**NRC INSPECTION MANUAL**	NMSS/FCSE

INSPECTION MANUAL CHAPTER 2606

ASSESSMENT OF THE RISK

RESULTING FROM A

POTENTIAL SAFETY NONCOMPLIANCE AT A FUEL CYCLE FACILITY

2606-01PURPOSE1

2606-02OBJECTIVES1

2606-03APPLICABILITY1

2606-04DEFINITIONS1

04.01Control2

04.02Credited Control2

04.03Enabling Event2

04.04Likelihood2

04.05Safety Basis2

04.06Safety Concern3

04.07Unanalyzed Condition3

04.08Uncredited Control3

2606-05RESPONSIBILITIES AND AUTHORITIES3

05.01 Director, Region II, Division of Fuel Facility Inspection (DFFI).3

05.02Director, FCSE.3

05.03Branch Chiefs, DFFI.4

05.04Branch Chiefs, FCSE.4

05.05 Fuel Cycle Facility Inspectors.4

05.06Office of Regulatory Research, Division of Risk Analysis, Director4

2606-06REQUIREMENTS4

06.01Assessing Risk Following a Potential Noncompliance4

2606-07REFERENCES13

Attachment 1: Safety Significance worksheet	Att1-1

Attachment 2: Sample Safety Significance Worksheet	Att2-1

Attachment 3: Sample Safety Significance Worksheet	Att3-1

Attachment 4:  Revision History for IMC 2606	Att4-1

Issue Date:  04/01/16	i	2606

# 2606-01	PURPOSE

This inspection manual chapter (IMC) provides guidance for determining the risk of an accident at a fuel cycle facility resulting from a potential noncompliance.  Specifically, this IMC details an approach to analyze the safety-significance of an upset condition, control failure, or degraded condition (including an unanalyzed condition) resulting from a potential noncompliance using the licensee’s NRC approved safety analysis methods, as applicable.  

# 2606-02	OBJECTIVES

This IMC provides the Nuclear Regulatory Commission (NRC) staff with a method to use facility safety information to evaluate a potential noncompliance at a fuel cycle facility based on risk. The considerations in this IMC are only applicable to determining safety significance, and may not be used to determine compliance, to assess the root cause, or to assess the overall significance (including regulatory significance). The determination of risk or safety-significance is an important consideration in determining any appropriate Agency enforcement action.  

# 2606-03	APPLICABILITY

This IMC is applicable to fuel cycle licensees licensed under 10 CFR Parts 40 and 70, with or without an approved integrated safety analysis (ISA).  The process in this IMC is a structured analytical method and relies on the use of either the licensee’s NRC-approved ISA methodology or the risk assessment method discussed in Section 2606-06 of this IMC.

Risk assessment should be based on controls, which may or may not include items relied on for safety (IROFS), credited before occurrence of the potential noncompliance.  For the purposes of this manual chapter, the term, “IROFS” may be used to also describe credited controls for 10 CFR Part 40 licensees.  Consideration may also be given for controls which were not specifically credited for the affected accident sequence but which were formally established beforehand for other reasons.  Engineered features and operator actions which were not documented and controlled, consistent with the approved methodology and prior to the potential noncompliance, should not, in general, be considered.  In limited cases, consideration may be appropriate for process conditions or the natural and credible course of events when based on a compelling argument demonstrating reasonable assurance that such conditions would necessarily be present.  In no case should the determination of risk rest solely on the natural and credible course of events.  

# 2606-04	DEFINITIONS

Terms used in this IMC are as defined in NRC regulations and guidance (e.g., NUREG-1520, “Standard Review Plan for the Review of a License Application for a Fuel Cycle 

Issue Date:  04/01/16	1	2606

Issue Date:  04/01/16		13	2606

Facility”).  Any specialized terms for use in this IMC are defined below.

## 04.01	Control

A structure, system, component, or operator action, relied on to prevent or mitigate an accident of concern.  The term “control” implies that the engineered features or administrative actions must be formally recognized, documented, implemented, and maintained as such by the licensee prior to occurrence of the potential noncompliance, and includes items relied on for safety (IROFS), other safety controls (e.g., double contingency controls), systems of controls working together to perform a single safety function, and formal licensee programs (e.g., fire protection program, chemical safety program, material control and accounting program).  These controls must be able to perform a safety function that would prevent or mitigate an accident of concern.  

## 04.02	Credited Control

A control that is documented, implemented, and maintained by the licensee’s approved methodology, as required by the license for that control, for an accident sequence or contingency applicable to the potential noncompliance that occurred.

## 04.03	Enabling Event

As defined in Nuclear Regulatory Commission Issuances, Volume 61, January – June 2005, an enabling event is a subsequent event that must take place for the accident sequence to proceed to a point where adverse consequences might occur.

## 

## 04.04	Likelihood

The probability or frequency of occurrence of an accident of concern (e.g., resulting in an intermediate or high consequence as specified in 10 CFR 70.61.)  Likelihood may be expressed in terms of the frequency of an initiating event, the probability of failure of a control on demand, or the frequency of an accident.  While likelihood may be presented in terms of probability or frequency, it may be evaluated quantitatively or qualitatively, in accordance with the licensee’s approved methodology.  Individual fuel cycle licensees define specific likelihood categories (e.g., “highly unlikely,” “unlikely,”  “not unlikely,” and “credible”) in their safety analyses and ISAs.

## 04.05	Safety Basis

Licensee safety analyses which ensure compliance with regulatory requirements and the safe operation of the facility with licensed materials.  Safety basis documents include the ISA, license application and all other safety analyses, technical evaluations, calculations and other supporting documentation the licensee used to establish safety limits and controls.

Issue Date:  04/01/16		2	2606

## 04.06	Safety Concern

An ongoing condition, as in a continuing operation, in which the risk of an accident of concern is determined to be unacceptable for long-term operation (e.g., risk of a high-consequence event is less than “highly unlikely” or that of an intermediate-consequence event is less than “unlikely”).

A “significant safety concern” is one in which the risk of a high-consequence event is “unlikely” or that of an intermediate-consequence event is “not unlikely.”

An “immediate safety concern” is one in which the risk of a high-consequence event is “not unlikely,” or where a high- or intermediate-consequence event has occurred or is imminent.

## 04.07	Unanalyzed Condition

An event or condition that results in the facility’s being in a state that the licensee did not previously analyze in a licensee’s safety basis documentation (e.g., criticality safety analyses, ISA documentation).  Unanalyzed conditions do not include events or conditions that the licensee considered and dismissed as not credible or considered as bounded by another event or condition, provided such events and conditions were recognized and formally documented. 

## 04.08	Uncredited Control

A control that is not recognized or formally documented by the licensee with maintaining risk at an acceptable level for an accident sequence or contingency applicable to the potential noncompliance that occurred, but which is recognized, documented, implemented, and maintained (according to the licensee’s approved methodology) for another safety purpose.

# 2606-05	RESPONSIBILITIES AND AUTHORITIES

## 05.01 	Director, Region II, Division of Fuel Facility Inspection (DFFI).

a. Coordinates resource activities related to the IMC with the Division of Fuel Cycle Safety, Safeguards & Environmental Review (FCSE).

b. Communicates safety concerns to appropriate senior management.

## 05.02	Director, FCSE.

a. Coordinates resource activities related to this IMC with Region II, DFFI

b. Provides technical resources to facilitate determination of safety concerns and significance.

c. Communicates safety concerns to appropriate senior management.

Issue Date:  04/01/16		3	2606

## 05.03	Branch Chiefs, DFFI.

a. Provide on-site inspection resources to perform the assessment of safety concerns and significance.

b. Communicates safety concerns and significance as determined by inspectors to FCSE and appropriate senior management.

## 05.04	Branch Chiefs, FCSE.

a. Provide inspection and technical review resources as needed to facilitate determination of safety concerns and safety significance.

b. Communicate safety concern and significance determinations to DFFI and appropriate senior management.

## 05.05 	Fuel Cycle Facility Inspectors.

a. Apply this IMC to determine whether there is a safety concern related to a potential noncompliance.

b. Apply this IMC to determine the safety significance of a potential noncompliance.

c. Coordinate with FCSE staff as needed to gather the technical information necessary to determine whether there is a safety concern and assess the safety significance of a potential noncompliance.

d. Communicate safety concerns and significance determinations to appropriate licensee and NRC management.

## 05.06	Office of Regulatory Research, Division of Risk Analysis, Director

Coordinates technical resources, as needed, to assist DFFI and FCSE in reaching consensus on technical issues associated with the assessment.

# 

# 2606-06	REQUIREMENTS	

# 

## 06.01	Assessing Risk Following a Potential Noncompliance

This IMC describes a method for assessing risk based on a licensee’s safety evaluation of the accident sequence or contingency involving the potential noncompliance that occurred.  The process for assessing the risk consists of (1) identifying the accident sequences or contingencies affected by the potential noncompliance, (2) determining the controls and other considerations applicable to those accident sequences or contingencies, including degraded or failed controls and those remaining available and 

Issue Date:  04/01/16		4	2606

reliable, (3) assessing the consequence of the sequences or contingencies based on the previous determination, and (4) assessing the likelihood of the consequence to determine the risk following the potential noncompliance.  The consideration of likelihood may be done quantitatively, qualitatively, or deterministically. This process is discussed in further detail below. Attachments 1, 2, and 3 provide blank and sample assessment forms that can be used to follow the process and communicate the results.  

a. Identify the Accident Sequences or Contingencies 

The staff will determine from the licensee’s safety basis documentation (e.g., criticality safety evaluations, ISA) the accident sequences or contingencies associated with the abnormal condition or control failure that occurred.  If the licensee’s safety basis documentation does not specifically identify the affected accident sequences or contingencies, such as may occur when an unanalyzed condition is discovered, the NRC staff should first identify whether the event or condition is similar to another sequence or contingency that was analyzed.  In addition, the staff should evaluate the potential for applicability to other sequences and contingencies that may also be affected.

Section 06.01 (c) and (d) will discuss assessing consequence and likelihood in terms of what events and controls may be considered, and to what extent.

b. Identification and Consideration for Controls

Licensees subject to the regulations of Subpart H of 10 CFR Part 70 are required to designate as IROFS engineered or administrative controls necessary to meet the 10 CFR 70.61 performance requirements.  Whether all necessary controls have been designated as IROFS is, therefore, a matter of compliance; however the safety significance of a noncompliance is influenced by the quality of the management measures applied to  a control, such as how the control is treated in the licensee’s configuration management program.  For the more detailed assessment of safety significance following the initial assessment, the staff should consider and credit all formally established and documented controls applicable to the situation and commensurate with their availability and reliability, depending on the management measures applied to them. 

Previously, it was common to discuss crediting IROFS versus other safety controls and whether “full credit” or “partial credit” for a given type of control should be applied to them, as in the case of controls which are failed or degraded.  This IMC revises that approach.  Specifically, the amount of risk reduction should not be based solely on the type of control, except as a crude and bounding estimate, but rather should also take into account all relevant characteristics (what NUREG-1520 calls “availability and reliability qualities”).  Rather than attempting to give partial credit when there are reduced management measures, credit will be given appropriate to the type of control (whether an IROFS or other formally established and documented safety control), taking into account the management measures that were actually applied to it (as opposed to what were required to be applied).

Issue Date:  04/01/16		5	2606

Other than considering how a control is treated in the licensee’s management measures programs, the staff should make no distinction between IROFS and other formal controls with regard the detailed assessment of safety significance.  The staff may also consider other characteristics of controls, as appropriate.  The staff should consider all relevant information so as to arrive at the most realistic determination of safety significance.  Therefore, enabling events and the natural and credible course of events may also be credited if the licensee’s approved ISA methodology allows this accreditation. The licensee must justify enabling events and the natural and credible course of events based on experimental measurements, physical arguments, the nature of the process, etc., when there is adequate assurance that the credited event or condition will be present when needed.

The staff should not give credit, however, for “as-found” conditions, by which is meant conditions the licensee does not ensure via formal controls or such other considerations as described above.  In cases where an accident did not actually occur, there will be some physical reason that can be found to explain this fact.  The staff should not credit such factors if the licensee does not ensure or formally control them.  For example, the staff should not credit the fact that only a small amount of material was present at the time of a potential noncompliance if much larger amounts of material are routinely present or allowed under existing plan procedures.

For assessing significance, the staff may credit events and conditions which were identified after the fact, such as controls for other accident sequences or contingencies.  This is the case even if a licensee has not recognized the impact of these events or conditions on the safety significance.  The staff has discretion whether to consider such events and conditions.  The NRC is not under any obligation to consider any events or conditions that the licensee has not used to justify the safety significance.  The licensee is responsible for safety, identifying controls and justifying their applicability, availability, reliability, and pedigree.  The burden is on the licensee and not the NRC staff to justify reducing the safety significance based on such events and conditions, and the staff should not expend undue resources in doing so.  Giving consideration to after-the-fact events and conditions (including uncredited controls) in assessments of safety significance is a separate consideration from determining compliance because the expectation is that licensees analyze and control sequences and contingencies prior to operating a process.  Any after-the-fact events or conditions put forward by the licensee or otherwise considered by the staff should be carefully evaluated and the justification for their applicability to the sequence or contingency in question documented. 

Having determined that a given control or specific event and conditions are applicable and should be considered in assessing safety significance, the staff should then determine how much credit is warranted.  The only relevant consideration—as with deciding whether it should be considered as discussed in the previous paragraphs—is the degree of assurance the staff has that the 

Issue Date:  04/01/16		6	2606

control or event will be present when needed to perform its safety function.  The amount of credit or risk reduction appropriate to a control or event, regardless of whether it was identified as an IROFS or safety control, depends primarily on the management measures and ISA methodology that are actually applied to it Controls not designated as IROFS may still be subject to relevant management measures in accordance with license commitments (e.g., configuration control, maintenance, training, procedures) according to the ISA methodology.  With regard to assessing safety significance, any difference between IROFS and controls that are not IROFS lies only in the difference in management measures applied to these two classes of items.  This is a separate question from that of compliance with the regulatory requirements.

In cases where the control has failed or is degraded—meaning its reliability and availability are reduced—because the licensee has applied improper management measures, the staff may find it appropriate to credit the control to a lesser extent than would be the case when all management measures were appropriately applied.  To assess how much credit is warranted, the staff should use the licensee’s own safety analysis methods (including the licensee’s ISA methodology) to determine how much credit would be given based on the management measures that were actually applied.  In so doing, the staff must adhere to any limitations and caveats of the method to give the appropriate credit.

For example, assume a licensee follows the index method of NUREG-1520, Rev. 2.  Using Table A-10, “Failure Probability Index Methods,” a passive engineered control may be scored as a -3 to -4 if it has high reliability.  If the staff determines this control is applicable and the required management measures were in place but was not considered by the licensee, then it would be appropriate to assign a score commensurate with the approved ISA methodology.  It is prudent for the staff to always err on the side of conservatism when assessing risk not based on the licensee’s own safety analysis, because the licensee is primarily responsible for safety.  However, if the licensee did not apply management measures sufficient to ensure “high reliability” then it would be appropriate to reduce the score to greater than -3 (e.g. -2).  In addition, Table A-10 has the following footnote:  “Indices less than (more negative than) -1 should not be assigned to IROFS unless the configuration management, auditing, and other management measures are of high quality, because without these measures, the IROFS may be changed or not maintained.”  If the licensee did not recognize the control (generalizing the criteria because there is no essential difference between a control and an IROFS with the same management measures) in advance and did not apply the appropriate management measures as required by the ISA methodology for the more negative scoring, then the staff should adhere to the Table A-10 footnote such that a score more negative than -1 would not be appropriate.

As another example, a duration index of -1 would be appropriate based on a required monthly surveillance.  If the licensee erroneously performed this 

Issue Date:  04/01/16		7	2606

surveillance only once a year, a duration index of 0 should be applied instead.  As yet another example, if the number of operations performed increases tenfold, then the frequency at which an administrative control is presumed to fail (which may be expressed as the demand rate times its probability of failure on demand) will increase proportionately.  These examples are only for illustrative purposes and should not be directly applied to future cases because many other factors may need to be considered in accordance with the licensee’s approved methodology.

It is expected there will be cases in which there is considerable uncertainty as to how much credit, particularly for uncredited controls, is warranted.  The staff should be conservative in such cases, and is under no obligation to consider anything not considered in the licensee’s safety analysis.

c. Assess the Consequence

The staff will assess the consequence associated with the accident sequence (high, intermediate, or low) as identified in the licensee safety basis documentation.  For criticality events, the consequence will normally be presumed to be high, unless it occurs in a shielded facility where the shielding is credited as a mitigative IROFS.  For radiological, chemical, and fire events, the consequence will be determined in accordance with the licensee’s ISA methodology, with appropriate consideration given to any mitigative IROFS present. If the potential noncompliance involved the failure or degradation of a mitigative IROFS, the consequence may be increased as a result. 

If more than one accident sequence or contingency is impacted, the staff must evaluate each of them in assessing overall safety-significance.  

If the potential noncompliance occurred at a facility with an ISA, but involved an accident sequence or contingency that the licensee did not analyze, the staff should attempt to apply the licensee’s approved ISA methodology to assess consequence.  In so doing, the staff must adhere to any limitations and caveats of the methodology to give the appropriate credit.  If this cannot be readily accomplished, or if the potential noncompliance occurred at a facility without an approved ISA, the following table should be used to provide a bounding estimate of consequence:

Issue Date:  04/01/16		8	2606

Table 1

Consequence

d. Assess the Likelihood

The staff will assess the likelihood of the accident sequence or contingency following the potential noncompliance that occurred.  As explained in more detail below, the likelihood of interest in assessing safety significance is not the likelihood of a sequence from start to finish, but rather the likelihood starting from the condition following the occurrence of the potential noncompliance (e.g., the conditional likelihood of an accident assuming what actually occurred).  Thus what is pertinent to this assessment is this conditional or residual risk following the occurrence of the potential noncompliance, not the change in risk.

Issue Date:  04/01/16		9	2606

If more than one accident sequence or contingency is impacted, the staff must evaluate each of them in assessing overall safety-significance.  

If the potential noncompliance occurred at a facility with an ISA, but involved an accident sequence or contingency that was not analyzed, the staff should attempt to apply the licensee’s approved ISA methodology to assess likelihood.  In so doing, the staff must adhere to any limitations and caveats of the methodology.  If this cannot be readily accomplished, or if the potential noncompliance occurred at a facility without an approved ISA, the staff should use Tables 2 - 4 to provide a bounding estimate of likelihood.  Tables 2 and 3 are appropriate when an accident sequence can be readily identified, such as an accident sequence that is included in the ISA Summary or involves radiological, chemical, or fire hazards. Table 2 is relevant to situations in which the overall likelihood is assessed quantitatively (including use of a semi-quantitative index method such as in Appendix 3-A of NUREG-1520.) Table 3 involves situations in which the overall likelihood is assessed qualitatively based on the type of control(s) remaining.  Table 4 is appropriate when a contingency can be readily identified, as when the potential noncompliance involved a criticality event that was analyzed only in a criticality safety evaluation or in some other deterministic analysis.[footnoteRef:2] [2:  The qualifier “quantitative” is meant to describe a method of risk-assessment based on estimating likelihood using quantified frequency and probability values.  The term “qualitative,” describes a method that estimates likelihood based on the logical and mathematical structure of a quantitative method, but which assigns likelihood categories based on qualitative criteria rather than quantified values.  (The index method lies between these and is considered semi-quantitative.)  The term “deterministic” describes a method that does not consider likelihood, but rather conservatively assumes worst-case conditions and bases acceptability on non-probabilistic criteria (e.g., defense-in-depth, double contingency).] 

Table 2 should be used when the accident sequence likelihood, starting from the potential noncompliance that occurred and proceeding all the way to an accident, is quantitatively or semi-quantitatively (e.g., using the index method from NUREG-1520) assessed:

Table 2

Quantitative Likelihood Matrix for Accident Sequences

For use when risk is assessed quantitatively or semi-quantitatively (e.g., index method)

In determining the residual accident sequence likelihood when applying Table 2, the staff should apply the licensee’s methods, if practicable.  Otherwise, Table 3 may be used.  Typically, each event or IROFS failure is assigned a likelihood score, depending on the type of control, management measures applied, etc. (using the licensee’s approved ISA methodology).  If the events or failures are all independent, they are typically summed to arrive at an overall likelihood score for the accident sequence.  It is important that the staff’s evaluation 

Issue Date:  04/01/16		10	2606

adhere to any caveats and limitations in the licensee’s approved ISA methodology.  Guidance on consideration of factors such as failure frequency vs. probability, demand rate, failure duration, etc., may be found in NUREG-1520, Chapter 3, Appendices A and B.  For example, while a passive engineered IROFS may normally receive an Effectiveness of Protection Index of -3 to -4, this may depend on the level of management measures applied or on other limitations.  The staff should therefore ensure that the licensee has rigorously followed its own methodology when the potential noncompliance involves an analyzed sequence.  Similarly, the staff should rigorously follow the licensee’s methodology when assessing an unanalyzed sequence.  If the staff is applying the licensee’s methodology to an unanalyzed sequence, any uncertainty in the assignment of likelihood scores should be done conservatively (e.g., use the more conservative value when there is a range of scores).  

In addition to ensuring that the appropriate management measures have been applied, the staff should verify that frequency and probability are correctly distinguished.  A different score may be appropriate depending on whether an event or failure warrants a Failure Frequency Index or probability of failure, e.g. Effectiveness of Protection Index.

Besides applying appropriate scores to individual events or failures, the staff should combine the scores correctly.  Failure Frequency or Effectiveness of Protection Indices must be combined so as to produce an overall accident sequence likelihood with the proper units of frequency or probability per event per year, to be consistent with Table 2 above.  The underlying mathematical details are provided in FCSS-ISG-01, “Methods for Qualitative Evaluation of Likelihood,” which has been incorporated into NUREG-1520.  The staff should carefully consider the following three factors, when applicable, which may significantly affect the overall accident sequence likelihood: failure duration, demand rate, and independence.

The staff should use Table 3 to qualitatively evaluate the accident sequence likelihood.  This matrix represents the case where there are, at most, two controls remaining.  The rows represent the condition of one control and the columns that of the other:

Table 3

Qualitative Likelihood Matrix for Accident Sequences

For use when risk is assessed qualitatively

ADM = administrative control; AEC = active engineered control; PEC = passive engineered control; 

HU = highly unlikely; U = unlikely; NU = not unlikely

Issue Date:  04/01/16		11	2606

Because this table does not take into consideration detailed frequency and probability information, it is recognized to be somewhat conservative.

Table 4 should be used when a deterministic or defense-in-depth, rather than a probabilistic, analysis is the basis for safety, such as a double contingency analysis performed to demonstrate subcriticality under normal and credible abnormal conditions.  This table assumes the basis for safety is a double contingency analysis.  If double contingency is based on two controls and no information besides the number and type of controls is readily available, the staff may use Table 3 in lieu of Table 4.  Otherwise, when additional pertinent information is available, the staff should use Table 4.

Table 4

Likelihood Matrix for Contingencies

For use when risk is assessed deterministically (e.g., double contingency analysis)

The likelihood determination is the most complex and significant part of determining the overall risk.  Whether the staff applies Table 2, 3, or 4 depends mainly on the licensee’s methodology and on the type and quality of information available.  In some cases, it may be desirable to cross-check the result using two or all three of these methods to determine the most reasonable estimate of the residual risk.

# 

# 2606-07	REFERENCES

07.01	Code of Federal Regulations, Title 10, Part 40, “Domestic Licensing of Special Nuclear Material”

07.02	Code of Federal Regulations, Title 10, Part 70, “Domestic Licensing of Special Nuclear Material”

07.03	FCSS-ISG-01, “Methods for Qualitative Evaluation of Likelihood” (ML042460008)

07.04	Nuclear Regulatory Commission Issuances, Volume 61, January – June 2005

07.05	NUREG-1520, Rev. 2, “Standard Review Plan (SRP) for Fuel Cycle Facilities License Applications” (ML15176A258)

END

Issue Date:  04/01/16		12	2606

# Attachment 1:  Safety Significance worksheet

SAFETY SIGNIFICANCE WORKSHEET

LICENSEE: _________ EVENT/NOV No: ________________ DATE: __________

*If initial assessment, only use credited IROFS/controls from the affected sequence or contingency, or applicable IROFS from other sequences in consequence/likelihood assessments. Justification for the applicability of IROFS from other sequences must be documented.

If provisional or final assessment has reduced likelihood or consequences from the initial assessment, document the justification for applicability of any items not considered in the initial assessment and coordinate with Office of Enforcement (OE).

**Types: I = IROFS; C = Credited Control; U = Uncredited Control; O = Other

†**Types:  I = IROFS; C = Credited Control; U = Uncredited Control; B = Bounding Assumption; 

E = Enabling Event; O = Other 

‡Credit:  F = Frequency; P = PFOD; DR = Demand Rate; DI = Duration Index

INSTRUCTIONS

This “Safety Significance Worksheet” provides a sample format for summarizing the results of an IMC 2606 safety significance determination.  Instructions for completing the form follow.

Affected Accident Sequence/Contingency:  A brief description of the accident sequence in sufficient detail to understand the major events (not just the initiating event) should be provided. If the sequence was analyzed in the licensee’s ISA, its label/number should be provided under “designation.”  The appropriate box should be checked to indicate whether the sequence was previously analyzed.  A separate worksheet should be included for each affected sequence. 

The term “sequence” is used in the instructions for “accident sequence or contingency.”  This longer term reflects that there may be an accident sequence explicitly identified in the licensee’s ISA, with appropriate IROFS, or there may be a scenario analyzed as part of a double contingency analysis in a licensee’s criticality safety evaluation, involving IROFS or other criticality controls.  The worksheet is intended to be flexible enough to accommodate either approach.

Purpose:  This worksheet may be used to summarize the results of an IMC 2606 evaluation at several stages in the enforcement process.  The types of assessments are summarized below:

Initial Assessment:  An assessment performed upon initial identification of a potential noncompliance or screening of an event.  The staff should attempt an initial assessment only based on the licensee’s analysis in the short time allowed during an inspection or during an assessment of whether there is an immediate safety concern. Only credited IROFS and controls, including IROFS credited for other sequences, should be considered during this initial phase because the staff will still be gathering information about the facility and processes, detracting from the feasibility of a more detailed safety significance evaluation.  

Provisional Assessment:  An assessment performed by the staff subsequent to the initial assessment but prior to final disposition of the potential noncompliance.  Factors other than credited IROFS and controls (e.g., uncredited controls) may be considered consistent with the guidance in IMC 2606 given that information should be available to perform a more detailed evaluation.

Final Assessment:  An assessment documenting the final Agency decision on the safety significance of a noncompliance or event. What may be considered is identical to that in the provisional assessment; the purpose of having two separate boxes is to indicate, at a glance, whether the assessment is pre-decisional or final.

NOTE:  If the safety significance of a provisional or final assessment of safety significance differs from that of the initial assessment, the staff must consult with OE due to the difficulty inherent in considering additional factors beyond credited IROFS and controls.

Consequence:  This section indicates the consequence part of the risk assessment.  Typically a fire is not directly a consequence of concern, because it is not directly mentioned in 10 CFR 70.61.  However, if a fire can result in a chemical release, radiological dose, or criticality, the applicable box should be checked as well.  If the sequence affects more than one area, check all applicable boxes.

Actual consequences are those in which the sequence progressed to completion, such that there was an actual chemical or radiological dose or criticality accident.

Potential consequences are those in which the sequence did not progress to completion and there was no chemical or radiological dose.  For criticality, the potential consequence is almost always considered high.

At the time of the revision of this IMC, all fuel facility licensees committed to considering criticality as a high-consequence event.  Future facilities that rely on mitigation to reduce the consequence of criticality to less than high still must ensure that nuclear processes will be subcritical under normal and credible abnormal conditions, in accordance with 10 CFR 70.61(d).

For other consequence types, normally the unmitigated consequence should be used since the potential consequence is evaluated assuming all IROFS have failed.

If it is deemed desirable to perform the IMC 2606 evaluation using mitigated consequences (e.g., when there is unusually high assurance that mitigative barriers will remain in place), this should be indicated by checking the appropriate box.  The basis for the mitigated or unmitigated consequence should be provided.

Type:  Indicates whether the mitigative feature is an IROFS, credited control (including IROFS on other sequences), uncredited control, or some other feature, such as physical considerations that inherently limit the consequence.

Magnitude:****Indicates the mitigated or unmitigated consequence (typically unmitigated), depending on which box is checked below.  This should be based on the licensee’s approved ISA methodology or the consequence categories in Table 1 of this IMC.

Credit:  Typically indicates the risk-reduction factor, or factor by which the mitigative feature has reduced the unmitigated consequence.  However, the means of conferring credit will be done in accordance with the licensee’s approved ISA methodology.

For each such mitigative feature, the staff should include a brief description, including an IROFS designation if applicable, and the basis for any credit taken.  If no factors apply, leave it blank.

Likelihood:****Indicates the likelihood of the sequence at the time of the potential noncompliance or event (conditional likelihood of an accident following the potential noncompliance of event).  Thus if a licensee has a potential noncompliance that results in loss of a control that changes the likelihood from “highly unlikely” to “unlikely,” the “unlikely” box should be checked.

IMC 2606 describes three distinct likelihood assessment methods—quantitative, qualitative, and deterministic, for use in accordance with Tables 2, 3, and 4 of the text.  The staff should use the appropriate method(s) in accordance with the guidance provided in the body of IMC 2606. The choice depends on the method of analysis used by the licensee and information available.  The staff should briefly justify the choice of method under “basis” on the worksheet.  Note that it may be advisable to employ more than one of the three methods as an independent check on the results of the safety significance determination.  In such cases, the staff should indicate which method was the main one used for the ultimate determination of likelihood.

Method #1:  The worksheet is designed to follow the information in Table 2 of IMC 2606.  This method is intended to be used when likelihood is assessed quantitatively (including the semi-quantitative index method from NUREG-1520). In applying Method 1, it is important that the likelihood be assessed rigorously in accordance with the licensee’s approved methodology, including, as appropriate, failure frequency, probability of failure on demand (PFOD), failure duration, and demand rate.  Guidance for doing so is provided in Appendix 3-B of NUREG-1520, “Qualitative Criteria for Evaluation of Likelihood” (formerly FCSS-ISG-01).

IEF:  The Initiating Event Frequency (IEF) is used whenever the initiating event in the sequence did not occur, since this block is intended to indicate the likelihood following the potential noncompliance or event.  If the initiating event occurred, its likelihood can no longer be considered in the conditional likelihood of the accident and this line should be left blank. Note that if an IROFS or control failure was associated with the potential noncompliance or event, it may not be the initiating event as identified in the licensee’s evaluation of the sequence, because in many cases the events do not have to occur in the precise order indicated in the sequence.

Preventive Features:  The type and credit (typically risk reduction factor, or factor by which the event likelihood is reduced) should be specified, including a description that includes the IROFS designation if applicable, as indicated under “Consequence” above. The risk-reduction provided by the preventive feature may be expressed in terms of a failure frequency, a probability of failure on demand (PFOD), a demand rate, or a failure duration.  If the licensee used an index method (such as that in NUREG-1520), typically each of these are assigned an index, and all such indices are added up to arrive at the overall likelihood.  If no factors apply, leave it blank.

Method #2:  This is typically applied when there is insufficient information to assess the risk reduction provided by preventive features (e.g., when the sequence was unanalyzed).  Method #2 is intended to be a conservative estimation of likelihood based solely on the type of control.  It may also be used as check on Method #1.  While Table 3 of IMC 2606 only considers those situations where there are two control barriers (which is often the case for criticality sequences), it may be adapted as follows;

If the entire sequence includes two controls, the state of one is indicated in the rows and other in the columns.  If one of the two controls has failed, the row or column entitled “no control” should be used.  If the sequence contains three controls and one has failed, then use the table for the remaining controls.  If two of the three controls have failed, use the table with “no control.”  For more controls, if two or more of them can be aggregated as a “control system,” the system may be treated as a single control for the purpose of applying the table.  In such cases, consider two administrative controls as an active engineered control, and any other combination (e.g., an administrative and an active engineered control) as a passive engineered control.

Method #3:****This is typically applied when the potential noncompliance or violation involves a double contingency analysis in a criticality safety evaluation rather than one analyzed in the ISA Summary.  Such a case may occur when the sequence is inadvertently omitted from the ISA Summary, or when it screened from further consider by being considered “not credible.”  Here the likelihood is determined based on meeting certain deterministic criteria, when there is no information available to estimate the likelihood of the individual contingencies.  Staff should indicate the overall likelihood category and the basis, including which paragraph of Table 4 of IMC 2606 applies.

Additional Considerations/Comments:****This block is to capture any unique aspect of the potential noncompliance or event that may impact the safety basis.  Any additional notes such as whether the potential noncompliance is considered programmatic may also be included.

Issue Date:  04/01/16		Att1-6	2606

# Attachment 2:  Sample Safety Significance Worksheet

The sample below shows the risk assessment of an IROFS failure.  The IROFS and the associated accident sequence are included in the licensee’s ISA.  In this example, the staff performed the assessment to determine the change in likelihood upon the failure of one of two credited IROFS.

SAFETY SIGNIFICANCE WORKSHEET

LICENSEE:  SNM-XX  EVENT/NOV No: 16-001 DATE: 01/26/2016

*If initial assessment, only use credited IROFS/controls from the affected sequence or contingency, or applicable IROFS from other sequences in consequence/likelihood assessments. Justification for the applicability of IROFS from other sequences must be documented.

If provisional or final assessment has reduced likelihood or consequences from the initial assessment, document the justification for applicability of any items not considered in the initial assessment and coordinate with Office of Enforcement (OE).

**Types: I = IROFS; C = Credited Control; U = Uncredited Control; O = Other

†**Types:  I = IROFS; C = Credited Control; U = Uncredited Control; B = Bounding Assumption; 

E = Enabling Event; O = Other 

‡Credit:  F = Frequency; P = PFOD; DR = Demand Rate; DI = Duration Index

Issue Date:  04/01/16		Att2-3	2606

# Attachment 3:  Sample Safety Significance Worksheet

The sample below shows the risk assessment of an IROFS failure while crediting other safety controls.  The IROFS and the associated accident sequence are included in the licensee’s ISA.  In this example, the staff performed the assessment to determine the change in likelihood upon the failure of one of two credited IROFS while crediting another safety control.

SAFETY SIGNIFICANCE WORKSHEET

*If initial assessment, only use credited IROFS/controls from the affected sequence or contingency, or applicable IROFS from other sequences in consequence/likelihood assessments. Justification for the applicability of IROFS from other sequences must be documented.

If provisional or final assessment has reduced likelihood or consequences from the initial assessment, document the justification for applicability of any items not considered in the initial assessment and coordinate with Office of Enforcement (OE).

Issue Date:  	  						Attachment 1								2606

Issue Date:  04/01/16		Att3-1	2606

**Types: I = IROFS; C = Credited Control; U = Uncredited Control; O = Other

†**Types:  I = IROFS; C = Credited Control; U = Uncredited Control; B = Bounding Assumption; 

E = Enabling Event; O = Other 

‡Credit:  F = Frequency; P = PFOD; DR = Demand Rate; DI = Duration Index

Issue Date:  04/01/16		Att3-3	2606

# Attachment 4:  Revision History for IMC 2606

Issue Date:  04/01/16	Att4-1	2606