changes to the

IST program that would affect the design, operation, or other activities of the plant. On a

component-specific basis, the licensee should have (1) identified instances in which the

proposed RI-IST program change would affect the design, operation, and other activities of the

plant, (2) identified the source and nature of the requirement (or commitment), and (3)

documented the basis for the acceptability of the proposed requirement changes by addressing

the key principles.

3.9.7-6 Rev. 0-August 1998
The licensee must comply with 10 CFR 50.59, 50.90, and 50.109 as applicable. The reviewer

should recognize that there are certain docketed commitments that are not related to regulatory

requirements that can be changed by licensees via processes other than as described in NRC

regulations (e.g., consistent with Reference 9).

2. IST Program Scope

Licensee's RI-IST program scope should include all components in the current code-prescribed

IST program. In addition, the scope should include those non-code components that the

licensee's integrated decision-making process categorized as HSSC.

The staffs basis for reaching a conclusion that the licensee's proposed RI-IST program

"provides an acceptable level of quality and safety" will be predicated, in part, on the licensee's

use of PRA to identify the appropriate components that should be included in an RI-IST

program. In addition, PRA insights should be used to evaluate test requirements (i.e., test

methods and frequency). This will ensure that assumptions used to justify relaxations in testing

requirements for components within the scope of the current ASME Code-required IST program

remain valid.

3. Changes To Component Test Requirements

A RI-IST program should identify components that are candidates for an improved test strategy

(i.e., frequency, methods or both) as well as components for which the test strategy might be

relaxed. It should also, in some cases, identify components categorized HSSC that may not be

included in the present IST program. The information contained in, and derived from, the PRA

should be used to help construct the testing strategy for components. To the extent

practicable, components with high safety significance should be tested in ways that are

effective at detecting their risk-important failure modes and causes (e.g., ability to detect failure,

to detect conditions that are precursors to failure, and predict end of service life). [Note: The

test described in the current ASME Code may not be particularly effective in detecting the riskimportant failure modes and causes of a component or group of components. A more effective

test strategy for HSSC components may be to conduct an enhanced test at an extended test

interval.] Components categorized as LSSC may be tested less rigorously than components

categorized as HSSC (e.g., less frequent or informative tests).

In some situations, an acceptable test strategy for components categorized HSSC may be to

conduct the existing approved code IST test at the code-prescribed frequency. In some

situations, an acceptable test strategy for components categorized LSSC may be to conduct

the existing approved Code IST test at an extended interval.

An acceptable strategy for testing components categorized HSSC and LSSC should be defined

in NRC-approved ASME risk-informed Code Cases. Licensees who choose to pursue RI-IST

programs should have considered adopting of test strategies developed by ASME and

endorsed by the NRC. Deviations from endorsed Code Cases must be reviewed and approved

by the NRC staff as part of the RI-IST program review.

3.9.7-7 Rev. 0-August 1998
In establishing the test strategy for components, the licensee should consider component

design, service condition, and performance, as well as risk insights. The proposed test strategy

should be supported by data that are appropriate for the component. The omission of either

generic or plant-specific data should be justified. The proposed test interval should be

significantly less than the expected time to failure of the component as assumed in the PRA

(e.g., an order of magnitude less)'. In addition, the licensee should demonstrate that adequate

component capability margin exists, above that required during design-basis conditions, such

that component operating characteristics over time do not result in reaching a point of

insufficient margin before the next scheduled test activity.

The IST interval should generally not be extended beyond once every 6 years or 3 refueling

outages (whichever is longer) without specific compelling documented justification available

onsite for review. Extensions beyond 6

years or 3 refueling outages (whichever is longer) will be considered as component

performance data at extended intervals is acquired. The documented justification for interval

extensions beyond 6 years or 3 refueling outages should be available onsite for review. This is

not meant to restrict a licensee from fully implementing NRC-approved component Code

Cases.

Components categorized HSSC that are not in the licensee's current [ST program should

(where practical) be tested in accordance with the NRC-approved ASME risk-informed Code

Cases, including compliance with all administrative requirements. When ASME Section Xl or

O&M Code testing is not practical, alternative test methods should be developed by the

licensee to ensure operational readiness and to detect component degradation (i.e.,

degradation associated with failure modes identified as being important in the licensee's PRA).

As a minimum, a summary of components and proposed testing should be included in the RIIST program.

For components categorized as HSSC that were the subject of a previous NRC-approved relief

request (or an NRC-authorized alternative test) the licensee should discuss the appropriateness

of the relief in light of the safety significance of the component in their RI-IST program

submittal.

If practical, IST components (with the exception of certain check valves and relief valves)

should, as a minimum, be exercised or operated at least once every refueling cycle. More

frequent exercising should be considered for components in any of the following categories, if

practical

* Components with high risk significance,

* Components in adverse or harsh environmental conditions, or

* Components with any abnormal characteristics (operational, design,

or maintenance conditions).

l For example, the MOV exercise requirement (which is comparable to the current

stroke time test) should be performed at intervals considerably smaller than the expected time

to failure.

3.9.7-8 Rev. 0 - August 1998
The testing strategy for each component (or group of components) in the licensee's RI-IST

program should be described in the RI-IST program description. The RI-IST program

description should summarize all testing to be performed on a group of components (e.g.,

motor-operated valve (MOV) testing in response to NRC Generic Letter 96-05 (Ref.7)). The

specific testing to be done on each component (or group of components) should be delineated

in the licensee's IST program plan and is subject to NRC inspection.

4. Relief Requests and Technical Specification Amendments

The following are to be approved by the NRC before implementing the RI-IST program:

* A relief request for any component, or group of components, that is not tested in

accordance with the licensee's ASME Code of record or NRC-approved ASME Code

Case.

* A technical specification amendment request for any component, or group of

components, if there are changes from technical specification requirements.

5. Scope, Level of Detail, and Quality of the PRA for IST Application

To be acceptable for application to RI-IST, PRA models must reflect the as-built, as-operated

plant, and they must have been performed in a manner that is consistent with accepted

practices. The quality of the PRA has to be shown to be adequate, commensurate with the role

the PRA results play in justifying changes to the test intervals or strategies.

While a full-scope PRA, covering all modes of operation and initiating events is preferred, a

lesser scope PRA can be used to provide risk information, but it must be supplemented by

additional considerations during the integrated decisionmaking process.

Regulatory positions for the required PRA quality and scope are further defined in Regulatory

Guide 1.174.

The PRA model should be developed to the component level for the systems important to

safety.

6. Categorization of Components

When using risk importance measures to identify components that are low risk contributors, the

potential limitations of these measures have to be addressed. Therefore, information to be

provided to the licensee's integrated decisionmaking process should include evaluations that

demonstrate the sensitivity of the risk importance results to the important PRA modeling

techniques, assumptions, and data. Issues that the licensee should consider and address

when determining low risk contributors include truncation limit used, different risk metrics (i.e.,

CDF and LERF), different component failure modes, different maintenance states and plant

configurations, multiple component considerations, defense in depth, and analysis of

uncertainties (including sensitivity studies to component data uncertainties, common-cause

failures, and recovery actions).

3.9.7-9 Rev. 0-August 1998
While the categorization process can be used to identify areas in which testing strategy can be

improved and areas in which sufficient safety margins exist to the point that testing strategy can

be relaxed, it is the determination of the change in risk from the overall changes in the IST

program that will help determine acceptability of the RI-IST program. Therefore, there are no

generically applicable acceptance guidelines for the threshold values of importance measures

used to categorize components as HSSC or LSSC. Instead, the licensee should demonstrate

that the overall impact of the change on plant risk is small as discussed in the next section.

Therefore, when categorizing components that are not modeled in the PRA, licensees must

take into account the reasons why these components were omitted in the first place. Although

PRAs model many of the SSCs involved in performance of plant safety functions, some SSCs

are not modeled for various reasons. However, this should not imply that unmodeled

components are not important in terms of contributions to plant risk. For example, some

components are not modeled because certain initiating events may not be modeled (e.g., low

power and shutdown events, or some external events); in other cases, components may not be

directly modeled because they are grouped together with events that are modeled (e.g.,

initiating events, operator recovery events, or within other system or function boundaries); and

in some cases, components are screened out from the analysis because of assumed inherent

reliability, or failures modes are screened out because of their insignificant contribution to risk

(e.g., spurious closure of a valve). The licensee should either provide qualitative arguments

that the proposed change to the unmodeled components do not result in an increase on risk, or

demonstrate that the components significant to risk are maintained as HSSC. In classifying

components not modeled in the PRA as LSSC, the licensee's integrated decision making

process should have determined that:

* The component does not perform a safety function, or does not perform a support

function to a safety function, or does not complement a safety function.

* The component does not support operator actions credited in the PRA for either

procedural or recovery actions.

* The failure of the component will not result in the eventual occurrence of a PRA initiating

event.

* The component is not a part of a system that acts as a barrier to fission product release

during severe accidents.

* The failure of the component will not result in unintentional releases of radioactive

material even in the absence of severe accident conditions.

7. Evaluating the Effect of Proposed Changes on Overall Plant Risk

The change in risk from proposed changes to the IST program should be consistent with the

guidelines provided in Section 2.2.2 of Regulatory Guide 1.174. In comparing the calculated

risk to the guidelines, the licensee should address the model and completeness uncertainty as

3.9.7-1 0 Rev. 0-August 1998
discussed in Regulatory Guide 1.174. In addition, the licensee should address parameter

uncertainty either by propagating the uncertainty during sequence quantification or by

demonstrating that the "state-of-knowledge correlation" effect (Ref. 8) is not significant

especially in cutsets where the RI-IST changes affect multiple components which are similar.

In evaluating the change in overall plant risk from proposed changes in the IST program, the

licensee should perform the following:

* Evaluate the risk significance of extending the test interval on affected components.

This requires that the licensee address the change in component availability as a

function of test interval. The analysis should include either a quantitative consideration

of the degradation of the component failure rate as a function of time, supported by

appropriate data and analysis, or arguments which support the conclusion that no

significant degradation will occur.

* Consider the effects of enhanced testing to the extent needed to substantiate the

change.

Other issues that should be addressed in the quantification of the change in risk include the

following:

* The impact of the IST change on the frequency of event initiators (those already

included in the PRA and those screened out because of low frequency) should be

determined. For applications in RI-IST, potentially significant initiators include valve

failure that could lead to interfacing system loss-of-coolant accidents (LOCAs) or to

other sequences that fail the containment isolation function.

* The effect of common cause failures should be addressed either by the use of

sensitivity studies or by the use of qualitative assessments that shows that CCF

contribution would not become significant under the proposed IST requirements (e.g.,

use of phased implementation, staggered testing, and monitoring for common cause

effects).

* Justification of IST relaxations should not be based on credit for post-accident recovery

of failed components (repair or ad hoc manual actions, such as manually forcing stuck

valves to open). However, credit may be taken for proceduralized implementation of

alternative success strategies. For each human action that compensates for a basic

event probability increasing as a result of IST relaxation, there should be a licensee

commitment to ensure performance of the function at the level credited in the

quantification. Excessively low human failure probabilities should be adequately justified

and there should be adequate training programs, personnel practices, plant policies, etc.

to ensure continued licensee performance at that level.

* The failure rates and probabilities used for components affected by the proposed

change in IST should appropriately consider both plant-specific and generic data. The

licensee should determine whether individual components affected by the change are

performing more poorly than the average associated with their class; the licensee

should avoid relaxing IST for those components to the point that the unavailability of the

poor performers would be appreciably worse than that assumed in the risk analysis. In

3.9.7-1 1 Rev. 0-August 1998
addition, components that have experienced repeated failures should be reviewed to

see whether the testing scheme (interval and methods) would be considered adequate

to support the performance credited to them in the risk analysis.

* The evaluation should be performed so that the truncation of LSSCs is considered. It is

preferred that solutions be obtained form a re-solution of the model, rather than a

requantification of CDF and LERF cutsets.

* The cumulative impact of all RI-IST program changes (initial approval plus later

changes) should comply with the guidance in Regulatory Position 2.3.3 of Regulatory

Guide 1.175 and Section 2.2.4 of Regulatory Guide 1.174.

8. Integrated Decisionmaking

The licensee's RI-IST program submittal should meet the acceptance guidelines contained in

Sections II.A.1 through 7 (above) or should justify why an alternate approach is acceptable.

Proposed changes to IST strategies should be evaluated in an integrated fashion which takes

into account traditional and probabilistic engineering information, supplemented by a step-wise

implementation plan and a performance monitoring and corrective action plan. General

acceptance guidelines for this integrated decision process are provided in Regulatory Guide

1.174, and they consist of the following key principles:

1) The proposed change meets the current regulations unless it is explicitly related to the

requested exemption or rule change.

2) The proposed change is consistent with the defense in depth philosophy.

3) The proposed change maintains sufficient safety margins.

4) When proposed changes result in an increase in core damage frequency and/or risk,

the increases should be small and consistent with the intent of the Commission's Safety

Goal Policy Statement.

5) The impact of the proposed change should be monitored using performance

measurement strategies.

In demonstrating adherence to the above principles, reviewers should ensure that licensees

address the following issues as part of their RI-IST submittals:

All safety impacts of the proposed change are evaluated in an integrated manner as part

of an overall risk management approach in which the licensee is using risk analysis to

improve operational and engineering decisions broadly by identifying and taking

advantage of opportunities for reducing risk, and not just to eliminate requirements the

licensee sees as undesirable. For those cases when risk increases are proposed, the

benefits should be described and should be commensurate with the proposed risk

increases. The approach used to identify changes in requirements was used to identify

areas where requirements should be increased as well as where they could be reduced.

3.9.7-1 2 Rev. 0-August 1998
* The scope and quality of the engineering analyses (including traditional and probabilistic

analyses) conducted to justify the proposed licensing basis change are appropriate for

the nature and scope of the change and are based on the as-built and as-operated and

maintained plant, including reflecting operating experience at the plant.

* The plant-specific PRA that is used to support licensee proposals has been subjected to

quality controls such as an independent peer review or certification.

* Appropriate consideration of uncertainty is given in analyses and interpretation of

findings, including using a program of monitoring, feedback and corrective action to

address significant uncertainties.

* The use of CDF and LERF as bases for probabilistic risk assessment guidelines is an

acceptable approach to addressing Principle 4. Use of the Commission's Safety Goal

qualitative health objectives (QHOs) in lieu of LERF is acceptable in principle and

licensees may propose their use. However, in practice, implementing such an approach

would require an extension to a Level 3 PRA, in which case the methods and

assumptions used in the Level 3 analysis, and associated uncertainties, would require

additional attention.

* Increases in estimated CDF and LERF resulting from proposed changes are limited to

small increments. The cumulative effect of such changes should be tracked and

considered in the decision process.

* The acceptability of the proposed changes is evaluated in an integrated fashion that

ensures that all principles are met.

* Data, methods, and assessment criteria used to support regulatory decisionmaking are

clearly documented and available for review.

B. IMPLEMENTATION, PERFORMANCE MONITORING, AND CORRECTIVE ACTION

1. Program Implementation

The following implementation activities are acceptable:

* For components that will be tested in accordance with the test frequency and methods

required by the ASME Code, no specific implementation schedule is required. The test

frequency and method should be documented in the licensee's RI-IST Program Plan.

* For components that will be tested in accordance with NRC-endorsed ASME Code

Cases, implementation of the revised test strategies should be documented in the

licensee's RI-IST Program Plan.

* Alternate test strategies proposed by the licensee (i.e., for components within the scope

of the current ASME Code), should be specifically approved by the NRC.

3.9.7-1 3 Rev. 0-August 1998
The licensee should increase the test interval for components in a step-wise manner (i.e., equal

or successively smaller steps, not to exceed one refueling cycle per step). If no significant

time-dependent failures occur, then the interval can be gradually extended until the component

is tested at the maximum proposed extended test interval. An acceptable approach is to group

similar components and test them on a staggered basis. Initially, it would be desirable to test at

least one component in each group every refueling outage. Guidance on grouping components

is contained in NRC Generic Letter 89-04, Position 2 for check valves (Ref. 5); Supplement 6 to

NRC Generic Letter 89-10 for motor-operated valves (Ref. 6); or other documents endorsed by

the NRC.

2. Performance Monitoring of IST Component

Monitoring programs should be proposed that are capable of adequately tracking the

performance of components that, when degraded, could alter the conclusions that were key to

supporting the acceptance of the RI-IST program. Monitoring programs should be structured

such that components are monitored commensurate with their safety significance. This allows

for a reduced level of monitoring of components categorized as having low safety significance

(LSSC) provided the guidance below is still met.

The acceptance guidelines for this item consist of evaluating the licensee's proposed

performance monitoring process to ensure that it has the following attributes:

* Enough tests are included to provide meaningful data,

* The test is devised such that incipient degradation can reasonably be expected to be

detected, and

* The licensee trends appropriate parameters as required by the ASME Code or ASME

Code Case and as necessary to provide reasonable assurance that the component will

remain operable over the test interval.

Assurance must be established that degradation is not significant for components that are

placed on an extended test interval, and that failure rates assumed for these components are

not compromised. It must be clearly established that those test procedures and evaluation

methods are implemented that reasonably ensure that degradation will be detected and

corrective action will be taken.

3. Feedback and Corrective Action Program

The licensee's corrective action program for this application is acceptable if it contains a

performance-based feedback mechanism to ensure that if a particular component's test

strategy is adjusted in a way that is ineffective in detecting component degradation and failure,

particularly potential common cause failure mechanisms, the RI-IST program weakness is

promptly detected and corrected. Performance monitoring should be provided for systems,

structures, and components with feedback to the RI-IST program for appropriate adjustments

when needed.

The licensee's corrective action program should evaluate RI-IST components that either fail to

meet the test acceptance criteria or are otherwise determined to be in a nonconforming

condition (e.g., a failure or degraded condition discovered during normal plant operation).

3.9.7-14 Rev. 0-August 1998
The licensee's corrective action procedures should:

* Comply with 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action."

* Determine the impact of the failure or nonconforming condition on system/train

operability and follow the appropriate Technical Specification when component capability

cannot be demonstrated.

* Determine and correct the apparent or root cause of the failure or nonconforming

condition (e.g., improve testing practices, repair or replace the component). The root

cause of failure should be determined for all components categorized as having high

safety significance, as well as for components categorized LSSC when the apparent

cause of failure may contribute to common cause failures.

* Assess the applicability of the failure or nonconforming condition to other components in

the IST program (including any test sample expansion that may be required for grouped

components such as relief valves).

* Correct other susceptible similar IST components as necessary.

* Consider the effectiveness of the component's test strategy in detecting the failure or

nonconforming condition. Adjust the test frequency or methods or both, as appropriate,

when the component (or group of components) experiences repeated or age-related

failures or nonconforming conditions.

The corrective action evaluations should periodically be given to the licensee's PRA group so

that any necessary model changes and regrouping are done as might be appropriate. The

effect of the failures on overall plant risk should be evaluated and the fact that the corrective

actions taken will restore the plant risk to an acceptable level should be confirmed.

The RI-IST program documents should be periodically revised to record any RH-IST program

changes resulting from corrective actions taken.

4. Periodic Reassessment

The test strategy for IST components should be periodically assessed to reflect changes in

plant configuration, component performance, test results, and industry experience.

5. RO-ST Program Changes After Initial Approval

Licensees can change their RI-IST programs consistent with the process (i.e., as defined in the

RI-ST Program Description) and results that were reviewed and approved by the NRC staff.

As discussed in Section V below, the overall RI-IST program, including changes thereto, are

enforceable under 10 CFR 50.55a. Examples of changes to RI-IST programs that would not

require review and approval may include, but are not limited to, the following:

* Changes to component groupings, test intervals, and test methods that do not involve a

change to the overall RI-IST approach which was reviewed and approved by the NRC,

* Component test method changes that involve the implementation of an NRC endorsed

ASME Code or an NRC-endorsed Code Case,

3.9.7-1 5 Rev. 0 - August 1998
* Re-categorization of components due to experience, PRA insights, or design changes

but not programmatic changes where the process used to recategorize the components

is consistent with the RI-IST process and results that were reviewed and approved by

the NRC.

Changes to RI-IST programs that would require review and approval may include, but are not

limited to, the following:

* Changes to the RI-IST program that involve programmatic changes (e.g., changes in

the acceptance guidelines used for the licensee's integrated decision making process),

* Test method changes that involve deviation from the NRC-endorsed Code

requirements, NRC-endorsed Code Case, or published NRC guidance.

The cumulative impact of all RI-IST program changes (initial approval plus later changes)

should comply with the guidance in Regulatory Position 2.3.3 of Regulatory Guide 1.175 and

Section 2.2.4 of Regulatory Guide 1.174.

Changes to a licensee's RI-IST program should also be evaluated using change mechanisms

described in the regulations (e.g., 10 CFR Part 50.55a, 10 CFR Part 50.59), as appropriate, to

determine whether prior NRC staff review and approval is required before implementation.

111. REVIEW PROCEDURES

A. REVIEW OF THE LICENSEE'S ENGINEERING EVALUATION

1. Evaluation of Proposed Changes

The reviewer should verify that the licensee reviewed the applicable licensing-basis documents

to identify proposed changes to the IST program that would affect the design, operation, and

other activities of the plant. On a component-specific basis, the licensee should have (1)

identified instances in which the proposed IST program change would affect the design,

operation, and other activities of the plant, (2) identified the source and nature of the

requirement (or commitment), and (3) documented the basis for the acceptability of the

proposed requirement changes by addressing the key principles.

The reviewer should consider other licensing-basis documents (e.g., Technical Specifications,

FSAR, responses to NRC generic letters) in addition to the IST program documentation to

identify and evaluate changes to the design, operation, and other activities of the plant. The

principal focus should be on the use of PRA findings and risk insights in support of those

proposed changes to a plant's design, operation, and other activities that require NRC approval.

Such changes include (but are not limited to) license amendments under 10 CFR 50.90,

requests for use of alternatives under 10 CFR 50.55a, and exemptions under 10 CFR 12.

However, the reviewer should note that there are certain docketed commitments, that are not

related to regulatory requirements that may be changed by licensees via processes other than

as described in NRC regulations (e.g., consistent with Reference 9). The licensee should have

identified any docketed commitments that would be affected by their proposed RI-IST program.

The reviewer should evaluate the acceptability of any changes to docketed commitments

3.9.7-1 6 Rev. 0-August 1998
associated with the proposed RI-IST program (e.g., changes to commitments made by the

licensee in response to NRC Generic Letter 89-10 or 96-05). If the reviewer concludes that

there is an "unacceptable" impact upon other commitments, then the reviewer must prepare a

safety evaluation addressing why the commitment is necessary from a safety standpoint2.

On a component-specific basis, the reviewer should evaluate the acceptability of each proposed

change that affects plant design, operation, or other activities. A determination of acceptability

should consider the original acceptance conditions, criteria, and limits, as well as the key

principles identified in Section I.A.8 above.

2. IST Program Scope

The reviewer should examine the proposed RI-IST program and verify the following:

* For selected systems, components that perform a safety-related function(s) are in the

proposed RI-IST program.

* All components categorized by the licensee's integrated decision-making process as

HSSC are included in the RI-IST program, regardless of their status in the licensee's

current IST program.

3. Changes To Component Test Requirements

By examining the licensee's material for a representative sample of components, the reviewer

should verify that the licensee considered component design, service condition, and

performance, as well as risk insights, in establishing the technical basis for each component's

(or group of components) test strategy. The licensee's rationale for the proposed change in

test interval and its relationship to expected time to failure should be reviewed. The reviewer

should verify that the proposed test strategies are supported by applicable generic or plantspecific failure rate data. The reviewer should verify that proposed test intervals are less than

the expected time to failure of the components in question. In addition, the reviewer should

spot check the licensee's calculations or basis for concluding that adequate component

capability exists, above that required during design basis conditions, so that component

operating characteristics over time do not lead to a point of insufficient margin before the next

scheduled test activity. The reviewer should verify that the IST intervals are not extended

beyond once every 6 years or beyond three refueling outages (whichever is longer) without

specific compelling documented justification. Extensions beyond 6 years or beyond three

refueling outages should be considered as component performance data at extended test

intervals is acquired.

2 Unless the technical adequacy of the licensee's proposal is dependent upon the

affected commitment determined to be unacceptable, the Staff reviewer should prepare either:

(i) a backfit analysis showing that imposition of the commitment will constitute a cost-justified

substantial increase in protection to public health and safety, or (ii) a "documented evaluation"

demonstrating that one or more of the exceptions in Section 50.109(a)(4) have been met.

3.9.7-1 7 Rev. 0 -August 1998
The reviewer should verify that the licensee made a commitment to adopt enhanced test

strategies as described in the risk-informed IST Code Cases developed by ASME, as endorsed

by the NRC. If the licensee chooses not to adopt one or more of these Code Cases (or if such

a Code Case is unavailable, the reviewer should examine the licensee's written technical

justification outlining why it is impractical to implement the risk-informed Code Case strategy

and should assess the adequacy of the licensee's proposed alternative test strategy.

The reviewer should verify that the licensee's RI-IST program identifies and tests components

categorized HSSC that are not in the licensee's current IST program commensurate with their

safety significance or that the licensee has demonstrated that a suitable search for such

components was conducted. These components should be tested in accordance with the

ASME Code where practical, including compliance with all administrative requirements. When

ASME Section Xl or OM Code testing is not practical, the licensee should have proposed

alternate test methods to ensure operational readiness and to detect component degradation

(i.e., degradation associated with failure modes identified as being important in the licensee's

PRA). NRC should review and approve these alternate test strategies before implementation of

the RI-IST program at the plant.

The reviewer should verify that the licensee assessed the appropriateness of relief for

components categorized as HSSC that were the subject of a previous NRC-approved relief

request (or an NRC-authorized alternative test) in light of the safety significance of the

component.

The reviewer should verify that the licensee has made a commitment to exercise or operate IST

components (except for certain check valves and relief valves) at least once every refueling

cycle if practical.

4. Relief Requests and Technical Specification Amendments

For components categorized as HSSC or LSSC not tested in accordance with the code test

method requirements or NRC-endorsed Code Case, specific relief would be required from the

applicable code requirements. Relief would also be required from the code test frequency

requirements for components of high safety significance not tested at the code-required

frequency. Relief is not required to adjust the test interval of individual LSSC provided it

conforms with the process reviewed and approved by the NRC staff or conforms with the

process described in an NRC-endorsed ASME Code Case.

* The reviewer should verify that requests for relief or proposed alternate testing have

been submitted to the NRC for approval. The reviewer should verify that the licensee

has submitted technical specification amendment requests for proposed changes that

affect the technical specifications.

* The reviewer should examine the basis for requests for relief and alternatives and

should assess the adequacy of the implementation of the alternative testing.

3.9.7-1 8 Rev. 0-August 1998
5. Scope, Level of Detail, and Quality of the PRA for IST Application

Review guidelines for PRA scope, level of detail, and quality are presented in Section 111.2.2

and Appendix A of SRP Chapter 19 (Ref.4) and are summarized below.

PRA Scope: Reviewers should ensure that they understand the scope of the PRA, and in

particular, what initiating events and operating modes are not represented in the PRA model. It

will be necessary to ensure that these missing contributions to risk are treated appropriately in

the integrated decisionmaking process.

Level of Detail: In RI-IST, the PRA would normally be used for two purposes: to provide input

to the categorization of components, and to evaluate the change in risk. Typically, a PRA

model will include both safety-related and non-safety-related components. The reviewer should

determine that all the components in the LSSC category are either modeled in the PRA and

have been treated appropriately, or there are qualitative arguments why they do not contribute

to risk. When evaluating the impact of the change on risk, the PRA model has to be sufficiently

detailed that the impact of the change on individual components can be accommodated, either

because there are events in the model that are in direct correspondence with the affected

components, or there is a mapping of the impact onto events in the model. Components for

which there is no mapping must be addressed with supplementary arguments.

Quality: The licensee must show that the PRA has been performed correctly and in a manner

that is consistent with accepted practices, and commensurate with the scope and level of detail

discussed above. If the approach to ensuring quality includes, in part, a peer review (e.g., an

independent peer review, an industry PRA certification, or an industry PRA cross comparison),

the staff reviewer should determine that the peer review process has been performed by

qualified individuals with knowledge of PRA techniques and practices. Reviewers should use

SRP Chapter 19, Appendix A as a guide to perform their own limited review of the PRA.

6. Categorization of Components

When risk importance measures are used to group components as low risk significant,

additional evaluations, sensitivity studies and other considerations have to be taken into

account. Review procedures for component risk categorization are provided in Appendix C of

SRP Chapter 19.

One of the considerations discussed in Appendix C of SRP Chapter 19 is the issue that

importance measures cannot address the integrated impact of the change. This aspect is best

addressed during the quantification of the impact of the change (item 7 below).

Typically, the PRA derived categorization will only address a subset of the contributions to risk.

That is, if the PRA only models internal event initiators at full power operations, results from risk

importance calculations will only be applicable for these events. If the PRA results are adopted

for other contributors, the reviewer should determine whether the same assumptions that apply

for the PRA model are likely to apply under the conditions being addressed. For example, a

3.9.7-1 9 Rev. 0-August 1998
component categorized as LSSC based on results from a full-power PRA may not be a low risk

contributor at shutdown conditions even if the component function and operating state is the

same for both full-power and shutdown conditions. In this case, reduced redundancy in certain

configurations may make a difference in the determination of risk importance.

7. Evaluating the Effect of Proposed Changes on Overall Plant Risk

There are two major areas of review: the modeling of the impact of the change on individual

components, and the propagation of these impacts through the PRA model for the calculation

of plant risk.

Modeling of the Effects of IST on PRA Basic Events

The review procedure for the modeling of the effects of IST changes on individual components

involves the following steps:

* Identify the assumptions underlying, and the characteristics of the model used to

evaluate the risk significance of extending selected component test intervals.

* Establish whether the validity of the model depends on the efficacy of the tests to be

performed as part of the IST program.

* If the model does not address degradation, review the arguments why degradation is

not a significant effect,

If the model requires the estimation of an exposure time, the reviewers should establish that the

fault exposure time credited in the PRA is reasonable in light of the IST interval and other

activities. In general, the mean fault exposure time will be taken to be one half of the test

interval. Some analyses may apply a fault exposure time other than this: a different fault

exposure time for a given component might be claimed as a result of credit taken for non-IST

validation of the performance of the component, perhaps by virtue of system challenges, or an

IST test on a different component that implicitly requires functioning of the subject component

and would therefore reveal a failed state of the subject component. The reviewer should

establish that the licensee has identified a basis for fault exposure times modeled, and that

commitments are in place wherever a fault exposure time is determined by a programmatic

activity. Where a fault exposure time is the result of tests on other components, the reviewer

should verify that there is assurance that these other tests will be performed and that the

behavior of the subject component will be surveilled in the course of these tests. Where a fault

exposure time is the result of system challenges, the reviewer should verify that this challenge

frequency is consistent with system challenge frequencies modeled elsewhere in the PRA.

Evaluation of Change in Risk

The comparison of the quantitative results of the PRA with the regulatory positions contained in

acceptance guidelines of Regulatory Guide 1.174 provides input to the demonstration that, if

increases in risk are proposed, these increases are small and consistent with the intent of the

3.9.7-20 Rev. 0 -August 1998
Commission's Safety Goal Policy Statement. General guidance on the evaluation of the

change in risk is given in Section 111.2.2 and Appendix A of SRP Chapter 19. Some issues

specific to the IST evaluation are given below.

Initiating Events: The reviewer is not expected to independently verify the licensee's

evaluation of the effect of [ST program changes on initiating event frequency. Rather,

the reviewer is expected to look for evidence that the licensee has considered the

effects of IST changes on initiating events that were analyzed in the PRA and those that

were previously screened out from the analysis to determine whether these events can

become more important as a result of the IST change. However, if a licensee argues for

a relaxation in testing frequency and/or method based on the adverse risk effects of

testing, the reviewer should review the calculational basis, especially if other plants of

the same type have not drawn similar conclusions.

Common Cause Failures (CCFs): The reviewer should check to confirm that the impact

of the IST change on potential CCFs has been considered in the PRA. It is important

that the selection of common component groups was performed correctly to ensure that

important common cause failure groups were not omitted. As a minimum, the CCF

groups should include: redundant standby pumps; redundant MOVs and air-operated

valves (AOVs) that change state; redundant check valves; and any other components

that change state in order to support IST component operability. Changes to CCF

probabilities could result from increases in the individual component failure probabilities,

or could occur as a result of an increase in the CCF model parameters (e.g., beta

factors, multiple Greek letter factors. etc.) If credit is taken for improved testing or

staggered testing, reviewers should check that licensees have established that

performance monitoring is capable of detecting CCF before multiple failures are allowed

to occur subsequent to an actual system challenge.

Human Reliability Analysis (HRA): The IST-specific aspects of HRA include errors

related to testing, and quantification of compensating human actions. Errors related to

testing are those that leave equipment unavailable until the condition is discovered

during a subsequent test or until the equipment is demanded (i.e., a restoration error).

Reviewers should verify that the assumptions, models, and data used to quantify this

error are consistent with the revised test strategies. The quantification of compensating

human actions refers to the credit taken for actions for purposes of deciding on IST

changes. Reviewers should confirm that credit for compensating human actions is

limited to proceduralized actions taken to actuate systems and that repair of failed

equipment is not considered. The intent of this review is to ensure that licensees do not

relax IST on the basis of relatively uncertain quantification of recovery probabilities.

* Component Failure Rates: The reviewer should establish that failure rates for

components that are important in the justification of the IST change are consistent with

plant-specific data. Failure rates that are appreciably less than generic data (e.g., those

that are more than a factor of 3 lower than generic data) should be justified. To use the

lower plant-specific failure rate, it must be demonstrated that the plant-specific failure

rate data came from a population statistically different from the generic population and

an engineering rationale should be provided. The reviewer should ascertain whether the

failure rate takes account of special environmental stresses or aging. If not, this should

figure in the evaluation of the performance monitoring and feedback activity.

3.9.7-21 Rev. 0 - August 1998
Quantification of Risk Impact: Reviewers should ensure that the evaluation of the

change has not been performed non-conservatively by, for example, using a predetermined cutset solution and requantifying the basic event probabilities, rather than

resolving the equations with the higher values. In addition, because of the simultaneous

increase in basic event probabilities associated with like components, it is important to

consider the impact of parameter uncertainties and the state-of-knowledge correlation.

This can be done by either propagating uncertainties or showing that the contributing

cutsets will not be affected by this correlation.

8. Integrated Decisionmaking

If the licensee's submittal regarding changes to component test strategies meets the

acceptance guidelines as specified in Section II, the submittal could be deemed to have used

an integrated decisionmaking process which ensures that the principles and expectations of

risk-informed regulation are met. This section provides procedures for the overall review of the

different elements of the integrated decisionmaking, and how these elements can complement

or compensate for others.

The licensee's records should clearly identify all factors considered in the decision process and

the basis for the proposed changes to the IST program. On a sampling basis, the reviewer

should conduct an independent evaluation to determine whether the licensee's conclusion is

technically sound. The reviewer's determination that the proposed alternative will provide "an

acceptable level of quality and safety" [Ref. 10 CFR 50.55a (a)(3)(i)] should be based on this

independent assessment.

The review of the proposed IST program change is discussed in Section III.A.1 and the

requirements for an exemption or a relief request associated with are discussed in Section

III.A.4. In evaluating the process for defining the overall change, reviewers should determine

whether the licensee has used an approach where risk insights were also used to improve test

strategies, and not just to relax testing requirements. This is discussed more in Sections

III.A.2 and III.A.3 under the review of program scope and strategy.

In evaluating the impact from changes to the [ST program, reviewers should determine that the

change is consistent with the defense in depth philosophy. Accounting for defense in depth is

an effective way to compensate for uncertainties in equipment and human performance. In

some cases, risk analysis can help quantify the range of uncertainty; however, there will remain

areas of relatively large uncertainty or areas not covered by the risk analysis. Therefore, where

a comprehensive risk quantification is not, or cannot be done, traditional defense in depth

considerations should be used or maintained to account for uncertainties. Review guidelines

for defense in depth considerations is provided in SRP Chapter 19. For IST changes, defense

in depth is preserved if, for example:

* The risk analysis shows that a reasonable balance is maintained between prevention of

core damage, prevention of containment failure, and consequence mitigation.

* System redundancy, independence, and diversity are maintained commensurate with

the expected frequency and consequences of challenges to the system. The effects on

system redundancy, independence, and diversity from potential common cause failures

3.9.7-22 Rev. 0 -August 1998
that could result from IST changes are addressed as part of the risk quantification

and/or as part of the implementation and monitoring strategies associated with the IST

change.

Credit taken for operator actions to compensate for relaxations in IST are justified and

these actions are backed up by licensee commitment (e.g., training, plant procedures,

etc.). Credit is not taken for non-proceduralized actions (e.g. for the recovery of failed

components). This ensures that the change preserves defenses against human errors.

Another element of the integrated decisionmaking is the assurance that sufficient safety

margins are maintained. In applications that seek relaxations in the IST strategy, safety

margins could be decreased. The level of justification required for such changes in margin

should depend on how much uncertainty is associated with the performance parameter in

question (e.g., component failure rate as a function of time for applications that seek to extend

test intervals), the availability of alternatives to compensate for adverse performance, and the

consequences of functional failure of the affected components. For example, safety margin is

maintained if:

* ASME Codes or alternatives approved for use by the NRC are met.

* Safety analysis acceptance criteria (e.g., USAR, supporting analyses) are met.

* In applications that propose to extend test intervals, component degradation is

accounted for, either by quantitative methods (analysis and data) or by qualitative

arguments which show that significant degradation will not occur. Component

degradation can also be addressed by the use of enhanced testing methods and the

trending of the required performance parameter to determine an acceptable test

interval.

* The component categorization process is robust, and the components identified for

relaxation in IST because of their low safety significance based on this categorization

will only have a small effect on plant risk. In addition, test intervals are based on a

margin to failure (by trending of performance characteristics) that is commensurate with

the risk significance of the component.

The categorization of components will be based in part on results from importance/risk rankings

from a PRA. Since importance measures are only applicable to components taken one at a

time, these measures are not an adequate measure of the change in total risk for changes that

involve more than one component. Therefore, reviewers should confirm that the overall impact

from an IST change is calculated, and that if risk increases are proposed, these increases are

small and consistent with the intent of the Commission's Safety Goal Policy Statement. Section

111.2.2 of SRP Chapter 19 contains guidance on the review of the overall risk impact.

Although the categorization process and the assessment of risk impact requires that all plant

operating modes and initiating events be addressed, it is not necessary in RI-IST that licensees

submit PRAs that treat all plant operating modes and all initiating events. Instead, when full3.9.7-23 Rev. 0 - August 1998
scope PRAs are not available, reviewers should ensure that the submitted findings are

supportable on the basis of available risk insights, traditional engineering analyses or other

plant operational information addressing modes and initiators not analyzed in the base PRA.

Section 111.2.2 of SRP Chapter 19 provides review guidance on this topic.

When relaxations in IST strategy are offset by alternative measures (e.g., additional monitoring,

different tests, procedures, training, etc.), the licensee should identify, and quantify to the extent

practicable, the effects of these alternative measures. Similarly, if there are benefits associated

with proposed relaxations (e.g., reduction in initiating event frequency, reduction in system

misalignment, reduction in radiation exposure), the licensee should identify, and quantify to the

extent practicable, the effects of these benefits. As a general rule, the alternative measures

and benefits should be directly linked to the systems or components associated with proposed

relaxations. However, on a case by case basis, the staff may also assess the licensee's

proposed improvements made to the test strategy for a group of components against proposed

relaxations in test requirements for another group of components in assessing the overall

acceptability of a proposed RI-IST program. For example, the risk increase associated with

relaxation of requirements for a group of low safety significant components may be deemed

acceptable in light of improvements made to a group of more high safety significant

components on the basis of quantitative or qualitative arguments on the overall change in risk.

The factors considered by the licensee's integrated decisionmaking process, as well as the

basis for the licensee's integrated decisionmaking process conclusion, should be clearly

documented. The reviewer should evaluate this documentation to see whether there is

adequate technical justification for the licensee's decisions.

Finally, review of the integrated decisionmaking process should include an evaluation of the

licensee's proposed implementation, monitoring and corrective action program, and how this

program is used to complement the risk analysis (monitoring for unexpected failure

mechanisms), the defense in depth analysis (in terms of prevention of common cause failures),

and the analysis of safety margins (trending of component performance relative to the margins

to failure). Guidance for this review is provided in Sections III.B.1 through lll.B.3.

Additional review guidance for the licensee's integrated decisionmaking process is presented in

Appendix B and in Section C.2 of Appendix C of SRP Chapter 19.

B. REVIEW OF IMPLEMENTATION, PERFORMANCE MONITORING, AND

CORRECTIVE ACTION

1. Program Implementation

The reviewer should check the adequacy of the justification for extending the test interval for a

sample of low safety significant components to verify that the extension is appropriate. The test

intervals for LSSC may be implemented at the discretion of the licensee after the NRC

approves the RI-IST program. The reviewer should verify that the licensee is increasing the

test interval for low safety significant components in a step-wise manner. Component

corrective action procedures should be in place for LSSC being tested on a step-wise basis

before any test intervals are extended.

3.9.7-24 Rev. 0-August 1998
HSSC and LSSC that will continue to be tested in accordance with the ASME Code

requirements for the licensee's code of record, or ASME Code Cases that have been endorsed

by the NRC, require no further review by the reviewer and are subject to site-specific

inspections.

The reviewer should verify that the licensee has developed plant corrective action and feedback

procedures to ensure that testing failures are reevaluated for possible adjustment to the

component's grouping and test strategy.

2. Performance Monitoring of IST Component

The review procedures consist of the following steps:

* The performance monitoring program is identified in the licensees proposal for RI-IST.

* The program is reviewed to determine whether it contains a test program that will

provide sufficient data to detect component degradation in a timely manner, as

described in Section II.B.2.

The reviewer should determine whether the licensee's monitoring process for RI-IST is

coordinated with existing programs for monitoring components performance and other

operating experience on their site and, when appropriate, throughout the industry. In particular,

monitoring that is performed as part of the Maintenance Rule (10 CFR Part 50.65)

implementation can be used in the RI-IST program when the monitoring performed under the

Maintenance Rule is sufficient for the components in the RI-IST program. As stated in Section

2.3 of Regulatory Guide 1.174, if an application requires monitoring of structures, systems, and

components (SSCs) not included in the Maintenance Rule, or SSCs that need a greater

resolution of monitoring than the Maintenance Rule (component- vs. train- or plant-level

monitoring), it may be advantageous for a licensee to adjust the Maintenance Rule monitoring

program rather than to develop additional monitoring programs for RI-IST purposes. Therefore,

the licensee may have adjusted the Maintenance Rule performance criteria to meet the

guidance in Regulatory Position 3.3 of Regulatory Guide 1.175 (i.e., the same guidance

provided in Section Il.B.2 above).

3. Feedback and Corrective Action Program

The reviewer should examine the licensee's corrective action program to verify that it is initiated

by component failures that are detected by the IST program as well as by other mechanisms

(e.g., normal plant operation, inspections).

The reviewer should verify that the licensee's corrective action procedures meets the

acceptance guidelines specified in Section ll.B.3.

The reviewer should verify that corrective action evaluations are given to the licensee's PRA

group so that any necessary model changes and regrouping can be periodically done by the

PRA group, if appropriate.

3.9.7-25 Rev. 0-August 1998
The reviewer should verify that procedures are in place to ensure that corrective actions

affecting the IST program get documented, as appropriate, in the licensee's RH-IST program.

4. Periodic Reassessment

The reviewer should assess the licensee's procedures for conducting the periodic risk-informed

IST program review to ensure that it

* prompts the licensee to conduct overall program assessments periodically to reflect

changes in plant configuration, component performance, test results, and industry

experience

* prompts the licensee to review and revise as necessary the models and data used to

categorize components to determine whether component groupings have changed

* prompts the licensee to reevaluate equipment performance (based on both plantspecific and generic information) to determine whether the IST program should be

adjusted

The reviewer should verify that the licensee has incorporated the results of its corrective action

program for IST program components into its periodic IST program reassessment.

The reviewer should verify that the licensee has procedures in place to identify the need for

more emergent RI-IST program updates (e.g., following a major plant modification or following

a significant equipment performance problem).

The periodic RI-IST program review conducted by the licensee may be done in conjunction with

the plant's periodic PRA updates, industry operating experience programs, the Maintenance

Rule program, and other risk-informed program initiatives.

5. RI-IST Program Changes After Initial Approval

The reviewer should verify that the licensee has a process or procedures in place to assure that

changes that meet the acceptance guidelines in Section ll.B.5 (above) are reviewed and

approved by the NRC staff prior to implementation.

IV. EVALUATION FINDINGS

The reviewer should write an introduction to the safety evaluation that

describes the proposed change in terms of

* the particular components that would be affected by the proposed changes in IST

program

* the plant systems involved with the proposed changes

* the change in testing strategy (i.e., test frequency and methods) proposed for each

component or group of components

3.9.7-26 Rev. 0 - August 1998
* the affect of proposed RI-IST program on the design, operation, and other activities of

the plant

* the affect of the proposed changes on the defense in depth philosophy and safety

margins

* the overall affect of the changed testing strategy on plant risk

* the proposed implementation and monitoring strategies

A. ENGINEERING EVALUATION

1. Evaluation of Proposed Changes

The reviewer should verify that sufficient information is provided in accordance with the

requirements herein and that the evaluation supports conclusions of the following type, to be

included in the staffs safety evaluation report:

On a component-specific basis, the NRC staff has reviewed each IST program change

as it affects the design, operation, and other activities of the plant. In conducting its

review, the staff considered the original acceptance conditions, criteria, and limits, as

well as the key principles identified in Section 2 of Regulatory Guide 1.174. Due

consideration was given to diversity, redundancy, defense in depth, safety margins, and

other aspects of the General Design Criteria. Having conducted this review, the staff

finds that the RI-IST program changes proposed by the licensee are acceptable.

2. IST Program Scope

The reviewer should verify that sufficient information is provided in accordance with the

requirements herein and that the evaluation supports conclusions of the following type, to be

included in the staffs safety evaluation report:

The staff concludes that the scope of the licensee's RI-IST program is acceptable

because it includes, in addition to components (e.g., pumps or valves) in the current

code-prescribed program, any other components categorized HSSC that were identified

as such as part of the PRA or licensee's integrated decision-making process (e.g.,

expert panel).

3. Changes To Component Test Requirements

The reviewer should verify that sufficient information is provided in accordance with the

guidelines herein and that the evaluation supports conclusions of the following type, to be

included in the staffs safety evaluation report:

* The licensee considered component design, service condition, and performance, as well

as risk insights, in establishing the test strategy for components. The proposed test

intervals for components were less than the expected time to failure of the components.

In addition, the licensee ensured that adequate component capability existed, above that

3.9.7-27 Rev. 0-August 1998
required during design basis conditions, such that component operating characteristics

over time will not result in reaching a point of insufficient margin before the next

scheduled test activity. The RI-IST intervals for components were generally not

extended beyond once every 6 years or once every three refueling outages (whichever

is longer). In every instance where the interval was extended beyond 6 years or beyond

three refueling outages (whichever is longer), the licensee submitted a specific,

compelling, documented justification that the staff found acceptable. [Each instance

should be explicitly addressed in the safety evaluation report.]

* The licensee also made a commitment to either adopt enhanced test strategies as

described in RI-IST Code Cases developed by ASME, as endorsed by the NRC, or to

request authorization from the NRC to perform an alternate test strategy.

* The licensee provided the staff with a description of the testing to be conducted on

components of high safety significance that were not in the licensee's current IST

program.

* The licensee assessed the appropriateness of relief for components categorized as

HSSC that were the subject of a previously approved relief request (or an NRCauthorized alternative test) in light of the safety significance of the component. The

staff finds that relief for these components is still appropriate. [Each instance should be

explicitly addressed in the safety evaluation report.]

* The licensee has made a commitment to exercise or operate IST components (except

for certain check valves and relief valves) at least once every refueling cycle where

practical.

4. Relief Requests and Technical Specification Amendments

The reviewer should verify that sufficient information is provided in accordance with the

requirements herein and that the evaluation supports conclusions of the following type, to be

included in the staffs safety evaluation report:

* The licensee's RI-IST program is testing components of high safety significance in

accordance with the code test frequency and method requirements or has a relief

request approved or submitted for approval. In addition, the licensee is testing LSSC in

accordance with the code test method requirements (although at an extended interval)

or has a relief request approved or submitted for approval. The licensee has approved

technical specification amendments for all proposed RI-IST program changes that

affected its technical specifications.

5. Scope, Level of Detail, and Quality of the PRA for IST Application

The reviewer should verify that sufficient information is provided in accordance with the

requirements herein and that the evaluation supports conclusions of the following type, to be

included in the staffs safety evaluation report:

3.9.7-28 Rev. 0-August 1998
* There is reasonable assurance of PRA adequacy, as shown by the licensee's process to

ensure quality, and by a focused-scope review by the staff which shows that the

components affect by the RI-IST process and those that are important to the

decisionmaking are appropriately modeled. In addition, results are shown to be robust

in terms of uncertainties and sensitivities to the key modeling parameters.

* The level of detail of the PRA is such that the IST components (and relevant failure

modes) that contribute most significantly to the plant's estimate risk are included, and

that the system and operator dependencies important to the plant risk are included.

* The PRA scope is adequate to provide insights on the plant risk and to provide input to

the component categorization process, and limitations in the scope is address in the

integrated decisionmaking process.

The reviewer should also verify that the information provided supports the following

conclusions:

* a model for unavailability in terms of fault exposure time exists and was used in the PRA

for evaluating the risk significance of extending the selected component test intervals,

* the arguments that support the conclusion that no significant degradation will occur are

justified or the licensee has considered enhanced testing to the extent needed to

substantiate the change.

6. Categorization of Components

The reviewer verifies that sufficient information is provided in accordance with the requirements

of this SRP section and that the evaluation supports conclusions of the following type, to be

included in the staff's safety evaluation report:

The licensee's process on the determination of risk importance of components in the RIIST program is robust in terms of the important PRA modeling techniques, assumptions,

and data. In addition, the factors as described in the section on integrated

decisionmaking (e.g., risk increases are small, defense in depth philosophy is

maintained, and safety margins are maintained) are taken into account when

categorizing a component as low safety significant.

7. Evaluating the Effect of Proposed Changes on Overall Plant Risk

The reviewer verifies that sufficient information is provided to make the following findings:

* The application is either risk neutral or decreases plant risk, or if an application results in

an increase in risk, the increase is within the acceptance guidelines specified in Section

2.2.4 of Regulatory Guide 1.174

* In calculating the risk impact:

3.9.7-29 Rev. 0-August 1998
* Fault exposure time for IST components is modeled appropriately and is linked

to programmatic activities.

* The effects of aging and environmental stresses (time dependent degradation of

the failure rates) has been addressed, either explicitly in the PRA models or as

part of the licensee's integrated decisionmaking process.

* The effects of the IST program change on initiating event frequency have been

considered.

* Common cause failure has been suitably addressed. The licensee has

systematically identified all component groups sharing attributes that correlate

with CCF potential and that affect IST, either in that they comprise IST

components or compensating SSCs. The licensee's performance monitoring

program addresses staggered testing of IST components in CCF groups.

* Credit for human actions that compensate for relaxation of IST is modeled in a

defensible way.

* Appropriate failure rates have been used for IST components. Justification has

been provided for the failure rates and monitoring will provide ongoing

justification. The licensee has reviewed the modeling of compensating SSCs,

and concluded that it is appropriate and that the significance of IST events is not

distorted by modeling of compensating SSCs.

8. Integrated Decisionmaking

If the licensee's proposed alternative is acceptable in light of the safety significance of the

component, and if the licensee's risk-informed IST program meets the detailed acceptance

guidelines specified herein, the staff should be able to reach the following general conclusion:

The licensee's proposed RI-IST program is authorized as an alternative to the ASME

Code-required IST program (e.g, including test frequency, test methods, and program

scope requirements) pursuant to §50.55a(a)(3)(i), based on the alternative providing an

acceptable level of quality and safety.

B. IMPLEMENTATION, PERFORMANCE MONITORING, AND CORRECTIVE ACTION

1. Program Implementation

The reviewer should verify that the licensee provided sufficient information is provided in

accordance with the guidance herein and that the evaluation supports conclusions of the

following type, to be included in the staffs safety evaluation report:

* For components in the high safety-significance category, the licensee will either

continue to test these components in accordance with the current ASME Code of record

for the facility (i.e., test frequency and method requirements) or has proposed an

3.9.7-30 Rev. 0 - August 1998
alternate test strategy that is acceptable to the staff (via either an NRC-endorsed ASME

Code Case or a plant-specific relief request). Testing strategies are adequately

described in the licensee's RI-IST Program Plan and were found to be acceptable.

* For components in the low safety-significance category, the licensee will either continue

to test these components in accordance with the current ASME Code of record for the

facility or has proposed an alternate test strategy that is acceptable to the staff.

* LSSC that will be tested less often than required by the current code may be tested at

an extended interval, in a step-wise manner, only if the interval can be justified on the

basis of previous component performance. An acceptable approach is to group similar

components and test them on a staggered basis. Corrective action procedures will

ensure that the licensee evaluates and corrects failures or nonconforming conditions

that may apply to other components in the group. The staff found that component

grouping was consistent with the guidance provided in NRC Generic Letter 89-04,

Position 2 for check valves; Supplement 6 to NRC Generic Letter 89-10 for motoroperated valves; or other documents endorsed by the NRC.

* The licensee has developed plant corrective action and feedback procedures to ensure

that testing failures are reevaluated for possible adjustment to the component's grouping

and test strategy.

2. Performance Monitoring of IST Component

The reviewer should verify that sufficient information is provided in accordance with the

requirements herein and that the evaluation supports conclusions of the following type, to be

included in the staffs safety evaluation report:

* A performance monitoring program exists that covers all components in the RI-IST

program.

* The program responds to the attributes specified in Section II.B.2.

* The licensee is committed to maintain the program as part of its RI-IST initiative.

3. Feedback and Corrective Action Program

The reviewer should verify that the licensee provided sufficient information in accordance with

the guidance herein and that the evaluation supports conclusions of the following type, to be

included in the staffs safety evaluation report:

* The staff concludes that the licensee's corrective action program is acceptable for

implementation with the RI-IST program because it contains a performance-based

feedback mechanism to ensure that if a particular component's test strategy is adjusted

in a way that is ineffective in detecting component degradation and failure, the IST

program weakness will be promptly detected and corrected.

3.9.7-31 Rev. 0-August 1998
4. Periodic Reassessment

The reviewer should verify that the licensee has provided sufficient information in accordance

with the guidance herein and that the evaluation supports conclusions of the following type, to

be included in the staffs safety evaluation report:

The staff concludes that the licensee's procedures for periodic reassessment of its riskinformed IST program are acceptable because the licensee's procedures for periodic

reassessment ensure that the licensee's test strategies are periodically assessed to

incorporate results of IST and new industry findings.

5. RI-IST Program Changes After Initial Approval

The reviewer should verify that the licensee has provided sufficient information in accordance

with the guidance herein and that the evaluation supports conclusions of the following type, to

be included in the staffs safety evaluation report:

The staff concludes that the licensee has an adequate process or procedures in place to

ensure that RI-IST program changes that could adversely affect the RI-IST program or

results that were previously reviewed and approved by the NRC staff get evaluated and

approved by the NRC before implementation.

V. RISK-INFORMED IST PROGRAM DOCUMENTATION

The reviewer should examine the licensee's submittal to assure that it contained the

documentation necessary to conduct the review described herein (i.e., the documentation

described in Regulatory Position 4 of Regulatory Guide 1.175). The detailed RI-IST program

and its updates should be maintained on site and should be available for NRC inspection

consistent with the requirements of 10 CFR Part 50, Appendix B.

The reviewer should also ensure that the cover letter that transmits to the licensee the staff's

safety evaluation approving the proposed RI-IST program (i.e., alternate IST program to that

prescribed by the ASME Code) contains a statement to the effect that "Failure to comply with

the RW-IST program as reviewed and approved by the NRC staff and authorized pursuant to 10

CFR 50.55a(a)(3) (e.g., including scope, test strategy, documentation, and other programmatic

requirements) constitutes noncompliance with 10 CFR 50.55a and is enforceable."

VI. IMPLEMENTATION

The preceding material is intended to provide guidance to licensees regarding the NRC staffs

plans for using SRP Section 3.9.7. Except in those cases in which the applicant proposes an

acceptable alternate method for complying with specified portions of Regulatory Guide 1.175,

the method described herein will be used by the staff in its evaluation of risk-informed,

performance-based changes to the design, operation, and other activities of the licensee's

plant.

3.9.7-32 Rev. 0-August 1998
VII. REFERENCES

1. U.S. Nuclear Regulatory Commission, 'Use of Probabilistic Risk Assessment Methods in

Nuclear Activities: Final Policy Statement," Federal Register, Vol. 60, p. 42622, August

16, 1995.

2. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.174, "An Approach for Using

Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to

the Licensing Basis," July 1998.

3. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.175, "An Approach for PlantSpecific Risk-informed, Decisionmaking: Inservice Testing," August 1998.

4. U.S. Nuclear Regulatory Commission, Standard Review Plan Chapter 19, "Use of PRA

in Regulatory Activities," July 1998.

5. U.S. Nuclear Regulatory Commission, Generic Letter 89-04, "Guidance on Developing

Acceptable Inservice Testing Programs," April 3, 1989.

6. U.S. Nuclear Regulatory Commission, Generic Letter 89-10, Supplement 6, "Information

on Schedule and Grouping, and Staff Responses to Additional Public Questions," March

8,1994.

7. U.S. Nuclear Regulatory Commission, Generic Letter 96-05, "Periodic Verification of

Design-Basis Capability of Safety-Related Motor-Operated Valves," September 18,

1996.

8. Apostolakis, G.A. and Kaplan, S., "Pitfalls in Risk Calculations," Reliability Engineering,

Vol. 2, pages 135- 145,1981.

9. Nuclear Energy Institute, "Guidelines for Managing NRC Commitments," Revision 2,

December 19, 1995.

3.9.7-33 Rev. 0-August 1998