ML20046D341

Forwards in Final Form,Numarc 93-01, Industry Guideline for Monitoring Effectiveness of Maint at Npp,May 1993, for Use & Info

ML20046D341
Person / Time
Issue date:	05/19/1993
From:	Correia R Office of Nuclear Reactor Regulation
To:	Zech G Office of Nuclear Reactor Regulation
References
NUDOCS 9308180091
Download: ML20046D341 (2)

Text

{{#Wiki_filter:rr - \\ Y~ % y May 19, 1993 MEMORANDUM FOR: Gary G. Zech, Chief Performance and Quality Evaluation Branch Division of Licensee Performance and Quality Evaluation FROM: Richard P. Correia, NRC Coordinator for NRC/NUMARC Maintenance Interactions Performance and Quality Evaluation Branch Division of Reactor Inspections and Licensee Performance

SUBJECT:

NUMARC MAINTENANCE RULE GUIDELINE, 93-01 NUMARC has forwarded in final form, NUMARC 93-01, Industry Guideline for Monitorina the Effectiveness of Maintenance at Nuclear Power Plants. May 1993 and is enclosed for your use and information. NUMARC revised sections of the guideline that contain information on Inherent Reliability, Risk Significant SSCs and Use of Industry Operating Experience. The enclosed cover letter from NUMARC to J.H. Sniezek, dated May 13, 1993, includes a brief description of these revisions and identifies the specific guideline sections that were changed. RES is in the final stages of completing Regulatory Guide 1.160, Monitorina the Effectiveness of Maintenance at Nuclear Power Plants, which will endorse NUMARC 93-01 as providing acceptable methods for complying with the provisions of the maintenance rule,10 CFR 50.65. Regulatory Guide 1.160 is scheduled to be issued in June 1993. >h. ORIGiKlAQMWrg-g GARv 9 2ECH Richard P. Correia, NRC Co'ordinator for NRC/NUMARC Maintenance Interactions Performance and Quality Evaluation Branch Division of Reactor Inspections and Licensee Performance

Enclosures:

As stated cc: See next page DISTRIBUTION: RPEB RF Central Files PDR R.Newlin (OPA) DFC SEND SB:REPD:DRIL NAME TO RCorrica:cct DATE PDR7 b d /93 / /93 / /93 / /93 / /93 COPY 7 s No Yes No Yes No Yes No Yes No Yes No OTTICIAL RECORD COPY Docunent Name: NUMARC3.PDR /f i PDR REVGP ERGNUMRC b /) i 9308160091 930519 PDR 3-110 0 0 3 3 5 E E E U S tCUiW x [/I' ( Ruam me

m ,_q T' t Gary G. Zech cc: T.Murley F.Miraglia J.Partlow D.Crutchfield E.Rossi R.Zimmerman G. Grant 0.Rothberg M. Ring T.Stetka T.Foley C.Petrone P.0'Reilly C. Johnson (RES) A.Serkitz C. Grimes C.Berlinger 0.Chopra W. Travers S.Newberry J.Sharkey F.Akstulewicz S.Reynolds B.Borchardt J.N. Wilson D.Trimble E.Doolittle J.Scarborough A.Vietti-Cook E.McKenna V

'Qrl X g-! ^7 1 K 3 YI } (1 l NUCLEAR MANAGEMENT AND RESOURCES COUNCIL j 1776 Eye S*eet NW.. Sude 300. Washington DC 20006-3706 i (202)872-1280 j l Thomas E.Dplon Vce Prescent & Deector 'i opecons Monocememo,e May 13,1993 6 se,ocn semees omsm l Mr. James H. Sniezek Deputy Executive Director l Nuclear Reactor Regulation, Regional Operations and Research Office of the Exceutive Director for Operations 1 U.S. Nuclear Regulatory Commission Washington, DC 20555 1.i

Dear Mr. Sniezek:

We have reviewed the proposed changes to NUMARC 93-01, Industry Guideline l for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, provided in U you letter of April 28,1993, and have addressed them in the following manner: 1. Inherent Reliabilire - The concept ofinherent reliability has been retained in the j guideline. However, in order to address the NRC concern, the fourth paragraph j under Section 9.3.3 has been modified to address the failure of an SSC that had j been designated as inherently reliable. 1 2. Risk Signi/lcant SSCs - The NRC change was incorporated as proposed. - Additionally, we have modified the first paragraph of Section 9.3.1 to separate the methods for developing risk significant criteria and the sources that could be used to monitor risk significant performance. j l 3, Use ofindustry operating experience - Part af the NRC proposed change was ) incorporated. 'Ihe sentence on pages 9 and 11 that were proposed for deletion I have been removed. :The wording in Section 12.2.2 was not added to Sections - 8.4.1.2 and 8.2.1.5. The words in Section 12.2.2 dealing with industrywide. operating experience are used in connection with the periodic assessment. The j words on industrywide operating experience in Sections 8.2.1.4 and 8.2.1.5 are j used in connection with determining the SSCs to be included under the scope of-j 1 !o q f:y-lf?$ 3 1

4, Mr James H. Sniezek May 13,1993 Page 2 l the Maintenance Rule. Therefore, we concluded that adding the words from Section 12.2.2 would be inappropriate for Sections 8.2.1.4 and 8.2.1.5. Additionally, in order to ensure that the NRC Regulatory Guide and industry guideline are consistent, we have added a new paragraph to Section 8.2.1. This paragraph addresses the issue of the switchyard and is taken directly from the proposed regulatory guide that the NRC staff discussed with the ACRS on April 16,1993. We have incorporated the above referenced changes into NUMARC 93-01 and enclose the guideline, in its final form, for your use. Please note that the guideline is no longer considered a draft document. The final document is numbered as NUMARC 93-01, with the date of May 1993. Subsequent revisions, as necessary, will be noted as NUMARC 93-01, Revision XX, with the appropriate month and year. Should you have any questions regarding this information, please contact me or l Warren Hall. Sincerely, [' I @/4) .A W Thomas E. Tipton TET/WJH:sp Enclosure ? e l i E

i o NUMARC 93-01 P r Industry Guideline for Monitoring the Effectiveness of f Maintenance at Nuclear Power Plants ) May 1993 ) l 4 Nuclear Management and Resources Council,.Inc. 1776 Eye Street, N.W. Washington, DC 20006 i q 3bMOd4

..E s a INDUSTRY GUIDELINE.FOR MONITORING THE EFFECTIVENESS OF ~ MAINTENANCE AT NUCLEAR POWER PLANTS - l MAY 1993 4 .x

~ 1, ~ ACKNOWLEDGEMENTS This guidance document, Industrv Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, NUMARC 93-01, was developed by the NUMARC Maintenance Working Group, Ad Hoc Advisory Committees for the Implementation of the Maintenance Rule, and an Ad Hoc Advisory Committee (AHAC) for the Verification and Wiidation of the Industry Maintenance Guideline. We appreciate the direct participation of the many utilities who contributed to the initial r development of the guideline and the panicipation of the balance of the industry who reviewed and submitted comments to improve the document clarity and consistency. The dedicated and timely effort of the many AHAC participants, including their i management's support of the effort, is greatly appreciated.- j NUMARC also wishes to express its appreciation to the Institute of Nuclear Power l Operations (INPO), and the Electric Power Research Institute (EPRI) who devoted i considerable time and resources to the development and verification and validation of the j industry maintenance guideline. l i t y i i i ) NOTICE Neither Nuclear Management and Resources Council, nor any ofits employees, members, l supporting organizations, contractors or consultants make any warranty, expressed or i implied, or assume any legal responsibility for the accuracy or completeness of, or assume any liability for damages resulting from any use of, any'information apparatus, method, or process disclosed in this report or that such may not infringe privately owned l rights. ~--

.T 3 FOREWORD On July 10,1991, the NRC publishc5 in the Federal Register (56 Fed. Reg. 31324) its final Maintenance Rule entitled, " Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants." In the Supplementary Information published with the notice, the Commission stated that it, " believes that effectiveness of maintenance must be assessed on an ongoing basis in a manner which ensures that the desired result, reasonable assurance that key structures, systems, and components (SSCs) are capable of performing their intended function, is consistently achieved." The importance of proper maintenance to safe and reliable nuclear plant operation has long been recognized by the nuclear utility industry and the Nuclear Regulatory Commission (NRC). The industry, since 1982, has placed increased emphasis on improving maintenance because ofits importance in improving overall plant performance. The industry recognizes that good maintenance is good business and is not an option, but a necessity. Throughout this period, senior industry management has continued to assure the NRC ofits complete commitment to the goal ofimproved safety and reliability through better maintenance. This commitment to better maintenance is reflected in the efforts of the individual nuclear utilities, the Institute ofNuclear Power Operations (INPO), the Electric Power Research Institute (EPRI), the Nuclear Management and Resources Council (NUMARC), the four Vendor Owners' Groups and others. This commitment has resulted in improved maintenance facilities, enhanced training of maintenance personnel, increased emphasis on good maintenance work practices and use of procedures, better technical guidance, and tracking of equipment performance. It also includes the formation of special industry centers to assist with maintenance-related issues and applications (e.g., the Nuclear Maintenance Assistance Center). The industry's efforts have resulted in significant progress in improved maintenance that is demonstrated by many U.S. plants attaining world-class performance by all rrsasurements, including industry overall perfonnance indicators, and NRC inspections and reports. i This industry guideline has been developed to assist the industry in implementing the final Maintenance Rule and to build on the significant progress, programs and facilities established to improve maintenance. The guideline provides a process for deciding which of the many structures, systems, and components that make up a commercial nuclear power plant are within the scope of the Maintenance Rule. It then describes the process of establishing plant-specific risk significant and performance i ,e

i 1 t FOREWORD (continued) criteria to be used to decide if goals need to be established for specific structures, systems, trains and components covered by the Maintenance Rule that do not meet their performance criteria. It should be recognized that establishing performance criteria can be interpreted as establishing goals. However, as used in this guideline, the approach is to first establish an acceptable set ofperformance criteria and monitor the structures, systems, and components against those criteria. This is an ongoing activity. If performance criteria are not met, then goals are established to bring about the necessary improvements in performance. It is important to note that the word " goal" as used in this guideline is used only where performance criteria are not being met. This provides the necessary focus at all levels within the utility where additional attention is needed. The industry and the NRC recognize that effective maintenance provides reasonable assurance that key structures, systems, and components are capable of performing their intended function. The guideline provides focus on maintenance activities and manpower use to assure the performance of safety functions by maximizing the use of proven existing industry and individual plant maintenance programs and minimizing the dilution of critical resources to modify maintenance programs when established performance criteria are being met. t h ii

,t s EXECUTIVE

SUMMARY

This Executive Summary provides a brief review of the key elements of this guideline and describes the overall process for implementation. The Foreword to this guideline provides a perspective on the purpose and intent of the guideline. The Industry Guideline Implementation Logic Diagram (Figure 1) describes the process for implementing the Maintenance Rule. The numbers to the upper right of the activity or decision en the logic diagram correspond to the section in the guideline where the topic is discussed. Utilities are required to identify safety-related and nonsafety-related plant structures, systems, and components as described by (b)(1) and (b)(2) of the Maintenance Rule. For structures, systems, and components not within the scope of the Maintenance l Rule, each utility should continue existing maintenance programs. i As of July 10,1996, the implementation date of the Maintenance Rule, all SSCs that are within the scope of the Maintenance Rule will have been placed in (a)(2) and be part of the preventive maintenance program. To be placed in (a)(2), the SSC will have been determined to have acceptable performance. In addition, those SSCs with unacceptable performance will be placed in (a)(1)2 with goals established. This determination is made by considering the risk significance as well as the performance of the stmetures, systems, and components against plant-specific performance criteria. Specific performance criteria are established for those structures, systems, and 3 components that are either risk significant or standby mode ; the balance are monitored against the overall plant level performance criteria. The high pressure coolant injection system is an example of a system that is in a standby mode during normal plant operations and is expected to perform its safety function on demand. It should be recognized that the performance of the support systems (e.g., HVAC) may have a direct impact on the primary system's performance (e.g., availability). IThe text of the Maintenance Rule is included in this guideline as Appendix A and the methodology for selecting SSCs to be included within the scope of the rule is further described in Section 8.0 of this gugdeline.As used in this guideline, (a)(1),(a)(2), (a)(3), (b)(1), or (b)(2) refer to the para CFp 50.65. Refer to the Appendix B definition and examples of standby systems and iii

1 EXECUTIVE

SUMMARY

(continued) The process addressing (a)(1) inchides establishing goals for structures, systems, trains, or components that have not demonstrated acceptable performance. It should be noted that the key parameter is performance. Risk significant structures, systems, and components should be identified by using 4 an Individual Plant Examination, a Probabilistic Risk Assessment, critical safety functions (e.g., inventory), or other processes, provided they are systematic and documented. The performance of structures, systems, or components that are determined to not meet the performance criteria established by a utility shall be subjected to goal setting and monitoring that leads to acceptable performance. For those structures, systems, trains, or components requiring goal setting, it is expected that many goals will be set at the system level. In addition, train and component level goals should be established (Section 9.0) when determined appropriate by the utility. Performance of structures, systems, trains, or components against established goals will be monitored until it is determined that the goals have been achieved and performance can be addressed in (a)(2). Structures, systems, and components within the scope of the Maintenance Rule whose performance is currently determined to be acceptable will be assessed to assure that acceptable performance is sustained (Section 10.0). Although goals are established and monitored as part of(a)(1), the preventive maintenance and performance monitoring activities are part of(a)(2) and apply to the structures, systems, and components that are within the scope of the Maintenance Rule. An assessment of the overall effect on plant safety will be performed for structures, systems, and components that support plant safety functions when they are taken out of service for monitoring or preventive maintenance activities (Section 11.0). 5 Periodic performance assessment and monitoring will be implemented through utility specific programs that include, as appropriate, event cause determination, corrective action, consideration ofindustry operating experience, and trending (Section i 12.0). 4As used in this guideline the scope ofIPE includes both internal and external events. 5The assessment period will be on a refueling cycle basis, but in no case shall the assessment period exceed 24 months. A three month period after completion of the refueling outage will be allowed for data gathering and analysis. iv

.P s EXECUTIVE

SUMMARY

(continued) Sufficient data and information will be collected and retained so that the effectiveness of maintenance and monitoring efforts can be determined (Section 13.0). V

4 A ! 4 Y.p e 4 h 5 I* e I k h t b . 1 I 6 h A i \\ k ? I 9 P = k l h I* - s I " \\

• r i

b i - I h . 1 I i e P 4 h { J VI t. Ip L ). h

t i Figura 1

• ',"""'O' industry Guideline implementation

--""*S* Logic D!agram V 821.1 82.12 82.12 82.14 82.15 i N N ,g gary. he rusafwp ry g,y. Are SSCs reised SSCs No fundWe No reise SSOs No ,g,g ggg, t .s,a,,. ,,,,,,e - rueSSC m - Sa SSc .o,am ac.u.e relased? trarmert? EOPs? M8810 SRS? tsctaf Yes Nas Yee Yes M lf 8716 6716 untran tre scope of theIAsirsonance Rule Systerra, strutises, and M ND componerts tot entran appicable t k morreenarne 931 soape d tre 7 Mairsenance Rule prog w m I I rak eigev6 cant pectormava entena these SSCs ( Establish rmA saprutcara anena and 932 93.3 A's Es:abish, monitor, sed SSOs risk N @me podcaDy) piart

1. 9'uncart?

nwei pertoma'ce craena I es 93.3 gge, w w P"'i3"*N* rnantenaron and g meesx&e' cordneon etwatoneg 944 Nstorm root came arialysm, ckwempre cane d failure, ard take correctwe acton l 9 3 4 ard 9 4 4 g/ 3 as an faip) 1F 102i No w SSC lowet gaat r regared' w Perform approprare 7 mornenaros on SSCs Yes (a)ft) 941 M Emablishgoals ( 1022 g l

• M,", rom.

Y 947 Martor pedoma'oe T maceptable? to gon! No V y,, 9 42 V 9.. - we w orm,oa - A mat? d faitse, and take No correctsve action [ )f 944 N hb. )I detomare caane d failse-93 4 and 9 4 4 and take caractwe action SSC pad v92.-9.. mJ,.,,,

r. '

= Ssc w p

• *'" P"' d*

v"' i I ,,q,,ed' manananoe i g t., _p*'1"_*'* g vii

f l i T i s f f i l P 4 9 1 I b t i I T ? I t -t t t i [ 5t I t i i t-t k t t f-d t-k . i. i d .t i f t c Vill s p w

t s e TABLE OF CONTENTS FOREWORD.....................................................................................................................i EXEC UTIVE S UMMARY............................................................................................... iii

1.0 INTRODUCTION

..............................................................................................1 2.0 P URP O S E AND S C OPE........................................................................................ 1 3.0 RES P ON S I BILITY............................................................................................... 2 4.0 APPLICABILITY ...............................................................................................3 5.0 DEFINITIONS ..............................................................................................3 6.0 G ENERAL REQUIREMENTS........................................................................... 3 7.0 UTILIZATION OF EXI STING PROGRAM S...................................................... 4 8.0 METHODOLOGY TO SELECT PLANT STRUCTURES, SYSTEMS, AND C O MP ONENTS.......................................................................... 8.1 Reference ...............................................................................................5 8.2 Guidance ...............................................................................................5 8.2.1 S el ection of Plant SSCs.................................................................... 5 f 9.0 ESTABLISHING RISK AND PERFORMANCE CRITERIA / G OAL SETTING AND MONITORING.............................................................. 15 9.1 Reference .............................................................................................15 9.2 Guidance .............................................................................................15 9.3 Determining the SSCs Covered by (a)(1).................................................. 16 9.3.1 Establishing Risk Significant Criteria.................................. 16 9.3.2 Performance Criteria for Evaluating SSCs.......................... 21 9.3.3 Evaluating SSCs Against Risk Significant and Performance Criteria............................................................ 24 9.3.4 Determining Whether an SSC Level Goal is Required....... 25 9.4 G oal Setting and Monitoring...................................................................... 25 9.4.1 G oal S ettin g......................................................................... 26 B

TABLE OF CONTENTS (continued) 9.4.2 Moni torin g......................................................................... 2 8 9.4.3 Dispositioning of SSCs from (a)(1) to (a)(2)....................... 30 9.4.4 Unacceptable Performance or Failure Cause Determination l and Dispositioning SSCs from (a)(2) to. (a)(1).................... 30 ' j 9.4.5 - Maintenance Preventable Functional Failures (MPFFs)... 32 i 10.0 SSCs SUBJECT TO EFFECTIVE PREVENTIVE MAINTENANCE PROGRAMS .............................................................................................35 ], 10.1 Reference .............................................................................................35 i 10.2 Guidance ............................................................................................35 h 10.2.1 Performance of Applicable Preventive l Maintenance Activities...................................................... 3 6 10.2.2 Ongoing Maintenance Effectiveness Evaluation................. 37 j 11.0 EVALUATION OF SYSTEMS TO BE REMOVED FROM SERVICE............ 39 11.1 Reference ...........................................................................................39 11.2 Guidance .............................................................................................39 11.2.1 Identify Key Plant Safety Functions Applicable to the Pl ant D esi gn........................................................................ 4 0. 1 11.2.2 Identify SSCs That Support Key Plant Safety Functions.... 40 11.2.3 Assess and Control the Effect of the Removal i of SSCs from Service on Key Plant Safety Functions......... 41 j 12.0 PERIODIC MAINTENANCE EFFECTIVENESS ASSESSMENTS................. 43 - 12.1 Reference .............................................................................................43: j 12.2 Guidance .............................................................................................43 ji 12.2.1 Review of G oals (a)(1)...................................................... 43 12.2.2 Review of SSC Performance (a)(2)...................................... 43 12.2.3 Review ofEffectiveness of Corrective Actions................... 44 4 12.2.4 Optimizing Availability and Reliability for SSCs............... 44 ' 13.0 D O CUMENTATI ON........................................................................................ 4 7 1 13.1 General .............................................................................................47-13.2 Documentation of SSC Selection Process............................................ 47 13.2.1 Maintenance Rule Scoping................................................ 4 7 -l 13.3 Documentation of(a)(1) Activities..................................................... 4 7 j 13.4 Documentation of (a)(2) Activities.......................................................... 4 8 13.5 Documentation of Periodic Assessment................................................... 48 l i X 6 E s

I s TABLE OF CONTENTS (continued) 1 APPENDICES APPENDIX A The NRC Maintenance Rule............................................................................. A-1 APPENDIX B Maintenance Guideline Definitions.................................................................... B-1 i-APPENDIX C M ainten ance Guid eline A cronyms..................................................................... C-1 i APPENDIX D l Example of a System with Both Safety and Non-Safety Funetions - CVCS ..........................................................................................D-1 f 4 4

r i ' LIST OF ILLUSTRATIONS Figure Page 1 Industry Guideline Implementation Logic Diagram.............................................. vii t L 1 Y 1 I t b s X11 t

.t s i

1.0 INTRODUCTION

On July 10,1991, the final Maintenance Rule, " Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," was published by the Nuclear Regulatory Commission (NRC) in the Federal Register (56 Fed. Reg. 31321) as 10 CFR 50.65. The Maintenance Rule will become effective July 10,1996, thereby requiring full implementation by that date. The basis for proceeding to issue the Maintenance Rule as well as expectations for its implementation is described in the Supplementary Information 4 i that accompanied the notice. The Commission indicated that it is important for the NRC to have a regulatory framework in place that would provide a mechanism for evaluating i the overall continuing effectiveness oflicensees maintenance programs. The NRC's overall objective is that structures, systems, and components of nuclear power plants be maintained so that plant equipment will perform its intended function when required. The i Maintenance Rule (see Appendix A)is characterized as a performance-based rule i providing focus on results rather than programmatic adequacy. 2.0 PURPOSE AND SCOPE l l This guideline describes an acceptable approach to meet the Maintenance Rule. However, utilities may elect other suitable methods or approaches for implementation. This guideline does not address the many industry programs that have been put in place to upgrade maintenance and may be used when implementing the Maintenance Rule. For example, work planning and scheduling, preventive and corrective maintenance, maintenance procedures, training, post maintenance testing, work history, cause determination methods and other maintenance related programs are not discussed. 1 The major elements of this guideline include: Selecting the structures, systems, and components (SSCs)6 within the scope of the Maintenance Rule; Establishing and applying risk significant criteria; 6As used in this guideline, SSCs can mean

• structures, systems, and components," or " structures, systems, er components," depending on use. Where the guideline discusses the need to establish goals and monitoring, SSCs will include, as applicable, " structures, systems, trains, and/or components.

i 1 i

Establishing and applying performance criteria; Goal setting and monitoring of applicable SSCs to ensure plant and system l functions are reliably maintained and to demonstrate the effectiveness of maintenance activities; Considering the effects on overall plant safety which result from taking SSCs out of service to perform monitoring or preventive maintenance; Performing the periodic assessment ofperformance; and Documentation needed to support :mplementation of the Maintenance Rule. This guideline provides a process for deciding which of the many SSCs that make up a commercial nuclear power plant are included within the scope of the Maintenance Rule. It then describes the process of establishing plant-specific risk significant and performance criteria to be used to decide if goals need to be established for specific SSCs covered by the Maintenance Rule. It should be recognized that establishing performance criteria can be interpreted as establishing goals. However, as used in this guideline, the approach is to first establish an acceptable set of performance criteria and monitor the performance. If performance criteria are not met, then goals are established to bring about the necessary improvements in performance. The word " goal" as used in these guidelines is used only where perfonnance criteria are not being met. This provides the necessary focus at all levels within the utility where additional attention is needed. In most situations the goal will be identical to the performance criteria that the SSC's historical performance does not meet. Although goals are set and monitored as part of (a)(1), the preventive maintenance and performance monitoring activities are pan of (a)(2) and apply to SSCs that are within the scope of the Maintenance Rule. 7 I 3.0 RESPONSIBILITY Each utility will implement a plant-specific program to meet the intent of the Maintenance Rule. The purpose of this guideline is to assist in developing and implementing plant-specific programs. This guideline provides flexibility for individual t utility implementation.,

,r c 4.0 APPLICABILITY This guideline is applicable to utilities holding an operating license issued in accordance with 10 CFR 50.21(b) and 50.22.- Plants that are defueled with a possession only license will be govemed in accordance with the possession only license. Periodically, as a result of design changes, modifications to the plant occur that may affect the maintenance program. These changes should be reviewed to assure the maintenance program is appropriately adjusted in areas such as risk significance, goal setting, and performance monitoring.. i 5.0 DEFINITIONS The definitions in Appendix B of this guideline are provided to promote consistent. interpretation of the Maintenance Rule. The terms are defined to the extent possible in accordance with existing industry usage. 6.0 GENERAL REQUIREMENTS The Maintenance Rule issued on July 10,1991, requires that licensees: "...shall monitor the performance or condition ofstructures, systems, or components, against - licensee-establishedgoals, in a manner suficient toprovide reasonable assurance that such structures, systems, and components, as defined in paragraph (b), are capable of fulfilling their intendedfunctions. Such goals shall be established commmsurate with safety and, wherepractical, take into account industry-wide operating experience. When theperformance or condition ofa structure, system, or component does not meet established goals, appropriate corrective action shall be taken. (2) Monitoring as specified in paragraph (a)(1) ofthis section is not required. where it has been demonstrated that theperformance or condition ofa structure, system, or component is being efectively controlled through theperformance ofappropriate preventive maintenance, such that the structure, system, or component remains capable of performing its intendedfunction. :

h a. I t' (3) Performance and condition monitoring activities and associated goals and 1 preventive maintenance activities shall be evaluated at least annually taking into account, where practical, industry-wide operating experience. Adjustments shall be made where necessary to ensure that the objective ofpreventingfailures ofstructures, systems, and components through maintenance is appropriately balanced against the objective ofminimizing unavailability ofstructures, systems, and components due to monitoring orpreventive maintenance. Inperforming monitoring andpreventive maintenance activities, an assessment ofthe totalplant equipment that is out ofservice i should be taken into account to determine the overall ejfect onperformance ofsafety functions. " f 7.0 UTILIZATION OF EXISilNG PROGRAMS This guideline is intended to maximize the use of existing industry programs, studies, initiatives and data bases. I t 7The NRC has initiated a proposed rulemaking to change the performance assessment requirement from annually to once every refueling outage, but not to exceed 24 months (see 58 Fed. Reg.15303, March 22, i 1993). The proposed change has already been reflected in this guideline (see Footnote 5).

\\ j .t t ? 8.0. METHODOLOGY TO SELECT PLANT STRUCTURES. SYSTEMS. AND j COMPONENTS ij 8.1 Reference q 10 CFR 50.65 .i (b) The scope ofthe monitoringprogram specified in paragraph (a)(1) ofthis section shall include safety-related and nonsafety relatedstructures, systems, and components, asfollows: i (1) Safety-related structures, systems, or components that are relied upon to remainfunctional during andfollowing design basis events to ensure the integrity ofthe reactor coolantpressure boundary, the capability to shut down the reactor and maintain ] it in a safe shutdown condition, and the capability to prevent or mitigate the consequences ofaccidents that could result in potential ofsite exposure comparable to the 10 CFRpart 100 guidelines. l t (2) Nonsafety related structures, systems, or components: = a (i) That are relied upon to mitigate accidents or transients or are used in plant ' i emergency operatingprocedures (EOPs); or (ii) Whosefailure couldprevent safety-related structures, systems, and i componentsfromfulfilling their safety-relatedfunction; or (iii) Whosefailure could cause a reactor scram or actuation ofa safety-related system. 8.2 Guidante 8.2.1 Selection of Plant SSCs The utility must first determine which SSCs are within the scope of the Maintenance Rule by applying the screening criteria below and as presented in Figure 1. l For the purposes of this guideline, a system is any collection of equipment that is. l configured and operated to serve some specific plant function (e.g., provides water to the - ~ i : i

c.) steam generators, spray water into the containment, inject water into the primary system), 5 as defined by the terminology of each utility (e.g., auxiliary feedwater system, containment spray system, high pressure coolant injection system). { 1 The scope of the Maintenance Rule, as defined in 10 CFR 50.65(b), is limited to SSCs that directly affect plant operations,iegardless ofwhat organization actually performs the maintenance activities For example, electrical distribution equipment out to [ the first inter-tie with the offsite distribution system should be considered for comparison j with 50.65(b), and thereafter, possible inclusion under the scope of the Maintenance l Rule. Thus, equipment in the switchyard, regardless ofits geographical location, is l potentially within the scope of the Maintenance Rule. j Safety systems may perform not only safety functions but also other functions that j have no safety significance. For example, the system may be used to transfer water from l one part of the plant to another as well as provide additional safety functions. The safety-functions of SSCs are addressed by the Maintenance Rule. i EXAMPLES 8 OF SSCs THAT ARE WITHIN THE SCOPE OF THE -} MAINTENANCE RULE BUT CONTAIN COMPONENTS OR FUNCTIONS THAT l ARE NOT RELATED TO SAFETY AND MAY BE OUTSIDE THE SCOPE OF THE .l MAINTENANCE RULE i CHEMICAL VOLUME AND CONTROL SYSTEMS (CVCS)* -) i SAFETY FUNCTION-HIGH HEAD INJECTION NONSAFETY FUNCTION-PRIMARY LOOP CLEANUP L EMERGENCY CORE COOLING SYSTEM SAFETY FUNCTION-HIGH PRESSURE INJECTION NONSAFETY FUNCTION-FILL SAFETY INJECTION ACCUMULATORS SEE APPENDIX D FOR ADDITIONAL DETAILS l l c i L EAll examples are for illustration purposes only and may not be true for a specific plant. Each utility j should examine its own plant for specific applicability. e s L ^ i

. I s

i j 8.2.1.1 Safety-Related SSCs Are the safety-related SSCs relied upon to remain functional during and following. design basis events to ensure: j l The integrity of the reactor coolant pressure boundary; or j The capability to shutdown the reactor and maintain it in a safe shutdown condition; or i The capability to prevent or mitigate the consequences of accidents that couM result in potential offsite exposure comparable to 10 CFR Part 100 - Guidelines?- l 1 EXAMPLES OF AVAILABLE INFORMATION SOURCES OF SAFETY-RELATED SSCs ? FINAL SAFETY ANALYSIS REPORT (FSAR) ] i Q-LIST MASTER EQUIPMENT LIST l A yes answer to any of the above will identify that the SSCs are within the scope of the Maintenance Rule. i 8.2.1.2 Nonsafety-Related SSCs that Mitigate Accidents or Transients Are the nonsafety-related SSCs relied upon to mitigate accidents or transients? j a This step requires utilities to determine'which nonsafety SSCs are needed to mitigate accidents or transients as described in the plant's Final Safety Analysis Report (FSAR). a

~. -r, i EXAMPLES OF NONSAFETY SSCs THAT ARE USED IN FSAR ANALYSIS TO MITIGATE ACCIDENTS l CONDENSATE STORAGE TANK (SUPPLY TO AUXILIARY 4 FEEDWATER) FIRE SUPPRESSION SYSTEM BORIC ACID TRANSFER SYSTEM USED FOR EMERGENCY BORATION i AND MAKE-UP TO THE REFUELING WATER STORAGE TANK i A yes answer will identify that the SSCs are within the scope of the Maintenance 1 Rule. 8.2.1.3 Nonsafety-Related SSCs that are used in Emergency Operating Procedures Are the nonsafety-related SSCs used in plant Emergency Operating Procedures (EOPs)? j i This step requires an evaluation be performed to identify important nonsafety-related SSCs under utility control that are used in EOPs. For a nonsafety-related.SSC to be considered important, it must add significant value to the mitigation function of an EOP by providing the total or a significant fraction of the total functional ability required to mitigate core damage or radioactive release (e.g., required quantity of water per minute 3 to fulfill the safety function). Nonsafety-related SSCs used in EOPs that are under the _} control of a utility and are important as established above are within the scope of the L - Maintenance Rule. Utilities should establish maintenance practices for important nonsafety-related SSCs used in EOPs consistent with their importance. i i Some examples of nonsafety-related SSCs used in EOPs that are not important as described above are as follows: instrumentation that provides redundant local _ information and does not provide a control function; fire hose capacity capable of - l supplying only a small fraction of that required to mitigate the accident; and portable emergency equipment that is available from off-site sources not under utility control. i Conversely, if the fire hose provides a large fraction of that required to mitigate the j accident, it should be under the scope of the Maintenance Rule. i,

t y 8.2.1.4 Nonsafety-Related SSCs Whose Failure Prevents Safety-Related SSCs from Fulfilling their Safety-Related Function j Will the failure ofnonsafety-related SSCs prevent safety-related SSCs from fulfilling their safety-related function? This step requires that each utility investigate the systems and system interdependencies to determine failure modes of nonsafety-related SSCs that will directly affect safety-related functions. As used in this section of the guideline, the term "directly" applies to nonsafety-related SSCs: 1 Whose failure prevents a safety function from being fulfilled; or Whose failure as a support SSC prevents a safety function from being fulfilled. A yes answer identifies that the nonsafety-related SSCs are within the scope of the Maintenance Rule. A utility should rely on actual plant-specific and industrywide operating experience, prior engineering evaluations such as PRA, IPE, IPEEE, environmental l qualification (EQ), and 10 CFR 50 Appendix R analyses. Industrywide operating experience is reviewed for plant-specific applicability and, where appropriate, is included in utility specific programs and procedures. It is appropriate to use this infonnation to the extent practical to preclude unacceptable performance experienced in the industry from being repeated. An event that has occurred at a similarly configured plant should be considered for applicability to the reviewing utility. The determination of hypothetical failures that could r$sult from system interdependencies but have not previously been experienced is not required. Failures subsequent to implementation of this guideline shall be addressed in the determination of cause, corrective action, and performance monitoring as described in Sections 8.0,9.0 and 10.0. , 1

i.1 1 EXAMPLES OF NONSAFETY-RELATED SSCs WHOSE FAILURE PREVENTS i SAFETY-RELATED SSCs FROM FULFILLING THEIR SAFETY-RELATED FUNCTION i i J A NONSAFETY-RELATED INSTRUMENT AIR SYSTEM THAT OPENS j CONTAINMENT ISOLATION VALVES FOR PURGE AND VENT A NONSAFETY-RELATED FIRE DAMPER IN STANDBY GAS .i TREATMENT SYSTEM WHOSE FAILURE WOULD IMPAIR AIR FLOW j i IN SOME CASES THE CONDENSATE STORAGE TANK IS NOT SAFETY-RELATED BUTIS A SOURCE OF. WATER FOR ECCS FAILURE OF A NONSAFETY SYSTEM FLUID BOUNDARY CAUSING LOSS OF A SAFETY SYSTEM FUNCTION (e.g., HEATING SYSTEM l PIPING OVER A SAFETY-RELATED ELECTRICAL PANEL) l 8.2.1.5 Nonsafety-Related SSCs Whose Failure Causes Scrams or Actuates 1 Safety Systems Will failure of the nonsafety-related SSCs cause a reactor SCRAM or actuation of safety-related systems? ) i This step requires utilities to determine, on the basis of utility-specific and industrywide operating experience, those nonsafety-related SSCs whose failure causes a l reactor scram or actuation of a safety-related system. l A yes answer identifies that the SSCs are within the scope of the Maintenance j Rule. j A utility should rely on actual plant-specific and industrywide operatmg i experience, prior engineering evaluations such as PRA, IPE, IPEEE, environmental l qualification (EQ), and 10 CFR 50 Appendix R analyses. ( Industrywide operating experience is reviewed for plant-specific applicability and, where appropriate, is included in utility specific programs and procedures. It is appropriate to use this information to the extent practical to preclude unacceptable l l ! i I

8 performance experienced in the industry from being repeated. An event that has occurred j at a similarly configured plant should be considered for applicability to the reviewing utility. The determination of hypothetical failures that could result from system interdependencies but have not been previously experienced is not required. Failures subsequent to implementation of this guideline shall be addressed in the determination of cause, corrective action, and performance monitoring as described in Sections 8.0,9.0 and 10.0. EXAMPLES OF FSAR NONSAFETY-RELATED COMPONENT TRANSIENT INITIATORS TURBINE TRIPS LOSS OF FEEDWATER LOSS OF INSTRUMENT AIR EXAMPLES OF NONSAFETY-RELATED SSCs WHOSE FAILURE CAN CAUSE A TRIP TURBINE / GENERATOR NON-ESF BUSSES THAT POWER REACTOR COOLANT PUMPS ROD CONTROL SYSTEM SUCH THAT MULTIPLE RODS DROP INTO THE CORE l

I [ i-! ~ t .j EXAMPLE OF NONSAFETY-RELATED SSCs WHOSE FAILURE CAN CAUSE A SAFETY SYSTEM ACTUATION i 1 RADIATION MONITOR (e.g., ISOLATES CONTROL ROOM VENTILATION) j i 8.2.1.6 SSCs Outside the Scope of the Maintenance Rule SSCs that do not meet the above criteria are outside the scope of the Maintenance Rule. These SSCs will continue to have appropriate maintenance activities performed on them. For these SSCs, the degree af maintenance attention will be dependent upon [ factors such as the consequence of SSC failure on power production and economic importance. t-i .[ i I f i i f l L F e l

.f EXAMPLES OF CATEGORIES OF EQUIPMENT THAT ARE OUTSIDE THE SCOPE OF THE MAINTENANCE RULE UNLESS THEY MEET THE GUIDANCE OF PARAGRAPHS 8.2.I.2,8.2.1.3, 8.2.1.4 or 8.2.1.5 FIRE PROTECTION SSCs FIRE PROTECTION SSCs THAT ARE IDENTIFIED UhTER 10 i CFR PART 50, APPENDIX R REQUIREMENTS ARE t NONSAFETY-RELATED AND THEREFORE ARE NOT INCLUDED WITHIN THE SCOPE OF THE MAINTENANCE RULE. SEISMIC CLASS 11 SSCs INSTALLED IN PROXIMITY WITH l SEISMIC CLASS I SSCs SEISMIC CLASS 11 SSCs ARE NOT INCLUDED WITHIN THE SCOPE OF THE MAINTENANCE RULE. SECURITY SSCs THE SSCs USED FOR THE SECURITY OF NUCLEAR POWER j PLANTS ARE NONSAFETY AND THEIR MAINTENANCE PROVISIONS ARE ADDRESSED SEPARATELY UNDER THE REQUIREMENTS OF 10 CFR PART 73. SECURITY SSCs ARE l NOTINCLUDED WITHIN THE SCOPE OF THE MAINTENANCE RULE. ~ EMERGENCY FACILITIES DESCRIBED IN THE EMERGENCY PLAN EXAMPLES INCLUDE THE TECHNICAL SUPPORT CENTER ' (TSC), OPERATIONS SUPPORT CENTER (OSC), A ND OTHER EMERGENCY OPERATING FACILITIES (EOFs).

a p g,py, p ./J

1. MW A.dAwi.-

AA-##r'4-e.-eq# d' 8-

1. -+ha-S4 L,Mr ArEM lA4 J

-.'+4-S Mds +394 M*md-A A-O i M A ed $iM..ra.A A h4M M4>A J f A A Ar 4 - M S u Adi' 4 N b &^30d-g I 4 t S / t i ' d i W t i . l e 'f n ]~ I i i i 1 h i-I. 4 - t 4 h s ? h 9 t w. g - I s 5 4 .k 1, d-a I d' a. . I g i a s 9 4 g.. N, - 9 e l \\ e w. "h g g., h ]. J. .O, ^ . l f 14 - i ' N t d' t

• -t i

..~.- - 5

.I 1 9.0 ESTABLISHING RISK AND PERFORMANCE CRITERIA / GOAL SETTING AND MONITORING l l 9.1 Reference 10 CFR 50.65 (a)(1) i Each holder ofan operating license under !f 50.21 (b) or 50.22 shall monitor the l performance or condition ofstructures, systems, and components against licensee established goals, in a manner suf]Icient to provide reasonable assurance that such structures, systems, and components, as defined inparagraph (b), are capable offulfilling l their intendedfunctions. Such goals shall be established commensurate with safety and, wherepractical, take into account industry-wide operating experience. When the performance or condition ofa structure, system, or component does not meet established goals, appropriate corrective action shall be taken. 1 9.2 Guidance Once the selection of those SSCs determined to be within the scope of the Maintenance Rule (Section 8.0) has been completed, it is then necessary to establish risk 9 significant and performance criteria to initially determine which SSCs must have goals established and monitoring activities performed in accordance with (a)(1). For SSCs that l do not meet performance criteria, goals are established commensurate with an SSCs safety significance and performance. Monitoring the performance of the SSCs against established goals is intended to provide reasonable assurance that the SSCs are proceeding to acceptable performance. All SSCs determined to be within the scope of the Maintenance Rule are subject to l an effective PM program as indicated by (a)(2)(see Section 10.0). SSCs that are within the scope of(a)(2) could be included in the formal PM program, be inherently reliable (e.g., visual inspection during walkdowns to meet licensee requirements that already exist), or be allowed to run to failure (provide little or no contribution to system safety function). When SSCs in (a)(2) do not perform acceptably, they are evaluated to determine the need for goal setting and monitoring under the requirements of(a)(1). 9 Performance of SSCs includes availability, reliability, or condition as appropriate. _ _ -

t l 9.3 Determining the SSCs Covered by (s)(1) i This section explains how to determine which SSCs that are under the scope of the Maintenance Rule will have goals and monitoring established in accordance with (a)(1). Establishing both risk significant criteria (Section 9.3.1) and performance criteria (Section 9.3.2) is necessary to provide a standard to measure the performance of SSCs (Section 1 9.3.3). 9.3.1 Establishing Risk Significant Criteria Risk significant criteria should be established to determine which of the SSCs are l risk significant. Risk significant criteria should be developed using any of the following methods: Individual Plant Examination (IPE), Plant-specific Probabilistic Risk Assessment (PRA), Critical safety functions (e.g., vessel inventory control) system performance

resew, Other appropriately documented processes.30 Utilities may find the following sources provide useful data for monitoring risk significant SSC performance:

Preventive Maintenance (PM) program results, f Evaluation ofindustrywide operating experience, or Generic failure data. Most of the methods described below identify risk significant SSCs with respect to core damage. It is equally imponant to identify as risk significant those SSCs that. t prevent containment failure or bypass that could result in an unacceptable release. Examples might include the containment spray system, containment cooling system, and 10The following NUREGs describe other processes that could be used for this purpose: NUREG/CR-5424, " Eliciting and Analyzing Expert Judgement"; and NUREG/CR-4692, PLG-0533, " Methods for the Elicitation and Use of Expert Opinion in Risk Assessment." 1 ! i L i

,,I ~ valves that provide the boundary between the reactor coolant system and low pressure systems located outside containment. f t Examples of risk determination methods are described in NUREG/CR-5695, "A Process for Risk-Focused Maintenance." Other methods that can assist a utility in identifying risk significant SSCs and enable appropriate maintenance prioritization and goal setting are included in: NUREG/CR-4550, " Analysis of Core Damage Frequency"; NUREG/CR-3385, " Measures of Risk Importance"; NUREG/CR-5692, " Generic Risk l Insights for General Electric Boiling Water Reactors"; and NUREG/CR-5637, " Generic ( Risk Insights for Westinghouse and Combustion Engineering Pressurized Water Reactors". i Work done to date on symptom-based emergency operating procedures as well as IPE vulnerability assessments may be used to establish risk significant criteria to screen SSCs, and to select those SSCs required to fulfill a critical safety function. An SSC could be risk significant for one failure mode and non risk significant for. others. An example of an SSC that is risk significant for one failure mode and non-risk significant for another is as follows: Blowdown valves on steam generators perform a safety function to close on isolation. However, the open position function is to maintain water chemistry which is a nonsafety function. Additionally, many SSCs that are functionally important in modes other than power operation, such as shutdown, may be .l identified by some normally employed analysis methods (e.g., Engineering Analysis, IPE/PRA, etc.). These should be determined by an assessment of their functional i importance in other modes and a review of events and failures that have occurred during these modes. Entry into a Technical Specification Limiting Condition for Operation, although important, is not necessarily risk significant. i Risk significant SSCs can be either safety-related or nonsafety-related. There are I risk significant systems that are in a standby mode and when called upon to perform a l safety function, are required to be available and reliable (e.g., high pressure coolant injection). i Another methodology that could be used to establish risk significance is a reliability approach to maintenance. Plants which have completed reliability based i f maintenance assessments for any systems that are risk significant could find data that supports the determination of SSCs necessary to perform critical safety functions. These l ! l l ? L

t i reliability assessments should indicate that functional importance is considered for all plant modes, plant failure experience has been reviewed and summarized, and potential failures have been identified and their likelihood considered. A reliability based maintenance approach can also provide the basis for a preventive maintenance activity, including component monitoring. Risk significant SSCs may be determined in accordance with a PRA similar to that used in response to GL 88-20, " Individual Plant Examination for Severe Accident Vulnerabilities." The assumptions developed for GL 88-20 could also be used in the calculation of the total contribution to core damage frequency (CDF) and 10 CFR Part 4 100 type releases as a basis for establishing plant-specific risk significant criteria. If a utility selects a method based on PRA to establish risk significance, it should begin the process by assembling a panel ofindividuals experienced with the plant PRA and with operations and maintenance. The panel should utilize their expenise and PRA insights to develop the final list of risk significant systems. NUREG/CR-5424'or NUREG/CR-4692 may be used as a guideline in structuring the panel. The panel's judgments should include consideration of the three specific risk importance calculational methods listed and described in Sections 9.3.1.1,9.3.1.2, and 9.3.1.3. It should be noted that each of these methods will identify a different set of SSCs based upon differing concepts ofimportance. Each method is useful in providing insights into risk significant SSC selection, and consideration should be given to using all of them in the decision . making process. Many currently used PRA software packages provide information on Fussell-Vesely Importance and Risk Reduction Importance. Not all software includes techniques that utilize accident sequence failure combinations (cut sets) and some adaptation of the software may be required to appropriately establish risk significant SSCs. The use of an expert panel would compensate for the limitations of PRA + implementation approaches resulting from the PRA structure (e.g., model assumptions, treatment of support systems, level of definition of cut sets, cut set truncation, shadowing effect of very large (high frequency) cut sets, and inclusion ofrepair or restoration of failed equipment) and limitations in the meanings of the importance measures. i i t ! I

9.3.1.1 Risk Reduction Worth The following are two alternative methods for applying Risk Reduction Wonh" techniques in the identification ofrisk significar.t SSCs. The two methods are similar, but the first normalizes the Risk Reduction Worth by the sum of all maintenance related Risk Reduction Worths, while the second uses Risk Reduction Wonh compared to overall Core Damage Frequency. Method A: An SSC would probably be considered risk significant ifits Risk Reduction Importance Measure contributes to at least 99.0 percent of the cumulative Risk Reduction Importances. Specifically, risk significant SSCs can be identified by performing the following sequential steps: Calculate the Risk Reduction Worth for the individual SSCs and rank in decreasing order. Eliminate Risk Reduction Worths that are not specifically related to maintenance (e.g., operator error and external or initiating events). Normalize the individual SSC Risk Reduction Worths by the sum of all the Risk Reduction Worths related to maintenance. These are the Risk Reduction Importance Measures for the individual SSCs, ranked by their contribution and expressed as a percentage. SSCs that cumulatively account for about 99.0 percent of the sum of Risk Reduction Importances related to maintenance should be provided to the expert panel as an input in risk determination. l I Method B: Risk Reduction Worth may be used directly to identify risk significant SSCs. An SSC would probably be considered risk significant ifits Risk Reduction Worth exceeds 0.5 percent of the overall Core Damage Frequency (Risk Reduction Worth >1.005). These may be identified by performing the following sequential steps: IIRisk Reduction Worth is the decrease in risk if the SSC is assumed to be perfectly reliable for all failure modes (e.g., failure to start and failure to run). NUREG/CR-3385, " Measures of Risk Importance and their Applications."

i Calculate the Risk Reduction Worth for the individual SSCs and rank in decreasing order. Eliminate Risk Reduction Worths that are not specifically related to maintenance (e.g., operator error and external or initiating events). SSCs whose Risk Reduction Worth is > 0.5 percent of the overall Core Damage Frequency should be provided to the expert panel as an input in risk determination. 9.3.1.2 Core Damage Frequency Contribution [ An SSC would probably be considered risk significant ifit is included in cut sets that, when ranked in decreasing order, cumulatively account for about 90 percent of the Core Damage Frequency. Specifically, risk significant SSCs can be identified by performing the following sequential steps: Identify the cut sets that account for about 90 percent of the overall Core Damage Frequency. Eliminate cut sets that are not related to maintenance (e.g., operator error and external or initiating events). SSCs that remain should be provided to the expert panel as an input in risk determination. 4 9.3.1.3 Risk Achievement Worth 2 shows at least a doubling of the overall l l An SSC whose Risk Achievement Worth: Core Damage Frequency should be provided to the expert panel as an input in risk determination. i 12 Risk Achievement Wonh is the increase in risk if the SSC is assumed to be failed for all failure modes (e.g., failure to start and failure to run). NUREG/CR-3385, " Measures of Risk Importance and their Applications."

9.3.2 Performance Criteria for Evaluating SSCs l Performance criteria for evaluating SSCs are necessary to identify the standard 4 against which performance is to be measured. Criteria are established to provide a basis for determining satisfactory performance and the need for goal setting. The actual performance criteria used should be SSC availability, reliability, or condition. The performance criteria could be quantified to a single value or range of values. For example, if a utility wanted to maintain an availability of 95 percent for a particular system because that was the assumption used in the PRA, then the 95 percent value would i be the performance criteria. If the performance criteria are not met, then a goal could be set at a value equal to or greater than 95 percent. Additionally, an example of condition 3 as a performance criteria would be a case in which a utility wanted to maintain the wall thickness of a piping system to comply with the ASME code requirements. The utility would establish some acceptable value for wall thickness and monitor by ultrasonic testing or other means. t If performance criteria are not met, the basis for the criteria should be reviewed to determine if goal setting is required and the appropriate goal value established. It should be recognized that while goals and performance criteria may have the same value and units, goals are only established under (a)(1) where performance criteria are not being met and are meant to provide reasonable assurance that the SSCs are proceeding to acceptable performance. j Specific performance criteria are established for all risk significant SSCs and for non-risk significant SSCs that are in a standby (not normally operating) mode. Standby systems (either risk significant or non risk significant and safety-related or nonsafety-related) may only affect a plant level criteria if they fail to perform in response to an actual demand signal. This means that a standby system could be failed but its inability to perform its intended function is not known until it is required to perform in response to a demand signal or during testing (e.g., a surveillance test to determine operability). The mode in which most standby system failures are observed is during testing. Because plant transients occur less frequently, failure on demand provigles minimal information. For this reason, a plant level criteria is not a good indicator or measurement of performance. The performance criteria for a standby system can be qualitatively stated as " initiates upon demand and performs its intended function." The reliability of a standby i i

a l system to satisfy both criteria can be quantitatively established as calculated in PRA methodology. Plant level performance criteria are established for all remaining non-risk significant normally operating SSCs. However, there may be some non-risk significant SSCs whose performance cannot be practically monitored by plant-level criteria. Should this occur, other performance criteria should be established, as appropriate (e.g., i repetitions of safety function faibres attributable to the same maintenance-related cause). All risk significant SSCs determined to have acceptable performance are placed in (a)(2) and monitored against performance criteria established for risk significant SSCs. An example of the process is as follows: SSC is determined to be in scope of Maintenance Rule; SSC is determined to be risk significant; SSC performance criteria are established (e.g., the criteria could be an acceptable level of availability / unavailability or reliability); SSC performance is determined to meet the established criteria; and SSC performance is monitored under (a)(2) against performance criteria established for risk significant SSCs. Those non-risk significant SSCs that are in standby and have acceptable performance are also addressed under (a)(2) and may be monitored by evaluating surveillance performance. ) Risk significant SSCs and non-risk significant SSCs that are in standby that are determined to have unacceptable performance, as defined in Section 93.4, are addressed under (a)(1), have goals established, and performance monitored to those goals. Remaining non-risk significant SSCs (those normally operating) are addressed under (a)(2) and performance is monitored against plant level criteria. In the event of a failure to one of these SSCs or plant level performance criteria is not met, a cause determination will be conducted and a decision made to address the SSC under (a)(1} and establish a goal and monitor performance to that goal or continue to address performance under (a)(2) after taking corrective action. - l

i - ? Overall plant level performance criteria are broad based and are supported by many SSCs that could be either safety or nonsafety-related. Since equipment f performance is a major contributor to meeting plant level performance criteria, it can be useful in determining maintenance program effectiveness. j 33 Plant level performance criteria should include, the following: j Unplanned automatic reactor scrams per 7000 hours critica!; Unplanned capability loss factor; and Unplanned safety system actuations. Other performance criteria may include indicators similar to those recognized by the NRC, industry organizations, or established by the utility to monitor SSCs that cannot be practically monitored by plant-level performance criteria. Each utility should evaluate its own situation when determining the quantitative value for its individual plant level performance criteria. The determination of the quantitative value will be influenced by different factors, including such things as design, operating history, age of the plant, and previous plant performance. Specific risk significant SSC performance criteria should consider plant-specific performance and, where practical, industrywide operating experience. Performance criteria for risk significant SSCs should be established to assure that reliability and availability assumptions used in the plant-specific PRA, IPE, IPEEE, or other risk determining analysis are maintained or adjusted when determined necessary by the utility. When establishing performance criteria for non-risk significant standby systems, I surveillance and actual system demands should be reviewed. Failures resulting from i surveillances and valid system actuations should be evaluated in accordance with Section 9.4.4. ? i i The terms that follow are defined in Appendix B. l 13 - 2-r

- 44 9.3.3 Evaluating SSCs Against Risk Significant and Performance Criteria j After establishing SSCs that are within the scope of the Maintenance Rule and l establishing the risk significant and performance criteria, the next step is to evaluate the SSCs against the criteria. There are two phases in this es m ation. In the first phase, SSCs are evaluated against the risk criteria (Section 9.3.1) to determine those SSCs that are risk significant. For those SSCs that are risk significant, i the associated SSC specific performance criteria is established (Section 9.3.2). For those SSCs that are not risk significant but are standby systems, the SSC specific performance criteria is established (Section 9.3.2). For the remaining SSCs, the overall plant performance criteria applies. f The second phase is to evaluate the specific SSCs against the established performance criteria using historical plant data, and industry data where applicable, to determine if the SSCs met the perfonnance criteria. The historical data used to determine the peformance of SSCs consists of that data for a period of at least two fuel cycles or 36 months, whichever is less. If the SSC does not meet the established performance criteria, a cause determination is performed (Section 9.4.4) to determine if the unacceptable performance was maintenance preventable (Section 9.4.5). If the unacceptable performance was not maintenance preventable, the SSC is placed in (a)(2) l and addressed in the preventive maintenance program. If the corrective action has resolved the issue, the SSC is placed in (a)(2). Ifit is determined that an acceptable trend in performance is not demonstrated or the corrective action has not corrected the problem (Section 9.4.5), the SSC is placed in (a)(1) and a goal is set (Section 9.3.4) for that SSC. If the trend of performance indicates that the cause determination and corrective actions are effective, monitoring should be continued until the goal is achieved. If the SSC is determined to be inherently reliable, then it is not necessary to place the SSC in (a)(1) and establish goals. As used here, an inherently reliable SSC is one that, l i without preventive maintenance, has high reliability (e.g., jet shields, raceways). The need to place an SSC under (a)(1) and establish goals may arise if the inherently reliable I SSC has experienced a failure. In such cases, the SSC cannot be considered inherently reliable. SSCs that provide little or no contribution to system safety function could be i allowed to run to failure (i.e., perform corrective maintenance rather than preventive maintenance) and are addressed by (a)(2).

e As of July 10,1996, the implementation date of the Maintenance Rule, all SSCs that are within the scope of the Maintenance Rule will have been placed in (a)(2) and be part of the preventive maintenance program. In addition, those SSCs with unacceptable l performance will be placed in (a)(1) with goals established. After full implementation on July 10,1996, those SSCs that have goals established will be monitored (Section 9.4.2) using current plant data to determine if the goal is being l met and if the SSC can be placed in (a)(2). l 9.3.4 Determining Whether an SSC Level Goal is Required If any of the following conditions exist, a goal should be established at the appropriate level (i.e., structure, system, train, or component): A maintenance preventable functional failure (MPFF) caused an overall = plant performance criteria to be exceeded (reference Section 9.4.5); or A MPFF caused a risk significant or non risk significant SSC performance criteria not to be met; or A MPFF continues to be repetitive following the corrective action. = P If the system or train level performance criteria or goal was not met as a result of a component's MPFF, then the situation should be reviewed to determine if a goal should be established for the component. If the cause of the component failure has been i identified and the necessary corrections made (e.g., replacement, redesign), a goal may not be needed unless it is a repetitive MPFF. 9.4 Goal Setting and Monitoring Goals are established to bring about the necessary improvements in performance. When establishing goals, a utility should consider various goal setting criteria such as existing industry indicators, industry codes and standards, failure rates, duty cycles, and performance related data. In addition to the assumptions made in and results ofreliability approaches to maintenance, the assumptions in or results ofIPEs/PRAs should also be considered when establishing goals. In addition, analytical techniques (e.g., system l unavailability modeling) may be considered for developing goals. When selecting a goal, the data should be collected over a sufficient length of time to minimize the effects of a random event. : i

i t l Monitoring should consist of periodically gathering, trending, and evaluating information pertinent to the performance, and/or availability of the SSCs and comparing the results with the established goals and performance criteria to verify that the goals are l being met. Results of monitoring (including (a)(1) and (a)(2) activities) should be analyzed in timely manner to assure that appropriate action is taken. Regulations and utility commitments (e.g., Emergency Diesel Generator docketed reliability targets in response to the Station Blackout Rule,10 CFR 50.63) provide a baseline for testing and surveillance activities of some SSCs under the scope of the Maintenance Rule. Additional testing and surveillance activities could be necessary if SSC perfarmance is unacceptable. The Maintenance Rule results could also provide the basis for reduced testing and surveillance. The basis for technical specification, licensing commitments, and other regulation may be appropriately used for goal setting. Typical examples of such regulations or licensee commitments include: 1. Surveillance test and inspections performed in accordance with Section XI i of the ASME code as required by 10 CFR 50.55a. i l 2. R.eactor pressure vessel material surveillance tests conducted in accordance with Appendix H of 10 CFR Part 50. 3. Containment leakage tests performed in accordance with Appendix J of 10 l CFR Part 50. i i 4. Component surveillance or testing required by plant technical specifications. 5. Fire protection equipment tested and maintained in accordance with Appendix R of 10 CFR Part 50. 6. Tests and inspectiuns performed in response to NRC bulletins, generic l t letters, or information notices. j i 9.4.1 Goal Setting Goals can be set at the structure, system, train, or component level, and for aggregates of these where appropriate. In some cases the utility may elect to establish e l thresholds which would provide indication ofimproved performance toward the ultimate j I l

~ .) i b goal. A quantitative value for a goal or threshold may be established on the basis of judgment resulting from an appropriately documented review ofperformance criteria (see Section 9.3.1). 9.4.1.1 System Level j For those SSCs requiring goal setting, it is expected that many goals will be established at the system level. Where system level goals are to be established, system. availability could be used as the monitored parameter. Due to plant-specific redundancy' and diversity, an SSC failure does not necessarily cause a loss of safety function but could ~ result in system or train performance that is unacceptable. I i 9.4.1.2 Train Level I Systems that have redundant trains may have goals established for the individual l trains. The goal could be based on the availability desired or assumed in the PRA j i analysis. Train level goals provide a method to address degraded performance of a single train even though the system function is still available. The train level goal should be' set - consistent with PRA or other methods of risk determination assumptions. Other 1 alternative goal setting could consider the possibility of the best performing train to be : 7 unavailable and the safety function reliability potentially reduced. i 9.4.1.3 Component Level When component level goals are determined io be necessary, they should be established based upon the component's contribution to a system not meeting its performance criteria or a system level goal. Candidates for component goals could include classes of components with unacceptable performance, components which have caused trips or are directly associated with the causes of challenges to safety systems, and those components which have failed causing the performance level or a goal at the system j or train level to be missed. Careful review and analysis should be performed prior to ; ll establishing component goals to ensure that the number of component goals is manageable and not overly complex. 9.4.1.4 Structure Level .t l It is expected that most structures will be addressed as required by (a)(2) of the - l Maintenance Rule. In those cases where it is determined that a structure must have a goal - { I =l [, i ~

1 s l established, the goal could be based on, for example, limits for cracking, corrosion, erosion, settlement, deflection, or other condition critena. l 9.4.2 Monitoring i Monitoring will be performed to determine if maintenance results in acceptable performance. Monitoring SSCs against specific established goals should be conducted in a manner that provides a means of recognizing performance trends. Where failures or not meeting performance criteria could result in the loss of an intended safety function, monitoring should be predictive, when appropriate, in order to provide timely warning. Monitoring should also provide a means for determining the effectiveness ofprevious corrective actions. i Monitoring should appropriately consider the following factors: Existing plant specific or industry performance monitoring such as i technical specification surveillances, O&M Code, plant daily tours,ISI/IST and Appendix J test programs, inspections and tests; Establishing a practical monitoring process (i.e., should not require extensive analytical modeling or excessive data collection) that is capable of detecting changes in SSC performance; and Establishing a baseline to which the goals are monitored. The monitoring frequency to meet established goals can vary, but may be initially established as that currently required by existing surveillance requirements or other surveillance type monitoring currently being performed. Frequency of monitoring is also dependent upon the goal established and the availability of plant-specific or industry data. It may be either time directed, or based on performance. The frequency of monitoring should be adjusted, if necessary, to allow for early detection and timely correction of negative trends. Data could be collected from existing sources (e.g., surveillances, Appendix J requirements, ISI/IST, work order tracking) that are relevant to the goal being monitored. The type and quality of the data being collected and trended is very important in that it

j .~,: i i will ultimately determine if goals are being met. The analysis and evaluation of the - collected data should be timely so that, where necessary, corrective action can be taken. j 9.4.2.1 Monitoring System Level Goals The object of monitoring at the system level is to evaluate the performance of the - ] system against established goals to proceed from the present status of not meeting a j performance criteria toward a level of acceptable performance. Some examples of parameters monitored at the system level include availability, reliability, and failure rate. Systems should be monitored utilizing existing surveillance procedures provided that the j data collected using these procedures addresses the specific system goal (s). j 9.4.2.2 Monitoring Train Level Goals i Monitoring train level performance against established goals should consist of gathering availability or failure data and evaluating the results. The review and analysis of this data will provide a basis on where improvements are needed and also confirm' j when corrective actions have been effective. Individual train performance should be : '.i compared to each other or against the average train performance. 9.4.2.3 Monitoring Component Level Goals j l Should it be determined that a component requires goal setting, component monitoring could include performance characteristic data (e.g., flow, pressure, pump j, - head, temperatures, vibration, current, hysteresis) that can be used to determine j performance of the component. Monitoring could also be done using non-destructive 1 examination analysis (e.g., oil or grease, vibration, ultrasonic, infrared, thermographic, i eddy current, acoustics, and electric continuity). Information could include surveillance test results that the utility already performs or industry failure rate data. l j

i 9.4.2.4 Monitoring Structure Level Goals i

Should it be determined that a structure requires goal setting, that goal should be j monitored to assure that the goal is being or will be met. Such structures might include the reactor containment, foundations for important components such as turbines, pumps 1 and heat exchangers, as well as stmetures whose degradation or failure could significantly j compromise the function of other SSCs covered by the Maintenance Rule.i Examples of { monitoring include non-destructive examina' tion, visual inspection, vibration, deflection,- l thickness, corrosion, or other monitoring methods as appropriate. j o l j l

9.4.3 Dispositioning of SSCs from (a)(1) to (a)(2) A goal may be determined to have been met, and monitoring of SSC performance against specific goals may be discontinued if any of the following criteria are satisfied: Performance is acceptable for three surveillance periods where the surveillance periodicity is equal to or less than a six month interval; Performance is acceptable for two successive surveillances where the surveillance periodicity is greater than six months but no greater than two i fuel cycles; or i An approved and documented technical assessment assures the cause is known and corrected and thus monitoring against goals is unnecessary. If any of these conditions are met, the SSC may be returned to the provisions of (a)(2). 9.4.4 Unacceptable Performance or Failure Cause Determination and i Dispositioning SSCs from (a)(2) to (a)(1) A cause determination of appropriate depth will be required for the followmg conditions: A goal not being met; A performance criteria not being met; t A failure of a risk significant SSC, even if the goal or performance criteria l + is met; or l A repetitive MPFF of any SSC within the scope of the Maintenance Rule, even if the goal or performance criteria is met. During initial implementation of the Maintenance Rule, repetitive failures that have occurred in the previous two operating and refueling cycles should be considered. [ After the initial rule implementation, utilities should establish an appropriate review cycle i t

for repetitive MPFFs (e.g., during the periodic review, during the next maintenance or test l of the same function, or in accordance with Section 9.4.3). The cause determination should identify the cause of the failure or un~ acceptable performance, and whether the failure was a MPFF (Section 9.4.5). It should identify any corrective action to preclude recurrence, and make a determination as to whether or not the SSC requires (a)(1) goal setting and monitoring (Section 9.3.4). ~ There are numerous techniques available to the utility industry that could be used to determine if the failure is a MPFF. In some cases this determination is a simple assessment of an obvious cause. In other. cases the determination may require a rigorous l and formal root cause analysis in accordance with a methodology that exists in the industry. Any of these would be satisfactory provided they result in identi5 cation and - l correction of the problem. Cause determination and corrective action should reinforce achieving the performance criteria or goals that are monitored, and may also determine whether the performance criteria or goalitselfshould be modified. A decision as to whether SSCs j should have performance or goals monitored should be made. The determination to allow failure may be an acceptable one. For example, a decision to replace a failed component that provides little or no contribution to safety function rather than performance of a preventive maintenance activity may reduce exposure, contamination, i and cost without impacting safety (see Section 10.2). Once the cause determination and corrective actions have been completed, the performance should continue to be monitored and periodically evaluated until the performance criteria or goal is achieved. The cause determination should address failure significance, the circumstances d surrounding the failure, the characteristics of the failure, and whether the failure is isolated or has generic or common cause implications (refer to NUREG/CR 4780, " Procedures for Treating Common Cause Failures in Safety and Reliability Studies," EPRI NP 5613). The circumstances surrounding the failure may indicate that the SSC - failed because of adverse operating conditions (e.g., operating a valve dry, over. l ' pressurization of system) or failure of another component which caused the SSC failure. The results of cause determination should be documented for failures of SSCs under the - scope of the Maintenance Rule (Section 13) l s l 1 [ f

4 9.4.5 Maintenance Preventable Functional Failures (MPFFs) ld A maintenance preventable functional failure is an unintended event or condition such that a SSC within the scope of the rule is not capable of performing its intended function and that should have been prevented by the performance of appropriate maintenance actions by the utility. Under cenain conditions, a SSC may be considered to be incapable of performing its intended function ifit is out of specified adjustment or not within specified tolerances. The cause determination should establish whether the failure was a MPFF. It will be necessary to then determine if a goal should be established on any SSC which experiences a MPFF (Section 9.3.4). If the SSC failure was not a MPFF, then the utility should continue to perform the appropriate maintenance on the SSC. t h h 34See Appendix B for definitions ofinitial and repetitive MPFFs. 4 i ; 1 6

C i q EXAMPLES OF MPFFs j ~ NOTE: " FUNCTIONAL" HAS BEEN ADDED TO PROVIDE EMPHASIS ~ ~ ON ASSURING SAFETY FUNCTIONAL PERFORMANCE (INCLUDING FAILURES THAT CAUSE SCRAMS) RATHER THAN ADDRESSING A ' -{ DEFICIENCY THAT DOES NOT AFFECT A SAFETY FUNCTION i FAILURES DUE TO THE IMPLEMENTATION OF INCORRECT i MAINTENANCE PROCEDURES, FAILURES DUE TO INCORRECT IMPLEMENTATION OF CORRECT I MAINTENANCE PROCEDURES. FAILURES DUE TO INCORRECT IMPLEMENTATION OF 4 MAINTENANCE PERFORMED WITHOUT PROCEDURES CONSIDERED WITHIN THE SKILL OF THE CRAFT. j FAILURES OF THE SAME KIND OCCURRING AT A UTILITY THAT' HAVE OCCURRED IN INDUSTRY AS DEFINED BY INDUSTRY-WIDE j OPERATING EXPERIENCE THAT COULD HAVE BEEN PRECLUDED BY AN APPROPRIATE AND TIMELY MAINTENANCE ACTIVITY. 'l FAILURES THAT OCCUR DUE TO THE FAILURE TO PERFORM MAINTENANCE ACTIVITIES THAT ARE NORMAL AND APPROPRIATE TO THE EQUIPMENT FUNCTION AND IMPORTANCE. EXAMPLES i INCLUDE FAILURE TO LUBRICATE WITH THE APPROPRIATE - MATERIALS AT APPROPRIATE FREQUENCIES, FAILURE TO ROTATE EQUIPMENT THAT IS IN A STANDBY MODE FOR LONG PERIODS.. l l ) i

EXAMPLES THAT ARE NOT MPFFs 1 INITIAL FAILURES DUE TO ORIGINAL EQUIPMENT MANUFACTURER (OEM) DESIGN AND MANUFACTURING INADEQUACIES INCLUDING l INITIAL ELECTRONIC PIECE PART EARLY FAILURES. INITIAL FAILURES DUE TO DESIGN INADEQUACIES IN SELECTING OR APPLYING COMMERCIAL OR "OFF THE SHELF" DESIGNED EQUIPMENT. INITIAL FAILURES DUE TO INHERENT MATERIAL DEFECTS. i FAILURES DUE TO OPERATIONAL ERRORS AND EXTERNAL OR INITIATING EVENTS. IF THE FAILURE THAT CAUSED AN MPFF RECURS DURING POST MAINTENANCE TESTING BUT BEFORE RETURNING THE SSCs TO SERVICE, IT COULD BE INDICATIVE OF UNACCEPTABLE CORRECTIVE ACTIONS BUTIS NOT CONSIDERED AN ADDITIONAL MPFF. INTENTIONALLY RUN TO FAILURE (SECTION 9.3.3). i t I r,

,= 10.0 SSCs SUBJECT TO EFFECTIVE PREVENTIVE MAINTENANCE PROGRAMS 10.1 Reference 10 CFR 50.65 (a)(2) Monitoring as specified in paragraph (a)(1) ofthis section is not required where it 1 has been demonstrated that theperfbrmance or condition ofa structure, system, or l component is being efectively controlled through the performance ofappropriate preventive maintenance, such that the structu.:, system, or component remains capable of l performing its intendedfunction. 10.2 Guidance The methodology for implementing the Maintenance Rule by demonstrating maintenance program effectiveness or inherent reliability in lieu of SSC goal setting is shown on the Industry Guideline Implementation Logic Diagram (Figure 1). Although goals are set and monitored as part of(a)(1), the preventive maintenance (PM) and performance monitoring activities are part of(a)(2) and apply to all SSCs that are within the scope of the Maintenance Rule. SSCs that are within the scope of(a)(2) could be included in the formal PM program, be inherently reliable (e.g., visual inspection during walkdowns to meet licensee requirements that already exist), or be allowed to run to failure (provide little or no contribution to system safety function). An effective preventive maintenance program is one which will achieve the desired results of minimizing component failures and increasing or maintaining SSC performance. The individual maintenance program elements (training, procedures, cause determination, etc.) are focused and directed toward achieving effective maintenance 3 I through appropriate use of resources. Ifit can not be demonstrated that the performance of a SSC is being effectively controlled through a PM program, then it is necessary to establish a goal and monitor the SSC's performance against the goal. If the SSC is determined to be inherently reliable, then it is not necessary to place the SSC in (a)(1) and establish a goal. As used here, an inherently reliable SSC is one that, without preventive maintenance, has high reliability (Section 9.3.3). -3 5-

i SSCs that provide little or no contribution to system safety function, therefore l could be allowed to run to failure (i.e., perform corrective maintenance rather than preventive maintenance) and are addressed by (a)(2). 1 10.2.1 Performance of Applicable Preventive Maintenance Activities t Several methods are available to the industry for determining applicable and effective preventive maintenance activities to ensure satisfactory performance of SSCs. It I is not the intention of this guideline to identify these programmatic methods of detennining applicable maintenance activities. Sound preventive maintenance activities include, but are not limited to, the following elements: Periodic maintenance, inspection, and testing; i Predictive maintenance, inspection, and testing; j Trending of appropriate failures. 10.2.1.1 Periodic Maintenance, Inspection, and Testing Periodic maintenance, inspection, and testing activities are accomplished on a routine basis (typically based on operating hours or calendar time) and include activities i such as external inspections, alignments or calibrations, intemal inspections, overhauls, and component or equipment replacement. Lubrication, filter changes, and teardown are some examples of activities included in periodic maintenance. i 10.2.1.2 Predictive Maintenance, Inspection, and Testing l Predictive maintenance activities, including performance monitoring, are generally non-intrusive and can normally be performed with the equipment operating. Vibration analysis (includes spectral analysis), bearing temperature monitoring, lube oil analysis (ferrography), infrared surveys (thermography), and motor voltage and current checks are some examples of activities included in predictive maintenance. The data obtained from predictive maintenance activities are used to trend and monitor equipment l performance so that planned maintenance can be performed prior to equipment failure. l t l -3 6-l

10.2.1.3 Performance Trending Performance should be trended against established performance criteria so that adverse trends can be identified. When adverse trends are identified, appropriate corrective action should be promptly initiated. The utility's historical data, when combined with industry operating experience, operating logs and records, and station performance monitoring data, can be useful in analyzing trends and failures in equipment performance and making adjustments to the preventive maintenance program. 10.2.2 Ongoing Maintenanee Effectiveness Evaluation Ensuring satisfactory performance ofrisk significant and standby SSCs requires an ongoing assessment against the utility's performance criteria (Section 9.3.3). The results of this assessment should provide for feedback and adjustment ofmaintenance activities such that MPFFs are addressed. MPFFs that are repetitive or risk significant must be investigated and the cause determined (Section 9.4.4). When performance is determined to require improvement, the utility should implement the appropriate corrective actions in a timely manner. The objective of monitoring plant level performance criteria is to focus attention 1 on the aggregate performance of many of the operating SSCs covered by the scope of the Maintenance Rule that are not individually risk significant. l There are no individual SSC performance criteria included in the plant level performance criteria. The SSCs that support plant level performance criteria are included in the preventive maintenance program covered under (a)(2) of the Maintenance Rule. A failure of an individual SSC may not result in unacceptable performance and may not affect a plant level performance criteria. The utility may elect to establish a goal for the SSC that failed. Ifplant level performance criteria were not met because of a MPFF, then the SSC should be considered for disposition to (a)(1). See Sections 9.3.3 and 9.4 for elements to be considered.- This section is not intended to exclude a periodic review of preventive maintenance activities in addition to the ongoing review to monitor maintenance effectiveness. 4,m J. 2#4. s = _a-h .w a 4 g .a r 4 s .af. 4 .s ,,,.-s_. h 5 e e 4 - 4 i i i e r 9 ? l l 4 1 k 1 - 3 f . j I 7 $(' 1-i ' 8 d l .i - e ~ h n P t r I t 4 e i 4 f ? -l I t 1 ] o I i [ s a 5 . f r 1-t E l ' h A i' 4 - k .p e " f n.

g j'

' t I w l' P l 1.. t I 8 h f . i h I i 38-i . i l W-> p - t.t p .-e.,...> n,- 9

r 11.0 EVALUATION OF SYSTEMS TO BE REMOVED FROM SERVICE 11.1 Reference i 10 CFR 50.65(a)(3) b inperforming monitoring andpreventive maintenance activities, an assessment of I the totalplant equiftnent that is out ofservice should be taken into account to determine the overall effect on performance ofsafetyfunctions. l i 11.2 Guidance This section provides guidance fbr the development of an approach to assess the impact on overall plant safety fimetions upon removal of SSCs from service. The method is intended to ensure that overall plant safety function capabilities are maintained. The assessment does not require a quantitative assessment ofprobabilistic risk be performed. However, the quantitative assessment option can be used by a utility that has the capability. It could take the form of guidelines for removing SSCs from service using a matrix approach, a check list, a list of pre-analyzed configurations or some other utility 1 specific approach. In those cases where a pre-analyzed configuration, matrix or other approach does not address the configuration the plant would be in to support the maintenance activity, additional considerations or evaluations should be performed. t Additional guidelines for the removal of systems from service during plant shutdown are included in NUhiARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management. He development of an approach to assess the impact on overall plant safety i functions upon removal of SSCs from service consists of three steps: Identify key plant safety functions to be maintained; Identify SSCs that support key plant safety functions; i Consider the overall effect of removing SSCs identified above from service i on key plant safety functions. 1 :1 4

Steps 1 and 2 have been discussed in general terms in previous sections, and i establish a framework for the assessment of removing SSCs from service described in Step 3. 11.2.1 Identify Key Plant Safety Functions Applicable to the Plant Design Key plant safety functions are those that ensure the integrity of the reactor coolant pressure boundary, ensure the capability to shut down and maintain the reactor in a safe shutdown condition, and ensure the capability to prevent or mitigate the consequences of l accidents that could result in potential offsite exposure comparable to 10 CFR Part 100. Examples of these are: I Containment Integrity (Containment Isolation, Containment Pressure and Temperature Control); Reactivity Control; I Reactor Coolant Heat Removal; and Reactor Coolant Inventory Control. These functions are achieved by using systems or combinations of systems, that could include redundant subsystems or trains. 11.2.2 Identify SSCs That Support Key Plant Safety Functions l Once the required key plant safety functions are identified, the SSCs that support them need to be identified (Section 8.2.1). The ability of a system to perform its intended function in support ofidentified plant safety functions is key to determining the overall effect of taking SSCs out of service. Work done to date on symptom-based emergency operating procedures as well as IPE vulnerability assessments can be used to establish risk significant criteria to identify SSCs and to select those SSCs required to fulfill a key safety function. 7 i 4 ;

11.2.3 Assess and Control the Effect of the Removal of SSCs from Service on Key Plant Safety Functions During the planning and scheduling phase and prior to authorizing the removal of SSCs from service, each planned maintenance activity that results in the removal of an l SSC identified in Section 11.2.2 from service should be assessed for its impact on key plant safety functions. This assessment should take into account current plant configuration as well as expected changes to plant configuration. For example, scheduling maintenance that requires auxiliary feedwater pumps being out of service should take into account plant mode or condition, an assessment of when auxiliary feedwater would be least needed, scheduled availability of other sources of feedwater, and the time auxiliary feedwater would be unavailable. Additionally, prior to actually removing the system from service to begin maintenance, the condition of the plant should be reviewed to verify that conditions are acceptable to take the system out of l service. i A e i i l

a_ _ r ,.,a 4 ,.u. .5~__L. mi ' h, 4 f I I h I t , t - r a i s I -t i t ' h e I .e s ? q l e i 1 t a 9 -1 b . t l -Is u I 's i '. h ? e r I I ' >I p 5 4 i a 5 g ? ) s I e - k a I T + s f i. Y p I - f 3 I s 42-7 A + b -.,. = - .e

PERIODIC M AINTENANCE EFFECTIVENESS ASSESSMENTS 12.0 12.1 Reference 10 CFR 50.65 (a)(3) Performance and condition monitoring activities and associated goals and 15 akinginto prevcntive maintenance activities shall be evaluated at least annually t account, wherepractical, industry-wide operating experience. Adjustment shall be made where necessary to ensure that the objective ofpreventingjhilures ofstructures, systems, and components through maintenance is appropriately balanced against the objective of l minimi:ing unavailability ofstructures, systems, and components due to monitoring or preventive maintenance. I 12.2 Guidance Periodic assessments shall be performed to establish the effectiveness of maintenance actions. These assessments shall take into account, where practical, i industrywide operating experience. The assessment consists ofseveral activities to assure an effective maintenance program and to identify necessary adjustments that should be made to the program. The periodic assessments, cause determination, monitoring, and other activities associated with the Maintenance Rule provide an opportunity to feedback lessons learned into the process. The following describes some of the activities that should be performed. 12.2.1 Review of Goals (a)(1) On a periodic basis goals established under (a)(1) of the Maintenance Rule shall be reviewed. The review should include an evaluation of the performance of the applicable SSCs against their respective goals and should also evaluate each goal for its continued applicability. To redisposition SSCs from (a)(1) to (a)(2), see Section 9.4.3. 12.2.2 Review of SSC Performance (a)(2) On a periodic basis, SSC performance related to plant level criteria should be assessed to determine maintenance effectiveness. The assessment should determine if 15See footnote 7. -_-____

1 performance is acceptable. If performance is not acceptable, the cause should be determined and corrective action implemented. For SSCs that are being monitored under (a)(2), the periodic assessment should include a review of the performance against the established criteria. To redisposition SSCs from (a)(2) to (a)(I), see Section 9.4.4. Where appropriate, industrywide operating experience should be reviewed to identify potential problems that are applicable to the plant. Applicable industry problems should be evaluated and compared with the existing maintenance and monitoring. activities. Where appropriate, adjustments should be made to the existing programs. 12.2.3 Review of Effectiveness of Corrective Actions As part of the periodic review, corrective actions taken as a result of ongoing maintenance activities or goal setting should be evaluated to ensure action was initiated when appropriate and the action (s) taken resulted in improved performance of the SSC. Corrective actions that should be reviewed include the following: Actions to ensure that SSC performance meets goals established by requirements of(a)(1); Actions taken as a result of cause determination as required in Section 9.3.3 or 10.2.2; and Status of problem resolution, if any, identified during the previous periodic l assessment. 12.2.4 Optimizing Availability and Reliability for SSCs For risk significant SSCs adjustments shall be made, where necessary, to maintenance activities to ensure that the objective of preventing failures is appropriately balanced against the objective of assuring acceptable SSC availability. For operating non-risk significant SSCs, it is acceptable to measure SSC performance against overall - - plant performance criteria and for standby systems to measure performance against specific criteria. l l l

i 'l The intent is to optimize availability and reliability of the safety functions by properly managing the occurrence of SSCs being out of service for preventive maintenance activities. This optimization could be achieved by any of the following: Ensuring that appropriate preventive maintenance is performed to meet availability objectives as stated in plant risk analysis, FSAR, or other reliability approaches to maintenance-j Allocating preventive maintenance to applicable tasks commensurate with anticipated performance improvement (e.g., pump vibration analysis instead - ofteardown); f Reviewing to determine that availability of SSCs has been acceptable; a Focusing maintenance resources on preventing those failure modes that affect a safety function ; or Scheduling, as necessary, the amount, type, or frequency of preventive maintenance to appropriately limit the time out of service. The emergency diesel generator can be used as an example of optimizing reliability and availability, (a)(3) and as an example of transitioning between the rule requirements specified in (a)(1) and (a)(2) as follows: If the Emergency Diesel Generator failed to meet its established performance criteria (Section 9.3.3), a cause determination would be made as described in Section 9.4.4 of this guideline. Examples of performance criteria may include the target reliability value (i.e.,0.95 or 0.975) at a level established in a utility's documented commitment from the Station Blackout Rule (SBO) and unavailability that, if adopted as a performance criteria, would not alter the conclusions reached in the utility IPE/PRA. If a need for goal setting as described in Section9.4 is indicated, an appropriate goal should be established and monitored as indicated in (a)(1) until such time as the goal (s) are achieved and monitoring can be resumed under (a)(2) as described in Section 9.4.3. Monitoring under (a)(1) could be achieved by use of exceedance trigger values as described in Appendix D of NUMARC 87-00, Revision 1, dated August 1991, Guidelines and Technical Bases for NUMARC Initiatives, Addressing Station Blackout at Light Water Reactors, excluding those values indicated under paragraph D.2.4.4 (Problem EDG). .i i P b e [ I l 5 1 1 : h I

13.0 DOCUMENTATION 13.1 General ~ Documentation developed for implementation of this guideline is not subject to the utility quality assurance program unless the documentation used has been previously defined as within the scope of the quality assurance program. This documentation should be available for internal and external review but is not required to be submitted to the hTC. l 13.2 Documentation of SSC Selection Process The SSCs that are identified for consideration under the provisions of the Maintenance Rule and the criteria for inclusion shall be documented. SSC listings, functional descriptions, Piping and Instrument Diagrams (P& ids), flow diagrams, or other appropriate documents should be used for this purpose. 13.2.1 Maintenance Rule Scoping The following items from the initial scoping effort should be documented: Performance criteria; i The SSCs placed in (a)(1) and the basis for placement, the goals i established, and the basis for the goals; and The SSCs placed in (a)(2) and the basis for (a)(2) placement. Periodically, as a result of design changes, modifications to the plant occur that may affect the maintenance program. These changes should be reviewed to assure the maintenance program is appropriately adjusted in areas such as risk significance, goal setting, and performance monitoring. i 13.3 Documentation of(a)(1) Activities Performance against established goals and cause determination results should be documented. Changes to goals including those instances when goals have been effective and the performance of the SSC has been improved to the point where the SSC can be __ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ - - _ - _ - _ - _ _ _ _ - _ -.

moved to (a)(2) should be documented. Monitoring and trending activities and actions taken as a result of these activities should also be documented. 13.4 Dnutmentation of(aV2) Activities Activities associated with the preventive maintenance program should be documented consistent with appropriate utility administrative procedures. For example, results of repairs, tests, inspections, or other maintenance activities should be documented in accordance with plant specific procedures. The results of cause determination for repetitive or other SSC failures that are the result of MPFFs should be documented. Documentation of SSCs subject to AShE O&M Code testing should be maintained. Evaluation of performance against plant level performance criteria (Section 12.2.2) shall be documented. Adverse trends will be identified and those SSCs affecting the trend will be investigated and, where appropriate, corrective action taken. 13.5 Documentation of Periodic Assessment The periodic assessment described above should be documented. Appropriate details or summaries of results should be available on the following topics. The results ofmonitoring activities for SSCs considered under(a)(1). The documentation should include the results of goals that were met; Evaluation of performance criteria or goals that were not met, along with the cause determinations and associated corrective actions taken; Corrective actions for (a)(1) and (a)(2) that were not effective; A summary of SSCs redispositioned from (a)(2) to (a)(1), and the basis; A summary of SSCs redispositioned from (a)(1) to (a)(2), and the basis; Identify changes to maintenance activities that result in improving the relationship of availability and preventive maintenance..

6 APPENDIX A THE NRC MAINTENANCE RULE l

APPENDIX A THE MAINTENANCE RULE 2. A new & 50.65 is added to read as follows: Q 50.65 Requirements for monitoring the effectiveness ofmaintenance at nuclear power plants. (a)(1) Each holder of an operating license under { 50.21(b) or 50.22 shall monitor the performance or condition of structures, systems, or components, against licensee-established goals, in a manner sufficient to provide reasonable assuranc.e that such stmetures, systems, and components, as defined in paragraph (b), are capable of fulfilling their intended functions. Such goals shall be established commensurate with safety and, where practical, take into account industrywide operating experience. When the performance or condition of a structure, system or component does not meet established goals, appropriate corrective action shall be taken. (2) Monitoring as sp 4.fied in paragraph (a)(1) of this section is not required where it has been demonstrated that the performance or condition of a structure, system, or component is being effectively controlled through the performance of appropriate preventive maintenance, such that the structure, system, or component remains capable of performing its intended function. (3) Performance and condition monitoring activities and associated goals and j preventive maintenance activities sha!! be evaluated at least annually 16, taking into account, where practical, industrywide operating experience. Adjustments shall be made where necessary to ensure that the objective of preventing failures of structures, systems, and components through maintenance is appropriately balanced against the objective of minimizing unavailability of stmetures, systems, and components due to monitoring or preventive maintenance. In performing monitoring and preventive maintenancc activities, an assessment of the total plant equipment that is out of service should be taken into account to determine the overall effect on performance of safety functions. I 16See footnote 7. A-1

I (b) The scope of the monitoring program specified in paragraph (a)(1) of this section shall include safety-related and nonsafety related structures, systems, and components, as follows: (1) Safety-related structures, systems, or components that are relied upon to remain functional during and following design basis events to ensure the integrity of the reactor coolant pressure boundary, the capability to shut down the reactor and maintain it in a safe shutdown condition, and the capability to prevent or mitigate the consequences of accidents that could result in potential offsite exposure comparable to the 10 CFR part 100 guidelines. l (2) Nonsafety related structures, systems, or components: 1 (i) That are relied upon to mitigate accidents or transients or are used in plant emergency operating procedures (EOPs); or l (ii) Whose failure could prevent safety-related stmetures, systems, and components from fulfilling their safety-related function; or (iii) Whose failure could cause a reactor scram or actuation of a safety-related system. (c) The requirements of this section shall be implemented by each licensee no j later than July 10,1996. Dated at Rockville, Maryland, this 28th day ofJune,1991. For the Nuclear Regulatory Commission. Samuel J. Chilk, Secretary ofthe Commission. '7 [FR Doc. 91-16322 Filed 7-9-91; 8:45 a.m.] Billing Code 7590-01-M l A-2 h

7,- . 4 ' l 4 APPENDIX B MAINTENANCE GUIDELINE DEFINITIONS

APPENDIX B MAINTENANCE GUIDELINE DEFINITIONS 1 ? availability: The time that a SSC is capable ofperforming its intended function as a fraction of the total time that the intended function may be demanded. The numerical complement of unavailability. cut sets: Accident sequence failure combinations. industrywide operating experience (including NRC and vendor): Information included in NRC, industry, and vendor equipment information that are applicable and available to the nuclear industry with the intent of minimizing adverse plant conditions or situations through shared experiences. I maintenance: The aggregate of those functions required to preserve or restore safety, reliability, and availability of plant structures, systems, and components. Maintenance includes not only activities traditionally associated with identifying and correcting actual or potential degraded conditions, i.e., repair, surveillance, diagnostic examinations, and preventive measures; but extends to all supporting functions for the conduct of these activities. (Source: Federal Register Vol. 53, No. 56, Wednesday, March 23,1988, Rules and Regulations / Page 9340). 1 1

maintenance, preventive: Predictive, periodic, and planned maintenance actions taken prior to SSC failure to maintain the SSC within design operating conditions by controlling degradation m failure. i Maintenance Preventable Functional Failure (MPFF)-initial and repetitive I An MPFF is the failure of an SSC (structure, system, train, or component) within the scope of the Maintenance Rule to perform its i,ntended function (i.e., the function performed by the SSC that required its inclusion within the scope of the rule), where the cause of the failure of the SSC is attributable to a maintenance-related activity. The maintenance-related activity is intended in the broad sense of maintenance as defined above. The loss of function can be either direct, i.e., the SSC that performs the function fails to perform its intended function or indirect, i.e., the SSC fails i to perform its intended function as a result of the failure of another SSC (either safety related or nonsafety related). l An initial MPFF is the first occurrence for a particular SSC for which the failure results in a loss of function that is attributable to a maintenance related cause. An initial MPFF is a failure that would have been avoided by a maintenance activity that has not been otherwise evaluated as an acceptable result (i.e., allowed to run to failure due to an acceptable risk). A " repetitive" MPFF is the subsequent loss of function (as defined above) that is attributable to the same maintenance related cause that has l previously occurred (e.g., an MOV fails to close because a spring pack was installed improperly - the next time this MOV fails to close because the f spring pack is installed improperly: the MPFF is repetitive and the previous corrective action did not preclude recurrence). A second or subsequent loss l of function that results from a different maintenance related cause is not considered a repetitive MPFF (e.g., an MOV initially fails to close because j a spring pack was installed improperly - the next time it fails to close, its h i l B-2 o 3 l ^ P

I w failure to close is because a set screw was improperly installed: the MPFF is not repetitive), t During initial implementation of the Maintenance Rule, repetitive failures that have occurred in the previous two operating and refueling cycles should be considered. After the initial rule implementation, utilities should establish an appropriate review cycle for repetitive MPFFs (i.e., during the periodic review, during the next maintenance or test of the same function, j or in accordance with Section 9.4.3). monitoring, performance: Continuous or periodic tests, inspections, measurement or trending of the performance or physical characteristics of an SSC to indicate current or future performance and the potential for failure. Monitoring is frequently conducted on a non-intrusive basis. Examples ofpreventive maintenance actions may include operator rounds, engineering walkdowns, and management inspections. l operating system: An operating system is one that is required to perform its intended function continuously to sustain power operation or shutdown conditions. i The system function may be achieved through the use of redundant trains (i.e. two redundant independent trains each with a motor driven pump capable of delivering 100% capacity to each train). In this case, either train using either pump will be capable of performing the system function. Normal operation would be with one train operating and one train in standby (not operating). The train in standby (not operating) would normally be capable of starting and providing the system function if the train that was in operation failed. In this case, if the function of the operating train is lost, and the standby (non-operating) train starts and B-3

l maintains the system function with no perturbation of plant operation, then there is no loss of system function. The performance criteria for this type of i system should include both the operational and standby (not operating) performance characteristics as applicable. In the case where a system with redundant trains has a diverse system (i.e. a steam driven pump and piping, valves, etc.) that will perform the same function, it is possible to lose both trains of the redundant system and still maintain system function with the diverse system. Performance criteria should be established for the diverse system based on its individual performance taking into account its diverse method of performing the required function, its unique configuration and any other functions related that it performs as related to the Maintenance Rule. reliability: P I A measure of the expectation (assuming that the SSC is available) that the-SSC will perform its function upon demand at any future instant in time. i risk: Risk encompasses what can happen (scenario), its likelihood (probability), j ~ and its level of damage (consequences). risk significant SSCs: Those SSCs that are significant contributors to risk as_ determined by PRA/IPE or other methods. F ~ B-4

l i .i i standby system or train A standby system or train is one that is not operating and only performs its intended function when initiated by either an automatic or manual demand signal. Some of these systems perform a function that may be required i intermittently during power operations (e.g., a process system used to adjust or correct water chemistry). Although not continuously operating the system or one ofits trains must be able to actuate on a manual or automatic signal and be able to perform its intended function as required. Since the system or train is in the standby mode, it will most frequently be determined as operable / inoperable during operability (surveillance) testing, although if designed to actuate automatically, it could fail on demand. Based on experience and the reason for performing surveillance testing the best way to measure the performance of the standby system is based on the results of performance on demand (both an automatic response to a valid signal and r as a result of surveillance testing). Examples of standby systems of this type would be the hydrogen recombiner system and the contaimnent spray system. Other systems and their associated trains may be configured in a standby mode during' power operation but during an outage are normally operating (e.g., RHR). Performance monitoring should consider the system function during all plant modes. l I unavailability, SSC (for purposes of availability or reliability calculation): The numerical complement of availability. An SSC that cannot perform its intended function. An SSC that is required to be available for automatic operation must be available and respond without human action. i B-5

't I unplanned automatic scrams per 7,000 hours critical This indicator tracks the average scram rate per 7,000 hours of reactor l criticality (approximately one year of operation) for units operating with more than 1,000 critical hours during the year. Unplanned automatic scrams result in thermal / hydraulic transients in plant systems. unplanned capability loss factor: Unplanned capability loss factor is the percentage of maximum energy generation that a plant is not capable of supplying to the electrical grid because of unplanned energy losses (such as unplanned shutdowns, forced i outages, outage extensions or load reductions). Energy losses are considered unplanned if they are not scheduled at least four weeks in advance. i unplanned safety system actuations Unplanned safety system actuations include unplanned emergency core cooling system actuations or emergency AC power system actuations due to i loss of power to a safeguards bus. l L f P F t B-6 l i

de e APPENDIX C MAINTENANCE GUIDELINE ACRONYMS i l i

l. _ __

- 'i t i [ APPENDIX C MAINTENANCE GUIDELINE ACRONYMS CFR Code of Federal Regulation EOP Emergency Operating Procedures i FSAR Final Safety Analysis Report IPE Individual Plant Evaluations j ISI Inservice Inspection IST Inservice Testing MPFF Maintenance Preventable Functional Failures NRC Nuclear Regulatory Commission NUMARC Nuclear Management and Resources Council f P&ID Piping and Instrument Diagrams PRA Probabilistic Risk Assessment ? 6 e n i C-1

Jya, 4.,. d ca.- 2 .+m. 4as. u a a 4 .a a 4 h - I

e.,, a s i

h . Q.e 'i . ? ? fi i 'I 5 t f I APPENDIX D l i EXAMPLE OF A SYSTEM WITH BOTH SAFETY AND .l NONSAFETY FUNCTIONS - CVCS i r 3 I - + ~ t i i i . i '? I

q g,. -.. i 4; t APPENDIX D -t EXAMPLE OF A SYSTEM WITII BOTH SAFETY AND q NONSAFETY FUNCTIONS - CVCS Note: This example is for illustration purposes only and is not intended to be definitive for any given plant. Each utility should examine its own design and operation for applicability. The typical Chemical and Volume Control System (CVCS), shown in the attached figure, has many functions such as: adjust the concentration of boric acid, maintain water inventory, provide seal water to the reactor coolant pump seals, process reactor coolant effluent for reuse, maintain proper chemistry concentration, and provide water for high l pressure safety injection. Clearly, the high pressure safety injection function of the i CVCS is encompassed by the description in (b)(1) of 10 CFR 50.65 and therefore, withm the scope of the rule. Other components and functions of the CVCS such as the regenerative heat exchanger, the letdown heat exchanger, the mixed bed demineralizers,. l the volume control tank and their associated valves and control systems which function to. maintain inventory, process coolant and maintain chemistry, do not generally have safety functions. These portions of the CVCS do not typically meet the descriptions in (b)(1) or j (2) of 10 CFR 50.65 and would not be considered within the scope of the rule. Components within these portions of the CVCS, however, may fit the descriptions in - (b)(1) or (b)(2). Examples of this would be the volume control tank isolation valves _. which close to align the system for high pressure injection and the various valves which l also serve as containment isolation valves. Other portions of the CVCS would need to be examined closely to determine whether they meet the descriptions in (b)(1) or (b)(2). For l example, the seal injection portion of CVCS may be within the scope if the reactor coolant pumps are relied upon in transients or EOPs, or if the failure of seal injection j could cause a scram or actuation of a safety-related system. j I i j t h D-1 ) i i q

~ 4 CllEMicct ANO VtRUME CONTROL SYSTEM -n S>'- no 5 coMr conuso esic n n m e'

4--d> -

,i, e, ( --- > *~TV+ >~ * * *

• q
  • • " ~

__ Q* iw no r l {l-

)

i o

( Eis "f" "'^' ,C" h [k - A m-P DE DE utxrn utns n l (I flor BOR arn ern E e REGEN ] ilEAT _) l EXCil e l e C g l Moj 3- _po @ dW tt c cuto tro --DO-~ FILTrn n...,,,, t.LT citanc No = ,l TANK 3 (,) ent.IctNG l S l Atix p 4 SPRAY stAL r AL g yg i l g BLFNDrR st e i EAT YOL l EXCit CONTR r""""1 - S PW b== I ac EX LTDM TANK s rgggr 9 um jl(Q - UA lll e G r*~ c::: 40 ,x O INSIDE g lf[g 4 gggggg 'Pg CONTAIfiMENT 0 taNx d j y a 4 roo< 0 ,,uDER RH95 Of M h l T 11 171 -= i l "_rd a {o - ny a x nos. ,,, - o l - 484 -

e -m nwsT

"~ b -}}