ML20056E607
| ML20056E607 | |
| Person / Time | |
|---|---|
| Site: | Pilgrim |
| Issue date: | 08/04/1993 |
| From: | Selin I, The Chairman NRC COMMISSION (OCM) |
| To: | Erin Kennedy, Kerry J, Studds G HOUSE OF REP. |
| Shared Package | |
| ML20056C684 | List: |
| References | |
| CCS, NUDOCS 9308240326 | |
| Download: ML20056E607 (8) | |
Text
- _-__-_-____ _ - - -
, ap
- gW%, UMITED STATES 3 0, -
iDn ;i NUCLEAR REGULATORY COMMISSION j K".#f4 .
n AssmGT oN. D. C. 20555 ugust 4, 1993
- ...f CHAIRMAN The Honorable Gerry E. Studds United States House of Representatives Washington, D.C. 20515-4611
Dear Congressman Studds:
In your letter of June 29, 1993, you and Senators Kennedy and Kerry raised several questions about the instrumentation for reactor vessel water level and the cracks on the disks of the low pressure turbines at the Pilgrim Nuclear Power Station. The Pilgrim plant shut down on July 22, 1993. During the shutdown, the licensee installed the modification to the reactor vessel water level instrumentation to ensure high functional reliability for long term operation as described in NRC Bulletin 93-03.
After installation and testing of the modification, the plant was restarted on July 25, 1993, and returned to power operation.
Enclosed are the staff's responses to your questions on the reactor vessel water level issues.
In addition, I have enclosed a copy of the NRC staff's analysis that forms the basis for the conclusion that the turbine may be operated until the next refueling outage (spring 1995) without any undue risk to the health and safety of the public. In reaching its conclusion, the staff reviewed the GE and SIA analyses performed on the turbine flaw indications, and found that although the SIA analysis is less conservative than the GE analysis (see enclosed analysis for details), sufficient conservatisms were built into the SIA analysis to conclude that no safety concerns exist for normal operation of the turbine to the end of the current fuel cycle. Boston Edison plans to replace the turbine rotors during their next refueling outage scheduled for April, 1995.
I hope that the information we are providing will help resolve your concerns.
Sincerely, 930824Ms26 930804 PDR LOMMS NRCC Ivan Selin CDFRESPONDENCE PDR
Enclosures:
- 1) Questions on level indication, w/ attachment
- 2) Low pressure turbine assessment, w/2 attachments gg g Originated by: R. Eaton, NRR g
.g' arx,
- f i, UNITED STATES vi NUCLEAR REGULATORY COMMISSION l r i. ~
i
% $I I i s WASHINGTON, D. C. 20555 I
$ Eldjhg /N! August 4, 1993 )
..is
..+
CHAIRYAN The Honorable John F. Kerry United States Senate ,
Washington, D.C. 20510
Dear Senator Kerry:
In your letter of June 29, 1993, you and Senator Kennedy and Congressman Studds raised several questions about the instrumentation for reactor vessel water level and the cracks on the disks of the low pressure turbines at the Pilgrim Nuclear Power Station. The Pilgrim plant shut down on July 22, 1993.
During the shutdown, the licensee installed the modification to the reactor vessel water level instrumentation to ensure high functional reliability for long term operation as described in NRC Bulletin 93-03. After installation and testing of the modification, the plant was restarted on July 25, 1993, and returned to power operation. Enclosed are the staff's responses to your questions on the reactor vessel water level issues.
In addition, I have enclosed a copy of the NRC staff's analysis that forms the basis for the conclusion that the turbine may be operated until the next refueling outage (spring 1995) without l
any undue risk to the health and safety of the public. In reaching its conclusion, the staff reviewed the GE and SIA analyses performed on the turbine flaw indications, and found that although the SIA analysis is less conservative than the GE analysis (see enclosed analysis for details), sufficient conservatisms were built into the SIA analysis to conclude that no safety concerns exist for normal operation of the turbine to the end of the current fuel cycle. Boston Edison plans to replace the turbine rotors during their next refueling outage scheduled for April, 1995.
I hope that the information we are providing will help resolve your concerns.
Sincerely,
/ l e d Ivan Selin
Enclosures:
- 1) Questions on level indication, w/ attachment
- 2) Low pressure turbine assessment, w/2 attachments I
gp u c e,#
8 '
% UNITED STAYES
[* J , i$ NUCLEAR REGULATORY COMMISSION i . Ml h WASHINGTON. D, C. 20555
$ Idb% ! August 4
\' . .e.* f 1993 CHAIRMAN The Honorable Edward M. Kennedy United States Senate Washington, D.C. 20510
Dear Senator Kennedy:
In your letter of June 29, 1993, you and Senator Kerry and Congressman Studds raised several questions about the instrumentation for reactor vessel water level and the cracks on the disks of the low pressure turbines at the Pilgrim Nuclear Power Station. The Pilgrim plant shut down on July 22, 1993. ,
During the shutdown, the licensee installed the modification to the reactor vessel water level instrumentation to ensure high functional reliability for long term operation as described in NRC Bulletin 93-03. After installation and testing of the modification, the plant was restarted on July 25, 1993, and returned to power operation. Enclosed are the staff's responses to your questions on the reactor vessel water level issues.
In addition, I have enclosed a copy of the NRC staff's analysis that forms the basis for the conclusion that the turbine may be operated until the next refueling outage (spring 1995) without any undue risk to the health and safety of the public. In ,
reaching its conclusion, the staff reviewed the GE and SIA l analyses performed on the turbine flaw indications, and found l that although the SIA analysis is less conservative than the GE l analysis (see enclosed analysis for details), sufficient I conservatisms were built into the SIA analysis to conclude that no safety concerns exist for normal operation of the turbine to I the end of the current fuel cycle. Boston Edison plans to replace the turbine rotors during their next refueling outage scheduled for April, 1995.
I hope that the information we are providing will help resolve ,
your concerns. l sincerely, g/ w fv11 D *r Ivan Selin
Enclosures:
- 1) Questions on level indication, w/ attachment
- 2) Low pressure turbine assessment, w/2 attachments l
r .
, 8 Enclosure 1 RESPONSE TO QUESTIONS ON REACTOR VESSEL WATER LEVEL INDICATION QUESTION 1 In the case of the Pilgrim Plant, the licensee will not be required to make the modification until the next planned cold shutdown, which isn't until April 1994. If the problem is serious enough to require a plant that is shut down on August 1, 1993, to make modifications, why are the other plants allowed almost a year before they are required to take the same action?
ANSWER On July 22, 1993, the Pilgrim Nuclear Power Station was placed in a cold shut down condition to investigate and repair an unidentified leak that occurred after returning to power operation from their refueling outage.
Consistent with the NRC staff's request in Bulletin 93-03, Pilgrim installed a modification to the reactor vessel water level indication before restarting the plant.
On May 28, 1993, the NRC issued Bulletin 93-03, in which it requested that each boiling water reactor (BWR) licensee implement hardware modifications necessary to ensure that the level instrumentation system is of high functional reliability for long-term operation. The NRC staff requested that these modifications be implemented at the next cold shutdown beginning after July 30, 1993, or if a facility is in cold shutdown on July 30, 1993, before starting up from that outage. The staff also requested each licensee to submit a report by July 30, 1993, describing the hardware modifications to be implemented. If a licensee chooses not to implement a hardware modification as requested by the bulletin, its report shall contain a description of the proposed alternative course of action, the schedule for completing it, and a justification for any deviations from the requested actions.
For transient and accident scenarios initiated from full power conditions, the level instrumentation should actuate safety systems as designed. The operators have received guidance and training as requested by Generic Letter (GL) 92-04 to ensure that any level errors will not result in improper operator actions. Further, the staff believes that an abrupt depressurization event resulting in a common-mode / common-magnitude level indication error is unlikely.
. i The staff determined that additional short-term compensatory measures were necessary for a normal cooldown for transient and accident scenarios begun from reduced pressure conditions. In Bulletin 93-03, the staff requested that each licensee implement certain short-term !
compensatory actions within 15 days and complete augmented operator !
training by July 30, 1993. Because the hardware modifications were requested to be implemented at the next cold shutdown after July 30, 1993, each plant is expected to be in cooldown conditions only once before the licensee makes modifications. If the level indication is i erroneous while the plant is being cooled down, the compensatory measures and operator training requested by Bulletin 93-03 should enable the operators to mitigate the consequences of any loss-of-inventory event.
An operating plant waiting until the next cold shutdown to make hardware modifications, instead of forcing an unplanned shutdown, would not increase the risk from event scenarios begun during reduced pressure conditions. The staff also finds no immediate safety concern with event i scenarios that begin during full pressure conditions. Therefore, the staff has concluded that plant operation is acceptable with adequate compensatory measures as requested by Bulletin 93-03 and with the actions already completed by licensees in response to GL 92-04 until a permanent hardware modification is made.
QUESTION 2a Is Mr. Blanch correct that the regulations and GL 91-18 require an operability determination in this case that would look at all functions )-
and determine whether the system is capable of performing its function? l Please include with your response a copy of the relevant regulations and guidance. !'
ANSWER Mr. Blanch is correct that licensees must continuously ensure operability, which involves verifying functional capability, if called into question. The technical specifications for each plant define ;
" operability", which, simply stated, is the ability of equipment to '
perform a specific refety function. In GL 91-18, attached, the staff gave guidance on acceptacle methods for addressing questions about degraded or nonconforming conditions, and determining how these conditions relate to aperability. The Pilgrim plant's Technical Specification 1.0.E states the following:
A system, subsystem, train, component or device shall be OPERABLE or have OPERABILITY when it is capable of performing its specified function (s). Implicit in this definition is the assumption that all necessary attendant instrumentation, controls, normal and emergency electrical power sources, cooling or seal water,
. t 4
lubrication or other auxiliary equipment that are required for the system, subsystem, train, cc.nponent or device to perform its function (s) are also capable of performing their related support function (s).
QUESTION 2b Is Mr. Blanch correct that the technical specifications for this particular device state that if the level measurement is inoperable, it must be fixed immediately?
ANSWER Pilgrim Nuclear Power Station Technical Specifications 3.1. A, " Reactor Protection System"; 3.2.A, " Primary Containment Isolation"; 3.2.B. " Core and Containment"; 3.2.F, " Surveillance Information Readouts"; and 3.2.G,
" Recirculation Pump Trip and Alternate Rod Insertion," all would require the reactor to be shut down if the reactor vessel water level instrumentation is inoperable; that is, if this instrumentation is not capable of performing its specific safety function (s). If the plant is already shut down, the level instrumentation must be returned to an operable status before the plant is restarted. Other boiling water {
reactors have similar technical specification requirements for the level l instrumentation. ,
i The NRC staff position is that current BWR water level instrumentation systems, tcgether with the short-term compensatory measures required in Bulletin 93-03, provide reasonable assurance that required safety functions will be successfully carried out.
QUESTION 2c If Mr. Blanch's assertions are accurate, does NRC Bulletin 93-03 conflict with the requirements of the regulations and guidance? !
ANSWER Bulletin 93-03 does not conflict with NRC regulations or guidance concerning operability.Bulletin 93-03 does not grant any licensee !
relief from the obligation to ensure operability. On the contrary, the NRC issued both the bulletin and GL 92-04 to request specific actions to l give additional assurance that the system is capable of performing its intended safety function.
l
- s I
i QUESTION 3 As you know, Boston Edison is not convinced of the applicability of the Millstone solution to its plant and is evaluating other options. Does the NRC have the authority to review this evaluation? Can the NRC make an independent determination on the applicability of the Millstone solution to Pilgrim or must it accept the licensee's decision?
ANSWER Boston Edison installed a modification to the reactor vessel water level !
indication that was very similar to the modification adopted at the !
Millstone plant.Bulletin 93-03 does not require NRC licensees to adopt I a specific solution to the water level indicator problem. Rather, each j
- licensee may choose the solution which it deems most appropriate. The '
! NRC requested that each licensee submit a report by July 30, 1993, to describe the hardware modifications to be implemented. The NRC staff ;
i weighs the acceptability of the selected option against the requests t discussed in GL 92-04 and Bulletin 93-03. l l
\
l l
i l
l 1
i
. _ = . - -
2 Attachment to Enclosure 1 ,
i
/ps* **o%'o UNITED STATES
~*
[" )w
- g j NUCLEAR REGULATORY COMMISSION wasmucrow. o. c. 2ones l
% ,' 9 T / November 7, 1991 TO: ALL NUCLEAR POWER REACTOR LICENSEES AND APPLICANTS i
i SUBJECT INFORMATION TO LICENSEES REGARDIh3 TWO NRC INSPECTION MANUAL SECTIONS ON RESOLUTION OF DEGRADED AND NONCONFORMING CONDITIONS AND l
ON OPERABILITY (GENERIC LETTER 91-18)
The NRC staff has issued two sections to be included in Part 9900, Technical !
Guidance, of the NRC Inspection Manual. The first is, " Resolution of Degraded anc Nonconforming Conditions." The second is, " Operable / Operability: Ensuring i the functional Capability of a System or Component." Copies of the additions to the NRC Inspection Manual (enclosure) are provided for information only. No ,
specific licensee actions are required.
The additions to the NRC Inspection Manual are based upo6 previously issued guidance. However, because of the complexity involve'd in operability determinations and the resolution of degraded and nonconforming conditions, there ,
nave been differences in application by NRC staff during past inspection !
activities. Thus, the purpose of publishing this guidance is to ensure i consistency in application of this guidance by the NRC. Regional inspection i personnel have been briefed on this guidance. The NRC will conduct further training on these topics to ensure uniform staff understanding.
The use of this guidance by inspectors may raise backfitting issues for specific licensees. The NRC backfitting procedures apply in such cases. Licensees should ;
consult with the Regional office regarding the application of specific staff .
positions in the guidance. i Please contact the appropriate NRC Project Manager if you have any questions regarding this matter.
t Jam k
es G. Partlow Assaciate Director for Projects Office of Nuclear Reactor Regulation
Enclosure:
As stated M T W O2s3 m
plSTRIBUTION:
s Docket File-(50-293 w/ incoming)
NRCT Local PDRs (w/inccaing)
, EDO #0009L92 l EDO Reading JTaylor JSniezek HThompson JBlaha l TMurley/FMiraglia l
JPartlow PDI-3 Reading (w/ incoming)
SVarga JCalvo WButler 0GC OPA OCA SECY # CRC-93-0594 NRR Mailroom (ED0#0009092 w/ incoming)
! ADP Secretary CNorsworthy l LMitchell REaton (w/ incoming)
Slittle JLinville, RI TMartin, RI JLieberman, OE BHayes, 01 JScinto, OGC i
l l
l l
1001SG
f .
d a
ENCLOSURE 1 p '**"*%,o UNITED STATES
!' ,. 7
- NUCLEAR REGULATORY COMMISSION I $ w A5arNGTON. O C 20h66
'o !
%' 'l NRC INSPECTION MANUAL OTSB l
PART 9900: TECHNICAL GU10ANCE i
i RESOLUTION OF i
DEGRADED AND NONCONFORMING CONDITIONS I
l 4
i 1
l Issue Date: 10/31/91 9900 Degraded Conditions
- .. . . = - . - - - - .
s ,
l RESOLUTION OF '
DEGRADED AND NONCONFORMING CONDITIONS Table of Contents f.1E 1.0 PURPOSE AND SC0PE........................ ........................I ,
2.0 DEFINITIONS. .................... ..... ........................ 2 2.1 Current Licensino Basis............................ ....... 2 !
Design Basis............................................... 2 2.2 2.3 D^ graded Condition.......................................... 2 ,
2.4 Nonconforming Condition.................................... 2 ,
! 2.5 F ul l Q u al i f i c a t i on . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 3.0 EACKGROUND. ..................................................... 3 i 4.0 DISCUSSION OF NOTABLE PROVIS10NS................................. 3 l
4.1 Publ ic He al t h and Sa fety. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 l
4.2 Operability Determinations................................. 3 4.3 The Current Licensing Basis and :
10 CFR 50 Appendix B....................................... 3 4.3.1 10 CFR 50, Appendix B.......................... 3
- 4.3.2 Changing the Current Licensing Ba.is s l to Satisfy an Appendix B Corrective Action..... 4 P i . 4.4 Discovery of an Existing But Previously l Unanalyzed Condition or Accident. . . . . . . . . . . . . . . . . . . . . . . . . . . 4 l
4.5 Justification for Continued Operation (JCO) . . . . . . . . .. . . . . . . 4 l
i
! 4.5.1 Background..................................... 4 4.5.2 JC0 De'Inition................................. 5 4.5.3 Items for Consideration in a JCO. . . . . . . . . . . .. .. 5 4.5.4 Discussion of Industry-Type JCOs............... 5 4.6 Re a s onabl e As surance of Safety. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 5.0 RE F E R EN C E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 9900 Degraded Conditions -i- Issue Date: 10/31/91 i
, , . _ - , _ _ . . - . . . . . - _ - - _ _ . - , _- , , . _ - _ _ . . _ ~ . _ . _ _ .
RESOLUTION OF DEGRADED AND NONCONFORMING CONDITIONS 1.0 PURPOSE AhD SCOPE:
To provide guidance to NRC inspectors on resolution of degraded and nonconfoming e.onditions affecting the following systems, structures, or components (SSCs):
(i) Safety.related SSCs, which are those relied upon to remain functional during and following design basis events (A) to ensure the integrity of the reactor coolant pressure boundary, (B) to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition, er (C) to ensure the capability to prevent or mitigate the consequences of accidents that could result in potential offsite consequences comparable to the 10 CFR Part 100 guidelines. Design basis events are defined the same as in 10 CFR 50.49(b)(1).
All SSCs whose failure could prevent satisfactory. accomplishment of (ii) any of the required functions identified in (i) A, B, and C.
(iii)
All SSCs relied on in the safety analyses or plant evaluations that t are a part of the plant's current licensing basis. Such analyses _and evaluations include those submitted to support license amendment requests, exemption requests, or relief requests, and those submitted to demonstrate compliance with the Commission's regulations such as fire protection (10 CFR 50.48), environmental qualification (10 CFR 50.49), pressurized thermal shock (10 CFR 50.61), anticipated transients without scram (10 CFR 50.62), and station blackout (10 CFR 50.63).
l (iv) Any SSCs subject to 10 CFR Part 50, Appendix 8.
l (v) Any SSCs subject to 10 CFR Part 50, Appendix A, Criterion 1. J (vi) Any SSCs explicitly subject to facility Technical Specifications (TS).
(vii) Any SSCs subject to facility TS through the definition of operability ,
(i.e., support SSCs outside TS).
Any SSCs described in the FSAR. !
(viii) I This guidance is directed toward NRC inspectors that are reviewing actions of licensees that hold an operating license. Although this guidance generally reflects existing staff practices, application on specific plants may constitute a backfit. Consequently, significant differences in licensee practices should be discussed with NRC management to ensure that the guidance is applied in a reasonable and consistent manner for all licensees.
l 9900 Degraded Conditions Issue Date: 10/31/91 l
,_.m. _ . . . . _ _ . . - _ , _ . , . . . . , , ,_. -....... _. _ . ,.-,
s
2.0 DEFINITIONS
f 2.1 Current Licensino Basis Current licensing basis (CLB) is the set of NRC requirements applicable to a specific plant, and a licensee's written comitments for assuring compliance with an:: operation within applicable NRC requirements and the plant-specific design ,
basis (including all modifications and additions to such comitments over the '
I life of the license) that are docketed and in effect. The CLB includes the NRC regulations contained in 10 CFR Parts 2, 19, 20, 21, 30, 40, 50, 51, 55, 72, 73, 100 and appendices thereto; orders; license conditions; exemptions, and Technical j Specifications (TS). It also includes the plant-specific design basis information defined in 10 CFR 50.2 as documented in the most recent Final Safety Analysis Report (FSAR) as required by 10 CFR 50.71 and the licensee's comitments remaining in effect that were made in docketed licensing correspondence such as .
licensee responses to NRC bulletins, generic letters, and enforcement actions, as well as licensee comitments documented in NRC safety evaluations or licensee event reports.
2.2 Cesian Basis Design basis is that body of plant-specific design bases infornfation defined by 10 CFR 50.2.
2.3 Decraded Condition A condition of an SSC in which there has been any loss of quality or functional capability.
2.4 Nonconformino Condition A condition of an SSC in which there is f ailure to meet requirements or licensee l
commitments. Some examples of nonconforming conditions include the following: ;
i
- 1. There is failure to conform to one or more applicable codes or standards specified in the FSAR.
- 2. As-built equipment, or as-modified equipment, does not meet FSAR design requirements.
- 3. Operating experience or engineering reviews demonstrate a design inadequacy.
- 4. Documentation required by NRC requirements such as 10 CFR 50.49 is not available or deficient.
l 2.5 Full Oualification f Full qualification constitutes conforming to all aspects of the current licensing basis, including codes and standards, design criteria, and comitments.
9900 Degraded Conditions Issue Date: 10/31/91 l
l . !
3.0 BACKGROUND
A nuclear power plant's SSCs are designed to meet NRC requirements, satisfy the For current licensing basis, and conform to specified codes and standards.
degraded or nonconforming conditions of these SSCs, the licensee may be required to take actions required by the Technical Specifications (TS). The provisions of Title 10 of the Code of Federal Regulations (10 CFR), Part 50, Appendix B, Criteria XVI, may apply requiring the licensee to identify promptly and correct conditions adverse to safety or quality. Reporting may be required in accordance with Sections 50.72, 50.73, and 50.9(b) of 10 CFR Part 50,10 CFR Part 21, and ine Technical Specifications (TS). Collectively, these requirements may be viewed as a process for licensees to develop a basis to continue operation or to place the plant in a safe condition, and to take prompt corrective action.
Changes to the facility in accordance with 10 CFR 50.59 may be made as part of the corrective action required by Appendix B. The process displayed by means of the attached chart titled, " Resolution of Degraded and Nonconforming Conditions,"
recognizes these and other provisions that a licensee may follow to restore or establish acceptable conditions. These provisions are success paths that enable licensees to continue safe operation of their facilities.
4.0 DISCUSSION OF NOTABLE FROVISIONS 4.1 Public Health and Safety ,
All success paths, whether specifically stated or not, are first directed to ensuring public health and safety and second to restoring the systems, structures, or components (SSCs) to the current licensing basis of the plant as an acceptable level of safety. Identification of a degraded or nonconforming l
l condition that may pose an immediate threat to the public health and safety requires the plant to be placed in a safe condition.
Technical Specifications (TS) address the safety systems and provide Limiting Conditions for Operation (LCOs) and Allowed Outage Times (A0Ts) required to ensure public health and safety.
4.2 Operability Determinations 9900, for guidance on operability see the Inspection Manual, Part
' OPERABLE /0PERABILITY: ENSURING THE FUNCTIONAL CAPABILITY OF A SYSTEM OR COMPONENT," and see the Inspection Manual Part 9900, ' STANDARD TECHNICAL SPECIFICATIONS STS SECTION I, OPERABILITY."
4.3 The Current Licensino Basis and 10 CFR 50. Aeoendix B 4.3.1 10 C'R 50, Appendix B l The design and operation of a nuclear plant is to be consistent with the current licensing basis. Whenever degraded or nonconforming conditions of SSCs subject to Appendix B are identified, Appendix B requires prompt corrective action to correct or resolve the condition. The timeliness of this corrective action should be commensurate with the safety significance of the issue.
9900 Degraded Conditions Issue Date: 10/31/91
. . l
\
l l
4.3.2 Changing the Current Licensing Basis !
to Satisfy an Appendix B Corrective Action
!. licensee may change the design of its plant as described in the FSAR in accordance with 10 CFR 50.59 at any time. Whenever such changes are sufficient to resolve a degraded or nonconforming condition involving an SSC that is subject both to Appendix B and 50.59, they may be used to satisfy the corrective action requirements of Appendix B, in lieu of restoring the affected equipment to its original design. However, whenever such a change involves a unreviewed safety question (U50) or change in a Technical Specification (TS), the licensee must l obtain a license amendment in accordance with 10 CFR 50.90 prior to operating the l plant with the degraded or nonconforming condition. In order to resolve the degraded or nonconforming condition without restoring the affected equipment to 1 J
its original design, a licensee may need to obtain and exemption from 10 CFR 50 in accordance with 10 CFR 50.12, or relief from a design code in accordance with 10 CFR 50.55a. The use of 10 CFR 50.59, 50.12 or 50.55a in fulfillment of Appendix B corrective action requirements does not relieve the licensee of the responsibility to determine the root cause, to examine other affected systems, or to report the original condition, as appropriate.
Further guidance on 10 CFR 50.59 is provided in the NRC Inspection Manual, Part 9900. "50.59 Changes, Testing, and Experiments." . j 4.4 Discovery of an Existino But Previous 1v Unanalvred Condition or Accident In the course of its activities, the licensee may discover a previously ;
unanalyzed condition or accident. Upon discovery of an existing but previously i l unanalyzed condition that significantly compromises plant safety, the licensee shall report that condition in accordance with 10 CFR 50.72 and 50.73, and put i
]
the plant in a safe condition. l For a previously unanalyzed condition or accident that is considered a significant safety concern, but is not part of the design basis, the licensee may subsequently be required to take additional action after consideration of backfit ;
issues (see Section 50.109(a)(5)).
4.5 Justification for Continued Ooeration (JC01 4.5.1 Background The iicense authorizes the licensee to operate the plant in accordance with the regulations, license conditions and the TS. If an SSC is degraded or nonconforming but operable, the license provides authorization to operate and the licensee does not need further justification. The licensee must, however, promptly identify and correct the condition adverse to safety or quality in accordance with 10 CFR Part 50, Appendix B, Criterion XVI.
Under certain defined and limited circumstances, the licensee may find that strict compliance with the TS would cause an unnecessary plant action not in the i best interest of public health and safety. NRC review and response is required i prior to the licensee taking actions that are contrary to compliance with the license conditions or TS unless an emergency situation is present such that 10 9900 Degraded Conditions Issue Date: 10/31/91 l
l
1 -.- -.a . s - .a n. . . ..uu .x . .,.a . . - . an- - , ,, , _ , , , . . - - _ - . ,
l CFR 50.54(X) is applied. A JCO, as defined herein for general NRC purposes, is the licensee's technical basis for requesting NRC responses to such action.
I 4.5.2 JC0 Definition ,
A Justification for Continued Operation' (JCO) is the licensee's technical basis for recuesting authorization to operate in a manner that is prohibited (e.g.,
outside TS or license) absent such authorization. The preparation of JCOs does not constitute authorization to continue operation.
I 4.5.3 Items for Consideration in a JC0 l
Some items which are appropriate for consideration in a licensee's development of a JC0 include:
l o Availability of redundant or backup equipment o Compensatory measures including limited administrative controls l
o Safety function and events protected against o Conservatism and margins, and l 0 Probability of needing the safety function. l o PRA or Individual Plant Evaluation (IPE) results that detemine how ;
operating the facility in the manner proposed in the JC0 will impact the core damage frequency.
l
~
1 I
a.5.4 Discussion of Industry-Type JCOs Currently, some licensees refer to two other documents or processes as JCOs that t are not equivalent to and do not perform the same function as the NRC-recognized JC0 (as defined in 4.5.2). This is an acceptable industry practice and to the l
i extent the industry JC0 fulfills other NRC requirements, the JCOs will be selectively reviewed and audited accordingly. l In the first industry-type JCO, the licensee may consider the entire process depicted in the attached chart as a single JC0 that includes such things as the basis for operability, PRA, corrective action elements, and alternative operations.
~
In the second industry-type JCO, the licens'ee may consider the documentation that is developed to support facility operation after the operabliity decision has been made as a JCO. This documentation can cover any or all of the items listed under " Interim Operation" on the attached chart.
' Regulations, generic letters, and bulletins may provide direction on specific issue JCOs, which do not require that they be submitted. Licensees may also use the JC0 for situations other than for operating in a prohibited manner.
The JC0 term has been used in Generic letters 88-07 on Environmental Qualifications of Electrical Equipment and 87-02 on Seismic Adequacy. Licensees should continue to follow earlier guidance regarding the preparation of JCOs on specific issues.
9900 Degraded Conditions Issue Date: 10/31/91 l
i i *.
k -
l l
l Although the "JC0" is used differently by some licensees, the NRC concern is that the operability decision is correct, documentation of licensee's actions are appropriate, and submittals to the NRC are complete. The licensee's ,
dscumentation of the JCO's is normally proceduralized through the existing plant record system, which is auditable.
4.6 Reasonable Assurance of Safety For SSCs that are not expressly subject to TS and that are determined to be inoperable, the licensee should assess the reasonable assurance of safety. If the assessment is successful, then the facility may continue to operate while prompt corrective action is taken. Items to be considered for such an assessment include the following:
o Availability of redundant or backup equipment !
o Compensatory measures including limited administrative controls o Safety function and events protected against o Conservatism and margins, and o Probability of needing the safety function.
o FRA or Individual Plant Evaluation (IPE) results that determine how operating the facility in the manner proposed in the JC0 will impact the core damage frequency. .
5.0 AEFERENCE See attached chart on next page titled, " Resolution of Degraded and Nonconforming conditions.*
l 9900 Degraded Conditions Issue Date: 10/31/91
l ..
l
!! $i l!iII i
- 11. [ jest l '. .
g
^ .
i ! j E i
- is i I l !!
et rIIIr>l ,lil
.. :i e I
l /
.) 1 T N i
E
! !! , 'l i E El 8
!l }
5 i i I!
h~
ili in si !!*iB j T
, 1I,I 8 i 's _ E
[ t
! _E I *5 5 I I i[g g 8 2
l liss !! !);ri I a -
1 i it isti Icili li ~
\ l ,
) l l E 1!1 I!
l ;!0li ll!
l E, 1 r N i I !l i T l l
,l{
i j;p l ; I i o, i yi l
i.- .
i1 i I
!o!I i, !
e 11 il l'li.j 'jllli.ii !I,& i 1'9;i
- i 5
. END 5 s j 7 9900 Degraded Conditions Issue Date: 10/31/91 l
ENCLOSURE 2 f' .. u , ,' * ., UNITED STATES
/' . NUCLEAR REGU' ATORY COMMISSION g wasw%GTON. D C Ee86
\' - -
'l NRC INSPECTION MANUAL OTSB PART 9900: TECHNICAL GUIDANCE l OPERABLE /0PERABILITY:
ENSURlhG THE FUNCTIONAL CAPABILITY OF A SYSTEM OR COMPONENT l
I l
\
l
)
i i
l -
i l
l 1
\
\
l \
l
- Issue Data
- 20/31/91 9900 Operability l
. '. i
.- r OPERA 3LE/0PERABILITY:
ENSURING THE FUNCTIONAL CAPABILITY OF A SYSTEM OR COMPONENT Table of Contents f.1SLt 1.0 PURPCSE AND SCOPE.... . .......................................I l 2.0 DEFINITIONS............ ......................................... 2 2.1 Current Licensing Basis.. ................................. 2 2.2 Design Basis. ... ......................................... 2 2.3 Degraded Condition...... .................. ............... 2 2.4 Nonconforming Condition.................................... 2
~
, 2.5 F u l l Q u a l i f i c a t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ,. . . . . 2 3.0 STANDARD TECHNICAL SPECIFICATION OPERABILITY DEFINIT ION AND DISCUSSION . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 l 3.1 Operability Definition..................................... 3 L
3.2 Variation of Operability Definition in Plant Specific TS... 3 !
3.3 Specified Function (s)...................................... 3 3.4 Support System Operability - .
Understanding System Interrelationships............ ....... 3 i
4.0 BACKGROUND
...................................................... 4 !
5.0 ADDITICMAL GUIDANCE FOR OPERABILITY DETERMINATIONS. . . . . . . . . . . . . . . 5 i
Focus on Safety............................................ 5 [
5.1 i
5.2 Full Qualification......................................... 6 ;
i 5.3 Deal with Operability and Restoration of Quali fication Separately. . . . . . . . . . . . . . .. . .. . 6 !
5.4 Determining Operability and Plant Safety is a Continuous Decision-Making Process.................................... 7 :
5.5 Timeliness of Operability Determinations. . . . . . . . . . . .. .... . . 7 3 i
s, 9900 Operability .i. Issue Date: 10/31/91
OPERABL E/0PERABILITY:
ENSURING THE FUNCTIONAL CAPABILITY OF A SYSTEM OR COMPONENT Table of Centents f.15Lt 5.0 ADDITIONAL CU10ANCE FOR OPERABILITY DETERMINATIONS (continued) 5.6 Timel i ne s s of Corrective Action. . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1
5.7 Just i fication for Continued Operation. . . . . . . . . . . . . . . . . . . . . . 7 l 6.0 DETAILED DISCUS $10N OF SPECIFIC OPERABILITY ISSUES. . . . . . . . . . . . . . .. 8 5.1 S:cce an Timing of Operability Determinations. . . . . . . . . . . . . 8 i l
6.2 Treatment of Single Failures j in C;erability Determinations.............................. 9 l
6.7.1 De fi ni t t en o f Singl e Failure. . . . . . . . . . : .,. . . . . . . 9 i
6.2.2 Capability to Withstand a Single Failure <
is a Design Consideration...................... 9 l
6.2.3 Discovery of a Design Deficiency in Which Capability to Withstand a singl e Fa il ure i s Lost. . . . . . . . . . . . . . . . . . . . . . 10 '
6.3 Treatment of Consequential Failures in Ope ra bili ty De t e rmin a t i ons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 6.3.1 Definition of Consequential Failure. . . . .. . . . . .10 6.3.2 Consequential Failures and Operability Determinations.................... 10 l 6.3.3 Consequential Failures and Appendix B.... . . .. .10 l 6.4 Operabili' Le, i a TS Surveillances and Prev .tyd Na 'anance................................ 10
( 6.5 Surveillance and Operability Testing ,
i in S a fety Configu rati on. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 i 6.6 Missed Technical Specificat ion Surveill ance. . . . . . . . . .. . . . .12 I 6.7 Use of Manual Action in Place of Automatic Action.........12 ;
1 j
Issue Date: 10/31/91 .ti. 9900 Operability
- - - - - . , , - . . r . . - . . - e - -- -- .-m m ,--.. r--
r . . . * ~ , . . . . - .,
i i
l OPERABLE /0PERABILITY:
i ENSURING THE FUNCTIONAL CAPABILITY OF A SYSTEM OR COMPONENT l
Table of Contents '
i 4
EAA1 i
5.0 DETAILED 01~CUSSION OF SPECIFIC OPERABILITY ISSUES (continued)
- Indeterminate
- State of Operability...................... 13 i 6.8 6.9 Use of Probabilistic Risk Assessment in Operability Decisions.................................. 14 l 6.10 Environment al Quali ficat ion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . !( l i
6.11 Technical Specification Operability vs.
ASME Code.Section XI Operative Criteria.................. 15 6.12 S uppo r t Sy s tem Ope ra bil i ty . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . 16 6.13 Piping and Pipe Support Requirements............'.......... 17 i 6.14 Flaw Evaluation........................................... 18 6.:5 Operational Leakage....................................... 19 l l 6.16 Structural Requirements................................... 19 l f
1 l
9900 Operability -iit. Issue Date: 10/31/91
OPERABLE /0PERABILITY:
ENSURING THE FUNCTICNAL CAPABILITY OF A SYSTEM OR COMPONENT 1.0 PURPOSE 'ND SCOPE To provide guidance to NRC inspectors for the review of licensee operability ceterminations af fecting the following systems, structures, or components (SSCs):
(i) Safety-related SSCs, which are those relied upon to remain functional curing and following design basis events (A) to ensure the integrity of the reactor coolant pressure boundary, (B) to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition, or (C) to ensure the capability to prevent or mitigate the consequences of accidents that could result in potential offsite consequences comparable to the 10 CFR Part 100 guidelines. Design basis events are defined the same as in 10 CFR 50.49(b)(1).
(ii) All SSCs whose failure could prevent satisfactory accomplishment of any of the required functions identified in (1) A,'B, and C.
(iii) All SSCs relied on in the safety analyses or plant evaluations that are a part of the plant's current licensing basis. Such analyses and evaluations include those submitted to support license amendment recuests, exemption remests, or relief requests, and those submitted to demonstrate compliance with the Comission's regulations such as fire protection (10 CFR 50.48), environmental qualification (10 CFR 50.49), pressurized thermal shock (10 CFR 50.61), anticipated transients without scram (10 CFR 50.62), and station blackout (10 CFR 50.63).
(iv) Any SSCs subject to 10 CFR Part 50, Appendix B.
(v) Any SSCs subject to 10 CFR Part 50, Appendix A, Criterion 1.
(vi) Any SSCs explicitly subject to facility Technical Specifications (TS).
(vii) Any $$Cs subject to facility TS through the definition of operability (i.e., support SSCs outside TS).
(viii) Any SSCs described in the FSAR.
\
i .
This guidance is directed tcward NRC inspectors that are reviewing actions of i licensees that hold an operating license. Although this guidance generally reflects existing staff practices, application on spectfic plants may constitute a backfit. Consequently, significant differences in licensee practices should be discussed with NRC management to ensure that the guidance is applied in a reasonable and consistent manner for all licensees.
Issue Date: 10/31/91 -1 9900 Operability-
l !
i .
l ,
2 i
2.0 CEr!N1T!CNS:
2.1 Cur ent Licensino Basss Current licensing basis (CLB) is the set of NRC requirements applicable to a !
specific plant and a licensee's written ccmmitments for assuring compliance with l and operatten within applicable NRC requirements and the plant-specific design '
basis (including all modifications and additions to such comunitments over the life of the license) that are dockeUd and in effect. The CL8 includes the NRC i regulations contained in 10 CFR Parts 2, 19, 20, 21, 30, 40, 50, 51, 55, 72, 73, 100 ano appendices thereto; orcers; license conditions; exemptions, and Technical .
Specifications (TS). It also includes the plant-specific design basis ,
informatien defined ia 10 CFR 50.2 as documented in the most recent Final Safety i Analysis Report (FSAR) as required by 10 CFR 50.71 and the licensee's connitments l remaining in effect that wtre made in docketed licensing correspondence suen as t licensee responses to NRC bulletins, generic letters, and enforcement actions, l as well as licensee commitments documented in NRC safety evaluations or licensee j event reports. }
2.2 Des'en Basis ;
~
Design basis is that body of plant specific desigr;bnes information defined by 10 CFR 50.2. .
2.3 Decraded Cendition ]
A condition of an SSC in which there has been any loss of quality or functional !
capability. l 2.4 Noncenfermina Condition t
l A condition of an SSC in which there is failure to meet requirements or licensee !
commitments. Some examples of nonconforming conditions include the following: j
- 1. There is failure to confom to one or more applicable coces or ,
standards specified in the FSAR. i
- 2. As-built equipment, or as-modified equipment, does not meet FSAR j design requirements.
- 3. Operating experience or engineering reviews demonstrate a design inadequacy. .
- 4. Documentation required by NRC requirements such as 10 CFR 50.49 is not available or deficient.
2.5 Full Qualification Full qualification constitutes confoming to all aspects of the current iteensing basis, including codes and standards, design criteria, and commitments.
1 i
9900 Operability Issue Date: 10/31/91
{
3.0 STAN?s:D TECuNIC AL SPECIFIC ATIONS OPEDABillTY DEFINITION aND DISCUSSION 3.1 Orerability Definition The Standarc Technical Specifications (STS) define operable or operability as i follows:
'A system, subsystem, train, component, or device shall be OPERABLE or have CPERABILITY when it is capable of performing its specified functions, and when all necessary attendant instrumentation, controls, electrical power, cooling or seal water, lubrication or other auxiliary equipment that are required for the system, subsystem, train, component, or device to perform its function (s) are also capable of perfoming their related l support function (s).'
l 3.2 Variatiens of Ocerability Definition in Plant Soecific TS There are se e al variations in existing plant specific TS of the above basic cefinition. Therefore, some judgement is required in application of this guidance on operability. Word differences that exist are not viewed by the NRC to imply any significant overall difference in application of the plant specific TS. Any problems that result from existing inconsistencies' between a plant specific definition of operability and this guidance should be' discussed with regional management, who. should discuss the issues with NRR if deemed necessary.
In all cases, a licensee's plant-specific definition is governing.
3.3 Soecified Function (s)
, The definition of operability refers to capability to perform the "specified l functions." The specified function (s) of the system, subsystem, train.
l component, or device (hereafter referred to as system) is that specified safety function (s) in the current licensing basis for the facility.
In addition to providing the specified safety function, a system is expected to i perform as designed, tested and maintained. When system capability is degraded to a point where it cannot perform with reasonable assurance or reliability, the system should be judged inoperable, even if at this instantaneous point in time the system could provide the specified safety function. See Section 6.11, which l discusses ASME Section XI, for an example.
3.4 Suenort System Doerability - Understandina System Interrelationshins The definition of operability embodies a principle that a system can perform its specified safety function (s) only when all its necessary support systems are capable of performing their related support functions. Therefore, an NRC inspector should expect that each licensee understands which support systems are necessary to ensure the operability of main systems and components that perform specified safety functions. Such an understanding is mandatory. Otherwise the licensee will not be able to implement the definition of operability.
l
!ssue Date: 10/31/91 9900 Operability l --
l l t 4.0 BACKG:t0VND The purpose of the Technical Specifications is to ensure that the plant is operated within its design basis and to preserve the validity of the safety ;
analyses, which are cencerned with both the prevention and mitigation of '
acc1 cents. Because both prevention of accidents and the ability to mitigate them >
must te continuously ensured, the process of ensuring OPERABILITY for safety or safety support systems is ongoing and continuous. The focus of operability is ;
foremost on the capability to ensure safety. j The process of ensuring operability is continuous and consists of the verification of operability by surveillances and formal determinations of ,
operability whenever a verification or. other indication calls into question the !
system's or component's ability to perform its specified function. <
I Verification of operability is supplemented by continuous and ongoing processes such as:
o Day-to-day operation of the facility o Implementation of programs such as inservice testing and inspection o Plant walkdowns or tours -
o Observations from the control room o Quality assurance activities such as audits and reviews i o Er.gineering design reviews including design basis reconstitution. !
Without any information to the contrary, once a component or system is ,
established as operable, it is reasonable to assume that the component or system !
should continue to remain operable, and the previously stated verifications should provide that assurance. However, whenever the ability of a system or structure to perform its specified function is called into question, operability must be determined from a detailed examination of the deficiency. i The determination of operability for systems is to be made promptly, with a I timeliness that is commensurate with the potential safety significance of the issue. If the licensee chooses initially not to declare a system inoperable, the '
licensee must have a reasonable expectation that the system is operable and that the prompt determination process will support that expectation. Otherwise, the
- licensee should immediately declare the system or structure inoperable. Where there is reason to suspect that the determination process is not, or was not prompt, the Region any discuss with the licensee, with NRR consultation as .
appropriate, the reasoning for the perceived delay. !
The T5 establish operability requirements on systems required for safe operation and include surveillance requirements to demonstrate periodically that these systems are operable. Performance of the surveillance requirement is usually considered to be sufficient to demonstrate operability provided that there is reasonable assurance that the systea continues to conform to all appropriate l criteria in the current licensing basis (CLB). Whenever conformance to the appropriate criteria in the CLB is called into question, performance of the surveillance requirement alone is usually not sufficient to determine operability.
9900 Operability Issue Date: 10/31/91
__ _ __ , .e~
knen operability verification or other processes indicate a potential deficiency or loss of quality, licensees should make a prompt determination of operability and act on the results of that determination. The licensee should also restore the quality of the system in accordiace with 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action.
5.0 ADDITIONAL GUIDANCE FOR OPERABILITY DETERMINATIONS In the course of review activities or through normal plant operation, a licensee may tecome aware of degraded or nonconforming conditions affecting the SSCs '
defined in Section 1. These activities include, but are not limited to, the following:
o Review of operational events o Design modifications to facilities o Examinations of records o Additions to facilities o Vender reviews or inspections o Plant system walkdowns.
These and other paths for identifying degraded or nonconforming conditions, includtr.g reports from industry and other utilities, should result in the prompt identification and correction of the deficiency by the licenser. Licensees should make an operability determination and take follow-on corrective action in the following circumstances:
o Discovery of degraded conditions of equipment where performance is called into question o Discovery of nonconforming conditions where the qualification of equipment (such as conformance to codes and standards) is called into question o Discovery of an existing but previously unanalyzed condition or accident. NOTE: For a previously unanalyzed condition or accident that is considered a significant safety concern, but is not part of the design basis, the licensee may subsequently be required to take
- additional action after consideration of backfit issues (See 10 CFR 50.109 (a)(5)).
The following guidance for dealing with issues that are closely associated with operability determinations has been derived from the NRC regulations and from previous guidance issued to licensees.
5.1 Focus on Safety i The immediate and primary attention must be directed to safety concerns.
Reporting and procedural requirements should not interfere with ensuring the health and safety of the public. To continue oper.ation while an operability determination is being made, the licensee must have a reasonable expectation that the systes is operable and that the determination process will support that expectation.
s.,
Issue Date: 10/31/91 9900 Operability l
- , . .-- ... . ~ . . -
l l
5.2 Full Qualification Full cualification constitutes conforming to all aspects of the current licensing basis, including codes and standards, design criteria, and commitments.
The 55Cs defined in section 1 are designed and operated, as described in the current licensing basis (CLB), to include design margins and engineering margins I of safety to ensure, among other things, that some loss of quality does not mean i imediate f ailure. The CLB includes comitments to specific codes and standards, j design criteria, and some regulations that also dictate margins. Many licensees add conservatism so that a partial loss of quality does not affect their comitments to the margins. The loss of conservatism not taken credit for in the safety analyses and not comitted to by the licensee to satisfy licensing requirements does not require a system to be declared inoperable. All other losses of quality or margins are subject to an operability determination and ;
corrective action.
5.3 Deal with Orerability and Restoration of Oualification Seoaratelv l
Operability and qualification are closely related concepts. However, the fact that a system is not fully qualified does not, in all cases, render that system ;
unable to perform its specified function if called upon.- According to the '
definition of operability, a safety or safety support system or structure must ,
te capable of performing its specified function (s) of prevention or altigation '
l as described in the current licensing basis, particularly the TS bases or FSAR. l l
l The prompt determination of operability will result in decisions or actions ,
l pertaining to continued plant operation, while qualification or requalification i t
becomes a corrective action goal. Qualification concerns, whether it is a lack l of required quality or loss of quality because of degradation, can and should be i promptly considered to determine the effect of the concern on the operability of the system.
If operability is assured based on this prompt determination, plant operation can continue while an appropriate corrective action program is implemented to restore l full qualification. This is consistent with the plant TS being the controlling i document for making decisions about plant operations, while 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, is the requirement document for dealing with restoring equipment qualification.
The principle of treating the related concepts of operability and restoration of qualification separately is to ensure that the operability determination is l l focused on safety and is not delayed by decisions or actions necessary to plan or implement the corrective action, i.e., restoring full qualification. l 9900 Operability Issue Date: 10/31/91
.~.
l 5.4 Deter-inine coerability and Plant Safety is a Continuous Decision Makino P-ocess Licensees are cbligated to ensure the continued operability of SSCs as specified by TS, or to take the remedial actions addressed in the TS. For other SSCs which may be in a degraded or nonconforming condition, it must be determined whether a condition adverse to quality exists and whether corrective actions are needed.
Operability is verified, as discussed above, by day to-day operation, plant tours, observations from the control room, surveillances, test programs, and o'her similar activities. Deficiencies in the design basis or safety analysis i or problems identified by the operability verification lead to the operability i determination process by which the specific deficiency and overall capability of the component or system are examined. The process, in one form or another, is j ongoing and centinuous. As a practical matter, decision making requires good j infomation and takes time. However, the process used by licensees should call for prompt and continuous attention to deficiencies and potential system inoperabilities. In addition, the licensee's process should call for imediately declaring eculpment inoperable when reasonable expectation of operability does not exist or mounting evidente suggests that the final analysis will conclude l that the equipment cannot perform its specified safety function (s). l 5.5 Tireliress of Ooerability Determinations -
Timeliness of operability determinations should be comensurate with the safety l significance of the issue. Once the deficiency has been identified and the i specific component or system has been identified, the determination can be made regarding the capability to perform the specified function (s). There is not an explicit requirement in the regulations for the timing of the decision. As discussed further in Section 6.0, timeliness is important and is determined by l
the safety significance of the issue. The Allowed Outage Times (A0Ts) contained in TS grerally provide reasonable guidelines for safety significance.
5.6 Timeliness of Corrective Action Timeliness of corrective action (i.e., the requirements in 10 CFR Part 50, l Appendix B, Criterion XVI, for " prompt" corrective action) should be comensurate with the safety significance of the corrective action. j The determination of operability establishes a basis for plant operation while !
the corrective action establishes or re-establishes the design j basis / qualification of the safety or safety support system. As in Section 5.5 j above, there is no explicit requirement in the regulations for timeliness of ;
i these corrective actions, except that 10 CFR Part 50, Appendix B, Criterton IV! !
! requires it to be ' prompt'. Again, timeliness is determined by the safety l significance of the issue. l 5.7 Justification for Continued Ooeration See the NRC Inspection Manual, Part 9900 Technical Guidance, ' Resolution of Degraded and Nonconfoming Conditions," for guidance on JC0s.
l Issue Date: 10/31/91 9900 Operability
-- ~ , _ . _ -
_.~ . __ _ . _ __ - _ _ , .l
. . t t
6.0 DETAltED DISCUSSION OF SPECIFIC OpERABillTY ISSUES 6.1 Stere and Timine of Operability Determinations Determining system, structure, or component (SSC) operability is a continuous process that cannot be avoided. Action is required any time an SSC that is required by TS or h'RC requirement to be operable is found to be inoperable If an imediate threat to public health and safety is identified, action to place the plant in a safe condition should begin as soon as this circumstance f; known and should be completed expeditiously.
Once a degraded or nonconforming condition of specific SSCs is identified, an !
operability determination should be made as soon as possible consistent with the ,
safety importance of the SSC affected. In most cases, it is expected that the decision can be made imediately (e.g., loss of motive power, etc.). In.other cases it is expected the decision can be made within approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of discovery even though complete information may not be available. Some few exceptional cases may take longer. For SSCs in TS, the Allowed Outage Times -
POTS) centained in TS generally provide reasonable guidelines for safety significance. For SSCs outside TS, engineering judgement must be used to determine safety significance. The decision should be based on the best information available and must be predicated on the licensee's reasonable expectation that the SSC is operable and that the prompt determination process will support that expectation. When reasonable expectation does not exist, the SSC should be declared inoperable and the safe course of action should be taken.
The licensee should examine the full scope of the current licensing basis, including the TS and FSAR commitments, to establish the conditions and performance requirements to be met for determining operability. The operability decision may be based on analysis, a test or partial test, experience with operating events, engineering judgment, or a combination of these factors taking into consideration equipment functional requirements. An initial determination l regarding operability should be revised, as appropriate, as new or additional l information becomes available.
The scope of an operability determination needs to be sufficient to address the l capability of the equipment to perform its safety function (s). Operability determinations should therefore include the following actions:
o Determine what equipment is degraded or potentially nonconforving.
o Determine the safety function (s) performed by the equipment.
o Determine the circiatinces of the potential nonconformance, including the possible failure mechanism.
o Determine the requirement or comitment established for the equipment, and why the requirement or cosnitment may not be met.
o Detemine by what means and when the potentially noaconforming equipment was first discovered.
9900 Operability Issue Date: 10/31/91
j I
o Determine safest plant configuration including the effect of transitional action.
o Determine the basis for declaring the affected system operable, through: ;
- a. analysis ;
- b. test or partial test, i
- c. operating experience, and l
- d. engineering judgement. ;
If an NRC-approved action (such as provided in an 1.C0 action statement) is )
imediately taken to compensate for failed equipment (e.g., placing one channel j of reactor protection in the tripped condition upon failure of the channel such j that the specified safety function can be maintained), continued operation of the facility is permitted.
t i
However, continued operation with an inoperable channel in the tripped condition l is not advisable because a subsequent failuce will result in a plant trip that '
l will challenge plant safety systems. It is also not advisable from the
! standpoint of plant availability.
t 6.2 Treatment of Sincle Failures in Ooerability Determinati~ ens 6.2.1 Definition of Single Failure 10 CFR Part 50, Appendix A. " General Design Criteria for Nuclear Power Plants,"
defines a single failure as:
"A single failure means an occurrence which results in the loss of capability of a component to perform its intended safety functions.
Multiple failures resulting from a single occurrence are considered to be
! a single failure."
6.2.2 Capability to Withstand a Single Failure is a Design Consideration Appendix A contains general design criteria (GDC) for SSCs that perfore major safety functions. Many of the GDC contain a statement similar to the following:
" Suitable redundancy in components and features and suitable interconnections, leak detection, isolation and containment capabilities shall be provided to assure that for. onsite electrical power' system operation (assuming offsite power in - not available) and for offsite electrical power system operation (assuming onsite power is not available) the system safety function can be accomplished assumina a sinale failure."
See, for example, GDC 17, 34, 35, 38, 41, 44. Therefore, capability to withstand a single failure in fluid or electrical systems is a plant-specific design-consideration, which ensures that a single failure does not resu' t in a loss of the capability of the system to perform its safety functions. i l
l
[
Issue Date: 10/31/91 .g. 9900 Operability
6.2.3 Discovery of a Design Deficiency in Which Capability to Withstand a Single Failure is Lost A desiga deficiency in which capability to withstand a single failure is lost, should be evaluated and treated as a degraded and nonconforming condition. As with any degraded or nonconforming condition, a prompt determination of operability is required.
For any cesign deficiency in which the capability to withstand a single failure is lost. the licensee must address the quality aspects and if the design deficiency affects the design basis requirements for the particular plant, promptly correct the deficiency in accordance with 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action.
6.3 Treat ent of Consecuential Failures in Oeerability Determinations 6 3.1 Definition of Consequential Failure A consecuential failure is a failure of an SSC caused by a postulated accident within the design basis. For example, if during a loss of coolant accident
! (LOCA) (a design basis event), the broken pipe could whip and incapacitate a l nearby pump, then the pump would not be able to function. Such a pump failure is called a consequential f ailure because the pump failed as'a result of the design basis event itself. In general, facility design takes any such l consequential failures that are deemed credible into consideration. In this
! case, that would mean that the broken pump was not one that the safety analysis would take credit for to mitigate the LOCA.
6.3.2 Consequential Failures and Operability Determinations Operability determinations should oe performed for those potential consequential failures (i.e., an SSC failure that would be a direct consequence of a design basis event) for which the SSC in question needs to function. Where consequential failures would cause a loss of function needed for lietting or ultigating the effects of the event, the affected SSC is inoperable because it cannot perform all of its specified functions. Such situations are most itkely discovered during design basis reconstitution studies, or when new credible failure modes are identified.
6.3.3 Consequential Failures and Appendix 8 With any consequential failure, the licensee must address the quality aspects and if the failure affects the design basis requirements for the particular plant, promptly correct the deficiency in accordance with 10 CFR Part 50, Appendix 8, l Criterion XVI, Corrective Action.
6.4 Deerability Durino TS Surveillances and Preventive Maintenance During preventive maintenance (PM), equipment may be removed from service and rendered incapable of performing the function (s) specified for safety. This equipment is clearly inoperable. For equipment subject to the; Technical 9900 Operability Issue Date: 10/31/91
- 1 l, .
-]
t l
4 i
l l Specifications'(TS), the PM activity and any other action that may be required j by the Limiting Conditions for Operation (LCOs), is expected to be completed within the Allowed Outage Time (A0T). For safety equipment not subject to the
! TS either explicitly by direct inclusion in the TS or implicitly through the I
! definition of operability, the licensee's PM activities should be consistent with the importance of the equipment to safety and the function (s) of the equipment ;
and a reasonable time goal should be set to complete the PM. j i
- In all cases, care should be exercised in removing equipment from service for PM j to avoid accumulating long out of-service times of safety trains. The licensee
- should reestablish operability before the equipment is returned to service. The .
i licensee also may need to reestablish operability for systems or components, in i whole or in part, that are actively dependent upon the equipment undergoing the ;
PM activity. The need for testing to reestablish operability should be based on a reasonable judgement about how the inoperable equipment may have been affected. ]
If retesting to reestablish operability is not possible or practicable because l of safety concerns, analysis or other means should be used to demonstrate l operability.
{ J
- 1 i If TS surveillances require that safety equipment be removed from service and
- rendered incapable of performing its safety function, the equipment is i inoperable. The LCO action statement shall be entered unless the TS explicitly ;
direct otherwise. Upon completion of the surveillance, the licensee should :
verify restoration to operable status of at least those portions of the equipment ;
or system features that were altered to accomplish the surveillance. )
- I NOTE
- With regard to surveillances or other similar activities (such as l inservice testing) that render systems inoperable for extended periods (i.e., those that may exceed the Allowed Outage Time (A0T)), licensees <
j must have prior NRC approval by license amendment for the surveillance ;
s requirement or redefine the tests. It is not the intent of surveillances !
j or other similar program requirements to cause unwarranted plant shutdowns i j or to unnecessarily challenge other safety systems. j 1 1 i See " Maintenance - Voluntary Entry into Limiti tem i Statements to Perf9W9Wesetve femintenance;* nspect<pferDration on Kaneal, PartActions 9900, j Technical Guidance.
} ~
! 6.5 surveillance and coerability Testina in Safety Confiauration i .
j Many systems are designed to perform both normal operational and safety j functions. It is preferable that both the Technical Specification (TS)
{ surveillance requirement testing and any other operability testing be performed j in the same configuration as would be required to perfom the safety function, i 1.e., safety mode. However, testing in the nomal configuration or mode of
- operation may be required for systems if testing in the safety mode will result
- in unwarranted safety concerns or transients. The mode of operation for the TS
- surveillance requirements test is usually prescribed and the acceptance criteria
- are estabitshed on that basis.
i l If a system should fail while it is'being tested in the safety mode of operation, the system is to be declared inoperable. For ongoing periodic testing that must i i
! l.
2 1 Issue Date: 10/31/91 9900 Operability
, __ . -_ . _ - ~ _ , _ _ _ _ _ _ _ _ _ _ . _ _ _ . _ . - _ _ . . . , - . . _ _ , _ _ _ _ _ . . _
~l; I
be performed during normal mode operation. the licensee should establish normal mode operational acceptance criteria that are based on a direct relationship to the safety mode requirements. Operability verification is then provided by acceptable normal mode operational test results.
Test failures should be examined to determine the root cause and correct the i problem before resumption of testing. Repetitive testing to achieve acceptable l test results without identifying the root cause or correction of any problem in i a previous test is not acceptable as a means to establish or verify operability. !
l l
6.6 Missed Technical Soecification Surveillance The Standard Technical Specifications (STS) contain Surveillance Requirement j 4.0.3 which states:
" Failure to perform a Surveillance Requirement (thin the specified time interval shall constitute a failure to meet the OPERABILITY requirements for a Limiting Condition for Operation. Exceptions to these requirements-are stated in the individual specifications. Surveillance Requirements do not have to be performed on inoperable equipment." .
Plant-specific Technical Specification (TS) variations of this statement may ex1st, in which case the plant-specific TS govern.
The Allowed Outage Time (A0T) in the action requirements specifies a time interval that permits corrective action to be taken to satisfy the LCO. If such a time interval is specified in the action requirements or if the licensee has adopted by license amendment, the 24-hour provision of amended Surveillance l
Requirement 4.0.3 as discussed in Generic letter (GL) 87-09, the completion of l a missed surveillance within these time intervals meets the requirements. As with systems discovered to be inoperable, the time interval begins upon discovery of the missed surveillance. Failure to perform a TS requirement within the specified time interval is considered a condition prohibited by the TS and is l
reportable at least under 10 CFR Part 50.73; it also say be subject to enforcement action.
Generic Letter 87-09 and other documents provide extensive guidance on surveillance extension, applicability, and success criteria. The above discussion involves only the operability issues.
6.7 Use of Manual Action in Place of Automatic Action Automatic action is frequently provided as a design feature specific to each safety systes to ensure that the specified functions of the system will be accomplished. Limiting safety system settings for nuclear reactors are defined in 10 CFR Part 50.36, " Technical Specifications," as settings for automatic protective devices related to those variables having significant safety ;
functions. Where a limiting safety system setting is specified for a variable on which a safety limit has been placed, the setting must be so chosen that automatic protective action will correct the abnormal situation before a safety limit is exceeded. Accordingly, it is not appropriate to take credit for manual s
9900 Operability -12 Issue Date: 10/31/91
l l
1 l J action in place of automatic action for protection of safety limits to consider i ecuipment operable. This does not preclude operator action to put the plant in i
l a safe condition, but cperator action cannot be a substitute for automatic safety j i limit protection.
l The licensing of specific plant designs includes consideration of automatic and manual action. While approvals have been granted for either or both type l I
actions, not every combination of circumstances has been reviewed from an 3'
' operability standpoint. Although it is possible, it is not expected that many i determinations of operability will be successful for manual action in place of 2
automatic action.
Credit for manual initiation to mitigate the consequences of :
j design basis accidents should have been established as part of the licensing review of a plant. l For any other situation in which substitution of manual action for automatic '
action may be acceptable, the licensee's determination of operability with regard focus on the physical differences between
' to the use of manual action must j
- automatic and manual action and the ability of the manual action to accomplish '
i the specified function. The physical differences to be considered '.nclude, but are not limited to, the ability to recognize input signals for action, ready access to or recognition of setpoints, design nuances that may complicate
" subsequent manual operation such as auto-reset, repositioning on temperature etc.,_ minimum manningor pressure, timing required for automatic action, requirements, and emergency operation procedures written for the automatic mode of operation. The licensee should hav_e written procedures in place and training accomplished on those procedures before substitution of any manual action for the ;
loss of an automatic action.
The assignment of a dedicated operator for manual action is not acceptable without written procedures and a full consideration of all pertinent differences.
The consideration of manual action in remote areas also must include the ability !
and timing in getting to the area, training of personnel to accomplish the task, i and occupational hazards to be incurred such as radiation, temperature, chemical, sound, or visibility hazards. One reasonable test of the reliability and !
i effectiveness of manual action may be the approval of manual action for the same function at a similar plant. Nevertheless, this is expected to be a temporary condition until the automatic action can be promptly corrected in accordance with 4
10 CFR Part 50 Appendix B, Criterion XVI, Corrective Action.
6.8 *Indeterwinate' State of Goerability An SSC is operable when it is capable of performing its specified function (s) and when all necessary support SSCs are also capable of performing their related support functions. See operability definition and discussion in Section 3.0.
Otherwise, the SSC is inoperable. When a licensee has cause to question the operability of an SSC, the operability determination is to se prompt; the timeliness must be commensurate with the potential safety significance of the issue. The determination process during this time; however, must be predicated on the licensee's reasonable expectation that the $$C is operable and that the prompt determination process will support that expectation. j 9900 Operability Issue Date: 10/31/91
- _ . . ~ , _ _.__ _ _ _ _ . - . _ _- _._-_
i In the absence of reasonable expectation that the SSC is operable, the SSC is to ,
te ceclared inoperable imediately. Subsequent evaluation may conclude that an SSC declared inoperable is in fact operable. The licensee's actions subsequent ;
to declaring an SSC inoperable are guided by the regulations, TS, plant procedures, and so forth. in addition, the licensee should detemine when and under what circumstances the system became inoperable so that reporting requirements may be met and NRC followup actions may properly reflect the circumstances and the licensee's efforts to correct and prevent recurrences. In sumary, an SSC is either operable or inoperable at all time. " Indeterminate" is not a recognized state of operability.
6.9 Use of Probabilistic Risk Assesswent in Ocerability Decisions Probabilistic risk assessment (PRA) is a valuable tool for the relative evaluation of accident scenarios while considering, among other things, the probabilities of occurrence of accidents or external events. The definition of operability states; however, that the SSC must be capable of perfoming its specified function (s). The inherent assumption is that the occurrence conditions or event exists and that the safety function can be performed. The use of PRA or probabilities of the occurrence of accidents or external events is not acceptable for making operability decisions. .
l However, PRA may provide valid and useful supportive information for a licensee l
amendment. The PRA is also useful for determining the safety significance of l SSCs. The safety significance, whether determined by PRA or other analyses, is l a necessary factor in decisions on the appropriate ' timeliness" of operability determinations. Specific guidance on the timeliness of determinations is presented in Section 5.5. j l
l 6.10 Environmental Oualification ,
1 When the NRC or licensee identifies a potential deficiency in the environmental I qualification of equipment (i.e., a licensee does not have an adequate basis to '
establish qualification), the licensee is expected to make a prompt determination l of operability, to take famediate steps to establish a plan with a reasonable
. schedule to correct the deficiency, and to write a Justification for Continued Operation (JCO) (See Note below), which will be available for NRC review. The licensee may be able to make a finding of operability using analysis and partial test data to provide reasonable assurance that the equipment will perform its safety function (s) in its accident environment when called upon to do so. The licensee should also show that subsequent failure of the equipment will not result in significant degradation of any safety function or provide misleading information to the operator.
NOTE: the JC0 referred to in . questions of equireent qualification is specifically addressed by Generic Letter 88-07 dated April 7,1908. This environmental qualification "JCo* includes an operability determination. It also states that the licensee should evaluate whether the findings are reportable under 10 CFR 50.72,10 CFR 50.73,10 CFR Part 21, the Technical specifications, ,
or any other pertinent reporting requirements, including 10 CFR 50.9. 1 9900 Operability Issue Date: 10/31/91
I The following actions should be taken if a licensee is unable to demonstrate !
equipment operability: ;
o for inoperable equipment in a system subject to the TS, the licensee shall follow the appropriate action statements. This could require i that the plant be shut down or remain shut down.
o For inoperable equipment in a system not subject to the TS, the licensee may continue reactor operation if the safety function can be accomplished by other designated equipment that is qualified, or if limited administrative controls can be used to ensure the safety function is performed. .
I
[
6.11 Technical Seecification Ocerability vs. ASME Code.Section XI I Orerative Criteria j The Technical Specifications (TS) normally apply to overall system performance ,
but sometimes contain limiting values for certain component performance, which I are specified to ensure that the design basis and safety analysis is satisfied. l The values (e.g., pump flow rate, valve closure time, valve leakage rate, safety / relief valve set point p essure) are operability ver.ification criteria. l If these values are not met at any time, the applicable LC0 shall be entered. ;
The ASME Section XI inservice testing plans required under 10 CFR 50.55(a) for !
pumps and valves may contain the same or different limits and additional l component performance acceptance values which, if not met, will indicate that the pump or valve has seriously degraded so that corrective action would be required :
to ensure or restore the operability and operational readiness of the pump or '
valve. The ASME Section XI acceptance criteria include ' required action ranges" l
! or limiting values for certain component performance parameters. These required i action ranges or limiting values as defined by the code as component performance ,
parameters, may be less conservative than the TS values which are safety analysis l limits. However, action must be taken when the TS requirements are not met. l Generic Letter 89-04 Attachment 1, Position 8, defines the starting point for the Allowed Outage Time (A0T) in TS action statements for ASME Section XI pumps and
~
valves. When perfonnance data fall in the required action range, regardless of whether the limit is equal to or more conservative than the TS limit, the pump or valve eust be declared inoperable immediately (the term " inoperative" is used in the text of ASME Section XI; the pump or valve is both " inoperative' and inoperable) and the TS action statement for the associated system must be entered.
In cases where the required action range limit is more conservative than its corresponding TS limit, the corrective action may not be limited to replacement or repair; it may be an analysis to demonstrate that that specific performance degradation does not impair operability and that the pump or valve will still fulfill its function, such as delivering the required flow. A new required action range may ba established after such analysis which would then allow a new deterstnation of operability.
Issue Date: 9900 Operability 10/31/91 )
, . -J t
- )
i The durations specified by the Code for analyzing test results have not been i accepted by the hRC for postponing entering a 15 action statement. As soon as data are recognized as being within the required action range for pumps or as a exceeding the limiting value of full-stroke time for valves, the associated i component must be declared inoperable and, if subject to the TS, the A0T
] specified in the action statement must be started at the time the component was j declared inoperable. For inoperable pumps and valves considered by ASME Section 1
- Il but not subject to the TS, the action should be consistent with the safety l i significance of the issue and the functions served by the affected system (s).
) Recalibrating test instruments and then repeating pump or v41ve tests is an 1 4 acceptable alternative to the corrective action of repair or replacement, but is
- not an action that can be taken before declaring the pump or valve inoperable.
I However, if during a test it is obvious that a test instrument is malfunctioning, '
the test may be halted and the instruments promptly recalibrated or replaced. !
During a test, anomalous data with no clear indication of the cause must be 1
attributed to the pump or valve under test. For this occurrence, a prompt i 4 determination of operability is appropriate with follow-on corrective action as j necessary. l l
l Note: In the above discussion, " required action range" and " inoperative" are ASME l Section XI terms. ,
6.12 Suecort System Ooerability I i
The definition of operability embodies the principle that a system can perform I its function (s) only if all necessary support systems are capable of performing i their related support functions. It is incumbent upon each licensee to l
understand which support systems are necessarY to ensure operability of systems and components that perform specified safety functions. l 1 When a support system is determined to be inoperable, all systems for which that support system is recuired for systems operability should be declared inoperable 4 and the LCOs for those systems entered. Any appropriate remedial actions specified by a supported system LC0 action statement (to cospensate for the j inoperable supported system) should be taken.
~
i When a support system is determined to be inoperable, the licensee should employ i the same operability determination process for the supported systems, as the licensee would for any other degraded system. In particular, the scope and timing of such operability decisions should follow the guidance in Section 6.1.
There are cases where judgment on the part of a licensee is appropriate in !
determining whether a support system is or is not required. One example is the l case of a ventilation system. A ventilation systes may be renuired to ensure
~
j that other safety-related equipment can perform its safety function in the summer, but may not be reauired in the winter. Similarly, the electrical power supply for heat tracing may be reouired in the winter to ensure that a safety- ,
related systes equipment can perform its safety function, but may not be reavired !
in the sunner. The need for judgment in reviewing what individual licensees do l in specific cases should be recognized. If a licensee determines that a i
9900 Operability Issue Date: 10/31/91 4
-+ - - < -
_ _=
r f
Technical Specification (TS) system is capable of performing its 7,pecified function (s) with an inoperable support system that is not in the TS, then no additional action outside of restoring the inoperable support systems is needed.
Furthermore, the licensee may modify the support function like any other change to the f acility by use of the 10 CFR 50.59 process and FSAR update, For some support systems, there are specific Allowed Outage Times (A0Ts) specified in the TS. Ideally, the A0T contained in the TS for a support system should be equal to or less than the A0T for any system for which that support system is reovired for system operability. Problems where inconsistencies exist l l between an A01 for a support system and the A0T for a system for which that ;
support system is required should be discussed with regional management who
! should discuss the issue with NRR if deemed necessary. While such inconsistencies are being resolved, the more restrictive A0T should be used. In
! some cases an amendment to the TS may be necessary.
l In all cases, the following principles should be used:
- a. The most important safety concern is to ensure that the capability to perform a specified safety function is not lost as a result of more than one train of a support or supported system being declared inoperable.
l When a support or supported system is declared inoperable in one train,
! the corresponding independent support or supported systems and all other associated support systems in the opposite train (s) should be ensured to be operable; i e., the complete capability to perform the specified safety function has not been lost. The term " ensure" as used here, allows for an administrative check by examining logs or other information to determine if required features are out-of-service for maintenance or other reasons.
These actions are not to be used in lieu of required TS actions.
l b. Upon determining that a loss of functional capability condition exists, actions specified in the support and supported system I.COs should be taken to mitigate the loss of functional capability.
6.13 pioinc and Pine Succort Renuirements All piping and pipe supports found to be degraded or nonconforming should be-subjected to an operability determination. To assist licensees . in the i determinations, operability guidance has been provided specific to various components. These components include the piping, supports, support plates, and anchor bolts. IE Bulletin No. 79-14 addressed the seismic analysis for as build safety-related piping systems. The supplement to IE Bulletin 79-14 dated August 15, 1979 and Supplement 2 to IE Bulletin 79-14 dated September 7, 1979 provide additional guidance. Concrete anchor bolts and pipe supports are addressed with specific operability criteria in Supplement I to Revision 1 of IE Bulletin 79 02.
The criteria for evaluat"* .perability of seismic design piping supports and j anchor bolts relating to sulletins 79 02 and 79-14 are detailed in the E. Jordan l
seno to the Regions dated July 1979, and the V. Noonan meno dated Appust 7,1979.
Upon discovery of a nonconformance with piping and pipe supports, 'iconsees may use the criteria in Appendix F of Section III of the ASME Code for operability determinations. These criteria and use of Appendix F are valid until the next refueling outage when the support (s) are to be restored to the FSAR criteria.
Issue Date: 10/31/91 9900 Operability
\
e
. =
} *
- u 2, ,
4 1'
l For systems determined to be otherwise operable but which do not meet the above i crite S. licensees sk. auld treat the systems or components as if inoperable until NRC approvai in ebtained for any additional criteria or evaluation methods used l to determint eeerability. Where a piping support is determined to be inoperable, 5
a ceterminauon of operability should be performed on the associated piping i system.
l
! 6.14 Flaw Evaluation i Regulation 10 CFR 50.55a(g) and Standard Technical Specification (STS) 3.4.10 i
(the section number may vary with plant specific TS) require that the structural integrity of ASME Code Class 1, 2, and 3 components be maintained according to i
Section XI of the ASME Code.
In the conduct of inservice inspection, maintenance i'
activities, or during plant operation, flaws in components will be discovered.
The operability of such systems containing flaws may depend on the flaw J
charatterization or evaluation performed by the licensee and the acceptability cf continued service of the component. Since the charxterization and/or evaluation is vital to the determination of operability, the licensee's efforts following flaw detection must be prompt.
Components containing flaws characterized or determined .to be within the j
acceptance standards in IWB-3500 (IWC-3500 for Class 2 componerits) of Section XI are acceptable for continued service and, although no determination of t operability is necessary, reporting must be in accordance with regulatory
- requirements.
I Upon discovery of a flaw exceeding the acceptance standards in IWB-3500 (IWC-3500 The
{
i for Class 2 components), the licensee should promptly determine operability.
- evaluation and acceptance criteria of IWB-3600 may be used in the determination.
}
For Class 3 moderate energy piping, i.e., Class 3 piping with a maximum operating temperature below 200 #F and a maximum operating pressure below 275 psig, the
]
evaluation and acceptance criteria in Generic Letter 90-05 may be used.
)
The licensee may treat the system containing the flaw (s), evaluated and found to i'
meet the acceptance criteria in IWB 3600, as operable until NRC approval in accordance with IWB-3600 is obtained. For Class 3 moderate energy piping, the l
" licensee may treat the system containing the flaw (s), evaluated and found to meet l i
- the acceptance criteria in Generic Letter 90-05, as operable until relief is
! obtained from the NRC. The licensee must promptly submit its evaluation for either case to the NRC for review and. approval.
Alternative evaluation procedures and/or acceptance critiria say also be used for J
IWB-3600 or Generic Letter 90-05. When alternative evaluation j
flaws exceeding procedures and /or acceptance criteria are used as a basis for acceptable continued service, the licensee must treat the system containing the flaw (s) as inoperable until NRC approval of procedures and criteria is obtained. Prior to i the approval, the plant must be placed in a safe condition or for systems in the TS, the plant must enter the corresponding Limiting Condition for Operation.
i I 9900 Operability Issue Date: 10/31/91 >
. ' , .~
]
4 i
I t !
6.15 Deeratienal Leakace I ,
If leakage develops in the reactor coolant system, there are additional !
recuirements. The Technical Specifications (TS) do not permit any pressure !
i bounoary leakage. The Operational Leakage Limiting Condition for Operation (LCO)
- must be entered upon discovery of pressure boundary leakage; therefore, an ,
j operability determination is not appropriate. !
i Article NB-2121 of Section III of the ASME Code excludes code requirements from materials not associated with the pressure retaining function of a component, such as packing and gaskets. However, leakage from the reactor coolant system i
j is limited to specified values in the TS depending on whether the leakage is from identified, unidentified, or specific sources such as the steam generator tubes or reactor coolant system pressure isolation valves. If the leakage exceeds the
- 3 1
i TS limits, the LCO must be entered.
1 For reacter coolant system leakage within the limits of the TS, the licensee j should determine operability for the degraded component and include in the 1 determination the effects of the leakage onto other components and materials.
i
! Furthermore, the regulations and TS require that the structural integrity of ASME ;
Code Class 1, 2, and 3 components be maintained according to Section XI of the !
ASME Code. If a leak is discovered in a Class I, 2, or 3 component in the conduct of inservice inspections, maintenance activities, or during plant .
2 operation, IWA-5250 of Section XI requires corrective measures be taken based on -i 3 repair or replacement in accordance with Section XI. In addition, a through wall ;
J flaw does not meet the acceptance criteria in IWB-3600. '
i f
Upon discovery of leakage from a Class 1, 2, or 3 component pressure boundary 4 (i.e., pipe wall, valve body, pump casing, etc.) the licensee should declare the '
component inoperable. The only exception is for Class 3 moderate energy piping '
' as discussed in Generic Letter 90-05. For Class 3 moderate energy piping, the licensee may treat the system containing the through-wall flaw (s), evaluated and found to meet the acceptance criteria in Generic Letter 90-05, as operable until relief is obtained from the NRC.
6.16 Structural Reauirements
^
Category I structures and supports (referred to herein as structures) which are subject to periodic surveillance and inspection in accordance with the requirements of Technical Specifications (TS) shall be considered operable if the limits stipulated in the TS are met. If these limits are not met, the Limiting Condition for Operations (LCOs) are to be entered for the affected structure.
If the degradation affects the ability of the structure to provide the required design support for systems attached to the structure, an operability determination must be performed for these systems as well.
Degradation affecting Category I structures include, for example, concrete cracking and spalling, excessive deflection or deferination, water Leakage, robar corrosion, missing or bent anchor bolts, etc. If these degradations are identified in Category I structures which are not subject to periodic l 9900 Operability i Issue Date: 10/31/91 f
l -
1
. l i
I I
i
! surveillance and inspection, they should be assessed by the literite to determine !
the capability of these structures to perform their specified function. As long !
as the identified degradation does not result in the exceedance of acceptance !
limits specified in applicable design codes and standards, referenced in the l design basis cocument, the affected structures are operable. !
Significant degradations resulting in the exceedance of the acceptance limits l l must be promptly reported in accordance with the requirements in 10 CFR 50.72 and evaluated by the licensee for determination of operability. These evaluations should include the criteria used for the operability determination and the i rationale for continued plant operation on a degraded condition outside of the design basis. The licensee's evaluations should also include the plan for corrective action, as required by Criterion XVI of Appendix B to 10 CFR Part 50, to restore degraded structures to their original design requirements. As stated- ;
above, any system which depends upon the degraded structure for required support i l should also be examined for operability if the degradation or nonconformant'e calls into question the performance of _ the system. NRC inspectors, with possible I
support from headquarters, should review licensees' evaluations of structural degracations to determine their technical adequacy and conformance to licensing l and regulatory requirements. $
I
! END j
l 1
i l
l l
l l
9900 Operability Issue Date: 10/31/91
6 1"w ENCLOSURE 3 l l
l LIST OF RECENTLY ISSUED GENERIC LETTERS 1
Generic Date of Le ge tNo , t, , , ,5,@ c t _ , , , , , , , , , , , , , , , , , ,I,s s u,a,n c e , , , , , , ,I s s u e d ,To , , , , , , , , , ,
i GENERIC SAFETY ISSUE 29, 10/17/91 ALL HOLDERS OF OP j 91-17 LICENSES OR CONST l " BOLTING DEGRADATION OR FAILURE IN NUCLEAR POWER PERM 1(S FOR NUCLEAR !
PLANTS" POWER PLANTS l
91-16 LICENSED OPERATORS' AND 10/03/91 HOLDERS OP LIC OR OTHER NUCLEAR FACILITY CONSTR. PERMITS FOR PERSONNEL FITNESS FOR DUTY NUC PWR/NPRs AND ALL LICENSED OPERATORS !
1
& SENIOR OPERATORS 91-15 OPERATING EXPERIENCE 09/23/91 ALL POWER REACTOR i i
FEEDBACK REPORT, SOLEN 0ID- LICENSEES AND OPERATED VALVE PROBLEMS AT APPLICANTS ,
- )
US REACTORS 09/23/91 ALL HOLDERS OF OP ;
l 91-14 EMERGENCY TELECOMMUNICA-LICENSES OR CONST. ;
I TIONS '
PERMITS l 91-13 REQUEST FOR INFO RELATED 09/19/91 LICENSEES AND APPLI-TO RESOLUTION OF GI130, CANTS Braidwood, Byron
" ESSENTIAL SERVICE WATER Catawba, Comanche Peak SYS FAILURES AT MUTLI-UNIT Cook, Diablo, McGuire j SITES," PURSUANT TO 10CFR50.54(f) 91-12 OPERATOR LICENSING NAT. 08/27/91 ALL PWR REACTOR EXAMINATION SCHEDULE AND APPIICANTS FOR i AN OPERATING LICENSE l RESOLUTION OF GENERIC 07/18/91 ALL HOLDERS OF 91-11 ISSUES 48, "LCOs FOR CLASS OPERATING LICENSES 1E VITAL INSTRLMENT BUSES "
and 49, " INTERLOCKS AND LCOs FOR CLASS 1E TIE BREAKERS" PURSUANT TO 10CFR50.54(f)
EXPLOSIVES SEARCHES AT 07/08/91 TO ALL FUEL CYCLE 91-10 PROTECTED AREA PORTALS FACILITY LICENSEES WHO POSSESS, USE, IMPORT OR EXPORT l FORMULA QUANTITIES ,
l '
OF STRATEGIC SPECIAL NUCLEAR MATERIAL INDIVIDUAL PLANT EXAMINATION 06/28/91 ALL HOLDERS OF 88-20 OLs AND cps FOR SUPP. 4 0F EXTERNAL EVENTS (IPEEE)
FOR SEVERE ACCIDENT VULNERA. NUCLEAR POWER REACTORS BILITIES - 10 CFR 50.54 (f)
48 Enclosure 2 i l PILGRIM UNIT 1: ASSESSMENT OF LOW PRESSURE TURBINE ANALYSIS During the refueling outage in April 1993, General Electric (GE) inspected the rotor in low pressure turbine "A" (LPA) at Pilgrim Unit I and found flaw indications in disks 4, 5, 6, and 7. GE recommended that the licensee either remove the seventh stage disk on the generator side (disk 7GA) or warm the LPA rotor before starting the turbine. The licensee later retained Structural Integrity Associates, Inc. (SIA) to evaluate flaw indications in disk 7GA. ;
On May 12, 1993, the licensee submitted the SIA analysis (Reference 1) to the NRC project manager, who requested that the NRC Materials and Chemical ,
l Engineering Branch (EMCB) review the SIA analysis to determine: whether there l were any gross error in the SIA analysis and whether the flaws indications in the turbine disks would have any effect on plant safety.
! Pilgrim Unit I has two low pressure turbines, LPA and LPB, with shrunk-on t i
disks. The flaw indications of the 7GA disk are located in both the hub and l l web. Although the fourth and fifth stage disks have more and larger flaws than the 7GA disk has, GE determined that the 7GA disk is the limiting disk 1 l based on operating conditions, the fracture toughness of the disk, and the !
consequences of a disk failure.
SIA performed parametric studies to determine effects of the fracture
) appearance transition temperature (FATT), fracture toughness variability, pre-warming, crack growth rate, and stress intensity factors. The EMCB staff compared key parameters used in both the GE and SIA analyses to our estimates (see Attachment 1). Parameters used in the GE analysis were extracted from the SIA analysis because GE's analysis was not available at the time of this assessment. !
For the 7GA disk, GE reported one indication of 3.556 mm (0.14 in) in the hub and an indication in the web which GE could not accurately size. For that indication, GE assumed a crack size of 6.35 mm (0.25 in] based on flaw inc. cations from other power plants' inspection data and laboratory data. The staff believes that the initial crack size of 6.35 mm [0.25 in] is conservative but could not quantify the uncertainty associated with the assumed size.
GE used a fracture mechanics model of an edge crack in an infinite plate having constant loading. GE's model is conservative because it is more compliant than the actual geometry, which is a radial crack emanating from the keyway.
I
,.. ,- j i
2--
Moreover, its constant loading does not consider the radial decrease in hoop stress with increasing distance from the bore. SIA's model is a hole in an l
- infinite plate with attenuated loading along the crack. The staff assumed.a '
model of a thick wall cylinder with attenuated loading. i l
GE used a crack growth rate of 1.52 mm [0.06] inch each year, which was the median value from a statistical study correlating the average crack growth rate with the wheel operating temperature from turbine inspection data of both >
BWR and PWR plants. SIA used 0.416 mm (0.0164 in), 0.51 mm [0.02 in), and t 1.52 mm [0.06 in] each year in its studies. The staff calculated a crack growth rate of 0.51 mm '0.02 inch] each year from previous inspection data of i the LPA rotor. The staff believes that the actual crack growth rate may be !
between 0.51mm [0.02 in) and 1.52 mm [0.06 in) each_ year. However, GE's data i indicate the upper bound growth rate (2 standard deviations) at an operating !
temperature of 78 "C [172 *F] could be as high as 2.03 mm [0.08-in] each year.
The critical stress intensity (K g) is an indicator of fracture toughness of the disk material. The lower the K,, used in the fracture mechanics analysis the more conservative the results will be. GE used a lower bound value of !
115 MPalm [105 ksi/in] which was taken from the graph of critical stress -
intensity vs. excess temperature (test temperature - FATT). The staff finds l that the value of 115 MPa/m [105 ksilin) is conservative.
GE and SIA calculated the critical crack sizes (depths) of 8.64 mm (0.34 in) and 13.72 mm [0.54 in], respectively. SIA conservatively assumed that the crack length is the length of the keyway bore. SIA indicated that if the i crack aspect ratio is known, the critical crack size may be larger than 13.72 mm [0.54 in). SIA's calculation results in a critical crack size of j about 11.43 mm [0.45 in] for the thick wall cylinder model.
Using the above parameters, the staff estimated a factor of safety for flaw size ranging from 1.21 to 3.6 based on the ratio between the crack length at end of the current fuel cycle in April 1995 to that of the critical crack size l
of the cylinder model (see attachment), The factor of safety for stress intensity (K,) ranges from 1.1 to 1.89, which was estimated by taking square root of the safety factor for flaw size.
The NRC desires that the turbine disk failure probability be IE-5 each year or lower for an unfavorably orientated turbine. GE's analysis is based on a turbine disk failure probability of IE-5 failure per year. SIA did not perform a probabilistic fracture mechanics analysis. Using engineering :
judgment, the staff estimated that the turbine disk failure probability for l the LPA turbine is between IE-5 and 1E-4 per year. The.NRC would permit a- I turbine in this condition to remain in service until the next scheduled j outage, at which time the licensee should ensure they meet the turbine disk failure probability to the IE-5 per year criterion (Attachment 2, Ref. 2).
l I
I ,
l
? !
r Upon assessing the information available, the staff found no safety concern for normal operation of the LPA turbine to the end of the current fuel cycle, although the SIA-analysis is less conservative than the GE analysis. The ,
staff intends to perform a confirmatory review of the GE analysis and its methodology.
t The Boston Edison Company has informed the NRC that it will be replacing both low pressure turbines during the next refueling outage, which is expected to be in April 1995.
l l
l l
l
, _ ,.- ,_. ,... . . _ , - . - . ~ . . , _ - - . - . - - - . , _ . . - - - . . - . - - - - . . . , . -. ,
.s .f
,
- 1 l . ATTACHMENT '. :: ENCLOSURE 2 l 3
PILGRIM TURBINE EVALUATION I I Initial Crack growth Kit lower bound Critical Time to i crack l
(mm/yr[in/yr]) (MPaJn[ksiVin]) crack deotn failure size !
Analysis (mm[in]) (years) !
j (mm (in]*)
, GE 6.35[0.25] 1.52[0.06] 115[105] 8.64[0.34] 1.5 SIA 6.35[0.25] 1.52[0.06] 115[105] 13.72[0.54] 4.8 0.51[0.02] 14.5 l
t NRC 6.35[0.25]
] 1.52[0.06] 115[105] 11.43[0.45] 4 1
0.51[0.02] 12
- Actuai easurea sizes range from 3.05 mm [0.12in] to 3.56 mm [0.14in] l GE SIA NRC j j APPLIED KI MODEL ~
- 5
_i L [
ok :
FACTORS OF SAFETY ON FLAW SIZE / STRESS INTENSITY FACTOR I (BASED ON NRC ASSUMPTIONS)
Crack grcwth Factor of Factor of rate per year safety at safety at mm [in) startup for flaw size normal operation for (at 24*C [75 *F] flaw size i (at 78'C [172 *F]) i 1.52 [0.C5] 1.21 2.82 0.51 [0.02] 1.55
)
3.60 Crack grewth rate Factor of Factor of safety at normal per year safety at startup operation for stress mm [in] for stress intensity intensity factor factor (at 78 *C [172 *F])
(at 24 *C [75 *F])
1.52 [0.05] 1.10 1.68 0.51 [0.02] 1.24 1.89
.. ".' ::ticr. ent 2 u Enclosure 2
References:
i May 12. 1993. letter from D. Rosario and P. Riccardella of Structural s intearity Associates to J. Gerety of Boston Edison,
Subject:
Evaluation {'
of the Pilgrim Unit i Low Pressure Turoine Rotor 7th Stage Shrunk-on Disk.
2.
NUREG-1048, Safety Evaluation Report related to the Operation of Hope '
Creek Generating Station, Supplement No. 6, July 1986.
l l
I l
l l
1 1
ktorgeggsNTMg.fy~F/ M:"Wh W 90dn W ?pw yalfy 2M M 83l$W$$$'t 0
. .m v .
.a
,~ .- . , g.,
,}'_f
.;- i',. ..
.y% ;;yy,,x, }.
3 - ,
. / UMTED STATES J- .
K!
~
[
1; wAsHwarow, p. c. zones
.t EDO CONTROL: 0009092 FROM: DUE: 07/14/93 i DOC DT: 06/29/93 i FINAL REPLY: {
R0p. Jerry E. Studds, Sen. Edward M. Kennedy & j Sen. John F. Kerry TO:
Chairman Selin FOR SIGNATURE OF: ** PRI ** CRC NO: 93-0594 Chairman Selin DESC: ROUTING:
CONCERNS REGARDING THE WATER LEVEL INSTRUMENTATION Taylor AND THE ISSUE OF OPERABILITY DETERMINATION AT Sniezek l PILGRIM Thompson _
! Blaha f l DATE: 07/01/93 Martin, RI ['
l . Lieberman, OE i*
l ASSIGNED TO: CONTACT: Scinto, OGC NRR Murley
~
l SPECIAL INSTRUCTIONS OR REMARKS:
l NRR RECEIVED: JULY 1,1993 NRR ACTION: DRPE:VARGA NRR ROUTING:
TEM FJM WR JP DC TG NRR MAIL ROOM ACTION ~
DUE TO NRR DIRECTOR S D&l BY
) ()
Yh Yd - .
V ~., l n'
'i '*
- OFFICE OF THE SECRETARY CORRESPONDENCE CONTROL TICKET PAPER NUMBER: CRC-93-0594 LOGGING DATE: Jul 1 93 ACTION OFFICE: EDO AUTHOR: Kennedy, Studds & Kerry AFFILIATION: U.S. SENATE ADDRESSEE: Chairman Selin LETTER DATE: Jun 29 93 FILE CODE:
SUBJECT:
Concerns regarding the water level instrumentation and the issue of operatibility determination at Pilgrim ,
ACTION: Signature of Chairman DISTRIBUTION: Chrm., Comrs., OGC, DSB, RF SPECIAL HANDLING: OCA to Ack.
CONSTITUENT:
NOTES:
DATE DUE: Jul 15 93 SIGNATURE: . DATE SIGNED:
AFFILIATION:
EDO --- 009092 9 3.opr30-4 W
- .-. .~ .