ML17333A777

Forwards Response to Request for Info Per 10CFR50.54(f) Re Adequacy & Availability of design-basis Info

ML17333A777
Person / Time
Site:	Cook
Issue date:	02/06/1997
From:	Fitzpatrick E AMERICAN ELECTRIC POWER CO., INC.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
AEP:NRC:1257, NUDOCS 9702120329
Download: ML17333A777 (67)

Text

CATEGORY 1 REGULATIQ INFORMATION DISTRIBUTIONSTEM (RIDE)

ACCESSION NBR:9702120329 DOC.DATE 97/02/06 NOTARIZED: YES DOCKET I FACIL:50-315. Donald C.

Cook Nuclear Power Plant, Unit 1, Indiana M

05000315 50-316. Donald C.

Cook Nuclear Power Plant, Unit 2, Indiana M

05000316 AUTH.NAME AUTHOR AFFILIATION FITZPATRICK,E.E American Electric Power Co., Inc.

RECIP.NAME RECIPIENT AFFILIATION Document Control Branch (Document Control Desk)

SUBJECT:

Forwards response to request for info per 10CFR50.54(f) re adequacy a availability of design-basis info.

DISTRIBUTION CODE:

A074D COPIES RECEIVED:LTR l

ENCL

(

SIZE: I5 TITLE: Responses to 50.54(f)

Req. for Design Basis Info NOTES:

C A

E RECIPIENT ID CODE/NAME PD3-3 PD INTERNAL:

PDR-2

THO, EXTERNAL: NRC PDR

.COPIES LTTR ENCL 1

1 1

1 3

3 1

1 RECIPIENT ID CODE/NAME HICKMAN,J NRR/DRPM/PGEB COPIES LTTR ENCL 1

1 1

1 R

Y D

U E

NOTE TO ALL "RIDS" RECIPIENTS:

PLEASE HELP US TO REDUCE WASTE!

CONTACT THE DOCUMENT CONTROL DESK, ROOM OWFN SD-5(EXT. 415-2083)

TO ELIMINATE YOUR NAME FROM DISTRIBUTION LISTS FOR DOCUMENTS YOU DON'T NEED!

TOTAL NUMBER OF COPIES REQUIRED:

LTTR 8

ENCL

. '. 8

fp II/

I indiana Michigan ~

Power Company 500 Circle Drive Buchanan, Ml 491071395 INQMNA MICNl6A&f PMfM February 6, 1997 Docket Nos.:

50-315 50-316 AEP:NRC:1257 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D. C.

20555 Gentlemen:

Donald C. Cook Nuclear Plant Units 1 and 2 REQUEST FOR INFORMATIONPURSUANT TO 10 CFR 50.54(f)

REGARDING ADEQUACYAND AVAILABILITY OF -DESIGN BASIS INFORMATION

'n October 9, 1996, the NRC requested that we provide information pursuant to 10 CFR 50.54(f) regarding the adequacy and availability of design basis information at the Donald C. Cook Nuclear Plant. This letter and attachment are being submitted in response to that request.

The purpose of the NRC's request for information is to obtain information that willprovide added confidence and assurance that Cook Nuclear Plant is operated and maintained within the established design bases and that any deviations are reconciled in a timely manner.

Our response describes how the original design bases were established, how changes have been controlled over the life of the plant, and how they are controlled today.

We rely on an integrated set of procedures and processes implemented over the life ofthe plant to formally control and document changes and the manner in which they are implemented.

Our confidence in the effective performance of these processes and procedures results from the findings of on-going internal and external audit and assessment programs that have repeatedly reviewed the manner in which the Cook Nuclear Plant staff has implemented these processes and determined, for the great part, that their implementation has been effective and appropriate.

In those instances where the need for revisions or additions to the processes and procedures have been identified, we have undertaken those changes in an appropriate manner.

In addition to determining and detailing how effective engineering design and configuration control have been maintained, we have also undertaken a number of reviews and assessments specifically for the purpose of developing this response and to re-affirm our confidence in the processes that are currently in place.

These reviews and assessments and the results thereof are also described m our response.

9702i20329 97020b PDR ADQCK 05000315 P

PDR 12005.'-r

U. S. Nuclear Regulatory Commission Page 2 AEP:NRC:1257 To further enhance our confidence in the configuration control processes in place at Cook Nuclear Plant, we are committing to conduct and complete two major programs.

These on-going programs are the design basis documentation reconstitution project, which was initiallyimplemented in 1992, and the UFSAR revalidation project, which was initiated in late 1996.

Both programs will provide added information and assurance regarding the status of configuration control at Cook Nuclear Plant.

These programs are described in section (f) of the response and the commitments associated with these programs are delineated in the introductory section of the attachment.

No other statements, written or inferred, should be considered to be regulatory commitments.

As the results of our on-going efforts become available, we intend to evaluate such findings and take those actions deemed necessary to maintain Cook Nuclear Plant configuration and performance fullyconsistent with the plant design bases.

Sincerely, Ed

'pm'ice President SWORN TO AND SUBSCRIBED BEFORE ME THIS~ DAY OF 1997 Notary Public My Commission Expires:

Jen Attachment ON NOTARYPUBUC, BERRIEN COUNTY,Ml h<YCOIIIIMISSIONEXPIRES FEB.10, 1999 CC:

A. A. Blind A. B. Beach MDEQ - DW Ec RPD NRC Resident Inspector J. R. Padgett

ATTACHMENTTO AEP:NRC:1257 Request for Information Pursuant to 10 CFR 50.54(f)

Regarding Adequacy and Availabilityof Design Basis Information

TABLE OF CONTENTS I

Introduction Page 1

II Question A:

Description of engineering design and Page 4 configuration control processes, including those that implement 10 CFR 50.59, 10 CFR 50.71(e), and Appendix B to 10 CFR Part 50 III Question B: Rationale for concluding that design bases Page 14 requirements are translated into operating, maintenance, and testing procedures IV Question C: Rationale for concluding that system, structure, Page 21 and component configuration and performance are consistent with the design bases V

VI Question D: Processes for identification of problems and implementation of corrective actions, including actions to determine the extent of problems, actions to prevent recurrence, and reporting to NRC Question E:

The overall effectiveness of your current processes and programs in concluding that the configuration of your plant(s) is consistent with the design bases Page 33 Page 40 VII Question F: In responding to items (a) through (e), indicate Page 46 whether you have undertaken any desipn review or reconstitution

programs, and if not, a rationale for not implementing such a program

Attachment to AEP:NRC:1257

'NTRODUCTION Page 1

This attachment to AEP:NRC:1257 provides our response to the October 9, 1996, letter issued by the Nuclear Regulatory Commission (NRC) entitled "Request for Information Pursuant to 10 CFR 50.54(f) Regarding Adequacy and Availability of Design Basis Information." Sections correspond to the specific requests for information.

(a)

Description ofengineering design and configuration control processes, including those that implement 10 CFR 50.59, 10 CFR 50.71(e), and Appendix B to 10 CFR Part 50 (b)

Rationale for concluding that design bases requirements are translated into operating, maintenance, and testing procedures (c)

Rationale for concluding that system, structure, and component configuration and performance are consistent with the design bases (d)

Processes for identification of problems and implementation of corrective actions including actions to determine the extent ofproblems, actions to prevent recurrence, and reporting to NRC (e)

The overall effectiveness ofyour current processes and programs in concluding that. the configuration of your plant is consistent with the design bases (fj In responding to items (a) through (e), indicate whether you have undertaken any design review or reconstitution programs, and ifnot, a rationale for not implementing such a program Each section that addresses a specific request has a general response followed by a more detailed description of past, present, or future programs related to the adequacy and availability of design bases information.

COMMITMKNTS There are currently two efforts in progress that willenhance the control ofdesign bases information at Cook Nuclear Plant.

First the design basis documentation reconstitution (DBDR) project willbe completed by the end of 1999.

The details of the project continue to evolve; however, we consider completion of a DBDR project, as generally described in section (f), by the end of 1999 a commitment to the NRC.

Second, we are in the process of conducting an updated final safety analysis report (UFSAR) revalidation project. The UFSAR revalidation project is in its initial stages; notwithstanding, completion of a UFSAR revalidation project, as generally described in section (f), by July 1997 is considered a commitment to the NRC.

No other new or revised commitments are intended by this letter.

Attachment to AEP:NRC:1257 SAFETY ANALYSISREPORT HISTORY Page 2 A brief history of the Safety Analysis Report is provided below for reference.

The Indiana & Michigan Electric Company, a major operating company of the American Electric Power Company, Inc., by application dated December 18, 1967, and as subsequently

amended, requested permits to construct and licenses to operate two pressurized water reactors, to be known as Donald C. Cook Nuclear Plant, Units 1 and 2 located on the eastern shore of Lake Michigan in Lake Township, Berrien County, Michigan.

American Electric Power Service Corporation (AEPSC) was the architect/engineer for the plant.

AEPSC selected Westinghouse Corporation as the nuclear steam supply system supplier.

Cook Nuclear Plant was the first to utilize an ice-condenser containment concept.

The preliminary safety analysis report volumes I, II, and IIIdescribed the plant design, construction, pre-operational testing, and planned operations.

Amendments 1 through 11 were submitted in response to questions from the Atomic Energy Commission (AEC) staff.

The AEC reported the results of its review prior to construction in a safety evaluation report dated January 14, 1969. Following a public hearing before an atomic safety and licensing board, the director of reactor licensing issued provisional construction permits CPPR-60 and CPPR-61 for units 1

and 2, respectively, on March 25, 1969.

AEPSC submitted the final safety analysis report (FSAR) for units 1 and 2 on February 1,

1971

~

Over the next seven

years, amendments were submitted in response to numerous NRC issues continually updating the licensing basis'of the units.

The unit 1 operating license was issued on October 25, 1974, and was based on information submitted through amendment 59.

The unit 2 operating license was issued on December 23, 1977, and was based on information submitted through amendment 80 dated December 21, 1977.

Prior to the promulgation of 10 CFR 50.71(e),

several FSAR amendments were submitted to resolve specific licensing issues during the time period betwee:. operating license issuance and the first update under 10 CFR 50.71(e).

Following the promulgation of 10 CFR 50.71(e), the first general update of the Cook Nuclear Plant FSAR was submitted in July 1982.

Additional updates have subsequently been submitted on an annual basis.

SUMMARY

The following sections of this attachment provide detailed responses to the six requests for information in the NRC's October 9, 1996, letter.

The response to question (a) describes the current processes for engineering design and configuration control. It includes details regarding the 10 CFR 50.59 review process and its integration into the plant configuration change processes.

The responses to questions (b) and (c) provide our rationale for concluding that design bases requirements are translated into procedures, and that equipment configuration and performance are consistent with the design bases.

Our rationale is based on our review of original and current processes, the pre-operational testing program, and special

Attachment to AEP:NRC:1257 Page 3

initiatives as well as the results ofour performance as indicated in internal assessments such as quality assurance (QA) audits and safety system functional inspections, NRC

'inspection reports, and licensee event reports.

The corrective action program is the cornerstone of. the response to question (d) regarding the identification of problems and corrective actions.

The response to question (e) relies on the answers to the other questions in outlining the effectiveness of these aforementioned practices and processes.

Lastly, the ongoing initiatives of the design basis documentation reconstitution project and the UFSAR revalidation project are described.

Attachment to AEP:NRC:1257 RESPONSES TO NRC RE UEST FOR INFORMATION Page 4 N~RC RR URRT (a)

Description of engineering design and configuration control processes, including those that implement 10 CFR 50.59, 10 CFR 50.71(e),

and Appendix B to 10 CFR Part 50

RESPONSE

At Cook Nuclear Plant, engineering design and configuration control consists of a number of interrelated processes.

These processes are integrated with our 10 CFR 50.59 program, Updated Final Safety Analysis Report (UFSAR) revision (10 CFR 50.71(e)), and the Quality Assurance (QA) program (Appendix B to 10 CFR 50).

Detailed procedures describe the scope and requirements necessary for implementation of these processes.

The following sections describe the above mentioned processes:

~

10 CFR 50.59 program

~

engineering design and configuration control processes

~

UFSAR update process (10 CFR 50.71(e))

~

10 CFR 50 Appendix B program

~

summary 1.

10 CFR 50.59 Pro ram The 10 CFR 50.59 process descriptions used at Cook Nuclear Plant are provided below.

~

Safety screening:

the documentation related to 10 CFR 50.59(a)(1) in which a determination is made regarding whether new or revised designs, procedures, tests, or experiments require a 10 CFR 50.59(a)(2) safety evaluation or further environmental review, or involve a change to the technical specifications, environmental protection plan, emergency plan, or security plan.

~

Safety evaluation:

the documentation related to 10 CFR 50.59(a)(2),

and required by 10 CFR 50.59(b), that supports the determination of whether a proposed change to the plant, proposed change to procedures affecting the plant, or a test or experiment creates an unreviewed safety question (USQ).

The safety screening involves consideration ofthe followingfive fundamental questions used to determine the need for a safety evaluation.

These questions ask whether the proposed change constitutes:

a change to the plant as described in the UFSAR, emergency plan, or security plan;

~

a change to procedures as described in the UFSAR, emergency plan, or security plan;

~

atest or experiment not described in the UFSAR;

Attachment to AEP:NRC:1257 Page 5

~

a change to procedures, design, nr a test or experiment that could affect the environment, or a

change to Appendix B of the technical specifications (environmental protection plan); or

~

a change to the technical specifications or the operating license.

Ifthe answer to these questions is no, a safety evaluation is not required pursuant to 10 CFR 30.59.

A safety evaluation may be conducted for any activity if there is uncertainty about the potential impact of the change or if there is a potential environmental impact.

The 10 CFR 50.59 safety evaluation examines whether a proposed change is a USQ.

The USQ determination uses the three criteria of 10 CFR 50.59(a)(2) when evaluating planned changes, tests, or experiments.

When a USQ exists, the proposed change, test, or experiment may not be implemented without prior NRC approval.

For design changes, safety evaluations are conducted on the portion of the system, component, or structure being modified.

In addition, interfaces with existing plant systems are reviewed from a systems interaction standpoint, when the interface created is determined to be potentially significant to safety.

The Plant Nuclear Safety Review Committee (PNSRC) is responsible for reviewing safety evaluations for proposed procedures and revisions to procedures; changes to equipment, systems, or facilities; and tests or experiments.

Additionally, the Nuclear Safety and Design Review Committee (NSDRC) performs independent reviews ofthese safety evaluations.

Proposed changes that do not involve a USQ and do not impact the technical specifications may be implemented without further NRC approval.

As part of the 10 CFR 50.59 process, however, such changes are evaluated to determine ifa change to the UFSAR is required.

When a change to the UFSAR is warranted, documentation for the proposed change is forwarded for incorporation in the annual update pursuant to 10 CFR 50.71(e).

Personnel who perform safety screenings or safety evaluations are selected by their management and receive initial and requalification training on an annual basis.

The 10 CFR 50.59 program at Cook Nuclear Plant has evolved over the years to achieve present standards as described above.

The program was shaped by NRC inspections, external and internal reviews, and industry initiatives.

There have been findings involving a lack ofadequate justification for specific safety review conclusions reached and the subjective nature ofdetermining whether a proposed change represented a change to the plant as described in the UFSAR.

We have, however, identified no instances where equipment declared operable was later deemed inoperable due to posing a USQ.

We responded to these findings by revising the 10 CFR 50.59 procedure to provide more detailed documentation requirements.

In addition, procedures were revised to require safety evaluations for all design

changes, regardless of UFSAR impact.

Training for personnel involved in safety screenings or safety evaluations also stresses these lessons learned.

Attachment to AEF:NRC:1257 Page 6 2.

Kn ineerin Desi n And Confi uration Control Processes Changes to design bases information can be related to either physical changes to the facility or changes to the design bases documentation.

Engineering design and configuration control is addressed in five main processes, A) design change packages (DCP), B) component evaluations, C) temporary modifications, D) setpoint control, and E) calculation control. Each process has procedural requirements to provide assurance that information is documented,

reviewed, and

approved, and that licensing requirements are met.

A.

Design Change Package The DCP process and the component evaluation process are used to permanently modify the physical c"nfiguration of the plant.

The DCP process uses a team approach to assure projects receive appropriate input,

guidance, and feedback from organizations involved in both pre-operative and post-operative activities.

The team is comprised of a minimum membership of an engineering representative, a project

engineer, and, a representative from plant operations.

Additional team members are requested as the prospect needs dictate. Either an engineering representative or the project engineer is selected as the team leader.

The team leader is assigned overall responsibility for the development, installation, and close-out of a DCP, and is responsible for managing the design change team.

The project engineer is the individual responsible for coordination of planning, scheduling, and installation activities.

The team defines scope, establishes responsibilities, develops schedules, and reviews the DCP checklist in support of the proposed plant change.

The checklist is a compilation of various engineering, design, licensing, and plant issues that must be addressed in the DCP development.

The checklist is included in the DCP.

The DCP development involves documenting issues that need to be addressed tojustify, install, operate, and maintain the design change and identify impacted items such as drawings, procedures, and special testing.

The DCP includes sections that address design inputs md their sources, bills of material, installation coordination, plant procedures, training, in-process testing, surveillance testing, and functional testing.

These issues are addressed and documented when applicable.

The DCP process provides assurance of proper implementation of modifications by requiring:

~

the use of checklists that identify related design and licensing criteria that may need to be addressed as part of the design development;

~

identification ofplant procedures, training, and in-process and functional testing that may need to be addressed;

~

verification by the installer and the installer's QC or peer inspector that the modification activity was installed per approved design and that as-builts accurately reflect the installation.

Installation and testing activities are performed in accordance with the nuclear plant maintenance (NPM) program.

These activities are:

planned utilizing approved drawings, specifications, procedures, and standards issued for or pertaining to the modification;

s

Attachment to AEP:NRC:1257 Page 7

~

reviewed to provide assurance that appropriate procedures, data sheets, and quality control (QC) inspections/hold-points have been included in the planned activity and.to verify compliance with the plant QC program; and

~

reviewed to provide assurance that appropriate post maintenance/modification testing requirements have been included.

The DCP checklist is divided into general, electrical, instrumentation and control, and mechanical issues.

The DCP and associated safety evaluations are reviewed and approved by the PNSRC.

Installation of modifications is planned and scheduled in accordance with the computerized work control system. The design change deviation or information request (DCDIR) process is used to resolve field discrepancies that may arise.

This process provides for appropriate review, resolution, approval, and documentation of deviations from the design package.

Post-modification testing specified in the design change package is performed by qualified personnel in accordance with approved testing procedures.

A design change testing deviation request (DCTDR) is available if a deviation from the approved functional testing or acceptance criteria is required.

Installation and testing documentation is forwarded to the project engineer after the individual work activities are completed.

The project engineer reviews the documentation and verifies that the work has been completed and that the documentation package includes completed installation and testing procedures, as-built drawings, DCDIRs, DCTDRs, and drawing verification lists.

Verified as-builts are transmitted to nuclear records managem:nt personnel and to configuration management personnel for review of affected drawings.

A post-installation walkdown is performed to provide assurance that there are no outstanding items that would indicate an incomplete installation, redline and as-built drawings have captured deviations and field runs, plant fire protection systems and Appendix R safe shutdown components were not adversely affected, affected equipment is properly labeled, and housekeeping/cleanliness is acceptable.

Discrepancies identified during the walkdown must be resolved before the design change is considered complete.

In accordance with our commitments to the NRC, the DCP process requires a 10 CFR 50.59 safety evaluation (as opposed to a safety screening), completion of a UFSAR impact statement form, and design verification in accordance with ANSI N45.2.11.

Design verifications are performed in accordance with established procedures.

The use of checklists is included in the design verification process. Ifapplicable, an approved technical specification change is required prior to the equipment being declared operable.

In summary, the DCP process controls the use of design bases information in performing modifications and provides assurance that documentation is updated based on walkdowns and as-built drawings.

Attachment to AEP:NRC:1257 B.

Component Evaluation Determination Page 8

Due to the declining number of nuclear suppliers and the evolution of component design, there is an mcreasing number of cases for which an identical replacement component is unavailable or obsolete.

We utilize a controlled process to provide assurance that replacement components meet or exceed the necessary technical and quality requirements ofthe original component. This equivalency determination process produces a component evaluation (CE). A CE is performed when it is determined that a non-identical replacement component willbe utilized.

Component evaluations are classified in the following categories:

~

like-for-like screening

~

vendor specified equivalent

~

non-specified alternate replacement - non-safety

~

non-specified alternate replacement - safety/special I)

Like-for-LikeScreening The purpose ofthis process is to locate a replacement component that can be purchased under the same approved technical and quality requirements as the original with no change to form, fit, or function requirements.

The component can be considered like-for-like ifit has the form, fit, and function oi the original component and meets one or more of the following criteria:

~

component that has part/model number differences because of administrative changes; identical component purchased from alternate or sub-tier supplier; or

~

component manufactured to identical industry standards.

There should be no technical or quality differences identified in comparing the proposed component with the original component.

Documentation is prepared with pertinent vendor information, operability release infcrmation, and basis for the like-for-like determination.

A safety screening or design verification is not required because technical and quality requirements have been previously established and reviewed.

2)

Vendor Specified Equivalent For vendor specified replacement components that are not like-for-like because of changes to the component, the differences between the original and replacement component must be specified in a document from the vendor.

The differences are evaluated to determine acceptability for the application(s).

Documentation is prepared that states the differences and reason(s) for acceptance of the vendor specified component.

Vendor specified replacement components require a safety screening.

The CE design verification checklist is used for verification of safety related components (other than like-for-like). The verifier completes the checklist, which provides portions of ANSI N45.2.11 relevant to the scope of the CE process.

3)

Non-Specified Alternate Replacement - Non-Safety This process is for components that are non-safety related, not designated QA-N (safety related), QA-M (selective QA programmatic controls), or QA-F (fire protection), and

Attachment to AEP:NRC:1257 Page 9

'ot associated with station blackout, Appendix R, Regulatory Guide 1.97, Seismic Qualification UtilityGroup (SQUG), or environmental qualification (EQ).

The design specifications ofthe original component (or the system requirements for that component ifdesign specifications of the component are not available) are compared to those ofthe replacement component.

Significant differences are evaluated to provide assurance that they are acceptable for the application.

Differences and reasons for the acceptance of the component are documented.

A safety screening is performed.

4)

Non-Specified Alternate Replacement - Safety/Special This process is for components that are designated QA-N, QA-F, or QA-M, or are associated with station blackout, Appendix R, Regulatory Guide 1.97, SQUG, or EQ.

The safety/special process includes a seven part review that provides assurance that design control activities are addressed.

This process requires a safety screening and CE design verification as stated in item 2) above for the vendor specified process.

When required, copies of CEs are forwarded to configuration management personnel for action.

Documents requiring updating are tracked using the document change request that is part of the CE.

C.

Temporary Modifications The temporary modification process establishes the mechanism for initiation, review, approval, installation, resolution, and closeout ofphysical modifications to the plant that are temporary in nature.

Each temporary modification receives a technical review in accordance with our technical review guideline.

The guideline requires a response to questions to identify potential impact upon the component, related system operation, plant operation, personnel safety, environment, and regulatory requirements.

Key attributes considered m this technical review include, but are not limited to, existing design inputs (such as pressure, temperature, fluidchemistry, voltage, current, material compatibility, seismic, wind, thermal, and dynamic loading), environmental qualification, electrical system loading, impact on surrounding equipment during a seismic

event, channel/train separation, fire hazards analysis, and penetration of high energy line break and fire barriers.

The guideline also provides assurance that the proper safety classification and seismic classification are established.

Engineering personnel are responsible for determining whether the temporary modification is needed, correct, practical, and accomplishes the intended purpose.

They also assess the impact of the temporary modification on safety, operability, and maintainability of the system and the plant as a whole.

In accordance with our commitments to the NRC, all temporary modifications receive a safety evaluation (as opposed to a safety screening).

This safety evaluation is conducted prior to installation, with the exception oftemporary modifications receiving emergency/off-hour processing. Ifthe temporary modification is to be installed using emergency/off-hour processing, originating department personnel perform a safety screening.

A "yes" response to one, or more of the questions on the safety screening checklist requires a safety evaluation prior to installation. If all responses on the checklist are "no", the installation may proceed prior to conducting a safety evaluation.

A safety cv'aluation is requested on the next working day.

Attachment to AEP:NRC:1257 Page 10 Temporary modifications and associated safety evaluations are reviewed and approved by the PNSRC and the plant manager or designee.

Approval to install a temporary modification that requires emergency/off-hour processing is given by the operations shift supervisor or assistant shift supervisor. Ifa safety evaluation is required, it must be reviewed and approved by the PNSRC before proceeding with the installation.

Following installation, appropriate functional and operability testing is performed and required procedure revisions and revised or marked-up operations drawings are issued.

The operations shift supervisor or assistant shift supervisor is informed that the temporary modification has been installed. The temporary modification is entered into the temporary modification log, the temporary modification package is filed in the control room, and the temporary modification is released for operational use.

Temporary modifications are either restored to the original approved design configuration, or can be converted to a permanent change in accordance with procedures.

D.

Setpoint Control Setpoint control is divided into two general categories:

(1) relay settings/engineered safeguards system (ESS) timing relay setpoint information and (2) control instrumentation setpoints.

Due to the nature of the information, the design control process and the calculation process are interrelated with the development of both relay and instrumentation settings.

1)

Relay Setting Sheets and ESS Timing Relay Setpoint List The relay setting sheets provide documentation for protective relays and solid state trip devices.

The ESS timing relay setpoint list provides documentation for the ESS auxiliary timing relays.

Calculations involving the settings are documented using the calculation process.

The calculation process includes appropriate reviews, verifications, and approvals for the calculation.

The approved setting is forwarded to nuclear records management pe.~onnel for distribution.

Changes critical to the ESS timing relay setpoints require documentation of the basis for the change.

Calculations associated with the setpoint are documented using the calculation process.

Setting changes to the relay setting sheets or the ESS timing relay setpoint list require a safety screening prior to issuance.

2)

Instrumentation Setpoint Instrumentation information is documented and controlled via the engineering control procedure (ECP),

instrument configuration documents (ICD), information change package (ICP), and the plant instrument setpoint control program (PISCP).

The ECP is a controlled mechanism for documenting instrumentation and control (I&C) information that may include:

process setpoints, process spans, emergency operating procedure setpoints, instrument uncertainty analysis, control strategies, engineering evaluations, or other I&C related issues.

The ICD defines information required for operation of a configurable device.

The ICP contains changes, additions, or deletions to I&C documents.

The ICP conveys information to individuals who produce either a DCP or setpoint change request (SCR) form. The ECP, ICD, and ICP are reviewed,

Attachment to AEP:NRC:1257 Page 11

approved, and forwarded to nuclear records management personnel for appropriate distribution.

The PISCP provides for controlling and documenting changes to plant instrument setpoints.

The setpoint information is made available through the plant setpoint document list (PSPD). The PSPD is a computerized document listing plant instruments having controlled setpoints.

Setpoints within the PSPD are classified fnto one ofthree categories; technical specification (TS), non-technical specification engineered (NTS-E),

and non-technical specification field set (NTS-FS).

SCRs are used to document and track changes/requests to setpoint information. SCRs on TS, NTS-E, and range changes to NTS-FS applications require a safety screening, prior to implementation.

E.

Calculation Control The calculation process is used in various areas involving design control and setpoint control.

Calculations are initiated, revised, reviewed, approved, and controlled by the organizations providing the information. A distinction is made between safety related calculations and non-safety related calculations.

Safety related calculations are subject to the calculation process.

Calculations serve as inputs to other processes such as DCPs, temporary modifications, and setpoint information.

Safety related calculations require design verification. The verification is by either the alternate calculation method or by a review of the calculation.

Calculations are approved by the responsible manager or designee.

Control of calculations permits revisions to calculations or the issuance of new calculations to supersede calculations that are no longer valid.

3.'FSAR U date Process 10 CFR 5D.71 e The UFSAR update process is controlled by a procedure establishing the mechanism for preparing and submitting the annual UFSAR

update, assigning specific responsibilities for administrative activitie's and technical reviews, and delineating organization accountability for technical accurac'y and completeness.

Overall respon '.bility for the UFSAR document is assigned organizationally to the nuclear licensing manager.

Each UFSAR subchapter is assigned to a specific manager who is responsible for reviewing the assigned UFSAR subchapter and preparing any necessary revisions.

Information to be addressed in the UFSAR update includes:

~

the effects ofchanges made in the plant or in procedures that make their current description in the UFSAR either inaccurate, incomplete, inappropriate, or misleading;

~

the effects of license amendments and the effects of safety evaluations in support of requested license amendments or in support ofconclusions that the requested changes do not involve a USQ;

~

the effects of analyses of new safety issues;

~

known errors or significant'omissions in the contents of the UFSAR;

'FSAR drawings affected by any of the above; and,

Attachment to AEP:NRC:1257 Page 12

~

the effects of responses to NRC questions contained in correspondence between the company and the NRC,.as they affect plant operations or systems as described in the UFSAR.

The UFSAR update process is integrated with other processes that control the change ofoperating procedures and plant configuration.

Correspondence to and from the NRC is reviewed to determine ifthe UFSAR is impacted.

Potential changes to the UFSAR as a result of 10 CFR 50.59 safety evaluations are provided to nuclear licensing personnel for incorporation into the annual UFSAR update.

The update is provided in July of each year.

The cutoff date for incorporation of changes into the UFSAR is January of the year of the submittal.

4.

10 CFR 50 A endix B Pro ram The updated Quality Assurance Program Description (QAPD) for Cook Nuclear Plant reflects our recognition of the fundamental importance of controlling design, modification, and operation of the plant by implementing a planned and documented quality assurance program.

The QAPD is part of the UFSAR, Section 1.7, although it js contained in a separate document.

The QA program has been established in accordance with the requirements of 10 CFR 50 Appendix B.

The processes that implement Appendix B have been continually enhanced over the years.

The QA program supports the goal of maintaining the safety and reliability of Cook Nuclear Plant at the highest level through a systematic program designed to provide assurance that activities affecting safety related functions are conducted in compliance with applicable regulations,

codes, standards, and established policies and practices.

This is accomplished through actions specified by the QA program and procedures that implement the program.

As specified by the

QAPD, condition reports and audit/surveillance reports provide the mechanism for personnel to notify management of conditions that are adverse to quality. In addition, ifin the employee's opinion, the notification does not receive prompt or appropriate attention, the employee is directed to contact successively higher levels of management.

The QA program establishes requirements to provide assurance that:

~

design changes are accomplished in accordance with the design change process;

~

procurement documents define the characteristics of items to be procured, identify applicable regulatory and industry codes/standards requirements, and specify supplier QA program requirements to the extent necessary to ensure quality; activities affecting the quality of safety related structures, systems, and components are accomplished using instructions, procedures, and drawings appropriate to the circumstances, including acceptance criteria for determming ifan activity has been satisfactorily completed;

~

documents controlling activities within the scope of the

QAPD,

'ncluding

changes, are reviewed for adequacy, approved for release by authorized personnel, and distributed and used at the location where a prescribed activity is performed;

l I

Attachment to AEP:NRC:1257 A

Page 13

~

activities that implement approved procurement requests for items and services are controlled to assure conformance with procurement document requirements;

~

items are controlled to prevent inadvertent use;

~

special processes are controlled and accomplished by qualified personnel using approved procedures and equipment m accordance with applicable codes, standards, specifications, criteria, and other special requirements; activities affecting the quality of safety related structures, systems, and components are inspected to verify their conformance with requirements;

~

testing is performed in accordance with established programs to demonstrate that structures,

systems, and components will perform satisfactorily in service;

~

measuring and testing equipment used in activities affecting the quality of safety related structures,

systems, and components is properly identified, controlled, calibrated, and adjusted at specified intervals to maintain accuracy within necessary limits;

~

activities with the potential for causing contamination or deterioration, and activities necessary to prevent damage or loss, are identified and controlled; operating status of structures, systems, and components is indicated by tagging of valves and switches, or by other specified means, in such a manner as to prevent inadvertent operation; materials, parts, or components that do not conform to requirements are controlled to prevent their inadvertent use; conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are identified promptly and corrected as soon as practical;

~

records that furnish evidence of activities affecting the quality of safety related structures,

systems, and components are maintained; and

~

a comprehensive system of audits is carried out to provide independent evaluation ofcompliance with, and the effectiveness of, the QA program including those elements of the program implemented by suppliers and contractors.

Summaru The preceding sections describe processes currently in place at Cook Nuclear Plant intended to properly maintain engineering design and configuration control, including those that implement the requirements of 10 CFR 50.59, 50.71(e), and 10 CFR 50, Appendix B.

Attachment to AEP:NRC:1257 NNcR~ NUEST Page 14 (b)

Rationale for concluding that design bases requirements are translated into operating, maintenance, and testing procedures

RESPONSE

The rationale for concluding that Cook Nuclear Plant design bases requirements are translated into operating, maintenance, and testing procedures is based on the present and past controls and processes, as well as a review of performance as indicated in inspection reports, licensee event reports (LERs), quality assurance audits, safety system functional inspections, and the design basis documentation reconstitution project.

The response to NRC question (b) is provided in the following sections:

~

controls and processes

~

internal reviews

~

safety system functional and similar inspections

~

design basis documentation reconstitution project

~

regulatory reviews

~

summary 1.

Controls and Processes Administrative processes have been developed and implemented to provide assurance of accurate and complete translation of design bases information into operating, maintenance, and test procedures in support of both pre-operational and power operation.

The methodology by which appropriate design bases information is established and maintained in Cook Nuclear Plant operating, maintenance, and test procedures is described in two parts.

The description of the pre-operational and startup testing phase addresses the dev.lopment and implementation ofprocedures that verified and validated design bases assumptions through the initial power operation phase.

The description of the power operation phase addresses subsequent maintenance of the plant design bases configuration.

A.

Pre-Operational and Startup Testing During construction of Cook Nuclear Plant, pre-operational and startup test procedures were prepared utilizing the format and content recommended by the Guide for Plannin of Pre-o erational Testin Pro rams and Guide for the Plannin of Initial Startu

~pro rams prepared by the Atomic Energy Commission in December of 1970.

Test procedures used for the initial pre-operational and startup testing were prepared based on pre-operational and startup "test guides" developed by the nuclear steam supply system (NSSS) vendor (Westinghouse) and the plant architect-engineer (AEPSC).

These test guides specified the test objectives, pre-requisites, system mitial conditions, special precautions, and acceptance criteria, and provided an outline of the tests to be conducted and how they were to be performed.

Attachment to AEP:NRC:1257 Page 15 Administrative procedures established for the preparation ofpre-operational test guides and procedures required that applicable portions of the Final Safety Analysis Report (FSAR), FSAR commitments, and system design specifications be reviewed and requirements included in the test guide and procedures.

These requirements were intended to ensure that the procedures were consistent with the design requirements established in the FSAR and that plant systems performed in accordance with their design intent as required by ANS 3.2, Administrative Controls and ualit Assurance for the 0 erational Phase ofNuclear Power Plants.

Prior to approval, safety related pre-operational and startup test procedures were reviewed by the Plant Nuclear Safety Review Committee (PNSRC) to further ensure consistency with the FSAR.

Additionally, the Nuclear Safety and Design Review Committee (NSDRC) reviewed pre-operational and startup test procedures related to engineered safety features.

The procedures used for system operation during the pre-operational testing phase were, in most cases, the same procedures used for normal operations.

In other cases, the operating instructions were written into the pre-operational test procedure and then re-written after the test in the normal operating procedure format.

In either case, pre-operational testing served to validate the normal operating procedure and demonstrate the system's ability to functionally meet its design objectives.

In addition, test procedures were written to implement technical specification surveillance requirements and to monitor equipment performance.

The technical specification surveillance and testing requirements were established to provide assurance that essential systems, including equipment, components, and instrument channels would continue to meet functional requirements in accordance with the design bases assumptions.

The pre-operational testing and calibration pro edures were used as input for the plant surveillance and test procedures.

. Plant operating staff, the cognizant engineer, the NSSS vendor (as applicable) and the plant manager evaluated the results of pre-operational testing.

The basis for this evaluation was to provide assurance that systems and components functioned in accordance with the established design bases.

In addition, through participation in the pre-operational testing, the NSSS vendor was able to confirm that the NSSS was capable of performing within its design bases.

The initial plant maintenance procedures were generally based on instruction manuals provided by equipment vendors and the NSSS supplier.

In the course of developing the original (revision 0) plant procedures, 10 CFR 50.59 safety evaluation applicability determinations were performed.

The "original issue" determination was mtended to ensure that the procedures were not written in a manner that would alter requirements described in the FSAR.

The methodology used to develop the procedures was approved by the Atomic Energy Commission (AEC) staff in a safety evaluation report dated September 10, 1973.

Specifically, the safety evaluation stated for Units 1 and 2:

"We conclude that the provisions for preparation, review, approval, and issue of written procedures are satisfactory.'

Attachment to AEP:NRC:1257 Page 16 The manner in which startup and pre-operational test procedures for Unit 1 operation were developed and reviewed was found satisfactory in the same safety evaluation report referenced above, as indicated by the following statement:

"We have concluded that the test and startup program described by the applicant is in accord with the AEC publication, Guide for the Plannin of Pre-p erational Testin Pro ram, and Guide for the Plannin of Initial Startu

~prc rams aad is acceptable."

Similarly, the Unit 2 startup and test program was found acceptable by the Nuclear Regulatory Commission in Supplement 7 to the Safety Evaluation Report dated December 23, 1977:

"We have evaluated the test and startup program proposed for D. C. Cook Unit 2 through Amendment 78 and the FSAR... The applicants have described testing planned to satisfy Regulatory Guides 1.79 and 1.80, which the staff reviewed and found to be acceptable."

The thoroughness of the original procedure preparation

process, the intimate involvement of the Cook Nuclear Plant staff, and the subsequent approval of that process by the NRC provides reasonable assurance that the procedures in place when operation of the plant commenced. adequately addressed the design bases that were contained in the FSAR.

B.

Power Operation Since the initiation ofpower operation, the accuracy of the plant design bases in plant procedures has been maintained through the use ofprocesses and procedures that reflect the requirements of 10 CFR 50.59.

Administrative guidance has been established to provide assurance that changes to the plant, procedures, technical specifications, and the facility operating license are adequately reviewed to preclude operation outside of the lant design bases.

Only personnel with the requisite training and qualifications may e used to develop and perform technical and 10 CFR 50.59 reviews ofnew procedures and revisions to existing procedures.

Safety screenings are performed for new or revised procedures.

In the event the safety screening identifies a potential UFSAR impact, a safety evaluation is performed to identify any potential unreviewed safety questions prior to implementation of the proposed change.

Changes to procedures must be reviewed by a qualified individual/group other than the individual/group who prepared the procedure or procedure change.

This technical review consists of an evaluation of the document to provide assurance the document is correct from a functional, engineering, and administrative perspective, as applicable.

The technical review also determines whether additional cross-disciplinary reviews are necessary.

Cross-disciplinary reviews are intended to ensure that when the document directs non-routine

actions, impacts operation, or assigns responsibility to another organization, the other organization concurs.

Individuals who conduct technical reviews of plant procedures are required to be members of the plant staff previously designated by the plant manager and must meet or exceed the minimum qualifications of ANSI N18.1-1971 Section 4.4.

The plant manager, or designee, is required to approve plant manager instructions, plant manager procedures, plant security implementing procedures, and emergency plan implementing procedures.

The originating department superintendents approve procedures specific

Attachment to AEP:NRC:1257 Page 17 to their respective department.

Plant performance assurance personnel also review plant manager instructions and procedures.

Temporary changes to procedures that do not change the intent of the approved procedures may be approved for implementation by two members of the plant staff, at least one of whom holds a senior operator license.

The PNSRC is responsible for review of new or changes to plant manager instructions and procedures as well as any procedure that requires a safety evaluation. Additionally, the NSDRC provides an independent review of the safety evaluation for procedures requiring a safety evaluation.

In a similar manner, proposed changes to the plant configuration are reviewed, prior to implementation, to identify the potential impact of the change on plant procedures.

Plant configuration change processes are described in section (a) above.

Following installation of the change, but prior to release for operational use, plant procedures are revised to reflect the change.

New training requirements associated with the change are identified and addressed.

As discussed above, the revision process includes a safety screening to provide assurance that the assumptions and requirements of the UFSAR are met.

New or revised procedures implementing tests and/or experiments are similarly reviewed using 10 CFR 50.59 criteria.

As appropriate, changes to technical specifications, and the facilityoperating license are distributed to affected plant personnel prior to the effective date of the change to determine the potential impact of the proposed change on plant procedures.

This process provides assurance that changes to the licensing bases will be adequately reviewed and incorporated, as applicable, into plant procedures prior to the implementation of the proposed change.

Development ofprocedures for maintenance ofequipment includes review ofapplicable documents such as technical specifications, vendor manuals, ANSI or other applicable standards, and applicable engineering documents.

This review is intended to ensure that applicable techmcal requirements are incorporated into the procedure.

Proper incorporation of technical requirements into the procedures provides assurance that the equipment willperform consistent with the design bases.

2.

Internal Reviews A.

QA Audits and Surveillances In developing this part and part 5 ofthis section, we performed an historical review of quality assurance audits and surveillances and documented correspondence for inspection reports and licensee event reports.

This review covered the years 1983 to the present.

The year 1983 was chosen based on two prime factors: (1) it was the first year followingthe initial issuance ofthe updated FSAR, and (2) major activities of the regulatory performance improvement program were being completed.

The response to question (d) describes in detail the various processes for identification of problems and implementation of corrective actions.

These processes provide additional assurance that design bases requirements are translated into procedures.

As a part of this response effort, audits were reviewed to determine ifdesign bases requirements have been translated into appropriate procedures.

Three corporate quality assurance audits on 10 CFR 50.59 safety screenings and unreviewed safety question determinati'ons were performed in the time per'iod 1992 to 1995.

The audits evaluated

Attachment to AEP:NRC:1257 Page 18 the effectiveness of safety screenings and reviews conducted'on design

changes, procedure changes, tests and experiments, as well as training and tracking issues.

These audits concluded that safety screenings and reviews were effectively performed.

B.

UFSAR Review We conducted a limited scope review of the UFSAR in April 1996 to verify that the information is consistent with the actual plant design and operating procedures.

Four sections ofthe UFSAR were selected for review. The review was intended to provide insight into the nature and significance of discrepancies that might exist.

The review revealed areas where inconsistencies exist between the UFSAR and the existing plant design and procedures.

Upon evaluation it was determined that none of these items were safety significant.

Although none ofthe discrepancies were found to be safety significant, current industry and regulatory initiatives indicated the need for a more extensive review ofthe UFSAR.

Based on the results of the limited scope review, we are performing a more extensive review of the UFSAR and the processes that support updating of the document.

This effort has been identified as the UFSAR revalidation project and is discussed in detail in section (f) of this submittal.

3.

Safe S stem Functional and Similar Ins ections We have expended considerable resources in conducting and supporting safety system functional inspections (SSFIs) and other similar inspections.

Internal SSFIs were conducted of the auxiliary feedwater

system, containment spray

system, control room/spent fuel pool/engineered safety features ventilation systeins, as well as a service water system operational performance inspection (SOPI).

These inspections were conducted using methodologies consistent with those used by the NRC. In addition, the NRC performed an SSFI of the essential service water system, an electrical distribution system functional inspection, and a SOPI of the emergency core cooling system.

The SSFI is based on the vertical slice inspection technique.

This technique.akes one system and evaluates the effectiveness of the

design, installation, operation, maintenance, and testing of the target system to ensure it is capable of performing its safety function.

The vertical slice inspection technique evaluates the effectiveness of the program's horizontal elements by looking at a small portion of the horizontal element (or control process) and the manner in which the horizontal elements are integrated for the selected system.

This is accomplished by reviewing design documentation to determine the design requirements for the system, and then evaluating the operation ofthe system and changes (operating changes, maintenance activities, and modifications) to ensure consistency with the design requirements.

In the SSFI type inspections performed, the systems were found capable of fulfilling their intended design function.

Significant design basis procedural issues were not identified during the SSFI type inspections.

(Note: the auxiliary feedwater system SSFI identified test procedure inadequacies in that portions ofthe auxiliary feedwater system and emergency diesel generator circuitry were not time response tested as required by the technical specifications; the portions of the circuits were subsequently tested and demonstrated an acceptable time response).

The results of these in-depth inspections

Attachment to AEP:NRC:1257 Page 19 provide additional confidence as to the adequacy of procedures in regard to design bases information.

4.

Desi n Basis Documentation Reconstitution Pro'ect As discussed in the response to item (f), we have undertaken an extensive design basis documentation reconstitution project.

Thus far, design basis documenS (DBDs) have been approved for 22 systems.

To date, there have been no procedural deficiencies identified through the design basis documentation reconstitution project that'resulted in equipment inoperability.

5.

Re ulato Reviews In addition to our internal reviews, we have reviewed the regulatory history relating to the design bases as indicated in NRC inspection reports, LERs, and other documentation from 1983 to the present.

The results ofthis review demonstrate generally good performance, although there have been instances where concerns or opportunities for improvement were identified by the NRC staff.

In most instances the concern was specific to a particular component, system, structure, or procedure.

Generic deficiencies identified during this review had been addressed in a generic manner (i.e., determining whether similar issues were present).

Issues involving procedures did not affect the health and safety of the public, as indicated in the evaluation of safety significance provided to the NRC in the associated LER.

By their nature, inspection reports and LERs focus on areas of potential concern.

As with the corrective action program, the resulting efforts to investigate and remedy the identified problems result m a strengthened overall process.

As a result, the process of identification and correction of problems provides further assurance that the design bases have been translated into the plant operating, testing, and maintenance procedures.

The following are examples of retrospective reviews based on concerns identified in inspection reports or LERs.

E,iigineering review of procedures to assure technical specification compliance with priority placed on containment integrity, auxiliary feedwater, and emergency core cooling systems; and independent review ofplant operations to ensure adherence to procedures and consistency of procedures in implementing the technical specifications.

~

A review by both corporate QA and plant organizations of all surveillances contained in tabular form in the technical specifications to ensure that surveillance scheduling meets the technical specification requirements; a review by impacted departments of the surveillances which are contained in tabular form in the technical specifications to determine, for tests that are not the sole responsibihty of a single department, that no omissions oftest requirements exist and to determine which documents show how that responsibility is established; and a review of technical specification surveillances that involve calibration and time response testing of process sensors, and actions to ensure that technical specification surveillance requirements are satisfied.

~

With regard to post-maintenance testing (PMT) procedures, a review of the work in question and review ofprevious work performed during the

Attachment to AEP:NRC:1257" Page 20 prior refueling outage to determine if PMT was performed properly.

The corrective actions also included placing engineering personnel m the direct line ofreview and approval ofPMT activities on an interim basis, and issuance of a new PMT standard.

~

An overall review of the test program for the component cooling water

'ystem to provide assurance that the program is comprehensive and effectively meets 10 CFR 50, Appendix B, Criterion XI.

In these instances the corrective actions included a retrospective review and validation of past work, correction of deficient items, and changes in the process to prevent recurrence.

An indication of the NRC assessment of the performance of Cook Nuclear Plant can be garnered from the most recent systematic assessment of licensee performance (SALP) report.

That report states that the overall plant performance was good and generally reflected a conservative operating philosophy and good safety focus.

The r'eview of LERs and inspection report findings performed for this response effort revealed relatively few issues related to design bases compliance.

When problems were of a generic nature, our response was to re-review past work in the same area and take applicable corrective action.

6.

Summary In summary, the policies, programs, activities, and events discussed in sections (a) and (b) above have provided us with an appropriate level of confidence that the design bases requirements have been accurately translated into the plant operating, maintenance, and testing procedures.

Prior to the beginning ofplant operation, we had in place a pre-operational test program and administrative procedures that controlled the development and revision of procedures and increased the likelihood that the design bases were accurately translated into plant documents.

This procedural system was buttressed by the involvement of key plant personnel throughout the

design, construction, and startup program development and implementation process.

Confidence in this position was further enhanced by the performance of multiple internal audits and activities that, although they may have identified narrowly focu ed concerns, corroborated that the design bases were being accurately reflected in the plant procedures.

In those instances where concerns were identified, we evaluated the issue and took actions to resolve the matter.

In the event that potential generic issues were identified, actions were taken to investigate and identify the true scope and depth ofthe issue.

It is believed that all of the above has resulted in an appropriate level of confidence that the design bases have been accurately transferred to the plant procedural documents.

Attachment to AEP:NRC:1257 E~RC RE EEE Page 21 (c)

Rationale for concluding that

system, structure, and component configuration and performance are consistent with the design bases

RESPONSE

The rationale for concluding that system, structure, and component configuration and performance are consistent with the design bases is based on the review ofpresent and past controls and processes, performance as indicated in quality assurance audits, self-assessments, SSFI type inspections, NRC Inspections, LERs, and the DBDRproject, as well as various other initiatives that reconfirmed specific parts of the design bases.

The following sections provide specific discussions:

~

historical perspective

~

original design practices

~

pre-operational testing

~

power operation

~

on-going performance testing routine operation, maintenance, and modification activities

~

system engineering

~

special initiatives

~

design basis documentation reconstitution project safety system functional and similar inspections

~

internal assessments

~

regulatory reviews

~

summary Historical Pets ective American Electric Power Service Corporation (AEPSC) began preparing itself for its nuclear future as early as 1952, with the assignment ofseveral engineers, designers, and maintenance specialists to Oak Ridge National Laboratory, Bettis Atomic Power Laboratory, Knolls Atomic Power Laboratory, and various projects at the National Reactor Testing Station.

In 1953, AEPSC became one of the co-founders of the Nuclear Power Group, Inc., and in the ensuing years participated, technically and financially, in the development ofone ofthe earliest commercial nuclear power stations.

This group was then dissolved.

It evolved into the East Central Nuclear Group (ECNG), and AEPSC was instrumental in the new group's formation.

ECNG was comprised of 10 utilitycompanies.

Its goal was to research and develop nuclear power.

AEPSC personnel acted as architect-engineer administrator, and research and development manager for the group.

ECNG's major undertakings were the development with various companies of a gas-cooled, heavy water moderated reactor from 1957-61, the development ofa supercritical pressure steam cooled fast breeder reactor from 1965-67, the development of a steam

Attachment to AEP:NRC:1257 Page 22 cooled fast breeder reactor in 1967-68, and from 1968-1982, a project for the gas cooled fast breeder reactor.

At the present time, the AEP Nuclear Generation Group consists of professional personnel who devote their activities to Cook Nuclear Plant and nuclear power industry issues.

2.

Ori inal Desi n Practices AEPSC was responsible for the design and construction of Cook Nuclear Plant.

Original design practices for the plant were the subject of considerable attention in the 1983-1984 timeframe.

During and following a 19S3 inspection (Report Nos. 50-315/83018 and 50-316/83019), there was significant dialogue concerning original design control practices and early design changes.

In response, corporate level and organization-specific procedures were revised to more fully implement the design verification requirements of ANSI N45.2.11-1974.

To ensure that design control and verification practices produced acceptable results, we performed an historical review of a sample of early design changes.

This sample of design changes was subjected to the design verification criteria set forth in ANSI N45.2.11-1974, and we concluded that the early design practices and verification methods were effective.

Finally, in 1984 a description of original design control practices for Cook Nuclear Plant was submitted to the NRC.

In developing this description, we concluded that original design practices were consistent with good engineering practice. 'lthough a large portion of the original design was performed prior to the publication of ANSI N45.2.11-1974, the design concept implemented included a cognizant engineer and a number of reviews.

Though different in form and ease of auditability from the requirements of ANSI, we concluded that the original design concept was commensurate with the design verification requirements described in 10 CFR 50, Appendix B, Criterion III,and ANSI N45.2.11 in ensuring an effective design process.

The NRC accepted this conclusion in inspection report 50-315/84016 and 50-316/S4018.

3.

Pre-o ei ational Testin The pre-operational testing program was intended to ensure that equipment and systems performed in accordance with design criteria prior to fuel loading. As the installation of individual components and systems was completed, they were tested and evaluated according to predetermined and approved written testing techniques, procedures, and check-off lists. Field and engineering analyses of test results were made to verify that systems and components were performing satisfactorily and corrective action was taken, when necessary.

The program included tests, adjustments, calibrations, and systems operation intended to ensure that initial fuel loadmg, initial criticality, and subsequent power operation were completed in a safe manner.

Functional tests were performed to verify that the system or equipment was capable ofperforming the function for which it was designed.

Operational tests involved actual operation of the system and equipment under design or simulated design conditions.

Whenever possible, these tests were performed under the same conditions as experienced under s',ation operations.

Attachment to AEP:NRC:1257 Page 23 Section (b) provides further discussion of development, implementation, and NRC approval of our pre-operational test program.

4.

Power 0 eration Since the initiation ofpower operation, system, structure, and component configuration have been maintained through use of processes and procedures that reflect the requirements of 10 CFR 50.59.

Our current processes for configuration management have been described in response to question (a).

f Administrative guidance has been established to provide assurance that changes to the plant are adequately reviewed to preclude operation outside of the plant design bases.

Only personnel with the requisite training and qualifications may be used to develop and perform technical reviews, safety screenings, and safety evaluations. AllDCPs and temporary modifications require a safety evaluation be performed, regardless ofwhether, the change impacts the UFSAR.

Other.

processes require a safety screening be performed, with a safety evaluation required ifa potential UFSAR impact is indicated.

The PNSRC reviews changes to equipment, systems, and facilities for which a safety evaluation has been performed. Additionally, the NSDRC performs independent review of the safety evaluations for these changes.

5.

On oin Performance Yestin An important means ofensuring continuing consistency between design bases and plant configuration and performance is periodic testing of plant systems and components.

Such testing provides assurance of system and component alignment and conformance with design documentation, and demonstrates the capability of the systems to meet the acceptance criteria of their specified testing requirements.

Some of the key testing routinely performed is as follows.

Surveillance testing:

Periodic and conditional surveillance tests to comply with technical specification requirements, license requirements, and other documents relating to maintenance and operation of the plant.

~

Post-modification testing: This testing provides an acceptable level of confidence that the modified equipment willfunction as designed and is properly integrated into plant systems.

~

Post-maintenance testing: This testing verifies that plant equipment is capable of satisfying its performance requirements after maintenance activities have been completed.

~

In-service inspection: These inspection activities provide an acceptable level of confidence that the structural integrity of plant components within the scope of the in-service inspection program is in accordance with UFSAR and ASME Section XI requirements.

~

In-service testing:

These testing activities provide an acceptable level of confidence that pumps and valves within the scope of the in-service testing program can perform their design safety function in accordance with UFSAR and ASME Section XI requirements.

~

Other related testing:

Additional testing activities help verify design bases consistency with plant configuration and performance.

An example of such testing is flow balance testing of the essential service

Attachment to AEP:NRC:1257 Page 24 water system, which verifies the system's capability to supply adequate flow to meet UFSAR requirements.

Taken collectively, our extensive, ongoing testing programs provide a continuous check and assessment of operation within the acceptance criteria derived from and reflecting design requirements.

6.

Routine 0 eration Maintenance And Modification Activities Normal operation and maintenance activities also serve to confirm configuration and performance consistency with design bases.

A.

Operations Operations personnel are required to monitor key plant parameters, to assess changes to these plant parameters outside prescribed limits, and to take appropriate corrective actions if these limits are exceeded.

Operations personnel also perform routine walkdowns of plant systems to verify proper operational configuration, alignment, and materiel condition.

B.

Maintenance As part of routine maintenance activities, proper plant configuration is also assessed.

Equipment degradation or failure is identified and corrected to assure plant systems are capable of performing their intended functions. In addition, preventive and corrective maintenance activities result in plant personnel reviewing existing configuration and verifying that configuration is in conformance with design requirements.

Development of procedures for maintenance of equipment includes review of applicable documents such as technical specifications, vendor manuals, ANSI or other applicable standards, and applicable engineering documents.

This review is intended to ensure that applicable technical requirements are incorporated into the procedures.

Proper incorporation oftechnical requirements into the procedures provides assurance that the equipment will perform consistent with its design bases.

Corrective actions for configuration inconsistencies are implemented as appropriate.

Post-maintenance testing and system restoration are accomplished as the final steps to maintenance activities, to provide assurance that the plant physical configuration is consistent with appropriate design documentation and operational procedures C.

Modifications Additional assurance of configuration and performance consistency with design bases is also gained through the established processes for design change development and implementation ofplant modifications.

The design change process requires the design change team to consider the design bases and design inputs when commencing the design work.

Modification activities are coordinated and monitor d by the project engineer.

After completion ofmodifications, the configuration is verified, documented in as-built design drawings, tested to determine conformance with design requirements, and restored to the appropriate operational configuration.

7.

S stem Kn ineerin The system engineering program is very important for assuring consistency of plant configuration and performance with design bases.

The purpose of the system engineering program is to provide appropriate technical support for the plant.

, Attachment to AEP:NRC:1257 Page 25 I

Individuals designated as system engineers maintain overall ownership of a particular plant system or multiple systems and are considered the primary contact for questions regarding the system.

The system engineers perform periodic walkdowiis of their assigned system.

These walkdowns are intended to capture changes in operating parameters and identify abnormal configuration problems.

The system engmeers are cognizant of temporary modifications to the system, and monitor these modifications during the periodic walkdowns.

System engineers generally are responsible for investigation of adverse conditions on their systems, which are identified through the corrective action system.

The review includes recommendation of corrective and preventive actions, as appropriate.

The system engineers are familiar with the performance, acceptance criteria, and bases for surveillance testing on their systems.

Depending on the test, the system engineers may be responsible for a second level review of the completed tests to identify adverse trends in performance.

System engineers review certain specified post-maintenance testing to ensure appropriateness.

System engineers also participate in the development of DBDs on their systems.

S.

S ecial Initiatives We have implemented special initiatives related to specific systems, structures, and components.

These initiatives involve verifying that system, structure, and component configuration and performance are consistent with design bases.

A.

Regulatory Performance Improvement Program The regulatory performance improvement program (RPIP) was developed in the early 1980s.

Several corrective action efforts were underway with each having a goal to improve a particular area.

These individual items were collected under the auspices of the RPIP to improve their effectiveness.

A series of letters and meetings between the NRC and AEP representatives provided progress reports.

The early issues addressed by the RPIP included reorganizations and augmentation of lant personnel, upgrading procedures, re-reviews of certain drawings and equipment abeling, procedure change control, action item tracking, problem alarms in control room, increased auditing, and increased involvement by review committees.

Two other efforts that were under the RPIP coverage and relevant to this discussion were flow diagram reviews and the assessment of earlier design practices.

The flow diagram drawings verification program involved a combined effort between operational and engineermg personnel to perform a walkdown of class I system operation (OP) flowdiagrams to ensure these drawings reflected the current plant status and function.

These walkdowns started in 1984 and continued until mid-1992.

Condition reports (CRs) were written to document the discrepancies and affected OP drawings were corrected.

A detailed data form was prepared for each marked OP flow diagram with pertinent information attached to the CR for the implementation of as-builts. The initial walkdowns were established for verification ofthe OP flow diagram class I drawings; however, the effort was expanded to the balance ofplant systems also.

The RPIP also included review of original design practices for the plant, and an historical review of a sample of early design changes to ensure that design control and

Attachment to AEP:NRC:1257 Page 26 verification practices produced acceptable results.

These reviews were described previously in this section.

The RPIP provides additional assurance that activities occurring prior to the program were performed appropriately and that systems, structures, and components are consistent with the design bases.

B.

VFSAR Review We conducted a limited scope review of the UFSAR in April 1996 to verify that the information is consistent with actual plant design and operating procedures.

Four sections of the UFSAR were selected for review. The review was intended to provide insight into the nature and significance of discrepancies that might exist.

The review revealed areas where inconsistencies exist between the UFSAR and the existing plant design and procedures.

Upon evaluation it was determined that none of these items were safety significant.

Although none ofthe discrepancies were found to be safety significant, current industry and regulatory initiatives indicated the need for a more extensive review ofthe UFSAR.

Based on the results of the limited scope review, we are performing a more extensive review of the UFSAR and the processes that support updating of the document.

This effort has been identified as the UFSAR revalidation project and is discussed in detail in section (f).

C.

Large Bore Piping Reconstitution Program In response to NRC inspection findings and internal reviews, the large bore piping reconstitution program (LBPRP) was initiated in 1990.

The purpose of the LBPRP is to confirm that pipe supports were installed in the correct location and with the correct functionality. In addition, the LBPRP is intended to confirm geometry of the piping systems, create analysis calculations, update design drawings, and provide reasonable assurance that the pipes and pipe supports are in compliance with the design bases.

The LBPRP walkdowns began in March 1991 to document the as-found information on large bore safety related piping and pipe supports to be used later in the piping system analysis.

The walkdown scope ofwork included the requirement to l. rform an operability determination when discrepancies were identified between the as-found condition and the design drawing. An operability determination was performed at the time a discrepancy was discovered using sound engineering practices and pre-established screening criteria.

The results ofthe LBPRP walkdown and operability determinations have demonstrated that none ofthe discrepancies impaired the continued operability ofthe piping systems.

The LBPRP analysis effort is approximately 90% complete and scheduled to be completed by mid-1997. At this time over 165 new piping system calculations have been prepared.

Any piping and/or pipe support modification identified as necessary through LBPRP willbe implemented as outlined in our letter AEP:NRC:1100C, dated March 20, 1995.

D.

Small Bore Piping Review We also reviewed our class I small bore piping systems in 1990 to determine whether installed small bore piping met the design bases requirements.

Walkdowns ofthe small

Attachment to AEP:NRC:1257 Page 27 bore piping systems were performed using screening criteria to evaluate the as-found conditions.

Initial operability determinations were performed when outlier conditions were identified. The piping systems were reviewed and met operability requirements.

Detailed analyses were performed to disposition outlier conditions.

The overall conclusion of the walkdown process was that the class I small bore piping at Cook Nuclear Plant met the design criteria for piping and pipe supports.

E.

Seismic Qualification UtilityGroup (SQUG)

The Seismic Qualification Utility Group (SQUG) was formed to develop criteria to implement the requirements of Generic Letter (GL) 87-02, Verification of Seismic Ade uac of Mechanical and Electrical E ui ment in 0 eratin Reactors Unresolved Safet Issue USI A-46. The requirements ofthe GL are applicable to thoseplants in which the mechanical and electrical equipment were seismically qualified prior to the issuance of the IEEE 344-1975 standard (the qualification for a substantial portion of the electrical/mechanical equipment in Cook Nuclear Plant was based on draft IEEE-344-1971 and later on the IEEE 344-1971 standard).

The GL provided guidance for resolution ofUSI A-46 and requested that owners ofoperating nuclear power plants not qualified to the IEEE 344-1975 standard verify the seismic adequacy of mechanical and electrical equipment needed to bring their plants to a safe shutdown condition following a safe shutdown earthquake (called the design basis earthquake or DBE at Cook Nuclear Plant).

Verification of seismic adequacy of electrical and mechanical equipment required for a safe shutdown after a DBE has been completed as per the guidelines of generic implementation procedure'rev. 2, and the NRC Supplemental Safety Evaluation Report, SS2R No. 2, supplement No.

1 to GL 87-02.

Upon completion of the SQUG project, it was concluded that the seismic adequacy of the selected electrical/mechanical equipment had been verified as per the requirements ofNRC GL 87-02, and that the equipment is capable ofsupporting a safe shutdown of the plant within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following a DBE.

F.

Append'; R Revalidation 10 CFR 50.48, issued in November 1980, provided more definitive requirements on the overall scope of the fire protection programs at nuclear power plants.

10 CFR 50.48 required us to comply with 10 CFR 50 Appeiidix R sections III.G,III.J, and III.O. The requirements ofthese sections were more specific and restrictive than the guidelines on fire protection of safe shutdown capability, emergency lighting, and reactor coolant pump lube oil collection than were provided in Appendix A to BTP APSCB 9.5-1.

Reviews in 1981 and 1982 revealed that compliance with Appendix R could not be demonstrated based upon the original efforts, and that additional effort would be required.

Efforts were undertaken to perform the necessary evaluations.

These efforts continued throughout the 1980s and resulted in numerous'echnical evaluations and NRC submittals.

A significant number of plant modifications were identified as necessary to achieve Appendix R compliance.

These modifications were implemented in the mid to late 1980s and included installation of additional detection and suppression

systems,

Attachment to AEP:NRC:1257 Page 28 boundary modifications, conduit and cable tray protection, and mechanical and electrical system modifications to provide alternative shutdown capability.

As a result of continued efforts to show Appendix R compliance in the early 1990s, a number of additional discrepancies were discovered.

These discrepancies

resulted, in.,

some instances, from inadequate design reviews performed for impact ofplant changes on Appendix R compliance.

At approximately the same time, the NRC identified problems with the use of Thermo-Lag fire barriers.

In response to these issues, we made improvements to the design change process and initiated a comprehensive Appendix R revalidation project. This revalidation effort was intended to build upon and enhance the existing safe shutdown analysis, to provide an analysis that was thoroughly documented in a defensible and repeatable manner, and to reduce reliance on Thermo-Lag fire barrier materials.

(We provided our closeout information on Thermo-Lag in December 1996 in our letter AEP:NRC:0692DB. It is currently under review by the NRC staff.)

Results of the Appendix R revalidation project are reflected in revisions to the safe shutdown capability assessment, safe shutdown system analysis, and the fire protection program manual.

These documents contain the methodology and results ofthe project and provide references to the appropriate source documents.

Compliance with the requirements of Appendix R has been strengthened by the comprehensive revalidation effort and the documentation enhancements implemented as a result of the project.

We continue to benefit from enhancements to the design change process implemented in conjunction with this project.

The activities noted above provide reasonable assurance that the 10 CFR 50 Appendix R requirements have been effectively implemented.

G.

Generic Letter S9-10 GL 89-10 required review of motor operated valve (MOV) design bases requirements and testing to provide assurance that these requirements could be met.

To implement the requirements of GL 89-10, a

significant review of system design

bases, configuration, and component (MOV) functional performance was accomplished.

ihe review and implementation of the MOV testing program have provided additional assurance of MOV performance consistent with the design bases.

H.

Generic Letter S9-13 To implement the requirements of GL 89-13, extensive review of the plant heat removal and ultimate heat sink functions were performed, including system and component design bases requirements and plant configuration and performance capabilities.

I.

Maintenance Rule To implement the new maintenance rule requirements of 10 CFR 50.65, system design bases were reviewed, and performance parameters were identified for safety related

systems, structures, and components (SSCs),

and SSCs important to safety.

A monitoring program was established as required by the maintenance rule to provide assurance that SSC performance is monitored against appropriate acceptance criteria and trended to ensure adequate maintenance requirements are in place.

Attachment to AEP:NRC:1257 J.

Generic Letter 88-20 Page 29 GL SS-20 contains the requirements for utilities to conduct an inc'ividual plant examination (IPE).

As stated in the GL, utility staff participating in the IPE was expected to examine and understand the plant emergency procedures, design, operations, maintenance, and surveillances to identify potential severe accident sequences for the plant; understand the quantification ofthe expected sequence frequencies; and determine the leading contributors to core damage.

The IPE involved an extensive plant familiarization effort and careful analysis of the as-built, as-operated plant.

To accomplish this familiarization, several data collection and documentation activities were undertaken during the initial phase of the project.

System notebooks were prepared for modeled systems after plant walkdowns and analyst review of drawings, system descriptions, the UFSAR, technical specifications, and applicable plant procedures.

Plant walkdowns were conducted to verify the design of the systems, to become familiar with the physical layout of the plant, and to visualize restorative actions or alternative systems.

Our IPE is a full scope investigation of the plant systems and operator response to design bas s and appropriate beyond design bases accidents.

The focus of the investigation was on the performance of the realistic assessment of the plant response to potential accident sequences.

Models of plant systems are detailed and explicitly include the performance ofall key components.

The success criteria used to determine whether or not plant systems achieve their intended safety function were realistically determined for each important accident sequence.

Because Cook Nuclear Plant is a dual unit plant, special attention was given to the, consider'ation of dual unit issues.

The interactions of the two units'ystems were modeled explicitly.

Special attention was also given to the interface between the traditional systems analysis and containment system analysis portions of the IPE.

K.

Bulletin 79-02 In response to this bulletin, verification ofthe adequacy ofinstalled concrete expansion anchor bolts for seisniic category I systems was performed.

L.

Recent Safety Analyses A number of major programs have been undertaken over the past several years to upgrade the analyses for the Cook Nuclear Plant units.

These efforts began with the Unit 1 reduced temperature program in 1988, undertaken to justify operation ofthe unit at a lower temperature to extend the life of the steam generators.

Two projects currently in progress are the unit 1 30% steam generator plugging program and unit 2 uprate program, which seeks to increase the umt output to 3600 MWt. Both of these projects have been submitted for NRC approval.

These series of programs resulted in a reanalysis of much of the content of UFSAR chapter 14.

The assumptions used in these analyses were reviewed to ensure that the plant and its operation were accurately described.

The goal of the review was to ensure that values assumed for systems or components in the UFSAR chapter 14 analyses are consistent with their functional capabilities.

Attachment to AEP:NRC:1257 Page 30 9.

Desi n Basis Documentation Reconstitution Pro ect As discussed in the response to item (f), we have undertaken an extensive 1=sign basis documentation reconstitution project.

Thus far, design basis documents have been approved for 22 systems.

To date, there have been no deficiencies identified through the project that resulted in equipment inoperability.

10.

Safe S stem Functional and Similar Ins ections As previously discussed in question (b), we have conducted and supported SSFIs and other similar inspections.

Internal SSFIs were conducted of the auxiliary feedwater

system, containment spray system, control room/spent fuel pooVengineered safety features ventilation systems, as well as a service water system operational performance inspection (SOPI). Internal inspections were conducted using methodologies consistent with those used by the NRC. In addition, the NRC performed an SSFI of the essential service water system, an electrical distribution system functional inspection, and a SOPI of the emergency core cooling system.

The SSFI is based on the vertical slice inspection technique.

This technique takes one system and evaluates the effectiveness of the

design, installation, operations, maintenance, and testing of the target system to ensure it is capable of performing its safety function.

The vertical-slice inspection technique evaluates the effectiveness of the program's horizontal elements by looking at a small portion of the horizontal element (or control process) and the manner in which the horizontal elements are integrated for the selected system.

This is accomplished by reviewing design documentation to determine the design requirements for the system, and then evaluating the operation ofthe system and changes (operating changes, maintenance activities, and modifications) to ensure consistency with the design requirements.

In the SSFI type inspections performed, the systems were found capable of fulfilling their intended design function. Significant design basis configuration and performance issues were not identified during the SSFI type inspections.

(Note: the auxiliary feedwater system SSFI identified a discrepancy in fuse-breaker coordination.

As documented in the LER associated with the discrepancy, the issue was not considered to represent a si<nificant risk to public health and safety). The results ofthese in-depth inspections provide confidence that the plant configuration and performance are in accordance with the design bases.

11.

Internal Assessments In developing this part and the next part of this section, we performed an historical review of quality assurance audits and surveillances and documented correspondence for inspection reports and licensee event reports.

This review covered the years 1983 to the present.

The year 1983 was chosen based on two prime factors:

(1) it was the first year following the initial issuance of the updated FSAR, and (2) major activities of the regulatory performance improvement program were being completed.

In addition to the SSFI type inspections, performance assurance personnel performed assessments to evaluate the effectiveness ofvarious aspects ofdesign bases compliance.

Ofthe approximately 1,700 assessments performed between 1983 and the present, 300 were identified as relating to aspects of design bases compliance, and, ofthose, 75 were reviewed for the purpose of this response.

The 75 assessments included nine that identified concerns relating to configuration, analysis, reviews, drawings, procedures,

Attachment to AEP:NRC:1257 Page 31 testing, or training.

Those concerns were closely monitored in follow-up assessments.

Subsequent audits have shown that proper actions were taken to correct the problems and to prevent recurrence.

Other issues were identified that were narrowly focused with no generic implications, and were resolved in a timely and appropriate manner.

Three audits were performed specifically addressing safety screenings and evaluations in 1992, 1994, and 1995.

These audits found that safety screenings and evaluations were effectively performed.

The design control process has been audited once per year by the site QA organization and eight times by the QA engineering organization during the past six years.

The audit plans for design control audits were developed using applicable NRC inspection modules.

Previous audits are reviewed during subsequent audits to assure corrective/preventive actions have been effective.

In addition to audits where design control is the focal point, design activities are also reviewed during audits of other topics.

For example, an environmental qualification (EQ) audit reviewed old design changes to assure the maintenance requirements for EQ were captured in the work control process.

Audits performed by the QA engineering organization during the 1990s addressed various aspects of the design process.

The audits were intended to ensure that aspects of the design bases requirements of the

systems, structures, and component configuration were included in the review.

In 1989, with support of an engineering consultant, we performed an audit and reviewed the design change program in detail.

The intent of the audit was to provide information as to the adequacy of Cook Nuclear Plant design practices.

The audit found the design control processes at the plant were generally effective in ensuring that the final design met applicable technical and regulatory requirements.

The audit did, however, reveal instances where correction or improvement was required.

As a response to the audit, design control procedures were revised to enhance and improve the design change process.

12.

Re ulato Reviews In addition to the internal assessments, we reviewed the regulatory history relating to the design bases as indicated in NRC inspection reports, LERs, and other documentation from 19S3 to the present.

The results ofthis review demonstrate generally good performance, although there have been instances where concerns or opportunities for improvement were identified by the NRC staff. In most instances the concern was specific to a particular system, structure, component, or procedure.

Generic deficiencies identified during this review had been addressed programmatically (i.e., determining whether similar issues were present).

Issues involving system, structure, and component configuration and performance did not affect the health and safety of the public, as indicated in the evaluation of safety significance provided to the NRC in the associated LER.

By their nature, inspection reports and LERs focus on areas of potential concern.

As with the corrective action program, however, the resulting efforts to investigate and remedy the problems result in a strengthened overall process.

As a result, the process of identification and correction of problems provides further assurance that the plant configuration and performance are consistent with the design bases.

Attachment to AEP:NRC:1257 Page 32 The following are examples of retrospective reviews based on concerns identified in inspection reports or LERs.

~

A corrective action was implemented to determine ifany startup CRs had not been dispositioned properly.

In performing this review, a

sample of 100 CRs was chosen at random (using a computer-based random number generator) from a total population of approximately 3800 CRs.

The results of the review concluded at the 95% confidence level that corrective actions taken in closing CRs during the time period prior to implementation of our present corrective action system were adequate to ensure that concerns ofpotential safety significance had been

~

appropriately resolved.

~

A generic review was performed for the electrical systems.

The study of electrical protection coordination included essential and balance of plant equipment for 250 VDC panels and motor control centers and all AC buses from the 4160 volt level to the 120 volt AC instrumentation level.

The fuse and breaker coordination study is considered a

comprehensive response because it required evaluation of a wide range ofessential electrical equipment.

Additional enhancements to strengthen QA oversight (e.g., performance-based audits with increased engineering expertise) were also developed and implemented.

These enhancements provide another means for increased awareness of the performance level of design control practices.

Other items are discussed in the section related to special initiatives.

In the above instances, the corrective actions included a retrospective review ofpast work to validate the work, correct deficient items, and make positive changes in the process to prevent recurrence.

The review of LERs and inspection report findings performed for this response effort revealed relatively few issues related to design bases compliance.

When problems were of a generic nature, our response was typically to re-review past work in the same area and take applicable corrective action.

A general indication of the NRC assessment of the performance of Cook Nuclear Plant can be garnered from the most recent systematic assessment of licensee performance report.

That report states that the overall plant performance was good and generally reflected a conservative operating philosophy and good safety focus.

13.

SVMMARY I

The response to question (a) provided a description of current processes for design control and review pursuant to 10 CFR 50.59, and UFSAR updating.

Improvements and enhancements have been made to these processes based on assessments of effectiveness,

clarity, and compliance with evolving regulate ry requirements.

Corroboration of the effectiveness of these procedures is obtained through review and assessment of the plant configuration via self-assessments.

In some instances, these assessments have been supplemented by performance of similar activities by the NRC staff. In a significant majority of the assessments, the processes and procedures were determined to be performing effectively with regard to design bases mformation.

In the limited number of instances where design bases concerns were identified by either internal or external reviews, actions were taken to resolve the concern and implement necessary actions.

0 g ~

Attachment to AEP:NRC:1257

~NRC IIE IIEE Page 33 (d)

Processes for identification of problems and implementation of corrective actions, including actions to deterinine the extent of problems, actions to prevent recurrence, and reporting to NRC

RESPONSE

The primary process for problem identification and resolution is the Cook Nuclear Plant corrective action program (CAP).

Within the CAP, the mechanism for tracking and resolving known or suspected adverse conditions/events is the condition report (CR).

This program has evolved over time and meets the requirements of 10 CFR 50 Appendix B, Criteria XVI. The CAP is supported by an internal and external audit process that serves to validate the implementation of the program.

The CAP is premised upon the vigilance and questioning attitude of plant employees.

It provides guidance to assist individuals in identification of adverse conditions at the plant.

An adverse condition is defined as a nonconformance, deficiency, deviation, discrepancy, or adverse trend of items, services, or administrative systems that, ifleft uncorrected, could adversely impact safety, quality, or operability.

The processes used to identify and classify adverse conditions include:

~

routine work processes

~

internal audits and assessments

~

external issues and assessments

~

condition reporting and classification The discussion of how the adverse conditions are identified and classified via these processes is provided in the subsequent sections.

1.

Routine Work Processes Routine work processes are the primary source of problem identification.

Senior management strongly encourages prompt identification, documentation, and resolution of adverse conditions.

These processes include the following:

~

employee observations

~

work control system

~

10 CFR Part 21 reporting

~

design change deviation or information request

~

materiel condition walkdowns

~

material receipt and inspection

~

surveillances Employee Observations The primary source for identification of adverse conditions is employee observation.

Any mdividual who identifies or suspects an adverse condition or event is responsible for reporti,~g the condition via a CR. A culture emphasizing a questioning attitude and proactive evaluation of potentially adverse conditions is continually reinforced by

Attachment to AEP:NRC:1257 Page 34 correspondence,

guidance, and recognition from senior management.

In addition, employees are made aware of the NRC's notification program with Form 3 being adequately posted throughout the plant.

The AEP employee concerns line is a method to report activities that may be adverse to applicable laws, regulations, the AEP System Code of Conduct, or any other policy, procedure, or issue ofimportance to the caller. The employee concerns line is managed and operated by an independent communications firm. It is available, toll-free, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> a day.

Calls are reviewed and responded to, regardless of the nature of the concern.

Callers do not need to give their name.

Employees are encouraged to make reports even ifthey do not have all of the facts.

Reports are documented by communications specialists and a written report generated.

The written reports are forwarded directly to the Office ofthe Chief Compliance Officer. Nuclear management is informed ofall concerns related to Cook Nuclear Plant. Ifapplicable, CRs are written in regard to these concerns and the issues handled through the CAP.

In addition to the employee concerns line, employees may identify concerns in confidence under the innovations and concerns program (previously known as the human performance enhancement system).

Submitted concerns are evaluated.

When applicable, the issue is reported via the CAP. Employees may contact the innovations and concerns coordinator at any time for a status of their report.

Work Control System The work control system is a computerized work management system that is the primary means for identifying, planning, scheduling, and implementing corrective and preventive maintenance activities associated with systems, structures, and components.

10 CFR Part 21 Reporting Procedures have been established to delineate the methods for reporting defects and noncompliances per 10 CFR 21.

Notices received from external organizations or generated internally involving potential 10 CFR 21 concerns are documents ~ in CRs.

These are reviewed by management and assigned to the cognizant organization for evaluation of applicability and impact on the plant.

The corrective action program contains requirements intended to ensure that potential 10 CFR 21 concerns are identified, documented, dispositioned, and reported in accordance with 10 CFR 21 requirements.

Other Routine Work Processes The design change deviation or information request is discussed in section (a) of this submittal. Materiel condition walkdowns are discussed in section (c). Material receipt and inspection is discussed in section (a) as a part of the QA program.

Surveillances are discussed in section (c) of this submittal.

2.

Internal Audits and Assessments Internal audits and assessments include the following:

~

QA audits

Attachment to AEP:NRC:1257 Page 35 QA Audits nuclear safety and design review committee audits safety system functional inspections adverse trends program 4

peer inspection program ANSI N45.2.6 inspection program self assessment process supplier performance audits Performance assurance personnel have overall responsibility for development and maintenance of the quality assurance program description (QAPD).

The QAPD describes requirements of a program implemented to comply with each aspect of 10 CFR 50 Appendix B.

Performance assurance personnel are also responsible for performing audits of activities important to safety to evaluate the effectiveness of the mternal controls used at Cook Nuclear Plant.

These audits include the following topic areas:

design control, in-service inspection/in-service testing, design change control program, plant procurement control, UFSAR, and specifications/system descriptions.

Other groups contribute to this effort to provide an overview and broad range of technical expertise.

Our audit process is shifting from a periodic assessment program to a continuous oversight process.

The revised program considers performance indicators in developing audit scope.

Audit content is tending toward program assessment instead of program coinpliance.

Surveillance activities go above and beyond the traditional QC role of nondestructive examination or inspection, and into the realm ofevaluating performance of plant activities and compliance with procedures.

The results of these surveillance activities are being used as performance indicators to the audit process.

The objectives of the audit program are to:

determine whether programs have been developed and documented in

'. cordance with specified requirements;

~

determine whether documented programs are adequate to fulfillspecified requirements;

~

verify by examination and evaluation of objective evidence that documented programs have been implemented and are effective;

~

identify nonconformances and program deficiencies;

~

verify correction of identified program deficiencies; and assess purchased material, equipment, and services at intervals consistent with their importance, complexity, and performance history.

With regard to audit methodology, audits are planned and scheduled to:

~

assess the adequacy ofthe quality assurance program covering activities affecting safety related functions and activities governed by regulation;

~

evaluate areas where the requirements of 10 CFR 50 Appendix B apply commensurate with the importance to safety of activities, and the adequacy and performance history of controls affecting the quality of

Attachment to AEP:NRC:1257 Page 36 structures,

systems, and components covered by the quality assurance program; and

~

assure that audit coverage remains current with the way activities are being performed.

Auditplans and checklist questions are developed based on 10 CFR, regulatory guides, ANSI standards, Cook Nuclear Plant procedures, the UFSAR, technical specifications, directives, policies, performance indicators, and historical documents such as:

~

previous audits and surveillances;

~

technician surveillance/inspection results;

~

condition reports associated with the topic being investigated;

~

corrective action trends report - review of trends associated with the topic being investigated; industry and operating experience; INPO information (findings, performance objectives, and criteria);

NRC information (inspection

manuals, information notices, generic letters, inspection reports, commitments, SALP reports, etc.);

~

past audits and auditee self assessments; and other performance data (weekly department reports, monitoring reports, NPRDS, American Nuclear Insurers (ANI) inspections, etc.).

Safety System Functional Inspections As discussed in sections (b) and (c), we have undertaken and supported numerous safety system functional inspections.

These vertical slice-type inspections take one system and evaluate the effectiveness of design, installation, operations, maintenance, and testing ofthe target system to ensure it is capable ofperforming its safety function.

Nuclear Safety and Design Review Committee Audit Program

'I The Nuclear Safety and Design Review Committee (NSDRC) provides an oversight function and is responsible for evaluating audit reports from the performance assurance and NSDRC audit program.

Adverse Trends Program A trend analysis report is issued twice a year.

This report contains information related to adverse trends, recurring events, and areas requiring increased management attention.

Peer Inspection Program The peer inspection program utilizes peer personnel as inspectors ofroutine work. The peer inspection program requires that peer inspectors be qualified to ANSI N18.1 (1971), Selection and Traimn of Nuclear Power Plant Personnel, and periodically trained in their skill area using accredited training programs.

As a result of their experience, qualifications, and training, these employees may perform inspections of work functions associated with normal operation ofthe plant, routine maintenance, and certain routine technical activities that are performed by other employees (peers).

Peer

Attachment to AEP:NRC:1257 Page 37 inspection personnel are independent in that th.".y do not perform or directly supervise the work being inspected, even though they may. be from the same work group.

ANSI N45.2.6 Inspection Program Safety-related work performed by contract personnel is inspected per ANSI N45.2.6, ualifications of Ins ection Examination and Testin Personnel for Nuclear Power Plants.

In addition, major modification and.non-routine maintenance work on safety-related equipment is inspected pursuant to ANSI N45.2.6, whether performed by employees or contractor personnel.

Self Assessment Process Managers are responsible for implementation of periodic self assessments of their departmental activities; facilitating self assessments led by other department personnel; and ensuring appropriate responses to self assessment findings.

Self assessments go beyond evaluating an activity or function against applicable procedures, rules, and regulations.

Self assessments include an analysis to determine whether an activity is bemg performed in an appropriate manner at the appropriate time. To accomplish this, self assessments consider established industry and internal benchmarks; identify strengths and challenges; and make appropriate recommendations for areas that could be improved.

Supplier Performance Audits We utilize a supplier performance audit program that implements the requirements of 10 CFR 50 Appendix 8, and the QAPD.

3.

External Issues and Assessments Operating Experience Nuclear operating experience is obtained from INPO and an initial screening is performed.

Operating experience applicable to the plant is identified and a review is performed to determi.ie what actions should be taken.

NRC Inspections, Generic Letters, and Bulletins Information on problems identified throughout the industry is often provided by the NRC through information notices, generic letters, bulletins, and other correspondence.

NRC correspondence is processed by nuclear licensing personnel and entered into our NRC correspondence system.

A "packet" is opened for the document, the document is entered into a tracking system, and a lead person in the nuclear licensing area is assigned.

The document is sub-assigned to appropriate group(s) for review and action as necessary.

Documents are reviewed for impact on the plant, and appropriate follow-up actions identified and tracked.

Industry Assessments INPO assessments are facilitated to allow open discussion and critical feedback concerningourperformance.

IssuesarereportedviatheCAP whenappropriate.

Issues and improvement items are assigned periodically to responsible personnel, reviewed by management, and tracked to completion.

Attachment to AEP:NRC:1257 4.

Condition Re ortin and Classification Page 38 Significance Classifications Observations meeting the definition of an adverse condition as stated

above, are reported via the corrective action program.

CRs are classified and evaluated in accordance with the methodology set forth in procedures.

The classification and evaluation processes start with a determination of operability and reportability of the adverse condition.

The determination of operability and reportabihty are described below.

The condition report is then reviewed by the condition assessment group (CAG), a committee consisting of managers from various disciplines.

The CAG reviews each condition report, assesses the immediate actions taken, and classifies the condition as to its uncertainty and risk.

There are four distinct levels of condition classification (A, B, C & D). The levels of classification are assigned by the CAG and are based upon a matrix of the degree (i.e.,

high, moderate, or low) of risk and uncertainty associated with the condition.

The CAG also assigns the condition report to the appropriate group for investigation and resolution.

When appropriate, root cause analyses are conducted and further preventive actions determined.

In addition, a final reportability review and PNSRC review may also be performed.

Corrective and preventive actions are tracked to completion.

Reportability The CAP is the process used for evaluating adverse conditions for reportability to the NRC. Reporting may be required pursuant to 10 CFR 50.72, 10 CFR 73, 10 CFR 21, other applicable sections of the Code of Federal Regulations, or the technical specifications.

When a condition report is generated, it is reviewed by the originator's supervisor and delivered to the on-duty operations shift. Shift personnel evaluate the CR to determine ifthe condition meets the immediate notification requirements of 10 CFR 50.72. Ifso, a call is made to the NRC emergency operations center.

Condition reports are also reviewed daily for reportability by nuclear licensing personnel during the normal work week.

In some cases, further investigation of the condition is necessary before reportability can be determined.

In such

cases, the condition report is marked as "reportability to be determined;"

Additionally, reportability is reviewed by the CAG, which also meets daily during the normal work week. For those conditions marked "reportability to be determined," nuclear licensing personnel complete the reportability determinations when sufficient information is available from investigation of the condition.

Operability Determination Process Plant procedures and administrative controls are used to initiate operability determmations, consistent with the intent ofthe guidance provided in Generic Letter 91-

18. A system, subsystem, train, component, or device is considered operable or to have operability when it is capable of performing its specified function.

Implicit in this definition is the assumption that necessary attendant instrumentation, controls, normal and emergency electrical power sources, cooling or seal water, lubrication, or other auxiliary equipment required for the system, subsystem, train, component, or device to perform its safety function are capable of performing their related support functions.

Attachment to AEP:NRC:1257 Page 39 The process for determination ofoperability for Cook Nuclear Plant systems, structures, and components (SSCs) is integrated with the CAP. Condition report investigators are required to advise the shift technical advisor (STA) if, at any time during a CR investigation, the operability of any SSC described comes into question.

The STA is required to promptly initiate, or cause to be initiated, an operability determination and to obtain engineering or other assistance, as

needed, to make the operability determination in a timely manner.

The CAG is responsible for review of completed operability determinations associated with CRs from an oversight perspective.

In its oversight function, the CAG assesses the need and makes assignments forperforming confirmatory operability determinations or supplemental analysis.

5.

Summaru The preceding sections describe processes currently in place to identify problems and implement corrective

actions, including actions to classify the problem, prevent recurrence, and report the problem to the NRC.

Attachment to AEP:NRC:1257

~NRC llE EEET Page 40 (e)

The overall effectiveness of your current processes and programs in concluding that the configuration of your plant(s) is consistent with the design bases

RESPONSE

We believe that the overall effectiveness of our current processes and programs is sufficient to provide reasonable assurance of plant configuration and performance consistent with the design bases.

As described in our response to NRC questions (a) through (d), processes and procedures have been in place throughout the life ofthe plant to control design changes and provide assurance that the plant is operated within its design bases.

The response provided in section (e) addresses the overall effectiveness of the current engineering design and configuration control processes, including those processes and procedures that implement 10 CFR 50, Appendix B, 10 CFR 50.59, and 10 CFR 50.71(e), and provides the bases for our conclusion that these processes and procedures have been and are implemented in an effective and appropriate manner.

This section, and the more detailed discussions of the processes provided above, demonstrate that our procedures contain appropriate requirements and the necessary checks and balances to provide reasonable assurance that the plant complies with and will remain within its design bases as defined in the UFSAR.

This conclusion is based on several basic determinations:

a) the original plant design practices and verification methods were effective and consistent with sound engineering practices as they existed at the time of initial licensing; b) the pre-operational test program provided assurance that the plant systems were capable of performing their intended function; c) appropriate processes and procedures have been in place throughout the life of the plant to control and document design and procedure changes; d) internal and external audits and assessments that have been performed throughout the life of the plant have repeatedly determined that the processes and procedures are appropriate and implemented in an effective manner; and e) when the need for changes and/or improvements to existing programs was identified, we implemented appropriate corrective action.

In addition, we have committed to the performance of two major projects designed to provide added confidence that Cook Nuclear Plant programs have been effective in translating and maintaining the plant design bases.

The initial design bases and procedures for Cook Nuclear Plant were established in the late 1960s and early 1970s by the original architect-engineer (AEPSC), and the NSSS vendor (Westinghouse) in accordance with applicable regulations and standards, and consistent with good and sound engineering practices.

Although much of this development occurred prior to the promulgation of the detailed guidance that exists today, we had extensive experience m the design and engineering of power plants and had participated in numerous early nuclear initiatives to gain additional experience with this new technology.

The intimate involvement of our staff from project inception provided a high degree of knowledge regarding the design bases and their subsequent translation into plant operating procedures.

This level of involvement has continued through all phases of plant activities up to and including the present period.

With regard to the effectiveness of original design practices, we were required to submit a description of original design control practices for Cook Nuclear Plant to the NRC in 1984.

In developing this description, the conclusion that the original design

Attachment to AEP:NRC:1257 Page 41 practices were consistent with good engineering practice was re-affirmed. Although a large portion of the original design had been performed prior to the publication of ANSI N45.2.11-1974, the design concept implemented for Cook Nuclear Plant was consistent to a significant extent with the philosophy ofthat standard.

Though different in form and ease of auditability from the ANSI requirements, it was concluded that the original design methodologies were commensurate with the design verification requirements described in 10 CFR 50 Appendix B Criterion III, and ANSI N45.2.11, in ensuring an effective design process.

When the original operating license was issued for Unit 1, we had in place the appropriate programs and procedures necessary to implement regulatory requirements associated with control of design changes.

These regulatory requirements included 10 CFR 50 Appendix B and 10, CFR 50.59.

The procedures implementing the requirements of 10 CFR 50.59 were issued during the pre-operational phase of plant activities.

The programs controlled the implementation of design changes from the beginning of operation, and are embodied in the current design change

program, corrective action program, and quality assurance program.

The engineering design and configuration control process consists of a number of interrelated processes.

Changes to design bases information can be related to either changes to the physical facility or changes to the plant documentation.

For physical plant changes, design control is addressed via design change

packages, temporary modifications, and component evaluations.

The design change package process is the mechanism for implementing significant permanent modifications at Cook,Nuclear Plant.

The design change process has procedural requirements to provide assurance that appropriate information is reviewed and documented, and that applicable licensing requirements, including the requirements of 10 CFR 50 Appendix B and 10 CFR 50.59, are met.

The design change process provides assurance ofproper implementation of design bases for physical plant changes (i.e., modifications) by requiring:

1) the use of checklists for design change packages to identify related design and licensing criteria; 2) identification of associated plant procedures,

training, and in-process and functional testing;

3) that appropriate procedures, data points, and QC holdpoints are included in the planned activity; and 4) that reviews be performed to provide assurance that post-maintenance/modification testing requirements have been included.

These procedures collectively contain the necessary attributes to maintain engineering design and configuration control.

Installation and construction activities are performed in accordance with design change package instructions and references.

Upon completion of installation, the project engineer is required to review the associated documentation and verify that the work and associated documentation package have been completed.

Post-installation walkdowns are also performed by the project engineer and others, as appropriate.

To provide further assurance, design change packages and associated safety evaluations are reviewed and approved by the plant nuclear safety review committee (PNSRC).

Additionally, the nuclear safety and design review committee performs an independent review ofthese safety evaluations.

As a result, the performance ofactivities associated with the implementation of design changes is closely controlled and receives multiple reviews, thereby providing assurance that the plant design bases are accurately reflected in design modifications and physical plant changes.

Similarly,.changes to procedures at Cook Nuclear Plant are closely controlled through the use of formal procedures.

Administrative guidance has been established to provide

Attachment to AEP:NRC:1257 Page 42 assurance that changes to plant procedures, technical specificatio'ns, and the operating license are reviewed to preclude operation oftlie plant outside the design bases.

Only personnel with the requisite training and qualifications may develop and perform the technical and safety (10 CFR 50.59) reviews associated with the development of new procedures and revisions to existing procedures.

Changes to procedures must receive an independent review by individuals with the requisite training and background to perform such reviews. This technical review consists of evaluation of the document to provide assurance that it is correct from a functional, engineering, and administrative perspective, as appropriate.

The technical review also determines whether additional cross-disciplinary reviews are necessary.

Beyond the initial reviews, the PNSRC is responsible for reviewing changes and additions to plant manager instructions and procedures, as well as any procedure whose safety screening indicates an unreviewed safety question determination is required.

While we are confident that the existing design and configuration control programs are appropriate and have functioned properly, it is recognized that the processes for identification of problems and implementation of corrective actions are critical to ensuring that the plant configuration and design bases are being maintained.

The response to NRC question (d) describes the processes that have been implemented for identifying, classifying, resolving, and reporting problems to the NRC.

The primary process for problem identification and resolution is the corrective action program (CAP), which meets the requirements of 10 CFR 50, Appendix B, Criteria XVI. Within the CAP, the mechanism for identifying, tracking, and resolving known or suspected adverse conditions/events is the condition report (CR).

The CAP is supported by an internal and external audit process that serves to validate the implementation of the program.

The CAP is premised upon the vigilance and questioning attitude of our employees.

The CAP provides guidance to assist individuals in identification of adverse conditions at Cook Nuclear Plant.

Employee observations, particularly in the course of routine work processes, are the principal source of problem identification.

Our senior management strongly encourages prompt identification, documentation, and resolution of adverse conditions.

This message is emphasized during employee training and is disseminated via multiple management directives and correspondence.

Any.ndividual who identifies or suspects an adverse condition or event is responsible for reporting (and has the authority to report) the condition via a CR.

Thi~ responsibility, and a culture emphasizing a questioning attitude and proactive evaluation of potentially adverse conditions, is continually reinforced by correspondence and guidance from our senior management.

In addition to the internal reporting mechanisms, the programs by which concerns can be reported directly to the NRC are emphasized during training and are reinforced through postings ofinformation regarding the process and the availability of applicable forms at appropriate locations throughout the plant.

The effectiveness of the programs and activities addressed above has been repeatedly demonstrated by self assessments and internal and external reviews.

While the CAP has been found to be generally effective at identifying potentially adverse conditions, opportunities for improvement of the CAP with regard to identification and timely resolution ofconditions have been identified. In response, our senior management has strongly reinforced its message regarding expectations for reporting of potentially adverse conditions at Cook Nuclear Plant.

In addition, the CAP is currently being revised to address these concerns and enhance its overall effectiveness.

Attachment to AEP:NRC:1257 Page 43 In addition to the assessments and audits that are performed in the normal course of plant operation, in preparation for the development of this response, we undertook an evaluation ofpast internal audits and self-assessments involving engineering design and configuration control.

These efforts, including SSFI type inspections and the design basis documentation reconstitution project, were reviewed to assess confidence in the conclusion that the design bases are translated into procedures and that systems, structures, and components are consistent with the design bases.

This review considered engineering design and other key configuration management processes, including our process for making changes to operations, maintenance, and testing procedures, and the UFSAR.

The review served to reinforce our confidence that activities were being conducted in a manner that provided an appropriate level of assurance that the design bases were accurately translated into operations, maintenance, and testing procedures and that systems, structures, and components were consistent with the design bases.

The effectiveness with which Cook Nuclear Plant design bases have been translated into plant design and procedures has been further buttressed through the implementation of various programs and initiatives related to design bases issues.

Although many ofthese programs were initially undertaken to address concerns raised by changing regulatory requirements or perceived shortcomings in existing plant programs, the results ofthese efforts provide further assurance that system, structure, and component configuration and performance are consistent with design bases.

These initiatives include, but are not limited to, the regulatory performance improvement

program, large bore piping reconstitution program, small bore piping review, recent safety analyses, Appendix R revalidation, seismic qualification utilitygroup, implementation ofthe maintenance rule, actions associated with our response to generic letters 88-20, 89-10, 89-13 and bulletin 79-02, and the system engineer program.

As a part of these initiatives, reviews have be'en undertaken addressing the adequacy of class I flow diagrams, engineering design practices, design verification, piping system documentation, anchor bolt adequacy, iping analysis calculations, updates to design drawings, seismic performance, fire oundary modifications, conduit and cable tray protection, motor operated valve functional performance, and plant heat removal and heat sink functions.

These programs, including the associated retrospective reviews, provide additional insight and confidence regarding the overall effectiveness of engineering design and configuration control practic s.

Moreover, in instances where opportunities for change and improvement were identified and subsequently implemented, the performance of these initiatives has served to enhance the effectiveness of configuration control activities.

Additional evidence and confidence regarding the manner in which design bases control activities are performed at Cook Nuclear Plant is provided by the numerous assessments by performance assurance personnel.

These assessments have evaluated the effectiveness ofvarious aspects ofdesign bases compliance. The design control process has been audited once per year by the site QA organization and eight times by the QA engineering organization during the past six years.

The findings of previous audits were reviewed during subsequent audits to assure corrective/preventive actions have been effective.

Three audits specifically addressing safety screenings and evaluations were performed between 1992 and 1995.

These audits determined that safety screenings and evaluations were being performed effectively. In addition, an audit was performed addressing documentation ofcompleted design change packages, engineering mterfaces, design verifications, calculations, safety evaluations, and engineering justifications.

Even though the audit identified instances where corrections or improvements were required, the overall conclusion reached was that the design control processes were effective in ensuring that the final design met applicable technical and

Attachment to AEP:NRC:1257 Page 44 regulatory requirements.

Those items that were cited as requiring changes were evaluated and appropriate changes made to the discrepant processes.

Ofthe approximately 1,700 assessments performed between 1983 and 1997, 300 were identified as relating to aspects of design bases compliance, and of those, 75 were reviewed in detail during the preparation of this response.

The 75 assessments were found to include nine that identified concerns relating to configuration, analysis, reviews, drawings, procedures, testing, or training.

These concerns were closely monitored in follow-up assessments.

Subsequent audits have shown that proper actions were taken to correct the problems and to prevent recurrence.

Other issues were identified that were narrowly focused with no generic implications, and were resolved in a timely and appropriate manner.

The results of SSFIs and other similar type inspections performed at Cook Nuclear Plant further support the conclusion that the design and configuration of systems, structures, and components have an appropriate level of consistency with design bases.

In the SSFI type inspections performed, the systems were generally found to be capable of fulfillingtheir intended design function and to be free of significant design basis configuration and performance issues.

The results ofthese in-depth inspections provide added confidence that the processes and procedures used to maintain plant configuration and performance in accordance with design bases, are effective as implemented.

In addition to these internal assessments, external reviews were also evaluated during the preparation of this response.

The evaluation of external reviews, including LERs and NRC inspection reports, indicated generally good performance, although there have been instances where concerns and opportunities for improvement were identified by the NRC staff.

In most instances, concerns were specific to a particular system, structure, component, or procedure.

Where generic deficiencies were noted, efforts were undertaken to determine whether similar deficiencies existed in other programs or processes.

This was accomplished by performing a retrospective review of past work to validate it, and, ifnecessary, correct deficient items and make positive changes in the process to prevent recurrence.

Even though some ofthe audits and assessments identified areas ofconcern or potential improvements, the performance of such reviews and the responses to the ident!.'ted

concerns, including an aggressive program to analyze and revise programs and processes in need ofrevision, has resulted in a situation today where a heightened level of confidence exists in the accuracy of the plant design basis and the manner in which it has been translated into the plant design and procedures.

Notwithstanding our determination that engineering design and configuration control processes, as currently implemented, provide reasonable assurance that the plant is maintained and operated in accordance with its design

bases, we have undertaken initiatives/revalidation efforts that when completed, willfurther increase understanding of and confidence in the level of conformance with design bases.

One of these initiatives, the design basis documentation reconstitution (DBDR) project, willhave the effect of centralizmg and increasing the retrievability of design bases information related to engineering design and configuration, while the UFSAR revalidation project willprovide further assurance ofthe accuracy and consistency ofinformation contained in the UFSAR. A detailed discussion of these initiatives is provided in section (f).

Based on our review of engineering design and configuration control practices, we believe there are reasonable assurances that:

1) design bases for Cook Nuclear Plant

Attachment to AEP:NRC:1257 Page 45 have been accurately translated into operating, maintenance, and testing procedures; 2) systems, structures, and components are consistent with the design bases; and 3) design bases are properly addressed when design and procedure changes e-e made.

In addition, we are confident that the overall effectiveness of our current processes and programs is sufficient to provide reasonable assurance that system, structure, and component configuration and performance are consistent with the established design bases.

Moreover, past problems in the design and configuration control area have been addressed in a forthright manner and were generally found to have a low safety significance. In recognition ofthe fact that there is always room for improvement and the potential value associated with increasing the level of confidence regarding such matters, we intend to devote significant resources to the on-going performance of the DBDR project and UFSAR revalidation project.

These programs are designed to improve performance and heighten the level of certainty regarding design bases adequacy and availability. As appropriate, findings that result from those programs will serve as the basis for further improvements to the design control processes.

Each of the activities addressed throughout this response, including development ofthe original procedures, engineering design and configuration control, auditing and assessment programs, and the corrective action program have served to demonstrate the effectiveness of the implementation of current processes and programs in providing reasonable assurance that the configuration of the plant is consistent with the design bases.

It is further anticipated that these processes and programs are fully capable of maintaining that condition in the future and that in the event further actions are required, we will undertake such actions as are necessary to maintain an appropriate level of conformance with the design bases.

Attachment to AEP:NRC:1257 N~RC RR URNT Page 46 (f)

In responding to items (a) through (e), indicate whether you have undertaken any design review or reconstitution programs, and if not, a rationale for not implementing such a program.

(Though not specifically defined in the NRC request for information, this section of the response is being referred to as section (f))

RESPONSE

As described in the preceding sections, we have undertaken various design review and reconstitution programs.

These programs include the large bore piping reconstitution project, Appendix R revalidation, small bore piping review, seismic qualification utility group, regulatory performance improvement program, ard recent reanalysis efforts for Chapter 14 of the UFSAR. These reviews have provided an added level of confidence in the implementation of design bases at Cook Nuclear Plant.

In addition, two programs were initiated that will strengthen our configuration management process and provide additional tools to maintain and operate the plant in conformance with the design bases.

The two projects are the design basis documentation reconstitution project and the UFSAR revalidation project.

1.

Desi n Basis Documentation Reconstitution Pro'ect In the industry, safety system functional inspections (SSFIs) and other vertical slice audits have identified a concern that design basis information is not readily retrievable or cannot be located.

Due to these

concerns, we commenced the design basis documentation reconstitution (DBDR) project in March 1992.

The DBDR project compiles design bases information, as design bases are defined in 10 CFR 50.2.

In addition, the project also compiles the functional requirements of

systems, structures, and components that impact plant operation, licensing, and engineering support.

The UFSAR w~s systematically reviewed to prepare a comprehensive list of systems appearing in the UFSAR. In addition, UFSAR accidents were mapped into design basis document (DBD) topics.

Industry issues such as high energy line break, seismic, AMSAC, and Appendix R were also identified for potential DBD development.

The list ofpotential DBDs was reviewed by engineering, licensing, and plant personnel and an outside consultant before final approval by senior management.

The DBDR project was presented to NRC Region III in April 1994.

The DBDR project is controlled by procedures written for the development and control of design basis documents.

These procedures are supplemented by instructions for specific DBDR project activities.

The DBDR project is currently underway. At this time, 22 DBDs have been approved and eight are in various stages of development, covering the majority of the safety

. related systems.

Issued DBDs are treated as controlled documents.

Another 18 DBDs are in scoping and initiation phases.

Currently, 69 DBDs are anticipated for this project.

Table A, which appears at the end of this section, provides a listing of the 69

Attachment to AEP:NRC:1257 Page 47 proposed DBDs and their current development status.

The DBDR project is scheduled to be completed by the end of 1999.

Prioritization of DBD preparation is based upon the following considerations:

~ 'afety related system;

~

core damage frequency contribution;

~

identified as a candidate. via 50.59 reviews;

~

licensee event reports;

~

nominated by plant operations;

~

resource allocations; regulatory attention in the nuclear industry; and, self assessments, QA audits, and engineering activities indicate a need to increase information retrievability.

The DBDR project is directed at compiling existing information.

Because information in the DBDs may be used in making decisions related to safety, the DBDR undertaking is treated as a safety related project.

Internal as well as exteinal efforts are conducted consistent with QA practices for safety related work. Performance assurance personnel audited the DBDR project in 1994 with participation by the DBDR project manager of another utility. The audit concluded that the DBDs are developed m accordance with existing procedures and project instructions. The DBDRproject is periodically audited.

Authors of DBDs are screened and selected for their subject matter knowledge and trained in QA requirements and project requirements.

Explicit guidance is provided as to the processing ofmissing, discrepant, or conflicting information. Particular attention is given to tracing safety requirements (analysis, engineering calculations, or regulatory directive) to their origin.

DBDR action items are tracked, trended, and monitored. An initial screening ofaction items is conducted by DBDR project personnel to determine ifa condition report (CR) is required.

CRs enter the corrective action program for review and resolution as described in section (d), above.

That process addresses operability and reportability requirements.

Responses to action items are reviewed by the responsible manager and DBDR project staff prior to closeout, to provide assurance that the resolution is responsive to the issues raised.

Each DBD is required to undergo a complete and independent verification. Comments are formally made by the verifier and resolved by the DBD author.

Each DBD has a companion design basis notebook that gives ready access to references withinthe DBD.

Subsequent validation of the DBD is performed by comparing selected design basis statements related to plant operation with procedures, precautions and limitations, program descriptions, and training material.

The recent NRC system operations performance inspection conducted in November and December of 1996 reviewed open action items associated with the systems being inspected.

It was noted that there were some action items that had been identified for which prompt action had not been taken to resolve the open items and update the DBD documents.

This prompted a review of current processes and resources associated with the DBDR project.

Attachment to AEP:NRC:1257 Page 48 Several actions have been taken to strengthen the DBDR project. A re-evaluation was performed of open action items to confirm the significance of the condition and a determination was made ifa condition report should be initiated. Additional resources have been assigned to the project to review and resolve open action items. The process by which the approved DBD document is maintained current is being reviewed and the applicable procedures willbe revised as necessary to reflect any changes.

The DBDR project to date has not identified a discrepancy that resulted in equipment inoperability.

TABLEA A

roved DBDs DB-12-250V DB-12-4KV DB-12-AFWS DB-12-APPR DB-12-AUXB DB-12-CCW DB-12-CNTS DB-12-CNTT DB-12-CTS DB-12-CVCS DB-12-CWS DB-12-ECCS DB-12-EDG DB-12-EDGS DB-12-ELEC DB-12-ESW DB-12-HVAB DB-12-HVCR DB-12-HV SR DB-12-NESW DB-12-RHRS DB-12-RPS Descri tion 250 V DC S stem 4KV S stem Auxiliar Feedwater S stem 10 CFR 50 A endix

'R'uxiliar Buildin Structure Com onent Coolin Water Containment S stems Containment Structure Containment S ra S stem Chemical Volume Control Circulatin Water S stem Emer enc Core Coolin Emer enc Diesel Generators Emer enc Diesel Generator Su ort S stem Elec. Control & Protection Circuit Philoso h Essential Service Water Auxilia Buildin Ventilation S stem Control Room Ventilation S stem En ineered Safet Features Ventilation Non-Essential Service Water Residual Heat Removal S stem Reactor Protection & Eng'd. Safety Feature Actuation System

Attachment to AEP:NRC:1257 Page 49 In Pro ress DBDs DB-12-CHEM DB-12-FP DB-12-HELB DB-12-LOCA DB-12-OFSP DB-12-RCS/LTOP DB-12-SBO DB-12-SFS Future DBDs DB-12-120V DB-12-480V DB-12-AMSC DB-12-CAN DB-01-CDFW DB-02-CDFW DB-12-CHL DB-01-CORE DB-02-CORE DB-12-E DB-12-FHS DB-12-FLD DB-12-FWSF DB-12-HTR DB-12-HVMC DB-12-ICC DB-12-ISI DB-12-NIS DB-12-MSSG DB-12-OPER DB-12-PAM Descri tion Chemist Control Fire Protection Hi h Ener Line Break Outside Containment Lar e/Small Break Event Offsite Power/Loss of Offsite Power Reactor Coolant S stem Station Blackout S ent Fuel S stem Descri tion 120V AC S stem 480/600V AC S stem ATWS/AMSAC Com ressed Air& Nitro en S stem Unit 1 Condensate and Feedwater Unit 2 Condensate and Feedwater Overhead Cranes, Hea Loads Unit 1 Fuel & Core Mana ement Unit 2 Fuel & Core Mana ement Environmental ualification Fuel Handlin S stems Floodin Internal &, External Feedwater S stem Faults Heat Tracin

& Freeze Protection HVAC Ma'or Com onent Inade uate Core Coolin In-service Ins ection/In-service Testin Nuclear Instrumentation Main Steam S stem 0 erator/Plant Interface Post Accident Monitorin

g t'4

(

4,

~

~

Attachment to AEP:NRC:1257 Page 50 DB-12-PIPD DB-12-PIWP DB-12-RADR DB-12-RCIT DB-12-RCFF DB-12-RMS DB-01-RVIN DB-02-RVIN DB-12-RWDE DB-12-ROD DB-12-SETP DB-12-SITE DB-12-STRUC DB-12-SSTF DB-12-STW DB-12-THIN DB-01-TG DB-02-TG Pi in Desi n Pi e Whi & Missiles Radioactive Release Faults Reactivit Chan e Initiated Faults Reactor Coolant Flow Faults Radiation Monitorin S stem Unit 1 Reactor Vessel & Internals Unit 2 Reactor Vessel & Internals

'Radioactive Waste Processin Waste Dis osal Rod Control/Rod Position Indication Instrumentation Set oint Methodolo Site Envelo e & Site Conditions Structural Desi n E ui ment Foundation & Shieldin Steam S stem and Turbine Faults Seismic/Tornado/Wind Turbine Buildin and Intake Structure".

Unit 1 Turbine Generator Unit 2 Turbine Generator 2.

UFSAR Revalidation Pro eet In 1996, we conducted a limited scope review ofthe UFSAR to evaluate the'nature and significance ofpotential discrepancies between the UFSAR and actual plant design, and plant operating procedures.

The review revealed that there are areas where discrepancies exist between the UFSAR and the plant as-built configuration and operation.

Upon evaluation, it was determined that none of the identified discrepancies were safety significant.

Even though none of the discrepancies were found to be safety significant, current industry and regulatory initiatives indicated the need for a more extensive review ofthe UFSAR.

A revalidation project was started in October 1996.

The initial UFSAR revalidation effort is intended to provide an in-depth, line-by-line review of six plant systems and at least four related plant programs.

Discrepancies identified during the review will be addressed and the UFSAR updated to provide assurance that the reviewed sections accurately depict the plant as built configuration and operation.

This project is being performed with the assistance ofEPRI and in a manner consistent with the philosophy of NEI 96-05, Guidelines for Assessin Pro rams for Maintainin the LLi i

i.Wk illbpf di d

ihbbhdp instructions.

) /~

I

Attachment to AEP:NRC:1257 Page 51 The purpose of this project is to verify that the plant design and operating processes appropriately reflect the information and requirements contained in the UFSAR and that when changes are made to the plant design or operating practices, the UFSAR is revised in an appropriate and timely manner.

In addition, it is our intent to resolve any identified inconsistencies and to ensure that appropriate and effective program mechanisms are in place to maintain a high level of consistency in the future.

Initialproject activities willentail an in-depth, line-by-line review ofsix representative plant systems and at least four programs associated with the implementation of plant design, procedural, and regulatory changes.

The review willinvolve an assessment of relevant technical aspects

[e.g.,

mechanical equipment, electrical power supply, supporting and initiating instrumentation and controls] of the systems to be reviewed as documented within the UFSAR.

Emphasis willbe on information and data related to tests, configuration description, calibrations, operational modes, operating limits, and functional performance statements.

Systems were selected on the basis ofmultiple criteria, including risk importance, status of related DBDR project, previously identified concerns, and the nature and extent of interactions with other systems.

Following the review of internal consistency, the information in the UFSAR will be compared with similar information in other plant documents.

Following is a list of typical documents expected to be used in the UFSAR review.

~

plant procedures

~

operations drawings

~

technical specifications

~

DBDs

~

system descriptions

~

engineering drawings

~

facility database

~

plant setpoint documents

~

engineering documents

~

QAPD Westinghouse documentation

~

AEPSC analyses

~

vendor documentation

~

audit findings walkdown information, observations, etc.

~

NRC inspection reports To supplement the review function, project personnel will conduct interviews with engineering personnel to more fullyunderstand the design history ofthe system and the operational modes.

When practical, project team personnel may conduct independent walkdowns of systems to validate that the documented information is consistent with the as-built status of the system.

Attachment to AEP:NRC:1257 Page 52 In addition to the system reviews, the processes that control changes to the plant licensing basis, plant design, and operating procedur'es willbe examined.

The manner in which any such changes are documented in the UFSAR will also be reviewed. If changes to these processes are identified, appropriate corrective actions willbe initiated.

The processes to be reviewed were selected to provide assurance that changes in the design and operation of Cook Nuclear Plant will be appropriately evaluated and accurately documented in the UFSAR. As a minimum, the following processes willbe reviewed during the initial phase of the project:

~

UFSAR updating process

~

10 CFR 50.59 review process

~

design change process operating procedure change process Screening of identified inconsistencies will be performed to determine if the discrepancy needs to be treated in accordance with our corrective action program.

CRs will be written and processed in accordance with established procedures described in the response to question (d).

Items requiring follow-up actions will be tracked and managed to final resolution.

To the extent practicable, project findings that require revision to the UFSAR willbe included in the July 1997 UFSAR submittal to the NRC.

The resolution of open items may continue beyond the July 1997 UFSAR update, if necessary.

Additional efforts regarding UFSAR revalidation will depend on the results of the program described above.

Subsequent activities will be performed if necessary to ensure corrective actions are comprehensive.

rt

~-e 0

~

~ 4.

I'