Configuration Management in a Risk-Informed Environment William H. Ruland, USNRC-Region I September 25, 2000 The purpose of this presentation is to provide background information for the reactor inspection and oversight process. This is the first lecture in the course and is designed to ensure that every student has a basic understanding of the process. The information in this presentation is from NUREG- 1649. The information on enforcement came from SECY 99-007. 11/16/2018 8:23:38 AM

The overall mission of the agency is to ensure public health and safety. This mission can be accomplished by ensuring plants perform well in the three strategic performance areas. Performance in each area can be further divided into cornerstones. Good performance in the cornerstones “Props Up” the strategic performance areas. There are cross cutting issues: Human Performance, Safety Conscious Work Environment, and Problem Identification and Resolution. A lack of any of these attributes may result in less than adequate performance in one or more cornerstones. 11/16/2018 8:23:38 AM

Features of Oversight Program Focuses inspections on risk. Applies greater NRC attention to facilities with performance problems. Uses objective measures of plant performance whenever possible. Gives timely assessments of plant performance. Avoids unnecessary regulatory burden. Bullet 1: 1. Reducing risk increases safety. 2. With diminishing resources, risk significance will be used more and more as a metric to assign resources. Bullet 2: 1. Poor performers represent a greater risk to public, therefore, these plants should receive more attention. 2. Good performers, as measured by standards to be discussed, will receive minimum inspection. A criticism of the old program was that SALP 1 plants received the same inspection effort as SALP 3 performers. 3. Objective measures are called performance indicators (PIs). 11/16/2018 8:23:38 AM

Baseline Inspection Program Minimum level of inspection conducted at all plants regardless of performance. Three parts: Inspection in areas which performance indicators do not cover. Performance Indicator Verification. Licensee problem identification and resolution program. 1. Bullet one defines the Baseline Inspection Program. 2. There are three basic components: A. Inspections in areas which performance indicators are not identified or do not cover a cornerstone. Again, P.I.s will not provide the full picture. Also, P.I.s do not exist in some safety related areas, so inspections are necessary. B. We will be verifying the P.I. Data. C. The PI&R (corrective action program) is a key component of the ROIP - if this program is not effective, then cornerstones will degrade. The new enforcement policy depends heavily upon the licensee’s program. PI&R is now a part of all inspection procedures, and a separate inspection procedure will examine the licensee’s PI& R program. 11/16/2018 8:23:38 AM

Performance Bands for Performance Indicators and Inspection Findings Green - Licensee Response Band White - Increased Regulatory Response Band Yellow - Required Regulatory Response Band Red - Unacceptable Performance DCDF < 1E-6 1E-6 < DCDF < 1E-5 1E-5 < DCDF < 1E-4 1. These slides show the four “bands” of licensee performance. 2. The bullet beside each band gives the definition of performance. 3. Emphasize that performance indicators and inspection findings will be categorized into one of these colors. 4. A significance determination process has been developed for each strategic area + EP to determine the risk associated with inspection findings. 5. The assessment of licensee performance will be based on P.I.s and Inspection findings using these colors. 6. Assessment will be discussed in a couple of slides, but it may be useful to point out that we will not, in general, have GREEN, WHITE, YELLOW, and RED utilities. DCDF > 1E-4 11/16/2018 8:23:38 AM

Web Page - Performance Indicators 1. This is a web page for one of the pilot plants. Note that each cornerstone has a color. 2. One of the EP cornerstone performance indicators is white. 3. Inspection reports will also be posted on the web. 4. Web postings + PDR documents will keep public informed. 11/16/2018 8:23:38 AM

Web Page Details 11/16/2018 8:23:38 AM 1. The value of the performance indicator can be determined by clicking on the PI box. This slide shows that Drill Participation has dipped into the white band. 11/16/2018 8:23:38 AM

Web Page - Inspection Findings See http://www.nrc.gov/NRR/OVERSIGHT/index.html 11/16/2018 8:23:38 AM

*Procedure for Reactor Safety Cornerstones IP 71111 Attachments* Adverse Weather (01) Heat Sink Performance (07) Non-routine Evolutions (14) Refueling and Outage Activities (20) Changes , Tests, or Experiments (02) ISI Activities (08) Operability Evaluations (15) Safety System Design & Performance (21) Equipment Alignment (04) Licensed Operator Re-qualification (11) Surveillance Testing (22) Operator Workarounds(16) Fire Protection (05) Maintenance Rule Implementation (12) Permanent Plant Modifications(17) Temporary Plant Modifications (23) 1. This slide lists the 19 inspection procedures. 2. Explains why attachment 18 was deleted. As outlined by the technical framework, the Piping System Erosion and Corrosion inspectable area supports the initiating events (not mitigating systems) cornerstone. Consequently, the SSCs of concern are those that form the reactor coolant system pressure boundary. Because of the materials used (and water chemistry control) in the reactor coolant system, few problems relating to erosion/corrosion to the RCS pressure boundary have been experienced. As such, the value of having an erosion/corrosion inspection of the RCS pressure boundary is questionable. (Note that SG tubes are effectively monitored under the ISI program.) With respect to initiating events other than LOCAs, the conditional core damage probability upon a failure of secondary piping or piping in the balance of plant is low. I recognize that people may be killed by such a piping failure. However, such an accident is little different than other forms of industrial accidents and personnel safety hazards. Wth respect to ISLOCAs, the main concern is the integrity of the check valves between the RCS and interfacing systems. Inspection of the check valve testing is part of the Inservice Testing inspectable area. Post pilot, Emergent Work (03) was merged with Maintenance Work Prioritization and the procedure was renamed. Inservice Testing (09) was merged with Surveillance Testing. Procedure 02 was renamed and slightly expanded. Containment Isolation Valve Testing was eliminated. Flood Protection Measures (06) Maintenance Risk Assessments Emergent Work (13) Post Maintenance Testing (19) ( ) = Attachment # *Procedure for Reactor Safety Cornerstones 11/16/2018 8:23:38 AM

Significance Determination Processes (SDP) The SDP is used to assign risk values (colors) to inspection findings. The SDP provides a methodology for equating inspection findings and PIs. SDPs exist for Reactor Safety, EP, Fire Protection, Occupational and Public Radiation Safety, and Safeguards. Cover bullets. Since the P.I.s are risk-informed, a methodology has to exist to determine the risk of inspection findings. This methodology is called the SDP. SDP colors + PI colors = method of assessing performance. SDP listing. 11/16/2018 8:23:38 AM

SDP Assessed Violations SDP will characterize risk associated with violation. Low risk significant violations will be non-cited and entered into corrective action program. Higher Risk significant violations will be subject to requirements of Action matrix. The significant determination processes will rate inspection findings using the same colors that are used for the P.I.s. This places them on an equal footing. The actions discussed on slides 28-34 are the enforcement process for these violations. 11/16/2018 8:23:38 AM

11/16/2018 8:23:38 AM Table 1 - List of Initiating Events in rows - Exposure time of performance issue in columns - Intersection of row and column of interest provides a likelihood rating in the form or a letter. Using previous example,AFW inoperable for 10 days. Transients =I B LOOP =II C SGTR =III D (also SLOCAs due to seal failures, etc.) SLOCA = IV E Note that 3 days ~ 1/100 of a year 30 days ~ 1/10 of a year > 30 days covers up to one year, SO THE COLUMNS REPRESENT A DECADE OF CHANGE. Note that the Approximate frequency column also change by powers of 10. Action Button - Back to Slide 10 - Event Tree 11/16/2018 8:23:38 AM

Last sheet - Table 2 Information needed to use this sheet is the initiating event frequency letter and the remaining capability number. Letter determines row, and number determines column. Go to intersection of row and column to estimate risk for sequence. From our example, B is the row, and 6 is the number. B6 is a Green result. Now picking up the SI pumps. This would increase the number to 8, and there is not an 8 column. Any number greater than 6 is a Green result. Keep track of “hits” in green cells. Counting rule later on. Note that result was used instead of finding. All sequences have not been analyzed, the “color” of the finding is the most risk-significant result. Note that risk increases as initiating event frequency increases (I.e., going from H to A) and also increases as mitigating capability decreases (going from 6 to 0). Also note that there is a decade change in risk going from one cell to another cell. Action Button - returns to previous slide

Risk Estimation Worksheet: Instructor Note - continue with HHSI example Plant Specific Worksheets available on World Wide Web Need a sheet for each affected initiating event. Fill out top of sheet with information from Table 1. (I, 10 days, and B) Circle affected system under affected functions column. Now credit each remaining mitigation capability using Table 3 Trains have been a problem with the SDP from Day 1. So, a few examples are in order: 1. EIHP - early inventory high pressure can be satisfied by either 1/2 charging pumps or 1/2 SI pumps. If both charging pumps are available, then one multi-train system is available. If both SI pumps are available, then the second multi-train system is available. Therefore, each of the available multi-train systems would receive a 3 from Table 3. The “or” can be thought of as an “and” when applying credit. 2. Now suppose that only 1 charging pump is available. From Table 3, a ranking of two would be assigned. Likewise, if 1 SI pump is available, a 2 would be assigned. If 1 charging and 1 SI pump are available, then a total of 4 would be assigned to EIHP. For Example: TRANS-AFW-PCS-EIHP EIHP is HHSI a multi - train system or SI pumps, another multi-train system. But ignore the SI pumps for a moment. We will pick them up a little later. PCS is operable but requires operator action . 11/16/2018 8:23:38 AM

Traditional Enforcement Actions Willfulness including discrimination. Actions that may impact NRC’s ability for oversight of licensee’s activities. Actual consequences such as an overexposure to public or plant personnel or a substantial release of radioactive material. Tradition enforcement stuff. Discrimination refers to interference with an employee’s notification to NRC. 11/16/2018 8:23:38 AM

RESULTS RESPONSE COMMUNICATION 11/16/2018 8:23:38 AM

Other Environmental Changes Consolidation of Operating Organizations Competitive pressures will remain or increase Maintenance of design basis - susceptible to cost-cutting since tie to operations and safety not obvious? License renewal? 11/16/2018 8:23:38 AM

Future Challenges Continued vigilance in maintaining configuration control, looking toward the future. Effective implementation of the corrective action program. Safe, event-free operation. 11/16/2018 8:23:38 AM