**NRC INSPECTION MANUAL**APOB

INSPECTION MANUAL CHAPTER 0308 ATTACHMENT 3 APPENDIX A

TECHNICAL BASIS FOR THE AT-POWER 

SIGNIFICANCE DETERMINATION PROCESS

Effective Date:  01/01/2021

# 0308.03A-01 PURPOSE

This appendix to Inspection Manual Chapter (IMC) 0308, Attachment 3, “Technical Basis for the Significance Determination Process” provides a technical basis for the risk categorization process used to estimate the risk significance of inspection findings at-power (within the safety cornerstones of initiating events, mitigating systems, and barrier integrity) as described in IMC 0609, Appendix A, “At Power Significance Determination Process.”

# 0308.03A-02 BACKGROUND

Since the initial implementation of the Reactor Oversight Process (ROP), the at-power SDP has involved a three phased approach.  The initial phase (Phase 1) was designed to screen findings of low risk significance to green to allow the staff to focus more resources on risk significant findings.  The second phase (Phase 2) was designed to estimate the risk significance of the finding, provide an engineering understanding of the finding, and serve as an additional screening tool to identify low risk significant findings that did not screen out in the initial phase.  The at-power Phase 2 process consisted mainly of site-specific pre-solved tables and risk-informed notebooks which, from a high level, were a set of tables and guidance designed using risk insights from the licensee’s risk model.  The third phase (Phase 3) was designed to add specificity to the Phase 2 risk evaluation if needed (i.e., provide more detailed analyses, reduce uncertainties, etc).

The majority of this IMC was dedicated to providing the technical bases for the pre-solved tables and risk-informed notebooks.  However, over the years, maintaining the site-specific pre-solved tables and risk-informed notebooks located in IMC 0609, Appendix A proved to be a challenging task. As plants implemented equipment modifications and associated revisions to the plant risk model, the accuracy of the pre-solved tables and risk-informed notebooks began to degrade.  Instead of revising all of the plant specific pre-solved tables and risk-informed notebooks, the agency decided to transition from the pre-solved tables and risk-informed notebooks to Systems Analysis Programs for Hands-on Integrated Reliability Evaluations (SAPHIRE) and the site-specific Standardized Plant Assessment Risk (SPAR) models.  SAPHIRE and the site-specific SPAR models provide an efficient and effective infrastructure that facilitates risk model fidelity and updates.

In the transition from the pre-solved tables and risk-informed notebooks to SAPHIRE and the site-specific SPAR models it is important to note some key technical differences.  The risk-informed notebooks are train-level models that had been benchmarked against the licensee PRA models.  They were designed as a tool to provide an “order of magnitude” estimate of the delta CDF.  The SPAR models are component level models that have also been benchmarked with licensee PRA models.  The SPAR models use a combination of generic and plant specific data from NUREG/CR-6928, “Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants.”  For legacy, reference, and knowledge transfer purposes, the pre-solved tables, risk-informed notebooks, and associated ROP guidance documents have been archived.

# 0308.03A-03 TECHNICAL BASIS FOR THE AT-POWER SDP

The technical basis for the at-power SDP is divided into two sections.  The first section (03.01) provides a technical justification for the screening questions.  The screening questions are categorized by safety cornerstone and provide a logical series of questions to determine if a finding can be characterized as having low safety significance.  The second section (03.02) provides technical justification for the detailed risk evaluation (DRE).  In contrast to the site-specific pre-solved tables and risk-informed notebooks, which had a robust and detailed technical justification in this IMC, the detailed technical justification for SAPHIRE and the site-specific SPAR models can be found in a variety of staff documentation (e.g., NUREGs).  As such, only an overview of the technical justification is provided in this IMC.

03.01Technical Basis for the At-Power Screening Questions

The initial screening is intended to screen out those findings that have minimal impact on risk early in the process as an efficiency measure.  The at-power screening questions apply to the reactor safety cornerstones of initiating events, mitigating systems and barrier integrity.  To support the issuance of SECY 99-007A, the staff performed a simple sensitivity test of the at-power inspection finding screening process.  The test was designed to ensure that findings with proven risk importance would not be screened out by the process.  The staff reviewed the 1996 accident sequence precursors (ASP) to potential severe core damage events.  In 1996, the NRC identified in NUREG/CR-4674, Vol. 25, fourteen precursors with a conditional core damage probability (CCDP) greater than 1E-6 affecting thirteen units.  In all there were seven at power precursor events involving initiating events and six at power precursor events involving the unavailability of mitigating systems.  All of the risk significant ASP events and degraded conditions successfully made it past the screening questions and would have required further evaluation using a DRE.  This sensitivity test that was used during the initial development stages of the ROP provides a level of confidence that potentially risk significant inspection findings will not be inadvertently screened out early in the process and will receive a more detailed level of evaluation.

Since the initial implementation of the ROP, the at-power screening questions have been clarified and refined based on lessons learned and experience.  In addition, some new screening questions have been added to improve the overall effectiveness of the screening process.  However, the screening questions as a whole have not changed enough to warrant another sensitivity study similar to the effort to support SECY 99-007A.  The staff recognizes that the at-power screening questions are not an all-inclusive set.  Therefore, as a conservative measure, if a finding screens to green in accordance with the applicable screening questions and the staff has reason to believe that there is still potential that the finding is risk significant, the staff reserves the opportunity to perform a DRE.

The information in following sections (03.01.01-03.01.04) provide a basis for each of the individual screening questions in IMC 0609 Appendix A.  The screening questions are presented by cornerstone exhibit and topic to mimic how they are arranged in IMC 0609 Appendix A.  The wording of each question matches the wording of the question in IMC 0609 Appendix A at the time the basis was created or revised.  The basis for each question and any question-specific supporting information is included below the question.  If there is generic supporting information for a topic, it is presented after the topic name, before the first screening question.

03.01.01 Technical Basis for the Initiating Events Screening Questions

A. Loss of Coolant Accident ( SEQ CHAPTER \h \r 1LOCA) Initiators

Supporting Information for LOCA Initiator Screening Questions:  The Initiating Events Cornerstone is focused on findings that either cause initiating events or increase the likelihood that an initiating event could occur.  It can be difficult to identify when a finding could result in an increased LOCA frequency.  As found conditions that represent significant degradation to the reactor coolant system (RCS) boundary should be evaluated for impact on LOCA frequency.  The Davis-Besse head degradation finding is one example where judgement was used to determine that the degradation impacted the LOCA frequency.

Question A.1:  After a reasonable assessment of degradation, could the finding result in exceeding the reactor coolant system (RCS) leak rate for a small LOCA (leakage in excess of normal makeup)?

· a.  If YES ➛ Stop.  Go to Detailed Risk Evaluation section.

· b.   SEQ CHAPTER \h \r 1If NO, continue.

Basis for Question A.1:  This question is intended to refer degraded conditions that could have resulted in RCS leakage in excess of normal makeup for further evaluation using a DRE.  RCS leakage that is within the capacity of normal makeup is not expected to require use of the emergency core cooling system (ECCS) and is therefore expected to be low risk.  For SDP purposes, a small LOCA is defined as a steam or liquid break in the RCS, other than a SGTR, that exceeds the ability to makeup using normal charging (PWR) or control rod drive (BWR) pump flow.  Normal makeup flow may include control room actions to start a standby pump or minimize letdown flow, if appropriate for the situation.  Findings related to protection of the reactor pressure vessel against fracture (e.g., pressure-temperature limits, pressurized thermal shock (PTS)) should be assessed under the Barrier Integrity Cornerstone.

Question A.2:  After a reasonable assessment of degradation, could the finding have likely affected other systems used to mitigate a LOCA (e.g., Interfacing System LOCA)?

· a.  If YES ➛ Stop.  Go to Detailed Risk Evaluation section.

· b.   SEQ CHAPTER \h \r 1If NO, screen as Green.

Basis for Question A.2:  This question is intended to refer degraded conditions related to RCS leakage that could cause failure of systems, structures or components (SSCs) used to mitigate a LOCA (e.g., ECCS) for further evaluation using a DRE.  These types of findings need further evaluation in a DRE because they both increase the likelihood of a LOCA and increase the ECCS failure probability.  This could happen as a result of leakage from the RCS into an interfacing system such as ECCS.  Another example of how this could happen is an instrument line leak that degrades the ability of a train of ECCS from auto starting.  Inability of a train of ECCS to auto start should be considered a loss of function for that train and a DRE should be performed.

B. Transient Initiators

Question B:  Did the finding cause a reactor trip AND the loss of mitigation equipment relied upon to transition the plant from the onset of the trip to a stable shutdown condition (e.g., loss of condenser, loss of feedwater)?  Other events include high-energy line breaks, internal flooding, and fire.

· a.  If YES ➛ Stop.  Go to Detailed Risk Evaluation section.

· b.   SEQ CHAPTER \h \r 1If NO, screen as Green.

Basis for Question B:  This question is intended to screen findings to Green for SSCs that are transient initiators but do not impact equipment used to respond to a plant trip.  A transient initiator is an SSC that causes a reactor trip or scram.  If the SSC that initiated the transient is also relied upon to respond to the trip, the finding needs further evaluation in a DRE.  The dual role of SSCs that are both used to mitigate initiating events and can cause initiating events increases the risk significance of these SSCs.  Some examples of transient initiators that are also mitigating equipment include loss of main feedwater, loss of condenser heat sink, and loss of offsite power (LOOP) events.  These types of initiating events need to be evaluated using a DRE.  For example, an uncomplicated loss of feedwater event for many plants has a change in core damage frequency of greater than 1E-6 per year.

C.  SEQ CHAPTER \h \r 1Support System Initiators

Supporting Information for Support System Initiator Questions:  Support system initiators include SSCs whose failure can both result in a plant trip and are needed to support frontline systems used to respond to that plant trip.  Examples of typical support system initiators include component cooling water, service water, AC power, DC power, and instrument air.  Frontline systems are those that provide critical safety functions.  Plant-specific support system initiators can be identified in the Plant Risk Information e-Book (PRIB).  Support systems often provide support for non-frontline systems as well.  A degraded condition that only affects the ability of the support system to supply a non-frontline system is not considered a support system initiator and should not be evaluated using these questions.  In addition, a degraded support system that cannot increase the probability of a plant trip is not considered a support system initiator and should not be evaluated using these questions.  Support system findings that are not support system initiators should be evaluated under the Mitigating Systems Cornerstone.

Question C.1:  Did the degraded condition result in an actual complete or partial loss of a support system (e.g., component cooling water, service water, instrument air, AC power, DC power)? 

· a.  If YES ➛ Stop. Go to Detailed Risk Evaluation section.

· b.   SEQ CHAPTER \h \r 1If NO, continue.

Basis for Question C.1:  The intent of this question is to refer findings related to an actual complete or partial loss of a support system initiator (support system issue that could cause a plant trip) for further evaluation using a DRE.  For the purpose of this question, a complete loss refers to loss of all trains of a system and partial loss refers to loss of one train of a system (or equivalent).  If the finding is related to a support system initiator but did not result in a complete or partial loss of a support system, it should be evaluated using the next question.  The dual role of support system initiators as initiating events and mitigating system increases the risk significance of these SSCs.  These types of initiating events should be evaluated using a DRE.

Question C.2:  Did the degraded condition increase the likelihood of a complete loss of a support system that would result in a plant trip?

· a.  If YES ➛ Stop. Go to Detailed Risk Evaluation section.

· b.   SEQ CHAPTER \h \r 1If NO, screen as Green.

Basis for Question C.2:  The intent of this question is to screen findings to Green that are related to support system initiators that did not result in a complete or partial loss of the support system (previous question) and did not increase the likelihood of a complete loss of a support system.  If the finding increased the likelihood of a complete loss of a support system, then a DRE should be performed because the initiating event frequency for that event may have changed.  If the finding affected a support system initiator but there was no actual loss of the support system or increase in the likelihood of a loss of the support system, then the risk significance associated with the finding is expected to be small.

D. Steam Generator Tube Rupture

Question D.1:  Does the finding involve a degraded steam generator tube condition where one tube cannot sustain three times the differential pressure across a tube during normal full power, steady state operation (3ΔPNO)?

· a.  If YES ➛ Stop.  Go to IMC 0609, Appendix J.

· b.   SEQ CHAPTER \h \r 1If NO, continue.

Basis for Question D.1:  This intent of this question is to refer steam generator tube conditions that violate the structural integrity performance criterion (typically 3 times the differential pressure across a tube during normal full-power steady-state operation, 3ΔPNO) for further evaluation using Appendix J.  These types of conditions make the tube more susceptible to failure during high pressure, dry steam generator core damage sequences, which have a frequency in the low 1E-5 per year range.  Therefore, risk significance results that are greater than Green are possible and further evaluation is appropriate.

Question D.2:  Do one or more SGs violate “accident leakage” performance criterion (i.e., involve degradation that would exceed the accident leakage performance criterion under design basis accident conditions)?

· a.  If YES ➛ Stop.  Go to Detailed Risk Evaluation section and refer to IMC 0609, Appendix J as applicable.

· b.   SEQ CHAPTER \h \r 1If NO, screen as Green.

Basis for Question D.2:  The accident leakage limit was established to show conformance with 10 CFR 100 dose guidelines during design basis accidents.  Findings involving accident leakage exceeding the limit need further evaluation using a DRE because the wide range of potential leak rates can result in risk significance results that are greater than Green.

E.  SEQ CHAPTER \h \r 1External Event Initiators

Question E.  Does the finding impact the frequency of a fire or internal flooding initiating event?

· a.  If YES ➛ Stop.  Go to Detailed Risk Evaluation section.

· b.   SEQ CHAPTER \h \r 1If NO, screen as Green.

Basis for Question E:  This question is intended to screen external event initiators to Green that do not impact the frequency of a fire or internal flooding event.  In the Initiating Events Cornerstone, the external events of interest are limited to fire and internal flooding.  Fires and floods have the ability to impact multiple areas and SSCs, which increases the risk-significance of these findings.  Other external events are not applicable in the context of the Initiating Events Cornerstone, because the licensee does not have control over these types of events (e.g., tornado, hurricane).

03.01.02 Technical Basis for the Mitigating Systems Screening Questions

A. Mitigating SSCs and PRA Functionality (except Reactivity Control Systems)

Question A.1 SEQ CHAPTER \h \r 1If the finding is a deficiency affecting the design or qualification of a mitigating SSC, does the SSC maintain its operability or PRA functionality?

· a.  If YES ➛ Screen as Green.

· b.   SEQ CHAPTER \h \r 1If NO, continue.

Basis for Question A.1:  The intent of this question is to screen findings to Green for which the SSC remained operable or for which the SSC remained PRA functional because there would be no risk impact if the SSC maintained its PRA function.  Many SSCs have different design basis functions and PRA functions.  An SSC may be declared inoperable because it does not meet a design basis parameter (e.g., flow, pressure, or timing) but may remain PRA functional because significant margin is built into the design basis.  A finding related to a degraded SSC that is considered inoperable for one of these reasons but remained PRA functional would screen to Green.  This question assumes that operability is more limiting than PRA functionality.  If operability is less limiting than PRA function, this question should not be used to screen the finding to Green.

Question A.2:  Does the degraded condition represent a loss of the PRA function of a single train TS system (such as HPCI/HPCS) for greater than its TS allowed outage time?

· a.  If YES ➛ Stop.  Go to Detailed Risk Evaluation section.

· b.   SEQ CHAPTER \h \r 1If NO, continue.

Basis for Question A.2:  This question is intended to refer findings related to single train technical specification (TS) systems for further evaluation using a DRE if the degraded condition existed for more than the SSC’s TS allowed outage time (AOT).  The AOT is being used to assess the impact of the exposure time during which the SSC could not perform its PRA function.  Although TS AOTs were not necessarily derived from risk evaluations, operating experience has shown that an SSC that cannot function for less than its AOT is generally not risk significant.  Therefore, a DRE only needs to be performed when the SSC could not function for a period of time greater than that defined in the AOT.  For plants that have adopted TSTF-505 and implemented risk-informed completion times (RICTs), the frontstop AOT should be used for screening purposes.  RICTs may not be applied in retrospect after a degraded condition occurs.

Question A.3:  Does the degraded condition represent a loss of the PRA function of one train of a multi-train TS system for greater than its TS allowed outage time?

· a.  If YES ➛ Stop.  Go to Detailed Risk Evaluation section.

· b.   SEQ CHAPTER \h \r 1If NO, continue.

Basis for Question A.3:  This question is intended to refer findings related to one train of a multi-train TS system for further evaluation using a DRE if the degraded condition existed for more than the SSC’s TS AOT.  The AOT is being used to assess the impact of the exposure time during which the SSC could not perform its PRA function.  Although TS AOTs were not necessarily derived from risk evaluations, operating experience has shown that an SSC that cannot function for less than its AOT is generally not risk significant.  Therefore, a DRE only needs to be performed when the SSC could not function for a period of time greater than that defined in the AOT.  For plants that have adopted TSTF-505 and implemented RICTs, the frontstop AOT should be used for screening purposes.  RICTs may not be applied in retrospect after a degraded condition occurs.

Question A.4:  Does the degraded condition represent a loss of the PRA function of two separate TS systems for greater than 24 hours?

· a.  If YES ➛ Stop.  Go to Detailed Risk Evaluation section.

· b.   SEQ CHAPTER \h \r 1If NO, continue.

Basis for Question A.4:  This question is intended to refer findings related to loss of function of two separate TS systems for further evaluation using a DRE if the degraded condition existed for more than 24 hours.  The exposure time of 24 hours before performing a DRE is based on risk analyst judgement.  A simple risk assessment using the SPAR models for two plants found that having an emergency diesel generator and a service water pump in the other division out of service could result in a greater than Green finding in only three days.  Therefore, the 24-hour exposure time is reasonable.

Question A.5:  Does the degraded condition represent a loss of a PRA system and/or function as defined in the PRIB or the licensee’s PRA (such as recovery of offsite power or the ability to feed and bleed) for greater than 24 hours?

· a.  If YES ➛ Stop.  Go to Detailed Risk Evaluation section.

· b.   SEQ CHAPTER \h \r 1If NO, continue.  

Basis for Question A.5:  The intent of this question is to refer degraded conditions for further evaluation using a DRE that can result in a greater than Green change in risk but may not be included in the TS or may not be easily defined as a component failure.  A system/function may be modeled in the PRA but may not be included in the TS or may not have a precise SSC definition.  These systems and/or functions are defined in the PRIB.  PRIB Table 6, “System/Function Success Criteria,” lists the general success criteria for each PRA system and function used in the plant-specific SPAR model.  Examples of PRA systems/ functions that are modeled in the PRA but may not be included in the TS include components in the instrument air system and the decay heat removal function of the residual heat removal pumps.  Examples of PRA systems/functions that may not have a precise SSC definition include the recovery of offsite power after a LOOP event, feed and bleed in a PWR after AFW system failures, manual reactor depressurization in a BWR, and various plant cross-tie capabilities.  The exposure time of 24 hours before performing a DRE is based on risk analyst judgement.  A simple risk assessment using the SPAR models for two plants found that failing the feed and bleed function, instrument air system, or ability to crosstie auxiliary feedwater to another unit could result in a greater than Green finding in as little 36 hours.  Therefore, the 24-hour exposure time is reasonable.

Question A.6:   SEQ CHAPTER \h \r 1Does the degraded condition represent a loss of the PRA function of one or more non-TS trains of equipment designated as risk-significant in accordance with the licensee’s maintenance rule program for greater than 3 days? 

· a.  If YES ➛ Stop.  Go to Detailed Risk Evaluation section.

· b.   SEQ CHAPTER \h \r 1If NO, screen as Green.

Basis for Question A.6:  The intent of this question is to refer degraded conditions on risk-significant, non-TS SSCs for further evaluation if the condition existed for more than 3 days.  The licensee’s maintenance rule program may be used to determine if an SSC is risk significant.  A simple risk assessment performed using a sample of non-TS equipment with high importance rankings (i.e., largest Birnbaum importance measures) determined that none of the SSCs sampled would result in a greater than Green finding with an exposure period of less than three days.  If the degraded condition on the risk-significant, non-TS SSC existed for less than three days and none of the conditions in the previous questions apply, the finding screens to Green.

B. External Event Mitigating Systems (Seismic/Flood/Severe Weather Protection)

Question B:   SEQ CHAPTER \h \r 1Does the finding involve the loss or degradation of equipment or function specifically designed to mitigate a seismic, flooding, or severe weather initiating event (e.g., seismic snubbers, flooding barriers, tornado doors) for greater than 14 days?

· a.  If YES ➛ Go to Exhibit 4. 

· b.  If NO, screen as Green. 

Basis for Question B:  This question is intended to refer findings related to seismic, flooding, and severe weather protections for further evaluation using IMC 0609 Appendix A Exhibit 4, “External Events Screening Questions,” if the degraded condition existed for more than 14 days.  The exposure time of 14 days before referring the finding to Exhibit 4 is based on risk analyst judgement and is intended to reduce the need to perform DREs for findings with short exposure times.  Seismic and flooding initiating event frequencies are often in the 1E-4 to 1E-5 per year range.  A finding associated with significant degradation could have a conditional core damage probability (CCDP) of .1.  An initiating event frequency of 1E-4 per year coupled with a CCDP of .1 could result in a greater than Green finding if it exists for about a month.  Therefore, the 14-day exposure time is reasonable.  Findings related to fires or fire protection equipment are not included in this question because those findings should be evaluated using IMC 0609 Appendix F, “Fire Protection Significance Determination Process.”

C. Reactor Protection System (RPS)

Question C:  Did the finding affect a single RPS trip signal to initiate a reactor scram AND the function of other redundant trips or diverse methods of reactor shutdown (e.g., other automatic RPS trips, alternate rod insertion, or manual reactor trip capacity)?

· a.  If YES ➛ Stop.  Go to Detailed Risk Evaluation section.

· b.   SEQ CHAPTER \h \r 1If NO, screen as Green.

Basis for Question C:  The intent of this screening question is to screen findings that result in a minor functional degradation of RPS (e.g., one automatic trip from one instrument) to Green when there are several redundant trips that provide the same function (e.g., three other automatic functional trips).  If there is a significant functional degradation to RPS, a DRE is warranted.  The determination of what a “significant” or “minor” functional degradation of RPS should be based on reasonable technical judgment of the inspectors, SRA, and management.

D. Fire Brigade

Question D.1:  Does the finding involve fire brigade training, qualifications, drill performance, or staffing?

· a.  If YES ➛ check if the following applies:

· The finding would not have significantly affected the ability of the fire brigade to respond to a fire.

· b.  If the above is checked ➛ screen as Green.

· c.   SEQ CHAPTER \h \r 1If NO, continue.

Basis for Question D.1:  The intent of this question is to screen administrative type fire bridge findings to Green as long as the degraded condition would not significantly affect the ability of the fire brigade to respond to a fire.  Significant degradation in administrative fire brigade controls, such as inadequate training or insufficient qualification of fire brigade members, could result in delays in fire-fighting times, resulting in larger fires than originally postulated.  The determination of what a significant affect entails should be based on reasonable technical judgment of the inspectors, SRA, and management.

Question D.2:  Does the finding involve the response time of the fire brigade to a fire?

· a.  If YES ➛ check if one or more of the following apply:

· The fire brigade’s response time was mitigated by other defense-in-depth elements, such as area combustible loading limits were not exceeded, installed fire detection systems were functional, and alternate means of safe shutdown were not impacted.

· The finding involved risk-significant fire areas that had automatic suppression systems.

· The licensee had adequate fire protection compensatory actions in place.

· b.  If at least one of the above is checked ➛ screen as Green.

· c.   SEQ CHAPTER \h \r 1If NO, continue.

Basis for Question D.2:  The intent of this question is to screen findings related to delayed fire brigade response times to Green as long as the delayed fire brigade response time would not have resulted in a delay in extinguishing a fire.  Fire brigade response times vary and short delays in fire brigade response times are not expected to significantly impact fire growth in most fire areas.  This may not be true for longer delays in fire brigade response times or delays in risk-significant fire areas.  Delays in manual fire suppression are not expected to have a risk-significant impact in areas with automatic fire suppression, because automatic suppression is the primary means of suppressing the fire.  The same is expected for delays in areas that have compensatory measures in place.  If the delayed fire brigade response time is expected to result in additional fire growth that could impact risk-significant SSCs, the finding should not be screened to Green using this question.

Question D.3:  Does the finding involve fire extinguishers, fire hoses, or fire hose stations?

· a.  If YES ➛ check if one or more of the following apply:

· There was no degraded fire barrier and the fire scenario did not require the use of water to extinguish the fire.

· The missing fire extinguisher or fire hose was missing for a short time and other extinguishers or hose stations were in the vicinity.

· b.  If at least one of the above is checked ➛ screen as Green.

· c.   SEQ CHAPTER \h \r 1If none of the boxes under D.1.a, D.2.a, or D.3.a are checked ➛ Stop.  Go to IMC 0609, Appendix M.

Basis for Question D.3:  The intent of this question is to screen findings related to prompt fire-fighting equipment to Green as long as the degraded condition would not result in a delay in extinguishing a fire.  Degraded manual suppression capabilities are expected to have a minimal risk impact in areas with gaseous suppression systems because the gaseous suppression system is the primary fire suppression method.  Fire brigade findings that are not screened to Green using this section are referred to IMC 0609 Appendix M for further evaluation.

E. Flexible Coping Strategies (FLEX)

Supporting Information for FLEX Screening Questions:  Following the earthquake and tsunami at the Fukushima Dai-ichi nuclear power plant in March 2011, the NRC issued Order EA-12-049, which requires licensees to develop a three-phase approach for mitigating the consequences of an extended loss of all alternating current power (ELAP) following a beyond-design-basis external event (BDBEE).  The initial phase (Phase 1) requires the use of existing, installed plant equipment and resources to maintain or restore the three key functions of core cooling, containment, and spent fuel pool cooling capabilities.  The transition phase (Phase 2) requires providing sufficient, portable, onsite equipment and consumables to maintain or restore the three key functions until they can be accomplished with resources brought from off site.  The final phase (Phase 3) requires obtaining sufficient offsite resources to sustain the three key functions indefinitely.  The guidance in NEI 12-06, “Diverse and Flexible Coping Strategies (FLEX) Implementation Guide,” provides one possible approach for licensees to satisfy the requirements of Order EA-12-049.  Allowed out of service time for FLEX equipment differs depending on which revision of NEI 12-06 the licensee implemented.  This information can be found in the licensee’s FLEX final integrated plan (FIP).

The NRC also issued NRC Order EA-12-050, which required licensees to install a reliable hardened containment venting system (HCVS) for Mark I and Mark II containments.  Order EA-12-050 was later rescinded and replaced by Order EA-13-109 to address containment integrity and release of radioactive materials during severe accident conditions.  Order EA-13-109 requires licensees to upgrade or replace the reliable hardened vents required by EA-12-050 with a containment venting system designed and installed to remain functional during severe accident conditions.  The guidance in NEI 13-02, as endorsed in JLD-ISG-2013-02, provides one possible approach for licensees to satisfy the requirements of Order EA-13-109.

Further, the NRC issued Order EA-12-051, which requires licensees to provide safety enhancements in the form of reliable spent fuel pool instrumentation for BDBEEs.  The guidance in NEI 12-02, “Industry Guidance for Compliance with NRC Order EA-12-051,” as endorsed in JLD-ISG-2012-03, provides one possible approach for licensees to satisfy the requirements of Order EA-12-051.

Portions of Orders EA-12-051 and EA-12-049 were codified in 10 CFR 50.155, “Mitigation of beyond-design-basis events.”  Regulatory Guide (RG) 1.226, “Flexible Mitigation Strategies for Beyond-Design-Basis Events,” endorses sections of NEI 12-06, Revision 4, with exceptions, clarifications and additions, for meeting certain regulations in 10 CFR 50.155.  RG 1.227, “Wide-Range Spent Fuel Pool Level Instrumentation,” endorses sections of NEI 12-02, Revision 1, with exceptions and clarifications, for meeting certain regulations in 10 CFR 50.155.  Order EA-13-109 for severe accident capable vents remains valid for plants with Mark I and II containments after issuance of 10 CFR 50.155.

Question E.1:  Is the inspection finding associated with equipment, training, procedures, and/or other programmatic aspects credited for the sole purpose of satisfying the requirements of Order EA-12-051 or 10 CFR 50.155 for spent fuel pool instrumentation and/or EA-13-109 for containment venting (i.e., not credited for satisfying EA-12-049 or other portions of 10 CFR 50.155 as well)?

· a.  If YES ➛ Screen as Green.

· b.   SEQ CHAPTER \h \r 1If NO, continue.

Basis for Question E.1:  This question is intended to screen findings related to spent fuel pool instrumentation and containment venting to Green if they are solely related to satisfying FLEX functions.  Spent fuel pool instrumentation is not modeled in most PRAs and is not expected to impact CDF.  Findings related to containment venting can contribute to LERF, but findings that are only related to the containment venting for FLEX are expected to have a small impact on LERF.  This question is not intended to evaluate findings related to containment venting for design basis accidents.  Those should be evaluated under the Barrier Integrity Cornerstone.

Question E.2:  Does the inspection finding involve equipment, training, procedures, and/or other programmatic aspects credited in any Phase 1 or 2 FLEX strategy such that any FLEX function (such as extended HPCI/RCIC/AFW operation, providing FLEX DC power, FLEX AC power, or FLEX RCS feed) could not be completed in accordance with existing plant procedures within the time allotted for an exposure period of greater than 21 days?

· a.  If YES ➛ Stop.  Go to Detailed Risk Evaluation section.

· b.   SEQ CHAPTER \h \r 1If NO, screen as Green.

Basis for Question E.2:  This question is intended to screen FLEX findings to Green if they are not expected to result in the failure of a Phase 1 or 2 FLEX function for greater than 21 days.  If the finding would be expected to result in the failure of a Phase 1 or 2 FLEX function for more than 21 days, the finding should be evaluated using a DRE.  Typical Phase 1 FLEX strategies include performing the deep DC load shed and extending operation of turbine-driven pumps (HPCI/RCIC/AFW), both of which extend the amount of time available to implement Phase 2 FLEX strategies.  If any of the Phase 1 FLEX functions fail, there may not be adequate time available to perform the Phase 2 FLEX strategies.  Typical Phase 2 FLEX strategies include installation of a portable diesel generators (DG) to repower the DC battery chargers (to restore DC power), to restore certain AC equipment (to restore core and/or containment cooling pumps), or to power portable pumps (to supply RCS or SG feed water).

For the purpose of this question, a FLEX function should be considered failed if the strategy could not be implemented in accordance with existing plant procedures within the time allotted. This could occur if multiple pieces of equipment fail or if one piece of portable equipment was failed but it’s failure would not be discovered within enough time for the licensee to install the backup piece of portable equipment. A FLEX function should also be considered failed if the deficiency would result in additional equipment failures that would require recovery actions (restoration of a function in some way outside of the existing strategies) or prevent completion of the strategy in accordance with existing procedures within the time allotted.

The following example illustrates how failure of a single piece of equipment can result in failure of a FLEX function (the inability to implement a FLEX function in accordance with existing plant procedures within the time allotted).  A licensee’s FLEX strategy for restoring core cooling requires deployment of a portable diesel generator to repower certain AC-powered motor operated valves (MOVs) within 6 hours of declaration of an ELAP.  However, failure of the portable diesel generator would not be identified until it was installed, connected to the AC bus, and used to open an AC MOV.  This is expected to occur 5 hours after declaration of the ELAP. It is expected that it would take an additional 2 hours to deploy the backup diesel generator - a total of 7 hours after declaration of the ELAP.  Since it would take longer to deploy the backup diesel generator (7 hours) than the time allotted for restoring core cooling (6 hours), the FLEX function should be considered failed for the purpose of the screening question and a DRE should be performed if the failure existed for more than 21 days.

The exposure time of 21 days was determined using the SPAR models.  The largest change in risk due to addition of FLEX to the SPAR models was determined to be approximately 8.7E-6 per year for internal events.  In order to account for external events (fire, flooding, high winds, seismic), the change in risk due to internal events was doubled.  This value was used to determine how many days it would take to reach the greater than Green threshold of 1E-6 per year.  Doubling the internal events value to account for external events was based on experience with multiple completed DREs that show this value is generally slightly conservative.

03.01.03 Technical Basis for the Barrier Integrity Screening Questions

A. Fuel Cladding Integrity

Supporting Information for the Fuel Cladding Integrity Screening Questions:  For the purposes of this SDP, issues that meet any of the following four criteria represent a challenge to fuel cladding integrity and require further evaluation:  (1) placed the plant in an unanalyzed condition, (2) adversely impacted any fundamental assumptions regarding fuel failure used in the accident analysis (such as fuel failure temperature or oxidation rate), (3) resulted in reactor coolant activity exceeding TS limits, or (4) resulted in automatic actuation of an SSC necessary to protect against exceeding thermal limits.

Question A.1:  Did the finding involve control manipulations that unintentionally added positive reactivity that challenged fuel cladding integrity (e.g., inadvertent boron dilution, cold water injection, two or more inadvertent control rod movements, recirculation pump speed control)?

· a.  If YES, ➛ Stop.  Go to IMC 0609, Appendix M.

· b.  If NO, continue. 

Basis for Question A.1:  The intent of this question is to refer findings involving the addition of positive reactivity that may have challenged fuel cladding integrity for further evaluation using Appendix M.  Fuel cladding integrity findings that did not challenge fuel cladding integrity continue to the next screening question.

Question A.2:  Did the finding result in a mismanagement of reactivity by operator(s) that challenged fuel cladding integrity (e.g., reactor power exceeding the licensed power limit, inability to anticipate and control changes in reactivity during crew operations)?

· a.  If YES, ➛ Stop.  Go to IMC 0609, Appendix M.

· b.  If NO, continue.

Basis for Question A.2:  The intent of this question is to refer findings involving reactivity management that may have challenged fuel cladding integrity for further evaluation using Appendix M.  Fuel cladding integrity findings that did not challenge fuel cladding integrity continue to the next screening question.

Question A.3:  Did the finding result in the mismanagement of the foreign material exclusion or reactor coolant chemistry control program that challenged fuel cladding integrity (e.g., loose parts, material controls)?

· a.  If YES, ➛ Stop.  Go to IMC 0609, Appendix M.

· b.  If NO, continue.

Basis for Question A.3: The intent of this question is to refer findings related to the foreign material exclusion or reactor coolant chemistry control program that may have challenged fuel cladding integrity for further evaluation using Appendix M.  Fuel cladding integrity findings that did not challenge fuel cladding integrity continue to the next screening question.

Question A.4:  Did the finding result from fuel handling errors, a dropped fuel assembly, a misplaced fuel bundle, or crane operations over the core or anywhere in the refueling pathway that challenged fuel cladding integrity or resulted in a release of radionuclides?

· a.  If YES ➛ Stop.  Go to IMC 0609, Appendix M.

· b.  If NO, screen as Green.

Basis for Question A.4:  The intent of this question is to screen findings related to fuel handling errors, dropped fuel assemblies, misplaced fuel bundles, or crane operation errors over the core or in the refueling pathway that may have challenged fuel cladding integrity or resulted a release of radionuclides for further evaluation using Appendix M.  Fuel cladding integrity findings that did not challenge fuel cladding integrity or result in the release of radionuclides should be screened to Green.  Fuel handling errors, such as a misplaced fuel bundle, that are discovered before startup are not expected to challenge fuel cladding integrity.  However, if the misplaced bundle is not identified before startup, the inspector may need to use judgement to determine if fuel cladding integrity was challenged and further evaluation is needed.  Findings related to fuel handling errors over the spent fuel pool (SFP) should be evaluated using the SFP questions.

B.Reactor Coolant System ( SEQ CHAPTER \h \r 1RCS) Boundary

Question B:  Does the finding involve potential non-compliance with regulatory requirements for protection of the reactor pressure vessel against fracture (e.g., pressure-temperature limits or pressurized thermal shock issues)?

· a.  If YES ➛ Stop.  Go to IMC 0609, Appendix M and consult the appropriate technical branch in NRR (NRR/DNRL/NVIB).

· b.   SEQ CHAPTER \h \r 1If NO, screen as Green.

Basis for Question B:  The intent of this question is to refer findings that violate reactor pressure vessel (RPV) fracture limitations for further evaluation and to ensure that personnel with specialized experience in these limits are included in the evaluation.  The integrity of the RPV is an underlying assumption in most PRA models.  Findings that question the integrity of the RPV can invalidate these underlying assumptions, and therefore require further evaluation.  Findings related to RPV fracture toughness requirements are evaluated in accordance with the ASME Code, Section XI, Appendix E, “Evaluation of Unanticipated Operating Events,” which provides deterministic acceptance criteria for evaluating the impact of out-of-limit conditions on the structural integrity of the RPV to determine whether the plant is acceptable for continued operation.  This question is not intended to evaluate findings related to RCS leakage.  RCS leakage findings should be evaluated under the Initiating Events Cornerstone.

C. Reactor Containment:

Question C.1:   SEQ CHAPTER \h \r 1Does the finding represent an actual open pathway in the physical integrity of reactor containment (valves, airlocks, etc), failure of containment isolation system (logic and instrumentation), failure of containment pressure control equipment (including SSCs credited for compliance with Order EA-13-109), failure of containment heat removal components, or failure of the plant’s severe accident mitigation features (AP1000)?

· a.   SEQ CHAPTER \h \r 1If YES ➛ Stop.  Go to IMC 0609, Appendix H.

· b.  If NO, continue.

Basis for Question C.1:  This question is intended to refer findings that primarily impact large early release frequency (LERF) for further evaluation using IMC 0609 Appendix H.  The SDP thresholds for LERF are an order of magnitude lower than for CDF.  Containment openings can allow unmitigated radiological releases if an accident were to occur, which can have a significant impact on LERF.  Containment isolation, pressure control, and heat removal findings can impact containment integrity and therefore significantly impact LERF.  Containment isolation, pressure control, and heat removal findings can also impact the operation of SSCs within containment, such as by changing the overpressure available for operation of the ECCS pumps.  Findings that impact operation of SSCs used to mitigate the consequences of accidents should also be evaluated under the Mitigating Systems Cornerstone.

Question C.2:   SEQ CHAPTER \h \r 1Does the finding involve an actual reduction in function of hydrogen igniters in the reactor containment?

· a.   SEQ CHAPTER \h \r 1If YES ➛ Stop.  Go to IMC 0609, Appendix H.

· b.   SEQ CHAPTER \h \r 1If NO, screen as Green.

Basis for Question C.2:  This question is intended to screen findings related to the containment hydrogen ignitors for further evaluation using IMC 0609 Appendix H.  Operation of the hydrogen ignitors contributes to increases in LERF, not CDF.  The SDP thresholds for LERF are an order of magnitude lower than for CDF.  Loss of the hydrogen ignitors can significantly impact LERF for certain containment types.

D. Control Room, Auxiliary, Reactor, or Spent Fuel Pool Building:

Question D.1:  Does the finding only represent a degradation of the radiological barrier function provided for the control room, auxiliary building, spent fuel pool, SBGT system (BWR), or EGTS system (PWR ice condenser)?

· a.   SEQ CHAPTER \h \r 1If YES ➛ Stop.  Screen as Green.

· b.  If NO, continue.

Basis for Question D.1:  The intent of this question is to screen findings to Green that are related to the radiological barrier function of certain areas.  Degradation of the radiological barrier function for these areas is not expected to contribute to an increase in CDF or LERF.  If degradation of the radiological barrier could result in a substantial potential for overexposure, the finding should be evaluated using IMC 0609 Appendix C, “Occupational Radiation Safety Significance Determination Process.”

Question D.2:  Does the finding represent a degradation of the barrier function of the control room against smoke or a toxic atmosphere?

· a.   SEQ CHAPTER \h \r 1If YES ➛ Stop.  Go to Detailed Risk Evaluation section.

· b.  If NO, screen as Green.

Basis for Question D.2:  This question is intended to refer findings that could result in main control room habitability concerns or evacuation for further evaluation using a DRE.  Findings that increase the probability of main control room evacuation can have a significant impact on risk and should not be screened to Green.

E. Spent Fuel Pool (SFP)

Question E.1:   SEQ CHAPTER \h \r 1Does the finding adversely affect decay heat removal capabilities from the spent fuel pool causing the pool temperature to exceed the maximum analyzed temperature limit specified in the site-specific licensing basis?

· a.   SEQ CHAPTER \h \r 1If YES ➛ Stop.  Go to IMC 0609, Appendix M.

· b.   SEQ CHAPTER \h \r 1If NO, continue.

Basis for Question E.1:  The intent of this question is to screen SFP related findings for further evaluation that resulted in the SFP exceeding its maximum analyzed temperature limit.  The SFP criticality analysis includes a maximum SFP temperature.  This temperature is often referenced in the plant-specific Final Safety Analysis Report (FSAR) for SFP accidents.  Above this temperature, the assumptions in the criticality analysis may no longer be met.  Therefore, further evaluation is required.  Further evaluation is performed using Appendix M because we do not have PRA models for SFPs.

Question E.2:   SEQ CHAPTER \h \r 1Does the finding result from fuel handling errors, dropped fuel assembly, dropped storage cask, or crane operations over the SFP that caused mechanical damage to fuel clad AND a detectible release of radionuclides?

· a.   SEQ CHAPTER \h \r 1If YES ➛ Stop.  Go to IMC 0609, Appendix M (refer to IMC 0609, Appendix C as applicable).

· b.   SEQ CHAPTER \h \r 1If NO, continue.

Basis for Question E.2:  The intent of this question is to screen SFP related findings that resulted in clad damage and a detectible release of radionuclides for further evaluation.  Further evaluation is performed using Appendix M because we do not have PRA models for spent fuel pools.  Findings that did not result in clad damage and a detectible release of radionuclides continue to the next question.  This question does not apply to fuel handling errors in the core or fuel bundles dropped over the core.  Findings related to fuel handling errors over the core should be evaluated using the fuel cladding integrity questions.

Question E.3:   SEQ CHAPTER \h \r 1Does the finding result in a loss of spent fuel pool water inventory decreasing below the minimum analyzed level limit specified in the site-specific licensing basis?

· a.   SEQ CHAPTER \h \r 1If YES ➛ Stop.  Go to IMC 0609, Appendix M.

· b.  If NO, continue.

Basis for Question E.3: The SFP decay heat removal analysis includes a minimum SFP volume.  The minimum volume is usually included in the TS.  Below this volume, the assumptions in the decay heat removal analysis may no longer be met.  Therefore, further evaluation is required.  Further evaluation is performed using Appendix M because we do not have PRA models for SFPs.

Question E.4:  Does the finding affect the SFP neutron absorber, fuel bundle misplacement (i.e., fuel loading pattern error) or soluble Boron concentration (PWRs only)?

· a.   SEQ CHAPTER \h \r 1If YES ➛ Stop.  Go to IMC 0609, Appendix M.

· b.  If NO, screen as Green.

Basis for Question E.4:  The intent of this section is to screen findings related to the SFP to Green if the finding did not challenge the assumptions for any SFP accidents or analyses or result in the release of radionuclides.  The intent of this question is to refer SFP findings related to neutron absorbers, fuel bundle placement, or soluble boron concentration for further evaluation.  These parameters are used in SFP criticality analysis.  If these parameters are not met, the assumptions in the analysis may no longer be met.  Errors in fuel bundle placement may also violate B.5.b assumptions.  Further evaluation is performed using Appendix M because we do not have PRA models for SFPs.

03.01.04 Technical Basis for the External Events Screening Questions

Question 1:  If the equipment or safety function is failed or unavailable, are ANY of the following three statements TRUE?  The loss of this equipment or function by itself during the external initiating event it was intended to mitigate:

· would cause a plant trip or an initiating event;

· would degrade two or more trains of a multi-train system or function;

· would degrade one or more trains of a system that supports a risk significant system or function.

· a.   SEQ CHAPTER \h \r 1If YES ➛ Stop.  Go to Detailed Risk Evaluation section.

· b.  If NO, Continue.

Basis for Question 1:  The intent of this question is to refer findings related to SSCs used to respond to external events for further evaluation using a DRE if the degradation is expected to be risk significant.  Findings that involve the loss of SSCs or functions that could cause a plant trip, degrade a risk significant system/function, or degrade multiple trains of multi-train systems/functions during the external event they were intended to mitigate could be risk significant and should be evaluated using a DRE.

Question 2:  Does the finding involve the total loss of any PRA function, identified by the licensee through a PRA, IPEEE, or similar analysis, that contributes to external event initiated core damage accident sequences (i.e., initiated by a seismic, flooding, or severe weather event)?

· a.   SEQ CHAPTER \h \r 1If YES ➛ Stop.  Go to Detailed Risk Evaluation section.

· b.  If NO, screen as Green.

Basis for Question 2:  The intent of this question is to refer findings related to SSCs used to respond to external events for further evaluation using a DRE if the degradation is expected to be risk significant.  Findings that do not meet the further evaluation criteria in the previous question and do not include the loss of any PRA function used to mitigate core damage sequences initiated by an external event are not expected to be risk significant and may be screened to Green.

03.02Technical Basis for the Detailed Risk Evaluation (DRE)

IMC 0609, Appendix A briefly describes how SPAR models (e.g., SDP Workspace, Event Condition Assessment, General Analysis) can be used to develop a plant specific estimate of the risk significance of an inspection finding.  The SPAR models consist of a set of plant-specific Probabilistic Risk Assessment (PRA) models that employ a standard approach for event-tree and fault-tree development as well as a standard approach for input data for initiating event frequencies, equipment performance, and human performance.  These input data can be modified to be more plant- and event-specific when needed.

The NRC staff ensures the SPAR models continue to be of sufficient quality for performing event and condition assessments of operational events and degraded plant conditions in support of the staff’s risk-informed activities.  In 2006, the staff implemented an updated SPAR Model Quality Assurance Plan with the objective of maintaining sufficient technical adequacy of the SPAR models.  There are processes in place to verify, validate, and benchmark these models according to the guidelines and standards established by the SPAR Model Program.  As part of this process, the Idaho National Lab (INL) performed a one-time “cut-set level” review of all the SPAR models with the licensee's PRA model.  INL also maintains a process to regularly update the SPAR models and typically 10-12 models are updated per year.  Additionally, INL provides support for real time updates of the SPAR model if necessary to complete an SDP evaluation.  The staff performs periodic reviews of the SPAR models, compares results against the licensee PRA models, and regularly updates the SPAR models based on operational findings and feedback to better represent the as-built, as-operated plant.  The staff has processes in place for the proper use of these models in agency programs, which are documented in the Risk Assessment of Operational Events Handbook (Ref. 1) also known as the “RASP Handbook.”

In addition, the staff (with the cooperation of industry experts) performed a peer review of a representative boiling-water reactor (BWR) SPAR model and pressurized-water reactor (PWR) SPAR model in accordance with American National Standard, ASME/ANS RA-Sa-2009, “Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications” (Ref. 2), and Regulatory Guide 1.200, “An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities” (Ref. 3).  This benchmarking effort is another avenue to verify the technical adequacy of the SPAR models.

The staff utilizes the SAPHIRE software to analyze the SPAR models.  A number of quality assurance activities have been instituted to ensure the software continues to meet the needs of the SPAR Model Program.  The staff contributed to the development of this revision of SAPHIRE by reviewing the software requirements, testing preliminary versions of the software, and providing feedback to be incorporated in the final software design. In addition, an Independent Verification and Validation (IV&V) evaluation of SAPHIRE was performed.  The IV&V team assessed the SAPHIRE software for conformance with the NRC’s documented technical requirements specified within the NURGE/BR-0167 “Software Quality Assurance Program and Guidelines” (Ref. 4), and where applicable, the IEEE Std 1012-2004 “Standard for Software Verification and Validation” (Ref. 5) as a secondary reference.  The staff continues to maintain and improve the SAPHIRE software to support the SPAR Model Program.  All SAPHIRE maintenance activities, modifications and improvements are performed in accordance with the established SAPHIRE Software Quality Assurance Plan.  Companion documentation for the SAPHIRE software is published as NUREG/CR-7039, Volumes 1 through 7 (Ref. 6).

# 0308.03A-04 REFERENCES

1. Risk Assessment of Operational Events, “Volume 1 – Internal Events,” Revision 2.02, U.S. Nuclear Regulatory Commission, Washington, DC, December 2017.

Risk Assessment of Operational Events, “Volume 2 – External Events,” Revision 1.02, U.S. Nuclear Regulatory Commission, Washington, DC, November 2017.

Risk Assessment of Operational Events, “Volume 3 – SPAR Model Reviews,” Revision 2, U.S. Nuclear Regulatory Commission, Washington, DC, September 2010.

Risk Assessment of Operational Events, “Volume 4 – Shutdown Events,” Revision 1.0, U.S. Nuclear Regulatory Commission, Washington, DC, April 2011.

2. ASME/ANS RA-Sa-2009, “Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications,” Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009.

3. Regulatory Guide 1.200, “An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,” Revision 2, U.S. Nuclear Regulatory Commission, Washington, DC, March 2009.

4. NUREG/BR-0167, “Software Quality Assurance Program and Guidelines,” U.S. Nuclear Regulatory Commission, Washington, DC, February 1993.

5. IEEE Std 1012-2004, “IEEE Standard for Software Verification and Validation,” Revision of IEEE Std 1012-1998, The Institute of Electrical and Electronics Engineers, Inc., New York, NY, June 2005.

6. NUREG/CR-7039, “Systems Analysis Programs for Hands-on Integrated Reliability Evaluations (SAPHIRE) Version 8,” Volumes 1-7, U.S. Nuclear Regulatory Commission, Washington, DC, June 2011.

7. IMC 0609, Appendix A, “At-Power Significance Determination Process”

8. IMC 0308, Attachment 3, “Technical Basis for the Significance Determination Process”

END

Attachment 1 – Revision History for IMC 0308, Attachment 3, Appendix A

Issue Date:  40308 Attachment 3 Appendix A

Effective Date: