ML20134K688

Forwards Response to Request for Info Per 10CFR50.54(f) Re Adequacy & Availability of Design Bases Info

ML20134K688
Person / Time
Site:	San Onofre
Issue date:	02/12/1997
From:	Ray H SOUTHERN CALIFORNIA EDISON CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
NUDOCS 9702140150
Download: ML20134K688 (106)

Text

.- . ._

SOUIHERN CMHORMA Executive Vice President An EDISON INTLRNATIONAL Company February 12,1997 U. S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, DC 20555-0001

. Gentlemen:

Subject:

Docket Nos. 50-361 and 50-362 Request for Information Pursuant to 10 CFR 50.54(f) Regarding .

Adequacy and Availability of Design Bases Information San Onofre Nuclear Generating Station (SONGS) Units 2 and 3 This letter provides Southem California Edison's response to a letter from James M.

Taylor (NRC) to John E. Bryson (Edison),

Subject:

" Request for Information Pursuant to 10 CFR 50.54(f) Regarding Adequacy and Availability of Design Bases Information,"

dated October 9,1996 and received by Edison on October 15,1996. The letter expresses the NRC's concern that the design bases may not be sufficiently understood and documented by some licensees to conclude their current facility configuration is consistent with the design bases or to support operability determinations and 10 CFR 50.59 evaluations in a timely manner.

Enclosures A through F contain Edison's responses to NRC request items (a) through (e) and its inquiry regarding design bases review and reconstitution programs. These enclosures contain descriptive information about various historical and current programs and processes. These programs and processes are changed from time to time to incorporate improvements and/or changes to work organization / processes. All such changes are made in accordance with applicable regulations and Licensing requirements. Therefore, these program and process descriptions should not be considered as commitments, but rather as " descriptions" of the current programs and processes.

Edison has completed and planned a number of rigorous engineering and assessment '

efforts which assure the adequacy and availability of design bases information. [

In 1994 Edison completed its Design Bases Documentation (DBD) Program begun in L/

1989. This program generated twenty-eight System and Topical DBDs. The program was intensive, involving in excess of 400,000 man-hours of effort and a rigor exceeding the requirements specified in NUMARC 90-12, " Design Basis Program Guidelines."

When NUREG-1397, "An Assessment of Design Control Practices and Design Reconstitution Programs in the Nuclear Industry," was issued in 1991, Edison assessed 9702140150 970212 ~'

ADO M 0500

r. o. % 800 2244 Walnut Grme n.,

f 1 Rosemead. CA 91770 81Mo2-16%

1

! Document Control Desk l-

its program plan and associated procedures to assure they did not contain the common

weaknesses cited by the NRC. Similarly when NRC policy statement, " Availability and

Adequacy of Design Bases information at Nuclear Power Plants " (57FR35455) was issued, Edison's DBD project team reviewed it and incorporated it into the DBD Manual and the DBD Program Plan.

I Edison's DBD Program included review of design bases calculations, generation of new '

drawings such as instrument loop. diagrams and Appendix R safe shutdown logic j diagrams, and acquisition or reconstitution of missing or inadequate calculations. It

. also involved documented plant verification walkdowns and reviews of operating l instructions and surveillance test procedures. For the areas covered, the DBD Program assured Edison that the configuration of the plant is consistent with the design i bases.

i

{ The areas covered by the DBD Program account for the majority of the systems

contained in the current Technical Specifications. Systems covered by the Technical

Specifications for which formal DBDs were not developed are: Post Accident

! Monitoring Instrumentation, Remote Shutdown System, Containment Systems, Control Room Emergency Air Cleanup System, Fuel Handling and Storage Systems, Class 1E j 120V AC System, and Emergency Diesel Generators. Although these systems were

included within the original program scope, Edison decided not to develop DBDs for them based on safety classification, risk significance, the extent of available design l bases information, coverage by a Topical DBD, and the influence of other ongoing j programs. Edison advised the NRC of this action.

Edison believes that its decision in 1994 to reduce the original scope of the DBD

! Program was appropriate. However, Edison is raising its standards in light of the rising 4

expectations within the industry and the NRC. Therefore, Edison is reactivating its i DBD Program for the purpose of developing DBDs for the Emergency Diesel Generator l and for the Containment Systems. This effort will be performed to the same rigorous j standards of Edison's original DBD effort and will be completed prior to October 1998.

1 In addition, Edison will perform a safety system functional assessment (SSFA) of the  :

Class 1E 120V AC System and the Control Room Emergency Air Cleanup System.

These assessments will include in-depth vertical slice reviews of actual design basis  !

documentation and comparisons with the as-built and as-operated plant following i processes similar to those described in NRC Inspection Procedure 93801, " Safety System Functional Inspections." Edison will complete these efforts prior to October 1998. Detailed assessment plans will be submitted via separate correspondence.

Some issues identified during the DBD Program have yet to be fully resolved. During the DBD Program Edison allowed resolution of less significant issues to be deferred consistent with other scheduled work based on documented operability and reportability assessments. Edison will expedite resolution of these issues to assure closure by July 1997.

t i

Document Control Desk I Other efforts provide Edison confidence that systems not specifically covered by the DBDs are consistent with their design bases. Edison's responses to Generic Letters 89-10 (Motor Operated Valves) and 89-04 (Inservice Testing) provide assurance that the configuration and performance of safety related pumps and valves are consistent with their design bases requirements.

Edison initiated a Setpoint Calculation Program in 1990. Edison completed the first phase of this program in 1993. This phase assured that safety related instrument setpoints and associated surveillance test requirements (with the exception of those related to a not yet installed upgrade of the radiation monitor system) are consistent with their design bases. Edison completed the second phase of this program in 1994.

This phase assured that values in Emergency Operating Instructions used to support substantive operator decisions reflect their design bases. Post Accident Monitoring instrumentation and Remote Shutdown Monitoring Instrumentation covered by the Technical Specifications were included in this phase of the program.

l' The third phase of the program began in 1993. This phase focuses on Technical Specification instruments which support accident mitigation or assure operation within initial conditions assumed in accident analyses. To date, approximately 40% of the required calculations have been completed.

l The fourth and final phase of the program will address instrument uncertainties where l the Technical Specifications do not provide specific surveillance test acceptance

l. criteria. This phase will begin 1997. The third and fourth phases of the program will be i

completed by October 1998 and will provide further assurance of consistency between design bases and Technical Specification requirements. A detailed program description will be submitted via separate correspondence.

Edison declart.d no instruments inoperable as a result of calculations performed in the  !

first three phases of the Setpoint Calculation Program which, to date, has evaluated the  !

majority of safety significant instrumentation covered by the Technical Specifications. ,

Edison expects similar results in the balance of the program. >

Edison's current Updated Final Safety Analysis Report (UFSAR) Review Project will verify accuracy of UFSAR requirements with respect to design bases calculation l results, implementing procedures, and the as-operated as-tested plant. To date Edison has reviewed roughly two-thirds of the UFSAR sections and has identified no safety l significant issue. Edison expects similar results in the balance of this project.

To assure consistency is maintained between the p!nnt and its design bases, Edison classified its DBDs as Design Disclosure Documents to assure they are controlled and l maintained current. Edison scanned the DBDs and the UFSAR into the site computer l network thereby making them available for their widespread use in the performance of work activities.

l

i  !

. _ Document Control Desk ,

i Edison employs formal controls on its design, configuration control, and procedure

processes, the overall effectiveness of which have been corroborated by intemal and l regulatory audits and inspections. NRC Inspection Report 95-201 documented the l Integrated Performance Assessment Program (IPAP) at San Onofre covering the period i

, from September 1993 to October 1995.- This detailed assessment by the NRC found that processes to control the design bases at San Onofre Units 2 and 3 are adequate. ,

In the area of engineering, the IPAP report indicated Edison's overall performance was  !

j superior.

2

. In light of programs completed, the effectiveness of processes to control changes to -i i plant configuration, the expected low likelihood of safety significant issues related to j i the adequacy or availability of design bases information, and commitments made '

I herein to perform additional intensive design bases information verifications, Edison j l believes that it has been responsive to the NRC's policy statement, " Availability and

, Adequacy of Design Bases Information at Nuclear Power Plants" (57 FR 35455) and  ;

has reasonable assurance that the configuration of San Onofre Units 2 and 3 is  ;

consistent with its design bases.

We trust that you will find our response clear and complete. Should you have any j questions or require additional information regarding this matter please contact me. )

l

] Sincerely, j Y-C Enclosures RJLee:s  !

cc: F. J. Miraglia, Jr., Director, Office of Nuclear Reactor Regulation i L. J. Callan, Regional Administrator, NRC Region IV K. E. Perkins, Jr., Director, Walnut Creek Field Office, NRC Region IV J. A. Sloan, NRC Senior Resident inspector, San Onofre Units 2 & 3 M. B. Fields, NRC Project Manager, San Onofre Units 2 and 3 bcc: (See attached sheet)

State of California County of San Diego By: .

Harold B. Ray Executive Vice Preside Subscribed and swom before me this day! of d V R & r v1 199 7.

n ~

MARIANE SANCHEZ COMM.# 1033763 fz h Notcry PubDe - CoEfomia f

$N 'V [ Com 4.1998 Notary & --

--;------m i

--64a a 4 _. _,, g i

4 i

E 1

I I

a 4

4 a

f s

3 1

4 ENCLOSURE A

ENCLOSURE A Paga 1 This enclosure responds to information request (a) which solicits a

" Description of engineering design and configuration controlprocesses, including those thatimplement 10 CFR 50.59,10 CFR 50.71(e), and Appendix B to 10 CFR Part 50."

1. OVERVIEW Edison has established programs and processes for control of the plant and configuration which are responsive to the requirements of these Nuclear Regulatory Commission (NRC) regulations. Implementation of these programs and processes has l been routinely audited by Edison and inspected by the NRC. These audits and {

inspections have demonstrated that the programs and processes are effective in l controlling activities to assure that the design bases of the plant are maintained. l Issues raised by these audits and inspections have been acted upon by Edison in a l timely manner, including appropriate enhancements to process controls to further strengthen the design and configuration control programs.

11. BACKGROUND The design bases of San Onofre Nuclear Generating Station, hereafter referred to as San Onofre, Units 2 and 3 are defined in the Updated Final Safety Analysis Report (UFSAR), specific Design Bases Documentation (DBD), and selected design analyses, calculations and other design documentation. The original plant design was controlled in the 1970s by the Engineer-Constructor (Bechtel) and the NSSS Supplier (Combustion Engineering, hereafter referred to as ABB-CE) using design control procedures developed to respond to 10CFR50 Appendix B (Reference 20) Criteria Ill and VI and Regulatory Guide 1.64 (Reference 21). Design documents (i.e.,

calculations, specifications, drawings, etc.) were developed, reviewed and approved in accordance with these procedures by the originating design organization. Interfaces were controlled by multi-discipline reviews within the originating design organization and external interface reviews between Edison, Bechtel and ABB-CE design groups.

The resulting design documents formed the basis for the plant configuration and the design bases descriptions included in the UFSAR (Reference 5).

Prior to full power operation of San Onofre Units 2 and 3, a Topical Quality Assurance Manual (TQAM) (Reference 2) was developed and issued by Edison to define the quality assurance program for the subsequent operations phase of San Onofre Units 2 and 3. The TQAM was based on the requirements of Topical Report SCE-1-A (Reference 1), which is invoked by reference in the San Onofre Units 2 and 3 UFSAR Chapter 17 and was approved by the NRC. Procedures were developed within Edison to implement TQAM design control and configuration provisions. Similar procedures were developed by Bechtel and ABB-CE for control of design activities within their organizations. Design changes were prepared by Edison's engineering organizations, Bechtel and ABB-CE in accordar,ce with these design control procedures to support

ENCLOSURE A Page 2 operating phase design changes. The design changes, including the 50.59 evaluations,were required to be reviewed and approved by the Edison engineering organizations. The configuration of San Onofre Units 2 and 3 was controlled by procedures developed by Edison organizations and Bechtel. In the mid 1980s, engineering contractors in addition to Bechtel were assigned design change responsibility by Edison and procedures were developed by these contractors similar to those used by Edison and Bechtel.

Between August 1984 and August 1988, Edison experienced a variety of challenges associated with the transition from a construction project to an operating environment.

A number of design related issues surfaced. As a result of NRC Safety System Functional Inspections (SSFis) and internal Edison reviews (enclosure F), Edison made major changes in the San Onofre Units 2 and 3 design control processes in 1989 and 1990. Responsibility for developing design changes was shifted from a combination of Edison and contractor engineering organizations to a newly established l Nuclear Engineering Design Organization (NEDO) within Edison. NEDO has been

staffed with fully qualified engineers who perform various design control functions and analysis previously performed by engineering contractors. The Station Technical organization within Edison continued to perform certain design changes but the scope i of these changes was normally limited to minor changes associated with their day-to- l day plant support function. The design control procedures employed by NEDO and i Station Technical were upgraded to reflect the best elements of those used by the i engineering contractors and those implemented at other nuclear plants. In addition, an l extensive program to develop DBDs, reconstitute missing design calculations, and l

, validate that the plant systems' configuration conform with the DRDs was implemented.

Under a program begun in 1991, the engineering methodology employed by ABB-CE to perform core reload and other analyses is being transferred to Edison Nuclear Fuel Management (NFM) so that these analyses can be performed in-house by NFM i

personnel. For the current Cycle 9 reloads, NFM personnel are performing the analyses, which are then mviewed and approved by ABB-CE personnel. Future  ;

i reloads are expected to be performed by NFM personnel using procedures developed 1 i

for these analyses. The Accident Analysis DBD will document the significant i assumptions and conclusions used in the accident analysis supporting the UFSAR i Chapters 6 and 15 safety analysis.

Ill. DESCRIPTION OF THE DESIGN CONTROL AND CONFIGURATION CONTROL PROCESSES The design control, configuration control and management processes implemented at San Onofre Units 2 and 3, are described below. These processes are defined in detail ,

in approved and controlled procedures. Design and configuration control processes  !

have been implemented throughout the design, construction and operation phases of San Onofre Units 2 and 3. These processes are continually being improved to reflect enhancements identified through benchmarking the best practices of other utilities and industries and through lessons learned from internal Edison audits and assessments.

ENCLOSURE A Pag 3 3 Exhibit A provides an overview of the design control and configuration control processes employed at San Onofre Units 2 and 3. Exhibit B provides an overview of the Edison corrective action process as described in Enclosure D to this submittal.

A. Design Control l The design control processes implemented at San Onofre Units 2 and 3 are defined in approved and controlled procedures which reflect the guidance of Regulatory Guide 1.64 (Reference 21) and ANSI N45.2.11 (Reference 30).

Process enhancements and procedure revisions have been made since the operating licenses were issued in February 1982 (Unit 2) and November 1982 (Unit 3). The revisions made in 1989 and 1990 formed the fundamental foundation of the processes used today. The procedure for " Design Process Flow and Controls"(Reference 101) provides an overview of the design process controls.

Major plant modifications are processed using Design Change Packages (DCPs) as described in the procedure for " Development, Review, Approval and Release of Conceptual Engineering Packages and Design Change Packages"(Reference 102).

DCPs include a description of the design change (i.e., reason for the change, functional objective of the change, impact of the change on site programs and procedures and a design criteria discussion), a 50.59 safety evaluation, a review of licensing and design document impact, applicable drawing changes documented in interim Design Change Notices (IDCNs) or new drawings, DBD changes, identification of computer software changes, calculation changes / impacts, construction safety assessment, material list, test guidelines and vendor documents / references. Changes to licensing documentation (e.g., Technical Specifications, Licensee Controlled Specifications, UFSAR, etc.) are also included in the DCP. DCPs are prepared by design teams and undergo design reviews (1) within the originating design disciplines; (2) outside the discipline; and (3) outside of the engineering organization by impacted groups as described in the procedure for " Document Review and Approval C introl" (Reference 107). Field changes to DCPs are formally processed and controlled using Field Interim Design Change Notices (FIDCNs) in accordance with References (102) and (107) and the procedure for " Field Change Notice and Field Interim Design Change Notice"(Reference 103). At completion of DCP installation and associated verification testing, the modification is formally turned over to the Operations organization. Following DCP turnover and acceptance, drawing changes included in the DCP are converted to Design Change Notices (DCNs) to reflect the as-built plant configuration. New and existing station procedures (e.g., operations, maintenance, testing, etc.) affected by the design change, are identified and scheduled for updating to support the turnover or to support future plant neads.

NRC approval of licensing document changes, where required, is normally obtained prior to DCP issuance. If NRC approval is outstanding at the time the DCP is issued, l conditions are included in the DCP to obtain this approval before design change use in

) an operational mode governed by the licensing document change. Following turnover

! ENCLOSURE A Pago 4 i

and acceptance of the DCP, Nuclear Licensing is notified by Configuration Control. .

! The licensing documents identified within the DCP are updated / issued in accordance l l with the procedures for " Preparation of Amendment Applications for Facility Operating l l Licenses"(Reference 110), " Preparation, Review and Approval of Changes to l I

Licensee Controlled Specifications"(Reference 111) and " Control of Licensing i Document Changes"(Reference 112), as applicable.

Minor plant modifications, as described in References (103) and (107), are processed using Field Change Notices (FCNs). An FCN or a package of FCNs (with one designated as a lead FCN) are prepared by a responsible engineer and reviewed and approved by an independent reviewer and an engineering supervisor. Reviews may also be performed by other engineering disciplines based on the complexity of the design change. Information and evaluations are provided in the FCN package including ,where appropriate, site program and procedures impacts, design and licensing document impacts, DBD changes, computer software changes, and );

calculation changes / additions. FCNs are required to have a specific 50.59 safety evaluation unless they pass a screening (see Section IV below). Upon completion of  !

the FCN installation, the FCNs are converted to DCNs to reflect the as-built plant configuration.

System engineers within NEDO and/or Station Technical review design document  ;

changes affecting their systems to assess the aggregate impact of multiple changes with relationship to the system design bases. l Design drawings and changes are prepared, reviewed and approved in accordance with the procedures for " Interim Design Change Notice and Design Change Notice" 1 (Reference 104), " Drawings and Design Change Notice Conversion"(Reference 105) j and " Document Review and Approval Control"(Reference 107). Drawings are l prepared by a responsible engineer or designer and checked by an independent reviewer to assure that the design is adequate and in conformance with applicable i design calculations, specifications and other design drawing requirements.

Interdisciplinary reviews of drawings are performed, where applicable. Upon completion of installation and field verification of the design changes, the IDCNs, FIDCNs and FCNs are converted to DCNs to reflect the as-built plant configuration.

Design calculations are prepared, reviewed and approved in accordance with the j procedures for " Preparation and Verification of Design Calculations"(Reference 106) and " Document Review and Approval Control"(Reference 107). Checklists are used by the originator and an independent engineer to verify the design calculation is adequate and to assure that appropriate design input is included, proper methodology is applied, and results are reasonable (including relevant design bases information).

Changes to calculations are controlled in a similar manner to the base calculation development to assure they are reconciled with plant design bases. Changes to calculations associated with a DCP or FCN are controlled by Interim Calculation Change Notices (ICCNs), which are converted to Calculation Change Notices (CCNs) upon completion and turnover of the DCP or FCN. Calculation results that have no

_. . . . . .. __ __ __ .- -_ ._ ..m __

l 1

ENCLOSURE A PageS phycical plant configuration change impact but, which may impact plant procedures, j are submitted to affected station organizations for impact review and initiation of associated plant procedure changes.

Engineering specifications and changes are prepared, reviewed and approved in accordance with the procedures for " Specifications / Mini-Specifications" (Reference 108) and " Document Review and Approval Control"(Reference 107). Three types of specifications are typically used: equipment procurement specifications; field construction specifications; and ASME Code design specifications._ These j

specifications are prepared by a responsible engineer, reviewed by an independent reviewer and other reviewers impacted by the specification to assure the requirements are technically adequate and conform with applicable codes, standards or other

requirements.

Design documents submitted by vendors in support of equipment procurement are reviewed and approved by Edison engineers in accordance with the proceduies for

" Processing of Supplier Documents"(Reference 109) and " Document Review and Approval Control"(Reference 107) to assure conformance with the requirements of the procurement documents and compatibility with Edison design requirements for the related DCP or FCN. Changes to design documents submitted by vendors to support equipment fabrication / installation are reviewed and approved by Edison in a similar l

manner. After equipment installation, the vendor design documents are used in conjunction with the design drawings to define the plant configuration and are updated and maintained in a manner similar to design drawings as described above.

I Nuclear fuel design changes, reload analyses and other core analyses are documented by generating or modifying calculations and/or by preparing a Reload Analysis Report (RAR) and reload Facility Change Evaluation (FCE). Assumptions and inputs for each reload are documented in the Reload Ground Rules which are based on plant design bases and configuration details. The Reload Ground Rules are j reviewed and approved by the affected engineering groupe within NEDO, Station l Tachnical and NFM as well as other affected groups such as Operations and Licensing. A 50.59 safety evaluation and review of design basis information are required in support of the RAR and FCE. For San Onofre Units 2 and 3, Cycles 1 through 8, fuel design changes and reload analyses were prepared and approved by l ABB-CE in accordance with the ABB-CE Quality Assurance manual and procedures as approved by Edison. For the Unit 2 Cycle 9 reload and the Unit 3 Cycle 9 reload, the RAR and FCE will be prepared by Edison's NFM organization. Supporting calculations ,

have been prepared by NFM using ABB-CE methodology and procedures as part of the reload technology transfer process. These calculations either have been or will be i independently reviewed and approved by ABB-CE. For subsequent reloads, Edison's procedures will be adapted to the process and utilized. UFSAR and design basis update revisions will reflect the Cycle 9 reload design. The above processes are controlled in accordance with the procedures for " Documentation of Safety Analysis"

. (Reference 113), " Reload Ground Rules Control Methodology"(Reference 114), '

" Installation of CECOR Geometry and Coefficient Libraries"(Reference 115),

ENCLOSURE A Pago 6

" Shuffling the CECOR Exposure Files"(Reference 116)," Preparation of the Plant -

Physics Data Book"(Reference 117)fControl of Nuclear Fuel Management Reduced Instruction Set Computer 600 Computer Network"(Reference 118) and " Engineering, Construction and Fuel Services Software Quality Assurance"(Reference 119).

B. Material Procurement Material procurement activities may affect plant configuration. The Procurement Engineering (PE) organization assures that appropriate technical and quality l assurance requirements specified in design documents (prepared in accordance with Section A above) are incorporated into the Purchase Order (s) for replacement or new components, parts and materials. For safety related/ quality affecting items specified in  ;

a Bill of Material (BOM), a Procurement Engineering Package (PEP) imposes ,

contractual requirements on the supplier, provides instructions to Procurement Agents, includ!,ig delineation of specific suppliers when appropriate, and instructions for Nuclear Oversight Division (NOD) Material Test and Receipt (MT&R) Group. The PEP assures that specified safety related/ quality affecting evnponents, parts and materials are purchased from approved suppliers and that the required certifications and documentation are obtained prior to the item being released for installation. .

Purchased components, parts and material are subject to receipt inspection / testing by MT&R to assure conformance with the PEP requirements prior to release for

)

installation or use in tha plant.

When materials or items specified for a safety related/ quality affecting application are not available, or cannot be obtained from a supplier with an Edison approved 10CFR50 Appendix B quality assurance program, PE performs a Technical Evaluation (TE). The TE documents the item's contribution to the performance of a safety function and the critical characteristics of the item that, when verified, would provide reasonable assurance that the item will perform its safety function as expected. The procedure for

" Quality Affecting Technical Evaluation / Procurement Classification and Acceptance Process" (Reference 120) defines the applicable controls.

Commercial Grade !! cms (CGI) and other items and material that require inspection and testing upon receipt rd San Onofre to verify conformance with the PEP and/or TE are submitted to the MT&R Group. A CGI dedication laboratory is maintained by MT&R that has extensive capabilities to perform inspection and testing of items and i mnterials including material / chemical analysis, nondestructive examination, electrical telting. civil material testing and seismic shake table testing. The procedures for '

" Material Test and Receipt Lab Program Implementation"(Reference 185), " Material l Test and Receipt Personnel Qualification Standards"(Reference 186) and " Receiving i inspection"(Reference 187) control the MT&R inspection and testing activities.

When Edison is unable to obtain an identical " replacement-in-kind" for an installed part or component, evaluations of proposed substitutions are documented in accordance with established procedures using the Substitution Equivalency Evaluation (SEE) process. The procedure for " Substitution Equivalency Evaluations (SEES)"(Reference

ENCLOSURE A Pago 7 121) describes the process in detail. The SEE may also provide the design or configuration change documents necessary to authorize installation in specific applications when, and if, the substitute item is to be installed. SEE's may authorize installation of piece parts if primary or secondary design documents are not affected.

FCNs in combination with SEES are used for component level changes or changes impacting primary or secondary design documents. FCNs are required to have a specific 50.59 safety evaluation unless they pass a screening (see Section IV discussion below).

C. DCP installation Plant configuration can be impacted during DCP installation and therefore activities affecting installation are controlled in accordance with the following procedures:

e " Preparation, Review and Approval of Nuclear Construction Administrative Procedures" (Reference 122) e " Preparation, Review and Approval of Component Test Procedures"(Reference 123) e " Preparation, Review and Approval of Preoperational Test Procedures (Reference 124) e " Review, Evaluation and Approt. al of Test Results"(Reference 125) e " Design Change Process"(Refdence 126) e

" Construction Work Orders" (Reference 127) e " Construction Problem Report"(Reference 128) e " Component Testing" (Reference 129) e "DCP Turnovers" (Reference 130) e

" Conduct of Work"(Reference 131) e " Field Change Notices" (Reference 132).

When the DCP is issued to the field, installation is controlled under Construction Work Orders (CWOs) by the Construction organization. Certain aspects of the DCP installation may be performed by the Maintenance organization under Maintenance Orders (MOs). The DCP turnover package identifies the CWOs/MOs that implement the design change. Each CWO/MO contains a detailed work plan describing the work instructions necessary to install that portion of the design change. The CWO/MO references the design documents being implemented. Work instructions may be stand alone or invoke the requirements of detailed construction specifications and procedures that delineate site specific or industry quality standards. Construction specifications and procedures (and changes) are reviewed, approved and controlled.

CWOs/MOs are reviewed by Operations Equipment Control (EC) to determine if Operations procedures and instructions require revision prior to placing the system in service. Testing to verify proper installation of the work is also performed using l CWOs/MOs and standard or unique test procedures. Test guidelines and acceptance criteria (including appropriate vendor equipment requirements) that are unique to the l

design change are specified in the DCP. Work completion is verified by the work

( organization and in selected cases by Quality Control (QC) inspection or test l

1 l

l l

l l ENCLOSURE A Page 8 1

l witnessing. Preoperational test results are approved by Engineering. A Test Exception Report (TER) is generated if the preoperational test results do not meet the '

prescribed limits during testing. The TER coritains a resolution block and retest requirements, which are completed by the design organization. A TER log and a copy ,

of TERs, generated during the conduct of test, are maintained with the test procedure. 1 l After DCP installation and testing, a turnover package is prepared by the Construction l

organization and submitted to the station for operability evaluation. Work organization

{

personnel perform walkdown verifications related to the portions of the plant modified  ;

by the DCP to assure that the plant as-built condition reflects the issued design '

documents. When the station operability evaluation of the DCP turnover is complete, the system is placed back into service by Operations following any required in-service testing. The Configuration Control organization notifies the Corporate Documentation Management Center (CDMC) to convert the DCP drawing changes to DCNs to reflect  ;

the as-built plant configuration. Control room stick file drawings are updated to reflect l the DCP installation. Partial turnovers impacting system configuration are reviewed by .

affected engineering personnel and documented on Interim As-Built (IAB) drawings  !

that are included on the control room stick file until replaced by the completed design change configuration on a subsequent turnover. In addition, any station procedure changes necessary to support the system operation are prepared and issued prior to 1 declaring the system operable. The Engineering organization uses the Action Request System to notify affected organizations when a DCP has been issued so that the procedure development process can be initiated per the procedure for " identifying and Assessing impact to Site Program and Procedures"(Reference 200). Certain procedure changes or Repetitive Maintenance Orders (RMOs) that may be needed for future Station activities (i.e., surveillance, testing, maintenance, etc.) are identified by the responsible station organization prior to DCP turnover. These procedure changes or RMO changes are tracked by the responsible station organization and are prepared, reviewed, approved and issued prior to the next procedure use. EC specifies on the Work Authorization (WA) the procedures required to be changed for equipment operability (after conferring with the Operations Procedures Group). The Operations Control Room Supervisor verifies specified procedures and instructions have been revised before declaring the system operable.

D. FCN Installation  !

Configuration control under the FCN process is similar to the DCP process as described above. However, there are certain process differences. Once issued to the field, installation is controlled by CWOs i.' the work is performed by the Construction organization or MOs if the work is performed by the Maintenance organization. There are typically a series of CWOs or MOs issued to install the modification. The lead FCN lists all the CWOs/MOs utilized to implement the modification. Each CWO/MO contains a detailed work plan describing the work instructions necessary to install that

! portion of the modification. MOs/CWOs implementing FCNs are reviewed by Operations EC to determine if Operations procedures and instructions require revision l prior to placing the system to be modified in service. Testing to verify proper i

I l

ENCLOSURE A Paga 9 j installation is also performed using CWOs/MOs and standard or unique test l procedures.- Test guidelines and acceptance criteria are specified in the FCN package l where applicable. Work completion is verified by the implementing organization and in

! selected cases by QC inspection or test witnessing. Construction or Station Technical l verifies plant as-built conditions associated with FCN installation when the work has

been completed. Following work completion, the system is placed into service by l Operations including any in-service testing. The balance of activities is as described for DCP installation.

E. Temporary Modifications The procedure for " Temporary Modification Control"(Reference 133) describes how Edison classifies Temporary Modifications and defines the process and configuration control requirements applicable to each classification. The Temporary Facility Modification (TFM) as described in the procedure " Temporary Facility Modifications" (Reference 155) is the preferred method of controlling temporary modifications however other methods such as Nonconformance Reports (see Enclosure D),

Operations procedures, Maintenance procedures, Design Change Documents (FCNs),

etc., may be employed as described in Reference (133) if they are more appropriate for the situation. Temporary Modifications have a specific 50.59 safety evaluation unless 1 they pass a screening (see Section IV below) either as part of the procedure l controlling the work activity or as part of the Engineering document (e.g., TFM, NCR, I FCN, etc.) associated with the Temporary Modification.

Barrier impairments are controlled by the procedure for " Control of San Onofre 2 and 3 Barriers" (Reference 164). This procedure provides controls over plant barriers (i.e.,

doors, hatches, etc.) that are required to be placed in a temporary configuration for maintenance, modification or other activities and subsequently restored to the design basis configuration. A 50.59 safety evaluation is performed for each barrier impairment.

F. Software Configuration Quality affecting plant software and engineering analysis software are developed, reviewed, approved, revised and controlled in accordance with the procedures for

" Engineering, Construction and Fuel Services Software Quality Assurance"(Reference 119), " Software Development and Maintenance" (Reference 134) and " Control of Computer Based Systems"(Reference 156) These procedures include provisions for documenting the software requirements, design, safety evaluation, test plans, test results, procedure impact, user notification and training. Control of Core Protection Calculator (CPC) and Core Operating Limits Supervisory System (COLSS)

Addressable Constants Changes are provided in accordance with the procedures for

" Control of Core Protection Calculator Addressable Constants"(Reference 188) and

" Control of Plant Physics Data Books, COLSS Addressable Constants and Reactor Engineering Data Transmittals"(Reference 189).

ENCLOSURE A Pago 10 1

G. Maintenance Activities Routine Maintenance activities including predictive, preventive and corrective

maintenance are performed in accordance with approved procedures and instructions that are implemented through the MO process. Configuration control measures are contained within the MO. " Work Activity Guidelines"(Reference 135) and

" Maintenance Order Preparation and Processing" (Reference 136) define MO processing controls / responsibilities and MO preparation / review requirements, respectively. Changes to individual Maintenance procedures and instructions are reviewed, approved and controlled.

Non-routine or special Maintenance activities are identified and prescribed in specific Maintenance procedures. For example, " Temporary System Alteration and Restoration" (Reference 137) defines the special requirements applicable to the temporary lifting and restoring of electrical leads. Design changes are controlled in accordance with the processes described in the above paragraphs.

H. Operations Activities The Operations organization has implemented several configuration control processes.

Each process is described in approved and controlled procedures. The configuration control processes of particular importance relate to revisions made to plant operating procedures and to Structures, Systems and Components (SSC) status control.

Revisione in Operating procedures (e.g., Operating Instructions, Abnormal Operating ,

instructions, etc.) may be necessary for a number of reasons including the installation ;

of plant modifications. Procedure revisions are required to be reviewed in accordance l

with the specific Operations guidance defined in the Operating Procedures Group l

Writer's Guide (Reference 138) and with the provisions of the procedures for " Author's i Guide for Preparation of Orders, Procedures and Instructions"(Reference 139) and l

" Review / Approval Process for Orders, Procedures and Instructions" (Reference 140)  !

except in certain cases where time constraints become a factor. When this situation occurs, expedited and controlled processes are implemented in accordance with the procedures for "Use of Procedures"(Reference 141), " Temporary Facility Modification Control" (Reference 142), " Temporary Change Notices" (Reference 143) or " Operation of Annunciators and Indicators"(Reference 144), as applicable. At the earliest available opportunity the change (s) implemented under the expedited or temporary process is formally converted to a revision. Irrespective of the process used to change l procedures, appropriate reviews are conducted to assure that the changes conform with the design bases requirements including performance of a screening evaluation to determine the need for a 50.59 safety evaluation.

Plant status control of SSCs is implemented using the WA process described in the procedures for " Work Authorizations"(Reference 145) and " Work Authorizations issue, Release and Modifications"(References 146). Within the Operations organization an EC group, made up of experienced, operations oriented personnel, review WAs prior

i ENCLOSURE A Pago11  !

to issue. WAs include clearance boundary definition and tagging instructions, the MO or CWO used to perform the work and system alignment / component position and

• restoration requirements. Independent verification is required to assure proper alignment / position and restoration as described in the procedure for " Control of System l Alignments"(Reference 147). EC employs a detailed reference guide for WA  !

evaluation. The reference guide also addresses evaluating special precautions such as fire protection, structural integrity, flooding and potential high energy impingement.  !

Within Reference (145) are special provisions that may be imp!emented by Operations shift management under certain specific conditions when plant work must proceed in an expedited manner and time does not permit a formal WA to be processed. j

l. Vendor Manuals Vendor manuals containing installation, operation, and maintenance instructions for l

equipment are initially received as part of the procurement of the equipment. l Equipment vendors are periodically contacted by San Onofre personnel to assure that l

the current vendor requirements applicable to the San Onofre supplied equipment are j available. Vendor information received as a result of the initial equipment procurement i and subsequent contacts are evaluated for incorporation into Operations and  !'

Maintenance procedures in accordance with the guidance of NRC Generic Letter 83-28 " Vendor Interface For Safety Related Components"(Reference 22) and NRC Generic Letter 90-03 " Relaxation of Staff Position on GL 83-28 Item 2.2 Part 2"  ;

(Reference 23) and the process controls included in the procedures for ' Vendor  !

Information Review Program Manual Compilation, Review, and Approval"(Reference 152),"Mainionance Engineering and Services Document Assessment and Tracking System" (Reference 153), and, " Configuration Document Change Control for Vendor information"(Reference 154).  ;

l IV. IMPLEMENTATION OF 10CFR50.59 REQUIREMENTS l The requirements of 10CFR50.59 are implemented in accordance with approved and controlled procedures. Edison utilizes the guidelines contained in NSAC-125

" Guidelines for 10CFR50.59 Safety Evaluations"(Reference 31). Safety evaluations are performed by personnel with pertinent technical expertise in the UFSAR, Technical Specifications, Licensee Controlled Specifications, etc. Personnel performing safety evaluations and screenings have access to design bases information contained in the UFSAR, DBDs and design documentation using site wide computer systems such as TOPIC, Nuclear Document Management System (NDMS), Nuclear Consolidated Data Base (NCDB), and Nuclear Document Information System (NDIS) and hard copy and microfiche records maintained in CDMC controlled files which are retrievable using  !

NDIS and NDMS computer systems. The following methods are used to determine the  !

need for a safety evaluation and the corresponding preparation and review of the l safety evaluations:

)

e Specific requirements for 50.59 safety evaluations applicable to proposed permanent facility changes covered by the DCP process are defined in the l

ENCLOSURE A Pago 12 procedure for " Development, Review, Approval and Release of Conceptual ,

Engineering Packages (CEPs)~and Design Change Packages (DCPs)"

(Reference 102). A safety evaluation is completed and reviewed and approved as part of the DCP. i o Evaluations applicable to nuclear fuel design changes are defined in the procedures for " Design Process Flow and Controls" (Reference 101) and

" Documentation of Safety Analysis"(Reference 113). A safety evaluation is completed, reviewed, and approved as part of the FCE.

' e Minor modifications using FCNs per the procedure for " Field Change Notice (FCN) and Field Interim Design Change Notice (FIDCN)" (Reference 103) have l a specific safety evaluation unless they pass the screening using criteria l contained in Reference (103). The FCN contains a block which is checked to indicate "no" if the screening is used or "yes" if a specific safety evaluation is  ;

required. The applicability of the screening or the adequacy of the safety evaluation is reviewed and approved as part of the FCN package. A recent change to Reference (103) has been issued to require a written basis for the FCN screening decisions. If the equipment is discussed in the UFSAR, a focused review is required to assure no change in plant function and/or design bases have occurred. The results of these reviews are documented within the FCN description of change with appropriate reference to the UFSAR sections reviewed for impact.

• Corrections to design drawings to reflect the existing plant configuration are documented using DCNs per the procedure for " Interim Design Change Notice (IDCN) and Design Change Notice (DCN)"(Reference 104). The DCNs are required to have a specific safety evaluation unless they pass a screening. The screening criteria are included in the DCN instructions (form 26-179-1) and include considerations of change impact for such items as operational / functional characteristics, quality group classification, safe shutdown or accident monitoring functions, piping analysis, containment coatings that could affect '

sump performance, containment hydrogen release potential and changes in function from automatic to manual or vice versa. The DCN form contains a block that is checked to indicate "no"if the screening criteria are passed or "yes"if a safety evaluation is required. The acceptability of the screening or the adequacy of the safety evaluation is reviewed and approved as part of the DCN package.

• Nonconformance Reports (NCRs) document interim and final dispositions (accept-as-is or repair) for nonconforming materials, parts and components installed in the plant. Per the procedure for " Nonconforming Material, Parts or Components" (Reference 148), a screening is performed to determine the need for a formal safety evaluation. The screening criteria are included in Reference (148) and include considerations of change impact for such items as changes in function from automatic to manual or vice versa, unreviewed system interactions, seismic or environmental qualification, quality group classification, unmonitored

ENCLOSURE A Paga 13 release paths or capabilities of radiological instrumentation, and operational

- characteristics of replacernent items to perform equivalent design functions. The i

results of the screening or the safety evaluation are included in the NCR safety

evaluation section, which is reviewed and approved as part of the engineering i

disposition approvals e Specific requirements for 50.59 safety evaluations applicable to Temporary l Facility Modifications (TFMs) and Barrier impairments are defined in the procedure for " Temporary Facility Modifications"(Reference 155) and the procedure for " Control of San Onofre 2 and 3 Barriers"(Reference 164) respectively. A safety evaluation is completed and reviewed and approved as part of the TFM or Barrier impairment. 2 e Changes to San Onofre procedures and instructions described in the UFSAR or tests and experiments not described in the UFSAR are required to pass a screening or have a written 50.59 safety evaluation per the procedure for "Unreviewed Safety Question Screening Criteria and Environmental Evaluations for Orders, Procedures and Instructions" (Reference 149) and the form "Unreviewed Safety Question Screening Criteria"(Reference 150). The screening is performed by plant personnel using the following criteria:

"Does the new procedure / procedure change:

1. Alter system / component performance or the design configuration of a system important to safety?

2. Alter the setpoint data or acceptance criteria of a system important to safety?

3. Alter the required actions as a result of not meeting the acceptance criteria?

4. Alter Technical Specification (TS)/ Licensee Controlled Specification (LCS) numerical data or violate TS/LCS provisions?

5. Reduce the required level of approval for a plant activity? i

6. Alter processes for handling, processing, monitoring or releasing licensed radioactive material not contained in plant systems?

7. Reduce operations margins or the conservatism of system operation for a system important to safety?"

A positive response to any of the questions requires the procedure change to be reviewed by personnel knowledgeable in the plant licensing and design requirements. If this review determines a safety evaluation is not required, a technicaljustification is included in the procedure change package. If a formal 50.59 safety evaluation is required, it is prepared, reviewed and approved in support of the procedure change by these personnel. The 50.59 safety evaluation performed as part of the design change process by Engineering is typically used as the safety evaluation for procedure changes that are used to j implement the design change scope, provided that the procedure changes are

1 ENCLOSURE A Pag 314 bounded by the safety evaluation for the design change. Selected procedures t

that are categorized as strictly administrative and do not affect plant i configuration or operation are exempt from the 50.59 evaluation.

Evaluations required as part of the preparation of a UFSAR change package are defined in the procedure for " Control of Licensing Document Changes" (Reference 112). This evaluation may be completed as part of the DCP, FCN, and DCN process and included in the change package. Other UFSAR change packages (e.g., procedure, correspondence, as-found conditions, etc.) require a i separate screening to determine the need for an evaluation to be performed as part of the package preparation. Where required, a safety evaluation is prepared, reviewed and approved as part of the UFSAR change package.

• Evaluations applicable to Licensee Controlled Specifications and Technical Specification Bases changes are defined in the procedure for " Preparation, Review and Approval of Changes to Licensee Controlled Specifications" (Reference 111). A safety evaluation is prepared, reviewed and approved as part of the change package.

• Changes to computer program software that affect plant SSC and processes described in the UFSAR are required to pass a screening or have a written 50.59 safety evaluation. References (119), (134) and (156) control this process.

The screening criteria involve considerations for using the software in the  !

performance of safety related functions, radiation dose assessment calculations, Technical Specification supporting calculations, operational function of safety I related equipment, change in the plant or procedure as described in the UFSAR, and a test or experiment that directs a plant operation or activity.

• Changes to plant configuration or procedures not specifically controlled by one of the above methods that require evaluation under the provisions of 10CFR50.59 are controlled by unique plant procedures controlling these j activities. Examples include CPC/COLSS Addressable Constants changes, 1 which are controlled per the procedures for" Control of Core Protection Calculator Addressable Constants"(Reference 188) and " Control of Plant Physics Data Books, COLSS Addressable Constants and Reactor Engineering Data Transmittals"(Reference 189); Abnormal Alignments, which are controlled '

by the procedure for " Control of System Alignments"(Reference 147); and Offsite Dose Calculation Manual Changes which are controlled by the procedure for " Assignment, Maintenance, Control and Distribution of the Offsite Dose Calculation Manuals" (Reference 190).

V. IMPLEMENTATION OF 10CFR50.71(e) REQUIREMENTS Edison's Nuclear Regulatory Affairs (NRA) organization is responsible for maintaining i and updating the UFSAR as required by 10CFR50.71(e). Engineeling is responsible l

for the technical accuracy of its contents. The updating process is defined in and

6 ENCLOSURE A Paga15 controlled by the provisions of the procedure for " Control of Licensing Document Changes"(Reference 112). The revision process addresses two categories.

Revisions that are initiated through the design change process and revisions initiated by other processes.

Revisions resulting from a design change are captured as part of the design change since a review of the UFSAR impact is required. UFSAR changes are forwarded to NRA at the issuance of the design change. The change is logged into NRA and a hard copy file maintained in a central location. Once the design has been implemented and turned over, the final change package is transmitted to NRA by the Configuration Control organization. This is included with the hard copy file.

Revisions to the UFSAR may also result from changes to procedures, changes to design calculations or analyses, correspondence, operating license changes, changes to administrative information, and as-found conditions. Under these situations a

, UFSAR change package, including a safety evaluation where applicable, is prepared.The package is logged and a hard copy file is maintained. Review and approval is required from various Edison organizations for these packages.  ;

i Between updates, changes for the UFSAR are accessible to plant personnel by site based computer systems and files maintained within NRA. On a refueling interval

.ycle, the approved change packages are assembled into an amendment to the

< UFSAR. The following information is also reviewed for changes to be included in the ,

amendment: the Quality Classification List (Q-List); the Environmental Qualification l (EO) Master List; the Piping and Instrumentation Diagrams; the Electrical One-Line Diagrams; and the Updated Fire Hazards Analysis drawings. The UFSAR amendment i

is submitted to the NRC after internal review by impacted organizations within Edison.

VI. IMPLEMENTATION OF 10CFRSO APPENDIX B REQUIREMENTS A quality assurance program to implement the requirements of 10CFR50 Appendix B was established by Edison at the initial design phase of San Onofre Units 2 and 3 and i has been continuously implemented by Edison, its contractors and suppliers through i the construction, startup and operation phases. The quality assurance program is i described in Topical Report SCE-1-A (Reference 1) and is referenced in UFSAR  ;

Chapter 17. It has been approved by the NRC. The Topical Report addresses the  ;

eighteen criteria of 10CFR50 Appendix B. Revisions are made when there are changes in organizational responsibilities and methods of program implementation.

These are provided to the NRC. Reductions in commitments require prior NRC review and approval.

The Topical Report requirements are implemented through the provisions of the San

Onofre Topical Quality Assurance Manual (TQAM, Reference 2), and through a series i of approved procedures and instructions many of which are referenced in this enclosure.

i ENCLOSURE A Pag 316 implementing procedures and instructions are organized by responsible department  !

(e.g., Operations, Maintenance, NEDO, etc.) or, in certain cases, by program (e.g.,  !

Nonconformance Reports). Procedures and instructions (including changes thereto) are processed in accordance with approved administrative procedures that control  :

their format, preparation, review, approval and issuance. Compliance with and the j effectiveness of these documents is assessed on a planned and periodic basis by '

l NOD and through division self-assessments. >

Vll. OVERSIGHT OF PROCESS IMPLEMEN TATION -

\ .

l The adequacy of implementation of the above process controls is regularly r tviewed i during NRC inspections and Edison NOD audits and assessments. A summary of the .

NRC inspections, LERs and Edison NOD audits and assessments related to I implementation of the above process controls during the last two years (1995 - 1996) is l

included in the following paragraphs.  !

A. NRC inspections e NRC Inspection Report 95-201 (December 1995) (Reference 58) documented an Integrated Performance Assessment Process (IPAP) at San Onofre Units 2 and 3. The IPAP covered the period from September 1993 to October 1995.  !

This detailed assessment by the NRC gave Edison reasonable assurance that the processes in place are adequate to control the design basis at San Onofre Units 2 and 3. The inspection team observed San Onofre to be a safe and generally well operated facility. There was no indicrlion of any major programmatic weakness in the five program areas. In the area of engineering, the IPAP report indicates that Edison's overall performance was superior. The J team reviewed self-assessments, design changes, temporary facility modifications, NCRs, setpoint calculations, and the status of drawing updates.  !

Engineering self-assessments were thorough. Safety evaluations for plant l modifications were performed thoroughly by trained engineers. Design changes and work requests contained proper safety evaluations, post-work testing and )

acceptance criteria, and assessments of the impact of the change on licensee programs. The team verified that the individuals performing safety evaluations received appropriate training. Edison's management of the drawing backlog was noted as being effective. In response to plant issues the team noted that Edison implemented a barrier control program and an instrument setpoint program. The MOV and IST programs were also identified as being good. The review of the system engineering program noted that the system engineers were knowledgeable of their systems, had completed the required training, were involved in problem analysis, the IST program, trending of pump and valve

! performance, and performed adequate coordination with Maintenance, NEDO, j and Operations. The Plant Operations Group's (POG) support to NEDO in the  !

I design process to provide plant operations and maintenance expertise was j noted as a strength.

ENCLOSURE A Paga 17

• NRC Inspection Report 95-26 (January 1996) (Reference 65) documents an inspection of engineering and technical support and 10 CFR 50.59 safety i evaluations. The following was concluded for this inspection: ,

l Edison was effectively implementing the requirements for control of nonconforming items.

l .

Edison design documentation was thorough and reflected good  !

engineering practices. '

l -

Edison system engineers were very knowledgeable of their systems, both i from a configuration standpoint and in reference to current developments affecting the systems.

Minor discrepancies were identified in the UFSAR. Edison corrected the specific deficiencies noted by the NRC and performed reviews to determine the extent of the prcblem. These reviews determined that a systematic review and update of the UFSAR was required.

It was noted that a 50.59 screening evaluation is performed to determine the need for a formal safety evaluation but the screening does not require that a basis be provided in the event a 50.59 safety evaluation is not required. An example was noted related to an FCN for the replacement of a flow-limiting orifice with a gate valve in the Reactor Coolant Gas Vent ,

System (RCGVS). The UFSAR description of this system had not been l updated to reflect the FCN design change. A formal 50.59 safety '

evaluation was subsequently performed by Edison, which concluded that no unreviewed safety question was identified. A UFSAR change request was initiated to update the UFSAR.

A Notice of Violation was issued for procedural noncompliance related to the UFSAR update process and the safety evaluation process.

• NRC SALP Report 95-99 (February 1996) (Reference 59) for the period of July 1,1994 through December 30,1995 noted strengths in engineering programs and procedures, design engineering role in assuring plant safety, the high level of engineering presence in the plant to support maintenance activities and engineering self-assessments and resultant corrective action.

• NRC Inspection Report 96-02 (April 1996) (Reference 60) documents a routine resident inspection related to an IPAP observation related to TCNs where actual procedure changes were being implemented prior to management approval. In addition there were a number of TCNs against some procedures. Separately, the inspector determined that the abnormal alignments procedure was being used for special tests, including nonstandard operation of high pressure safety injection pumps, multiple valve manipulations, and testing of associated check

, valves. The abnormal alignments were not approved by senior site management l prior to implementation. The impact of these deviations from administrative l procedures were determined to have no safety significance. Edison revised the l procedure program for handling of TCNs to establish mo;L effective controls. In t

l

ENCLOSURE A Page 18 1

addition, procedures were revised to require management approval prior to implementation of any abnormal alignments for test evolutions.  ;

e NRC Inspection Report 96-05 (July 1996) (Reference 61) concluded the UFSAR adequately reflected current refueling practices. During this inspection, the seal water for the charging pumps was determined to be inaccurately described in the UFSAR as being Class 1E powered. Edison prepared a UFSAR change to resolve this issue.

• NRC Inspection Report 96-08 (August 1996) (Reference 66) concluded, based on a review of related licensing documents, drawings, operating procedures, and a walkdown, that the AFW system is in a condition of operational readiness, and corrective maintenance of the system is effectively managed. On the issue of inoperable tornado dampers, the NRC determined that Edison was slow to i

initiate and complete an operability assessment. A subsequent review l determined that the tornado dampers had no design bases function to support plant tornado protection design criteria. Edison has taken actions to improve performance in the areas of timeliness of initiating Action Requests and the I technical rigor and timeliness of completing operability assessments.

e NRC Inspection Report 96-10 (December 1996) (Reference 67) concluded that Edison had adequately demonstrated the existing design basis capability of all l motor-operated valves and had estab?ished adequate controls for post- I maintenance / modification testing to maintain the design basis capability i consistent with its Generic Letter 89-10 program. l l

• NRC Inspection Report 96-15 (December 1996) (Reference 68) identified a l discrepancy in the UFSAR regarding maintaining the Volume Control Tank water level. A separate review of the emergency chilled water system and the corresponding DBD determined that there was an issue with the leakage from the system and corresponding makeup. Edison issued Action Requests to address the NRC observations. During this inspection it was also identified that the NCR process did not require a review of Operations or Mair,tenance procedures when making a design modification. Edison revised the NCR procedure (Reference 148) to reference the existing process (Reference 200) for performing these reviews.

• NRC Inspection Report 96-17 (December 1996) (Reference 64) documents an inspection of the Reactor Coolant Vent Gas System (RCVGS) orifice gate valve mispositioning. A Notice of Violation was issued for this event. The irispectors also reviewed a previous violation regarding this same valve identified in inspection Report 95-26. The inspector noted that the FCN procedure had not been revised to require a basis for the 50.59 screening process. Edison initiated actions to update the UFSAR. In addition, Edison issued a change to Reference (103) to require a written basis for the FCN screening decisions. If the equipment is discussed in the UFSAR, a focused review is required to assure no

ENCLOSURE A Pags19 change in plant function and/or design bases has occurred. The results of these reviews are documented with the FCN description of change with appropriate reference to the UFSAR sections.

l The specific issues raised during the above NRC inspections do not represent areas of safety significance that would compromise the design bases of San Onofre Units 2 and l

3. Edison has acted upon these specific issues in a timely manner and has initiated

appropriate enhancements to the process controls in the affected areas.

l B. Licensee Event Reports (LERS)

I

• LER 2-95-007 (May 1995) (Reference 80) - Incorrect Core Protection Calculator l (CPC) addressable constants were provided by ABB-CE and Edison personnel l erroneously entered the Unit 2 values into the Unit 3 CPCs. An engineering  ;

evaluation concluded that both San Onofre Units 2 and 3 remained within design bases limits during the period the incorrect addressable constants were installed. The correct addressable constants were subsequently installed.

1 e LER 2-95-009 (June 1995) (Reference 81) - UFSAR commitments to Regulatory l Guide 1.9 required Emergency Diesel Generator (EDG) electrical load sequencing be arranged such that the minimum output voltage of the EDGs I would not drop below 75 percent of nominal. A review of potential EDG loading j scenarios concluded that the minimum generator voltage would momentarily dip to about 60 percent in certain cases, but the EDG would satisfactorily perform its  !

intended design function.

1

• LER 2-95-014 (September 1995) (Reference 82) - The electrical system logic  ;

was modified to address degraded grid voltage conditions. The modification did ,

not include an audible or visual flashing alarm for a change in breaker control status to alert the operators of the need to enter a Technical Specification Action Statement when two sources of offsite power were lost.

• LER 2-95-016 (December 1995) (Reference 83) - An engineering review of potential interactions between Emergency Core Cooling System (ECCS) l components and steam that could be released from hypothesized High Energy l Line Breaks (HELBs) concluded that steam released from a rupture of one of these systems could have traveled through ventilation systems to ECCS and other safe shutdown system components, potentially creating a harsh environment in which some components were not designed to operate. Edison ,

installed design changes to mitigate the consequences of these postulated accidents.

• LER 2-95-017 (January 1996) (Reference 84)- A single analyzer monitors Toxic Gas Isolation System (TGIS) butane and propane but uses different carbon counts to establish the ppm reading for each gas. This allowed the propane channel to be calibrated at a higher setpoint level than allowed by the Technical

t ENCLOSURE A Pago 20

, Specifications. Edison revised surveillance procedures to assure compliance i

with the more restrictive setpoint requirements.

e LER 2-96 005 (July 1996) (Reference 85) - An reassessment of coaxial cables

and connectors for inside containment High Range Radiation Monitors (HRRM) concluded that during an accident, moisture could permeate the cable jacket and I cause a loss of HRRM signal. Edison initiated an alternate method of monitoring  !

l using a combination of permanently installed and hand-held radiation monitors to assure equivalent information is available to the operators. Design changes i

are also being installed during the Cycle 9 refueling outages to upgrade the environmental qualification of the cables / connectors.

l 1 e LER 3-96-005 (October 1996) (Reference 86)- As a result of a design change, a flow restricting orifice in the Reactor Coolant Gas Vent System (RCGVS) was ,

replaced with a one inch gate valve that has a hole drilled through the valve disc to provide an identical function as the flow restricting orifice. When opened, the presence of the valve precludes the operational need to first remove and later re-install the flow restricting crifice during refueling outages. During

• preparations to drain the Unit 3 Reactor Coolant System (RCS) to mid-loop, an operator found the valve open and later discovered that the valve had not been closed at the end of the last refueling outage (9/95). Edison confirmed that the plant always remained bounded by existing accident analyses and there was no '

safety significance related to the valve being left open.

The above LERs do not indicate systematic problems in control of the San Onofre 2 and 3 design or configuration and are not considered to have major safety significance.

Although certain weaknesses in the original San Onofre 2 and 3 design are identified by the LERs, the LERs provide examples of the current aggressive nature of the engineering reviews and evaluations being performed to assure compliance with the San Onofre 2 and 3 design bases.

C. Edison Audits ano Assessments NOD performs periodic audits to verify effective translation and implementation of design and configuration control requirements. NOD also performs comprehensive assessments. These assessments are focused reviews of all relevant activities relating to a specific design change or safety system to assure technical correctness, compliance with licensing requirements, consistency with design basis, and compliance with process controls. Results of these audits and assessments provide perspective on the effectiveness of the programs and organizations controlling the

design and configuration control process. Representative examples of these audits

! and assessments conducted during 1995 and 1996 are summarized below:

• SCES-507-95 " Station Welding and ASME Code Section XI Repair / Replacement Program"(Reference 306) - This audit verified that activities were satisfactorily

( performed in accordance with program requirements except those related to VT-

ENCLOSURE A Paga 21 2 examinations. These VT-2 examinations were not performed in conjunction l with system leakage tests on five occasions, prior to or immediately upon the  ;

return to service, on systems and/or components that require the tests as I designated by the ASME Codes Engineer on ASME Repair Specifications. The lack of VT-2 exams was determined to have no safety significance Corrective  !

! actions were taken to revise procedures to clarify responsibilities for performing VT-2 examinations.

l e SCES-508-95 " Plant Systems" (Reference 307) - This audit verified that several l key plant systems (Main Steam Safety Valves, Main Steam isolation Valves, l Atmospheric Dump Valves, Auxiliary Feedwater System Pumps, and Emergency l Chilled Water) were being tested in accordance with the Technical Specifications. No deficiencies were identified.  !

• SCES-519-95 " Procurement Docurnent Development" (Reference 308) - This  !

audit examined the actions of the Procurement Engineering group with regards j to procurement document development. The results showed that good judgement and engineering knowledge were employed during the development of these types of documents. Minor deficiencies were identified and corrected as a result of this audit.

i e SCES-524-95 " Design Control Processes implemented by NEDO"(Reference 309) - This audit concluded that NEDO generally implements the design control process in a satisfactory manner. The audit found a number of minor errors and l inconsistencies, which were caused by a lack of attention to detail by the engineering staff. These problems were corrected and procedure improvements were also provided related to change controls for drawings, calculations, and the UFSAR.

• SOS-032-95 "MMP 2060 Operations and Maintenance Procedure Changes" (Reference 310)- This surveillance reviewed Operations procedures changes that implement the degraded grid voltage design change (MMP 2060). The audit I concluded that the procedure changes satisfactorily addressed the MMP requirements except for requirements related to minimum voltage for diesel '

generator testing. Procedure changes were subsequently provided by Operations to address this area.

l l

Note: The MMP was a design change process previously used for minor design 1 changes. The DCP or FCN processes are presently used for design changes previously documented using MMPs.

• SEA 95-002 " Vertical Assessment of DCP 2&3-6984.00SJ (Excore Safety l Channel Neutron Flux Detector Replacement)" (Reference 311) - This l assessment concluded that the replacement excore detector design, i procurement, manufacturing, installation and testing was satisfactory. Minor

a ENCLOSURE A Pago 22 corrections to supplier documentation and DBD documentation were provided by Edison. - -

! e SEA 95-006 " Vertical Assessment of DCP 2&3-6926.00 and .01SJ (Radiation Monitoring System Replacement)" (Reference 312) - This assessment

concluded that the design and procurement of the replacement radiation  ;

monitoring equipment was satisfactory. Improvements were recommended in I

design calculations, procurement documentation, drawings, suppl!er seismic d

analysis documentation and documentation of DBD Open item Report (OIR)

, closure actions. Actions were taken or are in progress to addreso thase areas, e

SOS-079-95 "FCN 50.59 Evaluations" (Reference 313) - This surveillance reviewed FCN packages generated by NEDO and Station Technical. The 50.59 7

evaluations were concluded to be satisfactory. l 1

e SCES-603-96 " Reactor Protective System (RPS) Instrumentation and _

Engineered Safety Features Actuation System (ESFAS)"(Reference 314)-This l audit verified that the Station properly implemented the Technical Specifications j related to the RPS and ESFAS. Two minor deficiencies were noted, one related i to UFSAR updates and the other to work package sign offs, which were I corrected. i e SCES-604-96 " Reactor Coolant System" (Reference 315) - This audit verified 1 that the Station was in compliance with the applicable Technical Specifications.

Three items were identified as opportunities for improvement. Two instances identified Operations procedures that reflected incorrect Technical Specification references and one instance where a Station Technical procedure had an incorrect Technical Specification reference. Appropriate corrections to procedures were provided.

• SCES-605-96 "AR/NCR Program" (Reference 316) - This audit focussed on equipment / system operability assessments, associated reportability and non-conforming issues. The audit found the Action Request and associated Nonconformance Program to be in compliance with program provisions.

• SCES-627-96 " Motor Operated Valve (MOV) Program" (Reference 317) - This audit reviewed implementation of motor operated valve testing and maintenance requirements to assure proper performance of MOVs. The audit found the San Onofre program to be very good and to be implemented effectively.

• SOS-012-96 " Nuclear Fuel Management Engineering" (Reference 321) - This surveillance reviewed NFM activities related to (1) the preparation, review, approval and change control for Reload Ground Rules; and (2) computer program installation and verification / validation in support of the Cycle 9 fuel reload and safety analysis. The activities were determined to be performed in a satisfactory manner and in compliance with procedure requirements.

ENCLOSURE A Page 23 e SOS-013-96 " Spent Fuel Pool Cooling" (Reference 320) - This surveillance reviewed licensing documents and station procedures related to spent fuel pool cooling to assure consistency of requirements. The station procedures reviewed were, for the most part, consistent with the licensing documents reviewed Three Operations procedures were identified and revised to assure consistency of requirements among other Operations procedures, the UFSAR and the design calculations.

• SEA-96-004 " Configuration Control Assessment"(Reference 322)-This assessment was to determine the adequacy of controls of engineering and licensing documentation requirements that impact station activities, communication of these requirements to station organizations and incorporation of these requirements into station procedures and documentation. The assessment concluded that the engineering and licensing information had been correctly incorporated into most of the affected station procedures and documentation. The assessment reviews resulted in additional action items to revise station documents to reflect engineering requirements. As a result of this assessment and previously issued CAR-004-96, improvements were instituted in the communication, documentation and tracking of engineering recommendations for station procedure changes.

• SEA 96-007,"Self Assessment of Engineering and Fire Protection"(Reference 323) - An assessment was conducted by a team of Edison and other utility peer reviewers using NRC inspection procedures. The assessment reviews were conducted in the following areas: (1) Vertical Slice Review of Chilled Water System; (2) General Engineering Capabilities; (3) Design Change Review for Selected DCPs and FCNs; (4) Temporary Modifications (TFMs); (5) Engineering Problem Resolution; (6) Operations / Maintenance Support; (7) Independent Review and Operational Experience; (8) System Engineering; (9) Station Management; and (10) Fire Protection Program. ,

The overall conclusions related to the engineering programs were as followr Engineering is meeting program requirements.

For the areas reviewed, it was noted the material condition of the plant is well maintained and plant equipment receives adequate engineering attention.

Strengths were noted in the following areas:

(1) Strong engineering organizations exist and the engineering staff is knowledgeable, experienced, and exhibits strong analytical capabilities; (2) Engineering is responsive to plant safety / operability issues; (3) NEDO generates fundamentally sound designs that work well; (4) Engineering computer tools and trending are comprehensive.

Areas for improvement included attention to detail in preparation and review of design documentation and scheduling of lower priority engineering tasks

ENCLOSURE A Paga 24 Specific issues related to the adequacy of a 50.59 evaluation for a diesel

- cross-tie design change and the adequacy of the DBD electrical / controls description for the emergency chiller system design bases were highlighted as significant areas that required corrective actions.

The overall conclusions related to the Fire Protection Program were as follows:

The program was found to be effective in its ability to prevent, detect and respond to a fire emergency.

Personnel associated with the Fire Protection Program demonstrated strong ownership in their program and good working relationships between departments.

Strengths were noted in the following areas:

(1) Awareness / Ownership demonstrated by personnel associated with the Fire Protection Program; (2) Positive trend of the material condition of the fire protection systems; (3) Fire Department readiness and response; (4) Industrial Safety practices of all personnel noted during this assessment.

Areas for improvement included upgrading of material condition, storage practices for flammable materials, and Operations involvement in fire drills.

Appropriate corrective actions were taken or are in progress to address the assessment findings.

e SOS-042-96/ SOS-043-96/ SOS-045-96 "50.59 Evaluations for FCNs, DCPs, FCEs and DCNs" (Reference 324) - These surveillances reviewed the 50.59 evaluation process for design changes. The 50.59 safety evaluations were

. determined to be satisfactory for most of the design change packages reviewed.

Recommendations for improvement were identified related to the need for a documented 50.59 evaluation for two issued DCN packages and the need for UFSAR changes for certain FCN packages and Affected Sections Changes to a DCP. Appropriate actions were taken or are in progress to address these recommendations.

• SOS-046-96 "FCE for Unit 2 Cycle 9 Core Reload" (Reference 325) - This surveillance reviewed the FCE and associated RAR for the Unit 2 Cycle 9 core reload. The design control procedures related to the FCE were determined to be adequately implemented by NFM personnel.

The above audits, assessments, and surveillances demonstrate that Edison has effective processes to control the San Onofre Units 2 and 3 design and configuration to assure compliance with the design bases. Specific issues identified during these reviews have been acted upon in a timely manner by Edison and do not indicate

__ . _ ___ __. ___ _ _ _ - _ ._ _ _ _ _ _ _ . _ _ _ ___ _=

L i

'fiNCLOSURE A Pago 25 l generic weaknesses in the process controls or represent areas of safety significance l that would compromise the design bases of San Onofre Units 2 and 3. l l

Vill. CONCLUSION Edison has established programs and processes for control of the plant and configuration which are responsive to the requirements of 10 CFR 50.59,10 CFR 50.71(e), and Appendix B to 10 CFR Part 50. Implementation of these programs and processes have been routinely audited by Edison and inspected by the NRC. These -

audits and processes have demonstrated that the programs and processes are effective in controlling activities to assure that the design bases of the plant are maintained. Issues raised by these audits and inspections have been acted upon by i Edison in a timely manner, including appropriate enhancements to process controls to further strengthen the design and configuration control programs. 1 l

l

)

I l

l 1

I I

1 l

1 l

4

EXHIBIT A ,

) CONFIGURATION CONTROL PROCESS NRC Requiremente (1DCFR Re9 Guides, Other)

_ _ + .

Uoenes, UFSAR, UFHA,TS, LCS

. +

1 .

s um centrol P- ,

4 Desien Colm 4-- Indu"'Y Standards ->

Codes, Etc.

%g

{

h . vendor Desien ineo peos.Eic.) Note (1) v v i 4

Procurement Process  % c"- - - P-4.a-

• -b Requissons, PO, PEP (DCP44AJOR)(FCN44NOR)

Vendor Documentellon (FCE FUEL RELOADS)

(Design, tool, QA) -Dnsg Changes Evel(SEE) 080 Chenees FCN (50.50) 60.50

. .See imped (OPS, Maint , Test)

-Usensing impact (UFHA, UFSAR, TS, LCS)

Equipment .Deelen Criterte imped W Seteore Wns h N Note (2)

ReceMng 1r h v Test Plant Modokston Process ConstrucHon (CWO's) mn hure Procese un h anoa) -* . Translate design, soensing

. work Piens (CWOs, Mos) & wendor requirements into Plant procedures

. Work Auth. Process (WAR)

. Procedures (Operations, Maintenance,

.Const. Specitoseons Test, etc)

.OC Inspedion -Procedure chen0e review

.Tosens,TER (revision,TCN)

-Fioed Design Change 50.50 (FIDCN, FCN)

.Solhuere %

h h FCN Cloesout DCP Tumover Phg i i Stoson OpereMay Evolueton

+

CC

=

y v

o==="aa=

.. ._ "y COMC . system Alignment UFSAR/UFHA Update 4 Plant Control Pra-

• .Opeestons (Procedures)

DCNoCCNs -Meintenance (Procedures, FIDCNeOCNs Cloes go.)

Notts: FCN DNCe WAR .Teenne (Proc.dures)

ICCECN 4 . Wort control (WARS)

(1) Calculations with procedure impacts but . Temp Mods (System no physical plant changes. -> gagnm.., pg.g i..e.,

M&TE instenaton, etc.)

(2) Design Changes With procedure impacts. op,e

l

. _ . - EXHIBIT B l

CORRECTIVE ACTION PROCESS l (Refer to Enclosure D for Process Description) l Problem i

V  ;

AR \

Note (2) l h l 4 y Plant Equipment v System or Human Non-Equipment Impact Performance l Problem Problem  !

V AR Committee V l ER Review (Note 3)  !

Problem Resolution Note (1) l

-Engineering Evaluation v -Design Document & Change v

-Plant Procedure Change investigation Problem Resolution -Other

-MO/CWO (Work Document)

-NCR (repair, accept-as-is) v

-TFM (temporary change in config) Corrective Actions

-50.59 (to supportinterim & - Process Changes final config changes) 9

- Training

-Design Change Documentation h - Other i 1 Y

1

@ Y I

@ l Notes:

(1) The Division investigation Report (DIR) was previousy used in a similar manner to the present Event Report (ER).

(2) Corrective Action Requests (CARS), Problem Review Reports (PRRs), Regulatory Commimert Tracking System (RCTS) actions, Non-Regulatory Action Tracking System (N ATS) actions, Ste Problem Reports (SPRs) and other problem documentation were also previousy used in a similar manner to the Action Request (AR) to identry problems.

The AR system is intended to replace at of these problem reporting systems when it is futyimplemented.

(3) Preilminary operabity assessments are provided by the AR Committee in a timely manner to satisfy the requiremerts of Generic Letter 91-18 (Reference 24).

I j

I

1 1

l 1

l i

1 I

4 l

1 1

l 1

l l

l 1

l l

i l

ENCLOSUREB l

ENCLOSURE B Pags1 l

This enclosure responds to information request (b) which solicits the:

" Rationale for concluding that design bases requirements are translatedinto operating, maintenance, and testing procedures;"

l 1. OVERVIEW Edison has confidence that it has adequately translated design bases requirements into operating, maintenance and testing procedures because the required processes are performed in accordance with formal process controls; are subject to independent l reviews; and have been in many cases re-performed in accordance with more recent  !

and more rigorous standards.

11. ORIGINAL PROCEDURE DEVELOPMENT Edison originally developed its operating, maintenance, and testing procedures using preoperational system testing procedures, prerequisite component testing procedures, and the reactor startup _ sting procedures as a guide. The design bases requirements and assumptions of the Bechtel and Combustion Engineering (ABB-CE) design documents were incorporated in preoperational, prerequisite, and startup test ,

procedures which were formally reviewed and approved by Bechtel and ABB-CE. I Edison later revised the Emergency Operating Instructions (EOls) in response to the requirements of the Nuclear Regulatory Commission's (NRC's) Three Mile Island (TMI)

Action Plans. For this revision ABB-CE developed generic guidelines for reviewing EOls which were approved by the NRC. ABB-CE developed plant specific guidelines by incorporating the design bases information for San Onofre Units 2 and 3 into the generic guidelines. With the original EOls and the plant specific guidelines, a project team of Edison. personnel from Operations, Engineering, and Analysis and ABB-CE personnel developed the upgraded EOls. The upgraded EOls received tabletop reviews and were verified on the simulator. Walkdowns were performed to verify 1 information in the EOls was correct id that the steps could be performed as written.

Once completed, the project team urned over the EOls to Operations for training, i simulator use, and implementation in the control room.

Ill. PROCEDURE DESIGN BASES VERIFICATION This section demonstrates Edison has recently verified the translation of the design bases requirements in many of the operating, maintenance, and testing procedures.

As the result of the efforts described below, Edison has performed detailed reviews of )

l design bases requirements in the subject areas. Thus, Edison has reasonable l assurance that design bases requirements are translated into operating, maintenance, and testing procedures.

l ENCLOSURE B Page 2 j l

A. Design Bases Documentation Program Between 1989 and 1994 Edison completed an extensive Design Bases Documentation l (DBD) effort resulting in the generation of the twenty-eight System and Topical DBDs: l SYSTEM DBDs 6.9kV,4.16kV, and 480V Electrical Systems 1E 125V DC and 250V DC Systems

{

Non-1E-125V DC and 250V DC Systems l Reactor Coolant System '

Steam Generators and Secondary Side i Chemical and Volume Control System '

Component Cooling Water System Saltwater Cooling System Excore Nuclear Instrumentation System instrument Air and Backup Nitrogen Systems

{

Fire Protection and Detection Systems Radiation Monitoring System Plant Protection System Safety injection, Containment Spray, and Shutdown Cooling Systems  ;

Auxiliary Feedwater System Emergency Chilled Water System TOPICAL DBDs i Accident Analysis (Part 1)

Appendix R Safe Shutdown Codes and Standards Environmental Qualifications l Fire Protection Human Factors Engineering Hazards Analysis In-Service Testing, 'st 1 an Year interval In-Service Testing,2no Ten Year Interval Operator Actions Plant Level Topical Single Failure An essential element of the DBD process was the plant procedure review, which was performed for system DBDs and for pertinent podions of plant systems discussed in topical DBDs The plant procedure review included applicable Operating Instructions (Ois), Abnormal Operating Instructions (AOls), EOls, Surveillance Test Procedures i which confirm compliance to the Technical Specifications, and Test Procedures  ;

confirming safety related electrical interlocks. This review was controlled by procedures for " Plant Operating Instructions Review Methodology," "rechnical l

l l

ENCLOSURE B Paga 3 Specification Review Methodology," " Electrical Interlock Functional Testing Review Methodology," " Post-Modification Testing Review Methodology," and " Inservice Testing (IST) Review Methodology" (References 177,178,179,180, and 199). The plant procedure review provided reasonable assurance that the procedures were consistent '

with the design bases and that the design bases requirements cited in the procedures j were accurate and current and, where possible, based on revision controlled '

documents.

The DBD Program was intended to compile the plant design bases and to confirm that i the physical plant configuration and plant operations are consistent with the plant I design bases. Edison documented, evaluated, and subsequently dispositioned by the Open item Report process, as specified in the procedure, " Design Bases Documentation Open item Report" (Reference 181) discrepancies and inconsistencies found during the procedure review. Edison's Corporate Document Management i Center (CDMC) system contains results of the procedure review and associated engineering evaluation.

Furthermore, the reviews of the Ols and AOls related to systems for which DBDs were ,

performed, as well as reviews of the EOls, identified no discrepancy that would have  !

resulted in a unit shutdown nor was any discrepancy determined to be reportable.

Thus, Edison expects that any design bases discrepancy in those portions of Ols and AOls not reviewed as part of a DBD effort will similarly be of relatively low significance.

l B. Emergency Operating Instruction Review Edison developed and used Bases and Deviation Documents (BDDs) for the Operator  :

Action Topical DBD (also known as the EOl Topical DBD). The objective of the BDD effort was to document the ABB-CE Emergency Procedure Guideline (EPG)(CEN-152, Revision 3) (Reference 34) accident mitigation strategy and deviations therefrom as l

related to San Onofre Units 2 and 3. The effort resulted in nine EOl BDDs, including 1 screening technical deviations between the EPGs and the San Onofre Units 2 and 3 I EOls.

The BDDs identify technical deviations between the EPGs, and the EOls, as well as the bases for the accident mitigation strategies encompassed in the EOls. Technical deviations are departures from ABB-CE's technical requirements based on application to site specific functions that reflect a change in intent of a step or in strategy of the EPG. Where a technical deviation existed, an engineering analysis was identified that justified the deviation. Edison evaluated deviations between the ABB-CE EPGs and the San Onofre Units 2 and 3 EOls during development of the BDDs.

The Bases Document of the BDD includes an overview of the emergency and the mitigation strategy. It provides the intent and functional objective of each EOl step.

The Deviations Document of the BDD provides a technical description of all deviations, assesses their safety significance, including whether a 50.59 safety evaluation is required, and provides a technical justification for any deviations, including references.

ENCLOSURE B Page 4 C. Updated Finai Safety Analysis Report Review Project Edison committed (Reference 16) to evaluate the San Onofre Units 2 and 3 Update Final Safety Analysis Report (UFSAR) to revalidate its accuracy as a result of UFSAR discrepancies identified in NRC Inspection Report 95-26 dated January 19,1996 (Reference 65). Edison is performing the review in accordance with a detailed plan that describes methodology, establishes responsibilities, and defines a schedule.

Review activities are scheduled to be completed in 1997 and incorporated into Revision 13 to the UFSAR.

In accordance with 10CFR 50.71(e), Revision 13 to the UFSAR is scheduled to be submitted 6 months after the Unit 3 Cycle 9 outage. As described in the "UFSAR Review Plan and Guidelines," (Reference 192) the review will validate the accuracy of l the existing statements and data contained in the current UFSAR revision and pending l as-built changes awaiting incorporation. The effort will include a disciplined comparison of UFSAR statements and data against supporting documents, including DBDs and calculations, and implementing documents, including operating, maintenance, and surveillance test procedures.

This UFSAR validation project is a major effort estimated to exceed 20,000 man-hours of review. To date, after review of roughly two-thirds of the UFSAR sections, Edison has not identified any safety significant issues. Based on the findings to date, Edison believes that discrepancies that may be identified in procedures still to be reviewed, as well as procedures not included in the scope of this UFSAR review effort, will similarly be of low significance.

D. Setpoint Calculation Program in response to NRC inspections conducted in 1989 and 1991, Edison initiated a Setpoint Calculation Program. This program covers four major areas: safety related instrument setpoints, values in EOls, Technical Specification instrument setpoints, and Technical Specification surveillance test acceptance criteria.

In 1993, Edison completed the first phase of this program which evaluated safety j related instrument setpoints and associated surveillance test requirements (with the -

exception of those related to a not yet installed upgrade of the radiation monitor system). As part of this phase, a number of areas were addressed. Edison generated total loop uncertainty calculations. Setpoint values were reviewed to establish consistency with the design basis. Instrument loop calibration techniques and tolerances were reviewed against associated surveillance test requirements. No instrument inoperability was identified as a result of these calculations.

In 1994, Edison completed the second phase of the program which evaluated i instrument uncertainties for those values in EOls and Remote Shutdown Procedures used to support substantive operator decisions. Edison generated instrument ,

uncertainty calculations for these parameters. Post Accident Monitoring  ;

ENCLOSUREB Pag 3 5 Instrumentation and Remote Shutdown Instrumentation covered by the Technical Specifications were included in this phase of the program. No instrument inoperability was identified as a result of these calculations.

Edison initiated the third phase of the program in 1993. This phase focused on Technical Specification instruments whose values represent settings that function to mitigate accidents, and values for parameters which represent limiting initial conditions assumed for postulated accident or abnormal operational occurrences. To date, Edison has completed approximately 40% of these calculations, and no instrument has been determined to be inoperable.

The fourth and final phase of the program will address instrument uncertainties where the Technical Specifications do not provide specific surveillance test acceptance criteria. This phase will begin in 1997. l The Setpoint Calculation Program, to date, has generated approximately 185 1 calculations and has evaluated the majority of safety significant instrumentation  ;

covered by the Technical Specifications. There have been no cases where an I instrument was determined to be inoperable as a result of a calculation. Edison's j completion of the third and fourth phases of the program will provide further assurance l that there is consistency between design basis calculation results and Technical  ;

Specification surveillance requiremente, j E. Generic Letter 89-10 (Motor Operated Valve) Program l

The San Onofre Units 2 and 3 Generic Letter 89-10 Program demonstrates the capability of safety related motor operated valves (MOVs) to operate when subjected to worst case design bases conditions. The objective is: (1) to demonstrate the valves in the program will satisfy their design basis functions under worst case differential pressure and flow conditions, and (2) to assure the valves' continued capability to satisfy these requirements.

Edison's Nuclear Engineering Design Organization (NEDO) developed an MOV design standard and computer code to efficiently control the preparation and documentation of the MOV setpoint calculations. For each of the 89 valves per Unit, NEDO identified critical valve parameters (e.g., actuator type and size, setpoints, system parameters,etc.). They prepared operational bases calculations to determine the bounding design basis conditions, (e.g., differential pressures, maximum expected line pressures, and flow rates) under which each valve may need to function. NEDO also prepared valve weak link calculations to determine the valve component's structural capacity. The operational bases calculations, weak link calculations, and degraded voltage calculations were combined to produce valve setpoint calculations.

Maintenance revised its procedures to be consistent with the vendor recommendations and to encompass program requirements. Station Technical developed and executed test procedures whereby valves were tested at conditions as close to design bases

ENCLOSURE B Paga 6 requirements as could be reasonably achieved. Station Technical generated l

procedures for the evaluation and documentation of test data and established a trending program.

With the conclusion of the Unit 3, Cycle 8 refueling outage in 1995, Edison completed the baseline setting and testing of the valves within the Generic Letter 89-10 Program.

Summary reports were issued for Units 2 and 3, and Edison notified the NRC of the completion of the baseline testing. In October 1996, the NRC conducted a closure audit of the Generic Letter 89-10 Program and determined the testing and evaluation conducted, and the program elements in-place were acceptable.

F. Generic Letter 89-04 In response to Generic Letter 89-04, dated April 3,1989, " Guidance on Developing Acceptable Inservice Testing Programs," Edison initiated a detailed review of the Units 2 and 3 Inservice Test (IST) program. Generic Letter 89-04 provided additional guidance for selection and testing of pumps and valves. Edison performed a review to assure the appropriate population of safety related pumps and valves were included in the IST program, and to determine if additional acceptance tests were required.

Edison performed an extensive review of the design basis functions and performance requirements of each safety related pump and approximately 4400 safety related valves. Edison reviewed the design bases requirements for each safety related pump and valve which met the IST screening criteria. Edison also reviewed those valves which met the IST screening criteria to identify and document the applicable tests and acceptance criteria to support the corresponding design basis accident analysis. i Seven hundred and forty (740) valves were originally in the IST Program; as a result of l the review of approximately 3660 valves (total for both Units) not originally in the IST program, about 275 safety related valves were added to the IST program. From the review of approximately 740 valves in the IST program, Ecison found about 180 valves required additional seat leakage or stroke time testing. In certain cases, Edison made plant modifications to support valve testing.

Edison updated over 80 Operations and Engineering test procedures to reflect the additional population of valves and the revised tests and acceptance criteria. The final i set of valve baseline tests were performed during the Cycle 8 refueling outages in 1995. Edison added the entire IST program population of pumps and valves to the Nuclear Consolidated Database (NCDB) for more efficient identification, tracking, and trending of the IST Program testing. I As a result of this effort, the corresponding safety related pump and valve test procedures and performance test results were verified to be consistent with their  !

design bases requirements.

ENCLOSURE B Paga7 G. Technical Specification Surveillance Test Procedure Verification In January 1997, Edison undertook an initiative to verify surveillance procedure compliance with the newly implemented Technical Specification improvement Program (TSIP) Technical Specifications. This initiative is the result of Edison identifying inconsistencies in the procedural surveillance requirements and the TSIP Technical Specifications for diesel generator testing. This verification program involves a comprehensive review of Technical Specifications and Licensee Controlled Specifications (LCS) surveillance requirements and verifying accurate incorporation in the associated surveillance procedures. Furthermore, the program includes a comprehensive review of the surveillance tests of record to assure compliance with the Technical Specification and LCS requirements.

4 Surveillance test results or information which may not meet Technical Specification acceptance criteria are identified under the Action Request Program guidelines. This assures that each discrepancy is evaluated to determine if the discrepancy is nonconforming to design requirements, if there is an impact to operability, or if the discrepancy is potentially reportable to the NRC.

ARs generated as a result of this review have been evaluated for operability and reportability. On February 4,1997 a Licensee Event Report (LER) was submitted which noted several instances where Edison should have requested delayed implementation of the TSIP Technical Specifications surveillance requirements. Other i

instances were noted where either the Technical Specification wording or the i Technical Specification Bases wording could have been improved to provide additional ,

clarity of meaning. In addition, in two instances, Edison requested and was granted a l Notice of Enforcement Discretion (NOED) for continued operation of San Onofre Unit 3 until the next refueling outage; in each case Edison determined that the systems were operable.

IV. PROCEDURE CHANGE PROCESS The procedure change process at San Onofre Units 2 and 3 is designed to assure that  ;

design bases requirements are translated into the operating, maintenance, and testing procedures. This section discusses the administrative controls and the practices within the Operations, Maintenance, Station Technical and NEDO organizations for the procedure change process.

As discussed in Enclosure A, changes to operating, maintenance, and testing procedures can originate either in NEDO as a result of a design change or design development activities that do not result in changes to the plant, or in the responsible organizations to address corrections, clarifications, lessons learned, or enhancements.

Edison defines the processes for changing or generating operating procedures to accommodate design modifications in approved and controlled procedures, including  !

the " Author's Guide for Preparation of Orders, Procedures and instructions," j l

! ENCLOSURE B Pags 8 l

" Review / Approval Process for Orders, Procedures, and Instructions," and " Temporary  ;

! Change Notices"(References 139,140, and 143).  ;

i As part of the design change process or design development activities, the design organization performs an impact assessment on station programs and procedures.

The results of the assessment are documented and forwarded by an Action Request to the impacted station organizations as part of the design change process. The 50.59 i

safety evaluation performed as part of the design change process by NEDO is typically )

used as the safety evaluation for procedure changes that are used to implement the ,

design change scope, provided that the procedure changes are bounded by the safety I evaluation for the design change. 1 l

j Edison defines the process for revising operating, maintenance, and testing procedures to correct, clarify, enhance, or incorporate lessons learned in the same j approved and controlled procedures (References 139,140, and 143). This process requires a 50.59 screening evaluation for each change in accordance with the  ;

i procedure for"Unreviewed Safety Question Screening Criteria and Environmental l Evaluation for Orders, Procedures, and Instructions" (Reference 149). The screening evaluation, as discussed in Enclosure A, assists the procedure writer in determining if a 50.59 safety evaluation is required for a procedure change.

4 The Operations Procedure Group (OPG) uses an inhouse writers guide (Reference 138), approved by management, that provides guidance for developing new {

procedures and revising existing procedures. OPG routinely assesses the quality of j the writers guide and revises it as processes mature. Each Operations procedure writer is trained on the writers guide and must pass a qualification test prior to revising

or developing procedures. This training includes an understanding of UFSAR search

. techniques, Technical Specifications, and design basis information location. The procedure writers receive periodic refresher training on all sections of the writer's guide on a rotating basis. New procedures and procedure changes in progress are reviewed for conformance with the design bases, accuracy, and capability to be implemented.

Depending on the complexity of the change, table top reviews include the procedure j writer, an operator, and a cognizant engineer. A physical walkdown may also be ,

performed. l

Maintenance procedure writers use an in-house writer's guide, " Maintenance Procedure Writers Guide"(Reference 183), approved by management, that provides

guidance for developing new procedures and enhancing existing procedures.

Maintenance routinely assesses the quality of the writer's guide and revises it as processes mature. As appropriate, Maintenance procedure writers discuss the procedure changes with the technicians responsible for implementing the change. This i i

may involve a plant walkdown. Peer reviews within the Maintenance Procedure Writers Group provide added confidence in the procedure changes.

System engineers in Station Technical review operating and maintenance procedures

and suggest procedure enhancements to assure that system goals are achieved and

ENCLOSURE B Paga 9 that the procedures and activities meet equipment and system requirements. This review is important because improvements in the technical content, testing or monitoring frequency, maintenance frequency, and format can improve system performance. System engineers use their experience and knowledge of system requirements, operating maintenance history, vendor requirements, and industry operating experience to assure that operating and maintenance procedures address the potential causes of component and system problems and degradation. Generally, Operations and Maintenance will request system engineer review prior to any change in technical content to operating and maintenance procedures.

. As described in Enclosure A and briefly reiterated here, this procedure change process is under established administrative controls. Each procedure change must have a 50.59 safety evaluation or a 50.59 screening which indicates the safety evaluation is not required. The safety evaluation is performed by individuals cognizant of the design bases requirements. In addition to the procedure control, as discussed above, both Operations and Maintenance maintain in-house writer's guides for their procedure writers. Also, technical changes to procedures are generally reviewed by system engineers. These aspects provide reasonable assurance that the design bases requirements are accurately translated into the operating, maintenance, and testing procedures.

V. CONCLUSION Development of the existing operating, maintenance, and testing procedures and the efforts Edison has undertaken, which included design bases verification, provides Edison confidence that the design bases requirements have been translated into operating, maintenance, and testing procedures. Many of the existing procedures were based on the preoperational, prerequisite, and startup testing procedures from startup of the units. These procedures contained the design bases requirements of the plant to assure system and component operability. Following the original procedure development, the DBD Program verified the design bases requirements in many of the operating and testing procedures. Other efforts performed by Edison, in particular the Setpoint Calculation Program and the Technical Specification Surveillance Verification, verified the design bases requirements in many operating, maintenance, and testing procedures. The combination of the DBD Program and other efforts has resulted in verification of design bases requirements for a large number of procedures.

The procedure change process gives Edison confidence that des.go bases requirements will continue to be translated into operating, maintenance, and testing procedures. The process is administratively controlled and organizational practices provide additional assurance that design bases requirements will be adequately translated.

Therefore, Edison has reasonable assurance that design bases requirements are translated and will continue to be translated into operating, maintenance, and testing procedures.

1 l

l l

i ENCLOSURE C i I

\

\

i I

l t

ENCLOSURE C Page 1 This enclosure responds to information request (c) which solicits the:

l

" Rationale for concluding that system, structure, and component configuration and performance are consistent with the design bases;"

i

1. OVERVIEW Edison's current processes and programs are effective in maintaining system, structure, and component configuration and performance consistent with the design bases. These processes and programs have been performed in accordance with formal process controls, subjected to independent reviews, and, in many cases, re-performed to be consistent with more recent and more rigorous standards.

This response is divided into the following elements: l e Configuration Consistency l

Independent Design Verification  :

Prerequisite, Preoperational, and Reactor Startup Tests Systems and Components 1 Structures e Performance Consistency i Prerequisite, Preoperational, and Reactor Startup Tests  !

Post-modification / post-maintenance testing l

Technical Specification / Licensee Controlled Specification surveillance l testing Other periodic surveillance programs Each of these activities is described below, and a summary conclusion provided regarding the consistency of the plant configuration and performance with the design bases.

II. CONFIGURATION CONSISTENCY i

The original San Onofre Units 2 and 3 configuration was established during the initial I design phase and later translated to the field for construction via design drawings.

During the construction phase, walkdowns, quality assurance inspections, and independent contractor evaluations confirmed the original configuration of structures, systems, and components was consistent with the design drawings. After construction i activities, system preoperational and reactor startup testing further substantiated the  !

consistency of the configuration with the design basis. Edison's design and  !

configuration control process managed the configuration after commercial operation.

Edison conducted a Design Basis Document (DBD) Program from 1989 to 1994 to validate and/or reconstitute design basis information. Walkdowns were performed as part of the DBD Program to verify as-built plant systems were consistent with the

ENCLOSURE C Page 2 DBDs. Other programs, which were not system-specific, but focused on design bases issues, provided additional assurance that the plant's configuration is consistent with the design bases.

l A. Independent Design Verification J

Bechtel and Combustion Engineering (ABB-CE) developed the original San Onofre design utilizing design control procedures to assure design disclosure documents l accurately reflected inputs, assumptions, and results of design bases calculations and '

analyses. Edison used field walkdowns to substantiate that the as-built facility was I consistent with the design disclosure documents.  !

l San Onofre Units 2 and 3 received their operating licenses in February 1982 and November 1982, respectively. A review of NUREG-0712, " Safety Evaluation Report Related to the Operation of San Onofre Nuclear Generating Station Units 2 and 3,"

dated February 1981 (Reference 50), the supplements thereto, and related correspondence between Edison and the Nuclear Regulatory Commission (NRC) indicates that Edison addressed numerous design bases issues during the licensing process. Due to San Onofre's location in a region of increased seismic activity, the NRC focused on seismic design adequacy. The NRC and Edison each initiated a i

unique and independent evaluation related to seismic design bases during the i licensir( Lorocess. -

As documented in Supplements 1 and 2, to Reference (50), the NRC contracted with Energy Technology Engineering Center (ETEC) to perform a confirmatory analysis of loading combinations and stress limits on the shutdown cooling line. The results of the ETEC analysis were comparable to Edison's analysis and were well within applicable code criteria for the specified design basis loadings.

In December 1981, as a result of quality assurance and seismic design problems identified at Diablo Canyon, Edison initiated an Independent Design Verification Program (IDVP) of the San Onofre Units 2 and 3 seismic design and associated quality assurance activities. Edison's proactive initiative was taken to provide greater j assurance of the adequacy of the San Onofre Units 2 and 3 seismic design. The IDVP i was performed by Torrey Pines Technology, a subsidiary of the General Atomic ,

Company. The IDVP included a comprehensive review of the seismic design to verify j that the design process converted seismic design bases [specified in the Final Safety )

Analysis Report (FSAR)] into design documents utilized by the constructor and fabricators. Additionally the IDVP evaluated Edison's quality assurance audit plan and its imp;ementation at both San Onofre and the fabricators' shops. The IDVP concluded l that (a) Edison, Bechtel and ABB-CE had design control procedures in place that were satisfactorily implementea in the San Onofre 2 and 3 design process and (b) Edison and Bechtel performed audits at the site and supplier's locations to verify satisfactory j implementation of the seismic design documents. Complete details are provided in Supplements 5 and 6 of the Safety Evaluation Report (SER) (Reference 50) and in

I ENCLOSURE C Page 3  ;

letters from Edison to the NRC dated December 3, and December 29,1981, and April 5,1982 (References 6, 9, and 10).

These independent design verifications corroborated that the original San Onofre Units l

2 and 3 configuration was consistent with the design bases. l B. Prerequisite, Preoperational, and Reactor Startup Tests Prerequisite, preoperational, and reactor startup tests provided a solid initial baseline for structures, systems, and components configuration and performance consistency with the design basis. 1 Edison developed prerequisite, preoperational, and reactor startup tests to encompass all testing activities commencing at the completion of construction and ending at the completion of power ascension testing. These tests demonstrated that the components and systems were configured and operated in accordance with the design bases. The program and organization utilized for original startup testing is described i in Section 14.2 of the Updated Final Safety Analysis Report (UFSAR) (Reference 5).

Testing established baseline performance data for equipment and systems. Edison used normal operating and emergency procedures to perform the initial test program, 1 thereby verifying the correctness of the procedures to the extent practicable. l Edison performed prerequisite component tests on systems or portions of systems to i verify that individual components were properly installed and adjusted. Preoperational l tests were system level tests-conducted prior to fuel loading to demonstrate that structures, systems, and components met performance requirements. During these l tests, initial system performance requirements were demonstrated and measured i against acceptance criteria specified in the test procedures. Results were l documented, and where acceptance criteria could not be met, Edison implemented appropriate corrective actions to bring the system into specification. This testing provided baseline system and component performance characteristics, and established benchmark values of acceptance criteria for subsequent system and component testing. This testing also confirmed the configuration of plant systems was consistent i with the design bases requirements.

The reactor startup tests consisted of precritical tests, initial-criticality low power tests, I and power ascension tests. This testing demonstrated that the plant would operate as designed and was capable of responding to anticipated transients and postulated accidents as described in the FSAR. In summary, as reflected in the SER (Reference 50), the prersquisite, preoperational, and reactor startup test results showed that the plant can be safely operated and that performance levels can be maintained in accordance with the safety requirements established in the FSAR.

At the NRC's request, Edison performed additional plant testing after initial startup to demonstrate compliance with Branch Technical Position RSB 5-1, " Design Requirements of the Residual Heat Removal System" (Reference 69). Edison

ENCLOSURE C Page 4 conducted natural circulation cooldown testing on each Unit. The test results demonstrated acceptable plant and system performance, and that system operating instructions and emergency operating procedures were consistent with design bases

, requirements. In addition to providing experience and confirmation of operations l procedures, these tests provided actua! p; ant data for verification of plant and system 1

configuration.

In summary, the prerequisite, preoperational, and reactor startup tests provided a solid baseline for structures, systems, and components configuration consistency with the design basis.

C. System And Component Configuration

1. Design Basis Document Program Edison conducted an extensive DBD Program from 1989 to 1994. Edison conducted DBD Program activities in accordance with written and approved program guidelines and procedures. Trained, dedicated, multi-disciplined Edison and contract engineers implemented the DBD program scope. Design bases information was reviewed and, where necessary, missing or inadequate documentation was reconstituted. The DBD engineers reviewed applicable Operating Instructions to assure the plant was being operated consistent with the assumptions, initial conditions, and safety analyses identified in the DBDs. In addition, they reviewed Emergency Operating Instructions (EOls), in conjunction with developing Bases and Deviation Documents, to provide an understanding of the ABB-CE emergency procedure guidelines as well as the bases for the accident mitigation strategies encompassed in the EOls (Reference 100).

As part of the DBD Program, the DBD engineers also conducted plant walkdowns to verify that as-built plant systems were consistent with the DBDs. Walkdown guidelines specified that the walkdowns be conducted with attention to thoroughness. Walkdown guidance included items requiring particular attention, such as:

i Confirmation that assumptions and calculations remained valid for the '

current configuration.

Verification that drawings reflected the plant configuration or the actual  !

configuration as a calculation assumption.

Verification that the general arrangement / layout of the equipment, piping, electrical, instrumentation and controls, and other components pertinent to the safety functions, were consistent with the design bases.

Confirmation that barriers, seismic restraints, equipment supports, and snubbers appeared sufficient to fulfill essential functions.

i

ENCLOSURE C Page5 Inspection for evidence of adverse degradation due to age, environment,  !

or physical interactions, which could have impacted essential functions.  !

Verification that major equipment (using nameplate data) was consistent ,

with the system design bases parameters and values.  ;

The DBD engineers documented the walkdowns, including the description of any  !

significant observations. When open issues were identified, Open item Reports (or other appropriate plant reports) were generated to capture the concern, and I categorized as to the significance of the issue (Reference 181). The combination of these walkdowns, and, when required, any corrective actions, provided further confirmation the as-built plant configuration is consistent with the DBDs.

Edison completed twenty-eight System and Topical DBDs. These DBDs covered the ,

majority of systems included in the current Technical Specifications and the majority of risk significant items. The DBD effort included detailed reviews of design bases information and the reconstitution of missing or deficient analyses and calculations.

Edison did not complete DBDs for all Technical Specification systems. The details and Edison's rationale for this were provided to the NRC in a letter dated October 6,1993.

(Reference 12). Edison has confidence that the configuration of Technical l Specification systems that did not have a DBD performed is consistent with design  !

bases requirements. Specific elements of systems that did not have a DBD performed were reviewed for configuration consistency as parts of other Edison efforts. Examples of these design bases reviews include:

(1) Evaluation of motor operated valves in response to Generic Letter 89-10, (2) Review of inservice testing of pumps and valves in response to Generic  !

Letter 89-04, (3) Edison's Setpoint Calculation Program, and (4) Edison's UFSAR Review Project.  :

2. Generic Letter 89-10 (Motor Operated Valve) Program The San Onofre Units 2 and 3 Generic Letter 89-10 Program was established to demonstrate the capability of safety related motor operated valves (MOVs) to operate when subjected to design basis conditions. The objective of the program is: (1) to demonstrate the valves in the program will satisfy their design basis functions under worst case differential pressure and flow conditions, and (2) to assure the valves' continued capability to satisfy these requirements.

Edison's Nuclear Engineering Design Organization (NEDO) developed an MOV design standard and computer code to efficiently control the preparation and documentation of

. ~ .. -- .

l i

l ENCLOSURE C Page 6 the MOV setpoint calculations. For each of the 89 valves per Unit, NEDO identified the critical valve parameters (e.g. actuator type and size, setpoints, system parameters, l

, etc.). They prepared operational bases calculations to determine the bounding design l basis conditions (e.g. differential pressures, maximum expected line pressures, and l l flow rates) under which each valve may need to function. NEDO also prepared valve .

weak link calculations to determine the valve component's structural capacity. The  !

operational bases calculations, weak link calculations, and degraded voltage calculations were combined to produce valve setpoint calculations. '

~

Maintenance revised its procedures to be consistent with the vendor recommendations and to encompass program requirements. Station Technical developed and executed test procedures whereby valves were tested at conditions as close to design bases requirements as could be reasonably achieved. Station Technical generated procedures for the evaluation and documentation of test data and established a trending program.

With the conclusion of the Unit 3 Cycle 8 refueling outage in 1995, Edison completed the baseline setting and testing of the valves within the Generic Letter 89-10 Program.

Summary reports were issued for Units 2 and 3, and Edison notified the NRC of the completed baseline testing. In October 1996, the NRC conducted a closure audit of the Generic Letter 89-10 Program and determined the testing and evaluation conducted, and the program elements in-place were acceptable.

Evaluation of MOV performance-based test parameters, including group performance  ;

and margin assessments conducted as part of the test data reconciliation process, assured that these valves were configured consistent with the design bases. The evaluation also assured that the valves would perform their intended safety functions l when subjected to design bases conditions. These MOVs are monitored, under the Preventive Maintenance and Penodie Verification Programs, to identify any degradation or adverse performance, and to implement necessary corrective actions to maintain the design bases capability of the valves.

3. _ Generic Letter 89-04 In response to Generic Letter 89-04, dated April 3,1989, " Guidance on Developing Acceptable Inservice Testing Programs," Edison initiated a detailed review of the Units 2 and 3 inservice Test (IST) program. Generic Letter 89-04 provided additional guidance for selection and testing of pumps and valves. Edison performed a review to assure the appropriate population of safety related pumps and valves was included in the IST program, and to determine if additional acceptance tests were required.

As described in Edison letter to the NRC dated October 30,1992 (Reference 15),

Edison performed an extensive review of the design basis functions and performance requirements of each safety related pump and approximately 4400 safety related valves. Edison reviewed the design bases requirements for each safety related pump l and valve which met the IST screening criteria. Edison also reviewed those valves

ENCLOSURE C Page 7 which met the IST screening criteria to identify and document the applicable tests and acceptance criteria as required by the corresponding design basis accident analysis.

Seven hundred forty (740) valves were originally in the IST Program. As a result of the review of approximately 3660 valves (total for both Units) not originally in the IST program, about 275 safety related valves were added to the IST program. From the review of approximately 740 valves originally in the IST program, Edison found about 180 valves required additional seat leakage or stroke time tecting. In certain cases, Edison made plant modifications to support new valve testing.

Edison updated over 80 Operations and Engineering test procedures to reflect the additional population of valves and the revised tests and acceptance criteria. The final set of valve baseline tests was performed during the Cycle 8 refueling outages in 1995.

Edison added the entire IST program population of valves to the Nuclear Consolidated Data Base (NCDB) for more efficient identification, tracking, and trending of the IST Program valve testing.

As a result of this effort, the corresponding safety related pump and valve configurations and performance test acceptance criteria were verified to be consistent with design basis requirements.

4. Setpoint Calculation Program in response to NRC inspections conducted in 1989 and 1991, Edison initiated a Setpoint Calculation Program. This program covers four major areas: safety related instrument setpoints, values in EOls, Technical Specification instrument setpoints, and Technical Specification surveillance test acceptance criteria.

1 In 1993, Edison completed the first phase of this program which evaluated safety related instrument setpoints and associated surveillance test requirements (with the exception of those related to a not yet installed upgrade of the radiation monitor system). As part of this phase, a number of areas were addressed. Edison generated total loop uncertainty calculations. Setpoint values were reviewed to establish i consistency with the. design basis. Instrument loop calibration techniques and tolerances were reviewed against associated surveillance test requirements. No instrument inoperability was identified as a result of these calculations.

In 1994, Edison completed the second phase of the program which evaluated instrument uncertainties for those values in EOls and Remote Shutdown Procedures used to support substantive operator decisions. Edison generated instrument uncertainty calculations for these parameters. Post Accident Monitoring Instrumentation and Remote Shutdown Monitoring Instrumentation covered by the Technical Specifications were included in this phase of the program. No instrument inoperability was identified as a result of these calculations.

Edison ir%ted the third phase of the program in 1993. This phase focused on Technical Specification instruments whose values represent settings that function to

ENCLOSURE C Page 8 mitigate accidents, and values for parameters which represent limiting initial conditions ,

assumed for postulated accident or abnormal operational occurrences. To date, l Edison has completed approximately 40% of these calculations and no instrument has I been determined to be inoperable.

The fourth and final phase of the program will address instrument uncertainties where i the Technical Specifications do not provide specific surveillance test acceptance I

, criteria. Edison will begin this phase in 1997. I The Setpoint Calculation Program, to date, has generated approximately 185 I calculations and has evaluated the majority of safety significant instrumentation i

covered by the Technical Specifications. There have been no cases where an I instrument was determined to be inoperable as a resuit of the calculations. Edison's

! completion of the third and fourth chases of the program will provide further assurance l 4

that there is consistency between design basis calculation results and Technical Specification surveillance requirements.

l 5. Updated Final Safety Analysis Report Review Project Edison committed to evaluate the San Onofre Units 2 and 3 UFSAR to revalidate its i accuracy as a result of UFSAR discrepancies identified in NRC Inspection Report 95-26 dated January 19,1996. Edison is performing the review in accordance with a detailed plan that describes methodology, establishes responsibilities, and defines a l schedule. Review activities are scheduled to be completed in 1997 and incorporated )

l irto Revision 13 to the USAR. )

in accordance with 10CFR50.71(e), Revision 13 to the UFSAR is scheduled to be I submitted 6 months after the Unit 3 Cycle 9 outage. As described in the "UFSAR l Review Plan and Guidelines," (Reference 192) the review will validate the accuracy of the existing statements and data contained in the current UFSAR revision and pending  !

as-built changes awaiting incorporation. The effort will include a disciplined l comparison of UFSAR statements and data against supporting documents, including '

DBDs, calculations,.and implementing documents, including design drawings that depict the as-built configuration.

This UFSAR validation project is a major effort estimated to exceed 20,000 man-hours of review. To date, after review of roughly two-thirds of the designated UFSAR sections, Edison has identified no safety significant issues. Based on the findings to date, Edison believes that discrepancies that may be identified in UFSAR sections still to be reviewed against as-built design information will similarly be of low significance.

Therefore, Edison's completion of the UFSAR validation project will provide further assurance that the UFSAR and the plant configuration is consistent with the design bases.

1 I

ENCLOSURE C Page 9

6. Routine Operations Activities Operations personnel monitor key plant parameters to assess changes outside expected limits, and to take appropriate corrective actions in accordance with their procedures. They also perform routine plant system walkdowns to verify proper operational configuration, alignment, and material condition. Performing these routine activities provides additional assurance that the plant configuration is and will be maintained consistent with the design bases, to the extent reflected in plant operations procedures.

7. Routine Station Technical System Engineer Activities Station Technical System Engineers supplement the Operations group by having responsibility for monitoring and trending plant equipment performance in assigned system (s). The Station Technical System Engineer provides technical support and guidance to Operations and Maintenance, reviews and approves Design Change Packages (DCPs) against assigned system (s), and accepts system DCPs when post-modification testing is complete. The system engineer is responsible for temporary modifications to the system. This assures that temporary modifications receive the proper review, that the aggregate of such changes are evaluated, and any impacts to the design bases of the system are understood by the Station Technical System Engineer. >

i The Station Technical System Engineer conducts periodic plant walkdowns to identify deficiencies and to assure previous corrective actions have been implemented. The {

frequency varies, but it is expected that the Station Technical System Engineer will  !

perform a partial system walkdown at least weekly. The Station Technical System Engineer is also expected to perform a walkdown in a specific area as soon as j possibie following any system operational status change, maintenance activity, plant transient or design change. Where possible, the Station Technical System Engineer maximizes the benefit of the walkdown by including Maintenance and/or Operations personnel involved with the system. By virtue of these walkdowns, actua! plant configuration and conditions are regularly observed and, where warranted, promptly corrected.

The Station Technical System Engineers' routine activities provide further assurance that the plant configuration is and will be maintained consistent with the design bases. '

D. Structure Configuration Bechtel developed the original design of San Onofre structures utilizing design control procedures to assure that design disclosure documents accurately reflected inputs, assumptions, and results of design bases calculations and analyses. Edison and the NRC each performed a unique and independent evaluation that further corroborated Bechtel's original design related to seismic design bases, discussed previously in this

i 1

ENCLOSURE C Page 10 l enclosure. These independent evaluations provided greater assurance that the San Onofre Units 2 and 3 seismic design bases for systems and structures were adequate.

As part of final construction turriover, Edison used field walkdowns to validate the as-built structures were consistent with the design disclosure documents. Preoperational l and startup testing programs provided a solid initial baseline for structures, systems, and components configuration and performance consistency with the design bases.

Since original plant design and startup, the safety-related structures at San Onofre Units 2 and 3 have undergone no significant changes. The design of these structures i has remained predominantly stable with little, if any, change in critical design )

parameters or resulting margins (e.g. seismic response, wind loadings, tornado missile effects). I Edison conducted an extensive DBD program from 1989 to 1994. Although a specific  !

DBD was not developed for structures, certain other DBDs included and verified l elements of structural design requirements. The Environmental Qualification (EO) i Topical DBD reviewed structural features relative to EQ barriers and resulting " harsh" l environmental effects from postulated accidents. The Hazards Topical DBD addressed 3 structural issues such as: hydrologic events, wind and tornado effects, internal and l external (tornado-generated) missile protection, high energy line break effects, l moderate energy pipe breaks (flooding) effects, and seismic events. For each of these issues, DBD engineers verified the design disclosure documents for structures, as well {

as systems and components relied on for mitigation, to be consistent with the design l basis requirements. Hence, the topical DBD effort provided additional corroboration that design basis requirements for structures were accurately translated into design documents and into the as-built facility. l To support implementation of the NRC's Maintenance Rule, Edison recently performed walkdowns of safety related structures to establish baseline conditions for prioritization of future maintenance activities. The associated NEDO System Design Engineer performed walkdowns for each safety related building. The walkdowns identified no major inconsistencies with design documents. In some instances, minor discrepancies I were identified and documented via the Action Request program. None of these I discrepancies were safety significant or involved an unreviewed safety question or operability issue.

111. PERFORMANCE CONSISTENCY As discussed previously, the original San Onofre Units 2 and 3 configuration was established during the initial design phase and translated to the field via design drawings. Following construction activities, component prerequisite, system preoperational, and reactor startup testing demonstrated performance and was utilized to establish surveillance test acceptance criteria consistent with the design bases.

ENCLOSURE C Page 11 l

Since that time, Edison has utilized and continues to utilize a wide variety of programs I to assure that the performance of the plant is consistent with the design basis j requirements. Continued performance consistent with the design bases is assured i through: Technical Specification and Licensee Controlled Specification surveillance testing, post-modification and post-maintenance testing prior to Operations turnover, and other periodic surveillance activities that monitor plant performance and material plant conditions. These programs are described below, and, when combined, provide reasonable assurance that the performance of plant structures, systems, and components is consistent with the design bases.

l A. Prerequisite, Preoperational, and Reactor Startup Tests As discussed previously in this Enclosure, prerequisite, preoperational and startup testing programs provided a solid initial baseline for structures, systems, and components performance consistent with the design bases.

This testing demonstrated that the components and systems would perform in accordance with the design bases and FSAR. Testing established baseline performance data for equipment and systems. Edison performed prerequisite tests, preoperational tests, and reactor startup tests. Prerequisite component tests on systems or portions of systems verified that individual components were properly ,

installed and adjusted. Preoperational tests were system level tests conducted prior to fuel loading to demonstrate that structures, systems, and components met performance requirements. During these tests, initial system performance requirements were demonstrated and measured against acceptance criteria specified in the test procedures. This testing provided baseline system and component performance characteristics, which established benchmark values of acceptance criteria for subsequent system and component testing.

The reactor startup tests, which consisted of precritical tests, initial-criticality low power tests, and power ascension tests, demonstrated that the plant would operate in accordance with design and was capable of responding to anticipated transients and postulated accidents as described in the FSAR. As summarized in the SER (Reference 50), the initial performance and startup test results showed that the plant ,

can be safely operated and that performance levels can be maintained in accordance I with the safety requirements established in the FSAR.  !

At the NRC's request, Edison performed additional plant testing after initial startup to demonstrate compliance with Branch Technical Position RSB 5-1, " Design Requirements of the Residual Heat Removal System." Edison conducted natural circulation cooldown testing on each Unit. The test results demonstrated acceptable plant and system performance as documented in the NRC's SER (Reference 69).

l l

1 1

1

l ENCLOSURE C Page 12 l B. Post-Modification / Post-Maintenance Testing l Plant configuration and performance can be impacted during installation of design changes and after performing maintenance activities. To assure proper system and I

component operation, testing is conducted prior to Operations declaring the affected system and/or component operable.

l Post-modification testing provides confidence that the modified equipment will perform as designed. Prescribed limits for acceptance criteria, generated from a review of the original and/or modified design basis requirements, are developed with the design change, and, for DCPs are contained within the Test Guidelines section of the DCP.

These acceptance criteria can be contained in standard test procedures and, where required, unique test procedures. This testing is utilized to verify proper equipment installation and performance. Preoperational test results are reviewed and approved  ;

by Engineering to verify they meet design basis requirements. Prior to final l

acceptance by the station, Operations first verifies operability and then proper system alignment.

Post-maintenance testing and system restoration are accomplished as the final steps of maintenance activities. The Station Technical System Engineer is a resource to review Maintenance Orders and associated Work Authorizations to identify retest requirements, when requested by Maintenance or Operations personnel. An appropriate combination of inspections, checks, and tests is performed, based on

! design criteria, following maintenance of any equipment. These inspections, checks,

) and tests verify the original deficiency has been corrected and that the equipment will perform its intended function. System alignment and configuration are then verified by Operations personnel prior to final acceptance.

C. Technical Specification / Licensee Controlled Specification l Surveillance Testing l Periodic Technical Specification and Licensee Controlled Specification (LCS) i surveillances assure that the capabilities and performance levels of important systems and components have not degraded unacceptably from the design bases. The tests,

, checks, calibrations, inspections, and samplings at appropriate intervals specified in l

the Technical Specification or LCS are intended to verify that operating conditions of the Units and performance capability of systems and components remain consistent with the design bases.

The Technical Specification and LCS surveillance testing program is implemented through individual procedures within the responsible organizations. A summary listing of the specific Technical Specification and LCS sections, and associated testing  !

procedures, is contained in procedure entitled, " Technical Specification / Licensee Controlled Specification Surveillance Program Implementation" (Reference 161). The acceptance criteria for each surveillance test are based on design basis requirements derived from the safety analyses (which were also included in prerequisite, 1

I l

l ENCLOSURE C Page 13  !

preoperational ,and startup testing procedures and verified during startup). Changes I

to these surveillance test procedures, including acceptance criteria, are controlled in ,

accordance with the processes outlined in Enclosure A.  !

l Tests are performed and reviewed by qualified personnel in accordance with written l procedures and instructions. The data collected during surveillance activities, and the I acceptability of that data, is documented before declaring continued operability or l

returning a system or component to operable status. When required, the cognizant i supervisor reviews, evaluates, and approves the collected data and acceptability l determination prior to restoring the equipment / system to operable status. Surveillance data that do not meet the acceptance criteria are identified under the site problem identification and tracking program (Action Request Program). A prompt determination 1 of operability is made, and required actions are proposed to correct the deficiency, consistent with the Action Request system guidelines.

1. Technical Specification Surveillance Test Procedure Verification in January 1997 Edison undertook an initiative to verify surveillance procedure compliance with the newly implemented Technical Specification improvement Program (TSIP) Technical Specifications. This initiative is the result of Edison identifying inconsistencies in the procedural surveillance requirements and the TSIP Technical Specifications for diesel generator testing. This verification program involves a comprehensive review of Technical Specifications and Licensee Controlled Specifications (LCS) surveillance requirements and verifying accurate incorporation in the associated surveillance procedures. The program also includes a comprehensive review of the surveillance Tests of Record to assure compliance with the Technical Specification and LCS requirements.

Surveillance test results or information that may not meet Technical Specification acceptance criteria are identified under the Action Request Program guidelines. This assures that each discrepancy is evaluated to determine if it is nonconforming to design requirements, if there is an impact to operability, or if the discrepancy is l

potentially reportable to the NRC.

ARs generated as a result of this review have been evaluated for operability and reportability. On February 4,1997 a Licensee Event Report (LER) was submitted which noted several instances where Edison should have requested delayed i implementation of the TSIP Technical Specifications surveillance requirements. Other i l

instances were noted where either the Technical Specification wording or the Technical Specification Bases wording could have been improved to provide additional clarity of meaning. In addition, in two instances, Edison requested and was granted a l Notice of Enforcement Discretion (NOED) for continued operation of San Onofre Unit 3 i until the next refueling outage; in each case Edison determined that the systems were operable.

l

ENCLOSURE C Page 14

2. In-Service Testing Program The San Onofre In-Service Testing (IST) program is based on meeting the ASME code requirements for the performance testing of pumps and valves. Approximately 1100 valves and 58 pumps are in the IST program. The San Onofre IST program document contains criteria for selecting components for the program, testing and associated design performance requirements, and the respective test acceptance criteria derived from design basis analyses. Implementation of the IST program for San Onofre Units 2 and 3 is defined in Reference (162) for pumps and Reference (163) for valves. These procedures, in conjunction with the NCDB, define the administration of the program by specifying test intervals, alternate test methods, controls for changing the IST program database, and engineering review of test results. When performance of a pump or valve changes by greater than a prescribed limit, the program requires the initiation of j an Action Request to assure a timely operability assessment. Appropriate cause and l

corrective actions are taken to restore the valve / pump to within acceptable design  !

limits.

3. In-Service inspection Program The In-Service Inspection (ISI) program for ASME Code Class components assures  ;

the structural integrity and operational readiness of these components is maintained at '

an acceptable level throughout the life of the plant. The program detects early indications of potential component failure. This is achieved by carefully and methodically selecting a sample of component welds and supports for examination that may experience high pressure, temperature and other service-induced stresses resulting from normal operation and/or design basis requirements.

The ISI Program Plan defines all the ASME Code and non-Code examination, pressure test, repair and replacement requirements, and the system boundaries for the ASME Class 1,2, and 3 components and supports. The ISI Program conducts non-destructive examinations utilizing test method types such as ultrasonic, penetrant, magnetic particle, visual, and pressure.

The first ten-year ISI interval was successfully completed on March 31,1994. During this interval, all the component welds and supports, including the reactor pressure vessel, were examined per the Technical Specifications, ASME Code and other licensing commitments. Augmented examinations were also included for the reactor coolant pump flywheels, high energy lines, and low pressure turbine bores.

When indications of potential ISI component performance degradation or failure are identified, the program requires initiation of an Action Request. This assures timely assessment of operability, identification of root cause, and implementation of corrective actions.

ENCLOSURE C Page 15 D. Other Periodic Surveillance Programs Other periodic surveillance programs provide additional assurance that the configuration, operational readiness, and performance of systems and components is maintained. Examples of these programs are: Reliability Centered Maintenance, Flow Accelerated Corrosion, Generic Letter 89-13 performance testing, Operator rounds and shiftly walkthroughs, and Station Technical System Engineer State-Of-the-System Reports.

1. Reliability Centered Maintenance A Reliability Centered Maintenance (RCM) approach forms the basis for the RCM Preventive Maintenance Program at San Onofre Units 2 and 3. RCM utilizes decision logic to identify the preventive maintenance requirements of equipment according to the operational consequences of each failure and the degradation mechanism responsible for these failures.

The RCM method focuses on identifying plant systems, their respective subsystems, the functional failures of the subsystems and the component failure modes contributing to the functional failures. Applicable and effective preventive maintenance tasks are specified to minimize the exposure to those component failure modes which affect plant safety or operability.

2. Flow Accelerated Corrosion Program The Flow Accelerated Corrosion (FAC) Program identifies piping components in the turbine process cycle that have experienced high wear or have the potential for significant pipe wall thinning. Affected lines are mainly in the feedwater, steam extraction, and heater drain systems. The program relies, in part, on EPRI's CHECWORKS computer program and algorithms contained therein to envelope and select components showing wear. These components are then examined by ultrasonic testing of wall thickness. When the results of the examination analysis warrant, piping and components are replaced with upgraded erosion-resistant materials (where possible), to reduce further FAC pipe wall thinning and resulting iron transport to the steam generators. The program complies with EPRI-NSAC 202L, " Recommendations for an Effective Flow Accelerated Corrosion Program," the EPRI-sponsored computer program CHECWORKS, and site procedures. The FAC Program is under constant review and improvement through training within Edison and through participation in EPRI-sponsored training and utility user groups.

3. Generic Letter 89-13 Performance Testing Consistent with the guidance contained in Generic Letter 89-13, " Service Water System Problems Affecting Safety Related Equipment," Edison performs periodic visual inspection and testing of safety related heat exchangers in cooling water systems.

ENCLOSURE C Page 16 These inspections and tests are conducted on the Salt Water Cooling (SWC) system, i

the Component Cooling Water (CCW) system, and the intake Structure, which are utilized to discharge heat to the ultimate heat sink. Edison also applies aspects of this program to the Emergency Diesel Generator Cooling System, since it represents an analogous application to the above systems. As described in a letter from J. E. Tatum (NRC) to H. B. Ray (SCE) dated February 23,1990 (Reference 54), the NRC commended Edison for taking the initiative to expand the scope of the review to i include additional safety related heat exchangers that were outside the scope of the i generic letter.

I To maintain these systems in accordance with design basis requirements, Edison's inspection and Maintenance program contains: (1) an ongoing surveillance and control program to reduce incidences of flow blockage and biofouling in the intake structure and SWC system, (2) a routine visual inspection and maintenance program for representative portions of the intch structure and SWC system; and (3) CCW heat j exchanger testing to confirm that ir.brsed functions are performed in accordance with the licensing basis. To further baseline this program, Edison confirmed that Maintenance practices, Operating and Emergency procedures, and training modules involving the above systems were adequate to assure that the safety related equipment will perform as intended and that operators of the equipment will perform effectively (Reference 14). .

1

4. Operator Rounds and Shiftly Walkthroughs Operations personnel monitor key plant parameters to assess changes outside expected limits, and to take appropriate corrective actions in accordance with their procedures. They also perform routine plant system walkdowns to verify proper operational configuration, alignment, and material condition. This provides a real-tim'e indication of plant conditions and performance. Each operator performs a thorough inspection of his assigned area each shift. Conditions that are verified during these rounds include, but are not limited to

motor, pump, fan, etc. temperatures normal; noise and vibration normal; pump suction, discharge, and recirculation flow paths aligned; suction, discharge, and other system parameters normal; transient materials staged or in use are seismically restrained; satisfactory material conditions, including protective coatings; drain and vent hoses / caps are securely installed; gland / joint / fittings are inspected for leakage; no oil leakage from equipment; minor gas or water leakage with no resulting damage to equipment; fire, flood, ventilation isolation boundary, and electrical panel doors are closed and seals (where applicable) intact. Abnormal conditions are reported to the Control Room for evaluation, and either corrected on the spot or an Action Request is generated.

5. - Station Technical System Engineers Station Technical System Engineers are responsible for monitoring and trending performance of plant equipment in assigned system (s). The Station Technical System Engineer also provides technical support and guidance to Operations and

ENCLOSURE C Page 17 Maintenance, reviews and approves DCPs against assigned system (s), and accepts system DCPs when performance testing is complete. The System Engineer is also responsible for temporary modifications to the system. This assures that temporary modifications receive the proper review, that the aggregate of such changes are evaluated, and that any impacts to the performance of the system are understood.

On a nominal quarterly basis, the Station Technical System Engineer generates a State-of-the-System report for most important-to-safety systems. This report provides a broader, " project manager" perspective on system performance, identifies performance trends, and develops action plans for improvement. An assessment of the material condition, overall performance of the system, and precursor parameters that are used to monitor and detect declining performance trends are also included.

The system level parameters reflect measures of system availability and reliability and, where applicable, recommendation; for improvements are provided. These regular activities by the Station Technical System Engineer provide additional assurance that the plant performance remains consistent with design bases requirements.

IV. CONCLUSION In summary, the original San Onofre Units 2 and 3 configuration was established during the initial design phase and translated to the field for construction via design drawings. Walkdowns, quality assurance inspections, and independent contractor evaluations confirmed the original configuration of structures, systems, and components was consistent with the design drawings during the construction phase.

Component prerequisite, system preoperational and reactor startup testing established a baseline for configuration and performance consistent with the design bases.

Post-modification and post-maintenance testing assure consistency of the configuration and performance with the design bases. Technical Specification and other periodic surveillances assure that the capabilities and performance levels of important systems and components have not degraded unacceptably from the design bases.

Edison conducted an extensive Design Basis Document (DBD) Program from 1989 to 1994 to validate and/or reconstitute design bases information. DBD engineers performed walkdowns to verify as-built plant systems were consistent with the DBDs.

The Design Basis Document Program reconfirmed the design basis requirements and the consistency of the plant configuration. Other Edison programs are not system-specific, and consider multiple design bases requirements reaching horizontally across many safety related systems and components.

Edison's improved design and configuration control processes, along with post-modification and post-maintenance testing, preserve consistency with the design bases. Plant personnel monitor the operational state of the plant, including configuration and performance acceptability. System walkdowns are routinely performed by Operations and Station Technical Systems Engineers.

1 I

ENCLOSURE C Pag 318 Therefore, Edison believes there is reasonable assurance that the San Onofre Unit 2 and 3 plant configuration and performance are consistent with the design bases.

ENCLOSURE D

)

ENCLOSURE D Pagei j This enclosure responds to information request (d) which inquires about the:

" Processes foridentification of problems and implementation of corrective actions, including actions to determino the extent of problems, action to prevent i recurrence and reporting to NRC" l

1. OVERVIEW San Onofre has an effective set of programs to identify, resolve and prevent issues that could degrade the quality of plant operations or safety. This section describes the j San Onofre programs for corrective actions as follows:

• Corrective Action and Self Assessment Action Request Program

. Event Report Program

. Industry Event Program Nuclear Oversight Reporting Program

! e Reporting to Nuclear Regulatory Commission (NRC) t e Edison Audits and Assessments e NRC Inspections i

ll. BACKGROUND l l

There have been several corrective action processes in use at San Onofre through the

' design, construction and operational phases of the reactors. Development of a streamlined problem reporting system was initiated in 1994 because the existing corrective action processes had become complex and'not well understood by the

. general site population. This fact, combined with similar observations by the NRC in

, the 1995 Integrated Performance Assessment Process (IPAP) inspections, led to the development of the Action Request (AR) reporting system which was implemented in .

December 1995.

The identification and resolution of problems and potential problems at San Onofre has 4

undergone significant changes since the AR Program was instituted in 1995. Prior to that, each division had a separate program for reporting, investigating and correcting human performance and program deficiencies. Among these were the Division

investigation Report (DIR), Maintenance Division Experience Report (MDER),

Technical Division investigation Report (TDIR), Operations Division Experience Report (ODER), Nonconformance Report (NCR), Licensee Event Report (LER) Programs and Corrective Action Program (CAP) . These diverse site programs, methods and action

tracking systems occasionally delayed corrective action completion or formal closure.

A key feature of the AR Program is that it maintained many of the existing processes for addressing identified deficiencies while providing a singular and easy to use system for reporting and integrating self-assessment data regardless of the source. As such,

, human, program and equipment performance data are collected under one program J

l

~ ,,

ENCLOSURE D Page 2 1 which uses a multi-disciplined screening committee to determine the significance of the data and direct i AR to the appropriate organization for resolution. This concept brings together the results of self-assessments of San Onofre activities identified by 1 line organizations, the Nuclear Oversight Division (NOD) and outside auditing groups.  !

The AR Program allows the integration of information from a variety of sources and '

strengthens the overall processes of self-assessment and corrective action. '

)

Ill. CORRECTIVE ACTION AND SELF-AF,SESSMENT l l

A. Action Request Program l The AR Program was designed to capture problems or concerns into a single system.

This allows any worker to identify a problem or concern without worrying about who should address and disposition it. An AR is used to track and resolve corrective actions identified from self-assessments. In conjunction with the AR Program implementation, San Onofre management established a " lower threshold of event reporting" This lower threshold captures equipment and human performance trends that could not be captured with the preceding problem reporting programs.

The procedure, " Action Request / Maintenance Order Initiation and Processing,"

(Reference 157) documents the methodology for using the AR Program. A flow chart of the problem reporting and resolution process at San Onofre is provided in Exhibit B of Enclosure A. The AR program provides two primary flow path options as follows:

1. Equipment Related issues Issues that have the potential to impact plant equipment functions, introduce equipment or system operability or reportability considerations, or require corrective field work, are directed to the AR Committee for review. The AR Committee includes senior management representation from several site divisions including Operations, Maintenance and Station Technical. Each member of the AR Committee is familiar with and has ready access to documents (Technical Specifications, Design Basis Documentation, Updated Final Safety Analysis Report, etc) necessary to discharge the Committee responsibilities. The AR Committee reviews new equipment-related ARs and characterizes each issue in terms of operability, reportability and priority.

Assignments generated by the AR Committee may include NCRs, formal root cause evaluations, operability assessments, engineering evaluations for cause or procedure / program changes. Preliminary operability assessment by the AR Committee satisfies the Generic Letter 91-18 (Reference 24) requirement for timely (within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) operability assessment of conditions adverse to quality on important-to-safety systems and equipment. The AR Committee also serves to improve consistency in the application of management standards to problem evaluation through their management status and experience. Site staff training on the AR system emphasizes the AR Committee path as the most conservative

1 l

l ENCLOSURE D Page3 choice for issues that are not clearly qualified for processing as non-equipment ARs.

2. Non-equipment Related issues issues that are not equipment-related are allowed to proceed without AR Committee review. Human performance observations, procedure enhancement recommendations and drawing errors where the as-built configuration in the I plant is clearly correct, are examples of issues that advance without AR  :

Committee review. Assignment type options in the non-equipment process path l are limited to those issues which have no equipment implications (the user is  !

prohibited from generating a Maintenance Order (MO), NCR, operability l assessment, etc).

ARs that identify degradation or nonconformance of an important to Safety (ITS) structure, system or component (SSC) are assessed for root cause and corrective actions in accordance with Generic Letter 91-18, San Onofre Topical Report (Reference 1), and 10CFR50, Appendix B, Criterion XV and XVI (Reference 20). As discussed previously, timely operability and reportability assessments are initiated, documented and approved via applicable AR assignments. These ARs are screened by the AR Committee to prioritize significant problems and assign formal root cause evaluations.

Minor deficiencies, which do not warrant formal root cause assessments, are resolved l via a " rework" MO or design document correction assignment to restore design conformance of the SSC. If an ITS SSC does not conform to design but is operable and acceptable for service, an engineering NCR is used to track the problem to resolution. The primary purpose of the NCR Program is to document and resolve the deviation of components from design requirements. NCRs are fully electronic with built-in documentation controls including 10CFR50.59 safety evaluations and disposition approvals.

Equipment deficiencies that do not represent a "significant event adverse to quality" are assigned an Engineering Evaluation for Cause (EEC) rather than a formal root cause determination. The organization completing the EEC is responsible for coordinating any new assignments under the AR and for completing the resulting EEC corrective actions.

ARs are also used to highlight possible 10CFR21 reportable conditions (any plant component defect that could create a substantial safety hazard). The NOD Independent Safety Engineering Group (ISEG) determines the reportability of the defect in accordance with " Evaluation and Reporting of Problems to the NRC Pursuant to 10CFR21 and 10CFR50.9"(Reference 166) and is responsible for notifying the NOD Manager of those events with 10CFR21 implications. A potential 10CFR21 reportable plant defect is first considered for reportability under 10CFR50.73 via

ENCLOSURE D Page 4

" Licensee Event Report System"(Reference 174). The LER evaluation most often eliminates the need to report the event separately under 10CFR21 criteria. I B. Event Report Program l

The Event Report Program (Reference 171) is the single program used by the Nuclear l Divisions to evaluate and trend human performance and program related events at San Onofre. Event Reports (ERs) are assigned within the AR System to assure the event is accurately characterized and when appropriate, a root cause evaluation is initiated and corrective action taken. An ER is classified into one of four levels based on the degree ,

of event significance as determined by actual consequence and complexity. Event l trending information (such as failed barrier and cause) identified during the i investigation is entered into the AR trending system by the individual ER Division Coordinators (a specialist assigned from within the Division). Event Trend Reports (ETRs) are generated based on the frequency of similar barrier and cause failures.

These reports are used to anticipate possible problems in other, apparently unrelated, areas or divisions so that appropriate corrective actions can be implemented prior to a possible event. Corrective actions are entered into and tracked to completion via the AR tracking system.

I ERs are generated to assure that events caused by human performance, programmatic or organizational deficiencies are evaluated such that appropriate action is taken to prevent recurrence. The ER Program encourages workers to report events regardless )

of the event consequence. The result has been to develop a broad database that 1 allows trend identification and analysis for emerging or potential issues.

NOD is currently performing a quarterly evaluation to identify trend patterns across the Nuclear Divisions. The trending analysis is incorporated into the NOD quarterly report which is distributed to Vice Presidents and Nuclear Division Managers.

C. Root Cause Program Criterion XVI of 10C.FR50, Appendix B, requires that the cause of significant conditions adverse to quality be determined and corrective action taken to preclude repetition.

10CFR2 and 10CFR50.73 contain similar requirements for response to Notices of Violation and submittal of Licensee Event Reports. The Edison Topical Report Quality Assurance Program (Chapter 17 of the UFSAR) also requires NOD to make detailed recommendations for improving plant safety (Section 17.2.20.1, Reference 3) These requirements involve determining the root cause of significant events occurrir,g at San Onofre.

Edison established the Root Cause Program via Directive D-005, (Reference 165) to provide the formal management framework within which events contrary to quality and safety are promptly and properly evaluated for root cause. The Root Cause Program encompasses human performance issues and provides the basis for (a) required reporting or regulatory response and (b) corrective action to prevent recurrence. NOD

i ENCLOSURE D Page 5 responsibilities are discharged via San Onofre procedures " Event Report Program" (Reference 171), " Root Cause Program Standards And Methods"(Reference 172), and

" Root Cause Evaluations", (Reference 173). The procedures are used by the various Nuclear Divisions to conduct formal root cause evaluations. Management responsibility for the root cause evaluation and determination is clearly identified in these procedures.

Requirements for determination of the root cause for significant events adverse to

, quality are controlled in accordance with the procedures cited above and incorporated into the applicable Nuclear Division programs. The controls include regulatory reporting / response, nonconforming condition disposition and response to various oversight (audit) activities. The Root Cause Program does not supersede the requirements of these other programs; rathe-it provides the requisite complementary elements concerning root cause determination methodology, assurance of appropriate organization scope involvement, independent verification of results, quality, and management visibility / direction. When an event is significant and as directed by management, NOD will participate or assume direct responsibility for the evaluation

, and determination of the root cause. NOD responsibility includes review and approval of root cause analysis results with comments and recommendations provided to the appropriate Vice Presidents and Managers within the Nuclear Organization.

Event root causes fall into three categories: Equipment Failure, Human Error (Inappropriate Action) and Organizational & Prograrematic Deficiencies. Procedure

" Root Cause Program Standards and Methods" describes the phases of investigation ,

and analysis common to all such programs or processes. It also provides a selection of methods used in each phase and standards or minimum criteria that assures effectiveness of the Root Cause Program regardless of the event category. The procedure contains guidance for applying the root cause aspects of the specific problem to similar activities to prevent similar failures or problems. Step 2.4.9 contains the following, "Once the Root Cause(s) has been identified, all similar work practices, i procedures, activities and programs that are subject to the same Root Causes should be identified and evaluated for changes to prevent recurrence of similar events."

investigations conducted under the auspices of the Root Cause Program are intended to identify fundamental root causes. The Root Cause Program assumes that human performance is not always the cause of an event, but is often a symptom of the underlying cause. Root cause analysis is based on the presumption that corrections aimed at root causes rather than symptoms are effective and lasting. The product of this program has been a reduced number of events that degrade plant safety and reliability as evidenced by a declining number of reportable Licensee Event Reports (LER) during 1996. Also both Units have gone more than three and a half years

( without an unplanned trip.

ENCLOSURE D Page6 D. Industry Event Program l

The Edison Topical Report Quality Assurance Program (Chapter 17 of the UFSAR, {

SCE-1-A) requires that the ISEG exarnine plant operating characteristics, NRC issuances, industry advisories, Licensee Event Reports and other sources of plant t design and operating experience information that may indicate areas to improve plant safety. The industry Event Program for evaluating those types of information is the l subject of Reference 167. The program was developed to verify that information pertinent to plant safety originating from the nuclear industry is evaluated and provided 1 to appropriate organizations within San Onofre and Edison. The program operates in  ;

conjunction with the LER System discussed later under Section IV. NOD is directly responsible for evaluating industry operating experience reports (OERs) and identifying appropriate corrective actions to the responsible organizations. The ISEG Supervisor screens incoming OERs and periodically convenes an ISEG Screening Committee to consider applicable OERs for a detailed and documented evaluation.

The sources of operating experience information (OERs) include but are not limited to:

1) _ NRC Information Notices (ins),

2) INPO Significant Operating Experience Reports (SOERs),

3) INPO Significant Event Reports (SERs),

4) 10CFR21 reports originating outside Edison,

5) Combustion Engineering Technical Bulletins (CETBs) and -

6) Other applicable vendor notifications. l lSEG evaluations are at a level of detail commensurate with the significance of the l event to the safety of San Onofre operation. When deemed appropriate as part of the l

evaluation, detailed corrective actions are formulated and directed to the Cognizant Functional Division Manager (CFDM) for implementation. Corrective actions l commonly consist of making detailed recommendations for revising procedures, l conducting training, modifying equipment or activities connected with maintenance and operations or other means of improving plant safety or reliability. Formal tracking is  ;

accomplished through the AR tracking system if the corrective action is a San Onofre

, commitment or Regulatory Commitment Tracking System (Reference 159) (RCTS) if it f is an NRC commitment.

E. Nuclear Oversight Reporting Program NOD identifies problems during routine performance of assessments, surveillances, j audits, quality inspections and performance based observations. A comprehensive i audit schedule covering the criteria of 10CFR50 Appendix B assures proper oversight by NOD in required areas to verify that San Onofre complies with the regulatory requirements.

" Planning and Scheduling of Audits"(Reference 169) defines the scope of NOD audit j activities. The Audit Criterion Table of the procedure establishes the minimum program areas to be audited (as defined in the regulatory and license commitments),

l

i ENCLOSURE D Page 7 the method of implementation and the minimum audit frequency. The Master Adit ,

Schedule (MAS) and quarterly MAS updates are developed using input from the NOD i Managers and Supervisors. The MAS is a quick reference of the specific audits to be J l performed for the designated audit cycle. Audits may be supplemented by the NOD l l Surveillance Program which generally provides on-going verification of procedure i j implementation including witnessiry and making performance based observations of 2 l activities in progress.  !

NOD is also responsible for the San Onofre Corrective Action Program (TOAM Chapter l 1-F, Reference 4). The program is comprised of a hierarchy of integrated and 3 decentralized implementing procedures that contain controls necessary to implement I the TOAM requirements. Other division procedures are integrated into this program.

I For conditions adverse to quality that relate to implementation of the Quality Assurance l Program at Edison facilities or related suppliers, NOD maintains and implements a separate Corrective Action Program (CAP). The NOD Corrective Action Request (CAR), (Reference 158) provides for item or system identification, description of the adverse condition, cause of the condition, corrective action to resolve the problem, and 1 the currective action to prevent recurrence as appropriate to the problems identified. l Lesser problems may be identified and resolved by issuing a NOD Problem Review l

Report (PRR)(Reference 168), Currently, NOD CARS and PRRs may be used in conjunction with or in lieu of the AR Program to direct and assure the completion of appropriate corrective actions. These reporting methods are currently being evaluated for incorporation into the AR system.

The major corrective action processes discussed under Section Ill (AR, ER, Root Cause, Industry Event and the NOD Quality programs) work together to reduce events

i. that could degrade plant safety and reliability at San Onofre. A measure of the program success is the fact that Unit 2 has not had an unplanned reactor trip in almost four and a half years and Unit 3 in over three and a half years. Another measure is the l reduction of required LERs submitted to the NRC over the last five years covering l Units 2 and 3. There were an average of fourteen LERs per year submitted during 1992 through 1995 but only nine during 1996. Although the AR Program is a year old, the data is only now becoming meaningful with a statistically significant data base.

Ongoing trending of this data allows prompt action to resolve specific issues that have the potential to adversely affect the safe operation of San Onofre.

l IV. REPORTING TO NRC i Reporting information to the NRC is accomplished via procedure "NRC Reporting Requirements"(Reference 170). This procedure identifies NRC reporting requirements and organizational responsibilities that are in the regulations, Technical Specifications and the Offsite Dose Control Manual. The reporting requirements are  !

identified in attachments to the procedure.  !

i

l ENCLOSURE D Page 8 i

L Reporting events in accordance with 10CFR50.72 and 73 is provided in procedures l

" Notification and Reporting of Significant Events"(Reference 160) and " Licensee Event  ;

' Report (LER) System"(Reference 174). The first procedure (Reference 160) i i delineates the immediate reporting requirements of 10CFR50.72 for the Operations j l

staff and directs Operations to contact Compliance for additional reporting guidance.  ;

! The report is the responsibility of the Nuclear Regulatory Affairs (NRA) Compliance '

section. The LER Procedure (Reference 174) addresses event reportability l l determination as the first step. The Compliance Engineer is advised to review ,

l applicable information in the effort to determine if an event is potentially reportable. .

This review includes operator logs, Shift Technical Advisor reports, CARS, NCRs, ARs, ERs, and any other applicable document. Once a determination is made, the i Compliance Reportability Supervisor is notified and, if appropriate, a timely notification !

of the event is made to the NRC. l i

The Compliance Engineer proceeds through the LER investigation, preparation, review j and approval process. The procedure provides detailed information for each of these i phases If necessary, a management briefing meeting is held to discuss the event, reportability, issues, actions to be taken, preliminary cause and corrective actions.

)l The LER is reviewed and approved by cognizant organizations. Commitments made in the LER are incorporated into the Regulatory Commitment Tracking System (Raference 159) with the approval of the appropriate manager. The final LER is rrviewed and approved by the Vice President, Engineering and Technical Services rend the Vice President, Nuclear Generation.

I V. EDISON AUDITS AND ASSESSMENTS NOD performs periodic audits and surveillances of the reporting programs. The most recent audits covering the programs are described below:

i

1) SEA 96-003, " Assessment of Action Request Process"(Reference 319) I concluded that the AR process was generally implemented in accordance with l procedural' requirements and that the engineering evaluations were technically )

adequate. However, there were instances where Station Technical personnel l had not established consistent work practices for assignment and closure of  ;

l followup activities associated with ARs. Station Technical completed corrective {

actions in October 1996 and closed AR 960301568.

2) SCES-615 96, " Biannual Corrective Action Audit"(Reference 326) evaluated the adequacy of the root causes identified in DIRs. It was found that the root cause analy sis techniques did not consistently identify the underlying cause of

! incidents involving human performance. Corrective action was completed with i the development and implementation of the AR Program in December 1995 and j the associated ER Program .

1 ENCLOSURE D Page 9  !

3) SOS-018-96, " Operator Licenses, NRC Reports and Notifications,"(Reference 327) describes a surveillance of the process used to initiate, process and submit l I

reports to the NRC within 30 days as required by 10CFR50.74,55.25 and 55.53(g). This surveillance was conducted at the request of NRA following a near miss (28 days to submit) for timely submittal of a report required by 10CFR55.25 (30 days required). Personnel error (inattention to detail) was determined as the primary cause of the near miss. No program deficiencies ,

were identified. l

4) SCES-616-96, " Biannual Corrective Action Audit"(Reference 328) resulted in i one PRR (020-96) with recommendations to: 1) review the NOD CAP l procedures to assure consistency,2) provide training to assure consistent understanding of CAP fundamental elementc and 3) determine an appropriate I root cause evaluation initiating criteria that is consistent between both the Root Cause and ER Programs. Procedure changes and training are in progress.

5) SOS-024-95, "NOV Response Verification Inspection Report 95-05," (Reference I 329) describes Edison actions taken as a result of inappropriate issuance of  !

security access badges to individuals. Based on document reviews and I personnel interviews, NOD concluded that the actions taken to prevent recurrence had been implemented. No deficiencies were identified.

The above audits, assessments and surveillances demonstrate that Edison has l effective corrective action programs. Specific issues identified during these reviews i have been acted upon in a timely manner by Edison and do not indicate significant  !

weaknesses in the programs or identify areas of safety significance that would compromise appropriate corrective actions. i l

VI. NRC INSPECTIONS NRC Inspection Report 96-05 (Reference 61) pointed out that the purpose of the AR Program was to provide a single system for reporting conditions, events and proposed improvements for corrective action by the San Onofre organizations. The inspection report indicated that the threshold for problem identification was very low and all items were properly reviewed with appropriate actions assigned and implemented. The report also noted that Edison's self-assessment of the AR Program was thorough and effective.

NRC Inspection Report 95-201 (Reference 58 ) concerned the results of the IPAP which covered the period from September 1993 to October 1995. The inspection team observed San Onofre to be a safe and generally well operated facility. There were no indications of major program weaknesses in any of the five program areas. Strengths were identified in root cause analysis, the corrective action system, and NOD's CAR process, it was noted that Edisan had separate systems for identifying deficiencies (NCR, PRR, CAR, SPR, DIR, etc). The team identified some weakness in SPR l

l

ENCLOSURE D Page 10 classification of deficiencies and corrective actions tracking. Edison took action to l implement a new and easier AR Program in December 1995.

l i

NRC SALP Report 95-99 (Reference 59), continued to identify strengths in the area of l the corrective action systems and characterized them as effective in resolving equipment design and engineering procedural deficiencies. Root Cause analysis for  :

equipment deficiencies and performance issues was also cited as a strength in this latest report. The report elso identified a need for NCR process improvement, which  ;

has been accomplished.  !

Vll. CONCLUSION Edison has established extensive and effective programs at San Onofre to identify  !

problems, determine their extent and provide appropriate resolution. For significant  !

conditions adverse to quality, the programs require the cause to be determined and appropriate corrective actions implemented to prevent recurrence. Processes are in place to identify conditions that are reportable to the NRC in accordance with license conditions. Edison audits and NRC inspections have demonstrated the effectiveness of these programs and processes.

i l

i I

4 1

1 ENCLOSURE E

)

1 I

1 l

I i

J I

F t

I l ENCLOSURE E Pago1 This enclosure responds to information request (e) which solicits:

"The overall effectiveness of your current processes and programs in concluding that the configuration of your plant (s) is consistent with the design bases."

I

1. OVERVIEW Edison has completed and planned a number of rigorous engineering and assessment efforts which assure the adequacy and availability of design bases information.

II. DISCUSSION In 1994 Edison completed the Design Bases Documentation (DBD) Program begun in 1989. The program generated twenty-eight System and Topical DBDs. This program was intensive, involving in excess of 400,000 man-hours of effort and a rigor exceeding the requirements specified in NUMARC 90-12, " Design Basis Program Guidelines."

When NUREG-1397, "An Assessment of Design Control Practices and Design Reconstitution Programs in the Nuclear Industry," was issued in 1991, Edison assessed its program plan and associated procedures to assure they did not contain the common weaknesses cited by the NRC. Similarly when NRC policy statement, t " Availability and Adequacy of Design Bases Information at Nuclear Power Plants "

(57FR35455) was issued, Edison's DBD project team reviewed it and incorporated it into its DBD Manual and the DBD Program Plan.

Edison's DBD Program included review of design bases calculations, generation of new drawings such as instrument loop diagrams and Appendix R safe shutdown logic diagrams, and acquisition or reconstitution of missing or inedequate calculations. It also involved documented plant verification walkdowns and reviews of operating instructions and surveillance test procedures. For the areas covered, the DBD Program assured Edison that the configuration of the plant is consistent with the design bases.

The areas covered by the DBD Program account for the majority of the systems contained in the current Technical Specifications. Systems covered by the Technical Specifications for which formal DBDs were not developed are: Post /*ccident Monitoring Instrumentation, Remote Shutdown System, Containment Systems, Control Room Emergency Air Cleanup System, Fuel Handling and Storage Systems, Class 1E 120V AC System, and Emergency Diesel Generators. Although these systems were included within the original program scope, Edison decided not to develop DBDs for l them based on safety classification, risk significance, the extent of available design l bases information, coverage by a Topical DBD, and the influence of other ongoing programs. Edison advised the NRC of this action.

Edison believes that its decision in 1994 to reduce the original scope of the DBD Program was appropriate. However, Edison is raising its standards in light of the rising l

l l

l ENCLOSURE E Page 2 i

expectations within the industry and the NRC. Therefore, Edison is reactivating its DBD Programs for the purpose of developing DBDs for the Emergency Diesel Generator and for the Containment Systems. This effort will be performed to the same rigorous standards of Edison's original DBD effort and will be completed prior to October 1998. In addition, Edison will perform a safety system functional assessment (SSFA) of the Class 1E 120V AC System and the Control Room Emergency Air Cleanup System. These assessments will include in-dep'h vertical slice reviews of actual design basis documentation and comparisons with the as-built and as-operated plant following processes similar to those described in NRC Inspection Procedure 93801, " Safety System Functional Inspections." Edison will complete these efforte prior to October 1998.

Some issues identified during the DBD Program have yet to be fully resolved. During the DBD Program Edison allowed resolution of less significant issues to be deferred consistent with other scheduled work based on documented operability and reportability assessments. Edison will expedite resolution of these issues to assure closure by July 1997.

Other efforts provide Edison confidence that systems not specifically covered by the DBDs are consistent with their design bases. Edison's responses to Generic Letters 89-10 (Motor Operated Valves) and 89-04 (Inservice Testing) provide assurance that the configuration and performance of safety related pumps and valves are consistent with their design bases requirements.

Edison initiated a Setpoint Calculation Program in 1990 and completed the first phase in 1993. This phase assured that safety related instrument setpoints and associated surveillance test requirements (with the exception of those related to a not yet installed upgrade of the radiation monitor system) are consistent with their design bases.

Edison completed the second phase of this program in 1994. This phase assured that values in Emergency Operating instructions used to support substantive operator decisions reflect their design bases. Post Accident Monitoring Instrumentation and Remote Shutdown Monitoring Instrumentation covered by the Technical Specifications were included in this phase of the program.

The third phase of the program began in 1993. This phase focuses on Technical Specification instruments which support accident mitigation or assure operation within initial conditions assumed in accident analyses. To date, approximately 40% of the required calculations have been completed.

The fourth and final phase of the program will address instrument uncertainties where the Technical Specifications do not provide specific surveillance test acceptance criteria. This phase will begin in 1997. The third and fourth phases of the program will be completed by October 1998 and will provide further assurance of consistency between design bases and Technical Specification surveillance test procedures.

ENCLOSURE E Page 3 l The Setpoint Calculation Program, to date, has evaluated the majority of safety significant instrumentation covered by the Technical Specifications. Edison declared

! no instruments inoperable as a result of calculations performed in the first three phases. Therefore, there is a low likelihood that the balance of this effort will reveal an operability issue.

Edison's current Updated Final Safety Analysis Report (UFSAR) Review Project will verify accuracy of UFSAR requirements with respect to design bases calculation results, implementing procedures, and the as-operated as-tested plant. To date Edison has reviewed roughly two-third = of the UFSAR sections and has identified no safety significant issues. Edison expects similar results in the balance of this project.

To assure consistency is maintained between the plant and its design bases, Edison classified its DBDs as Design Disclosure Documents to assure they are controlled and maintained current. Edison scanned the DBDs and the UFSAR into the site computer network thereby making them available for their widespread use in the performance of work activities.

Edison employs formal controls on its design, configuration control, and procedure processes, the overall effectiveness of which have been corroborated by internal and regulatory audits and inspections. NRC Inspection Report 95-201 (December 1995) documented the Integrated Performance Assessment Process (IPAP) at San Onofre covering the period from September 1993 to October 1995. This detailed assessment by the NRC found that processes to control the design bases at San Onofre Units 2 and 3 were adequate. In the area of engineering, the IPAP report indicated Edison's overall performance was superior. The IPAP report found engineering self-assessments to be thorough and concluded that trained engineers thoroughly performed safety evaluations for plant modifications. Design changes and work requests contained proper safety evaluations, post-work testing and acceptance criteria, and assessments of the impact of the change on licensee programs. The IPAP report characterized the Motor Operated Valve (MOV) and Inservice Testing (IST) programs as good. The review of the system engineering program noted that the system engineers knew their systems and completed the required training. System engineers were involved in problem analysis, the IST program, and trending of pump and valve performance, and performed adequate coordination with maintenance, design engineering, and operations.

Ill. CONCLUSION in light of completed programs, planned efforts to perform intensive design bases information verifications, the expected low likelihood of future safety significant issues related to the adequacy or availability of design bases information, and effective processes to control changes to plant configuration, Edison has reasonable assurance that it is effectively assuring that the configuration of San Onofre Units 2 and 3 is consistent with its design bases.

l

e ENCLOSURE F i

l I

i i

l 1

i l

l l

\

l

ENCLOSURE F Page 1 This enclosure responds to the request for information regarding design bases reconstitution which reads:

If design review or reconstitution programs have been completed or are being l

? conducted, provide a description of the review programs, including identification

of the systems, structures, and components (SSCs), and plant-level design

l. attributes (e.g., seismic, high-energyline break, moderate-energyline break).  !

l The description shouldinclude how the program assures the correctness and i

accessibility of the design bases information foryourplant and that the design {

bases remain current. If the program is being conducted but has not been l

completed, provide an implementation schedule for SSCs and plant-level design attributes review, the expected completion date, and method of SSC prioritization used for the review.

1. OVERVIEW This Enclosure demonstrates the thoroughness of San Onofre's design review and j

reconstitution programs and identifies those systems, associated components, and i plant-level attributes (called Topicals) which have been, or will be, addressed as part l of the program. Additionally, it outlines the measures implemented to assure I correctness and accessibility of design bases information and to assure the design l bases remain current. A program status is provided for those items not yet complete.  !

11. BACKGROUND Operating licenses were received for San Onofre Units 2 and 3 in February 1982 and November 1982, respectively. As a recent vintage plant, numerous design bases )

issues were addressed during the licensing process (Reference 50).

l A prime example is the seismic design adequacy reviews conducted by the Nuclear Regulatory Commission (NRC) as well as independent evaluations commissioned by Edison and performed by Torrey Pines Technology, a subsidiary of General Atomic (References 6, 9,10, and 50). These efforts consisted of a comprehensive review of the seismic design to verify that the seismic design bases specified in the Final Safety

- Analysis Report (FSAR) had been correctly translated into design documents used by the Engineer-Constructor (Bechtel) and equipment fabricators. The NRC concluded that "... the design verification program was acceptably designed and implemented to uncover systematic design deficiencies that may exist in the design of San Onofre l Units 2 and 3."  !

l i The need to develop DBDs for Units 2 and 3 became evident after a variety of i challenges to operation, maintenance, and design of these facilities during the initial " l stages of transition from a construction based organization to an operating plant  ;

environment. The culmination of these events was a Safety System Functional Inspection (SSFI) of the Units 2 and 3 Component Cooling Water (CCW) and Saltwater Cooling (SWC) Systems which resulted in several Notices of Violation and Deviation.

_ _. _ _ _ _ __ _ ~ . . - . _ . _ . . _ _

ENCLOSURE F Page 2 The inspection was particularly critical of Edison's understanding of the design bases,

)

accuracy and availability of design information, and the overall quality of engineering. '

(Reference 51) l Edison had already recognized the declining performance of engineering and had .

commissioned the Design Process Task Force during 1987 to address overall design  !

! control. Following the 1988 SSFl on CCW and SWC, Edison chartered a second task l force to perform and publish an independent Assessment of Engineering and I Technical Support (IAETS). l l

The Design Process Task Force recommendations were finalized in late 1988 and  ;

incorporated as procedural changes and enhancements over the next few years. The i l findings and recommendations of IAETS were issued in August 1988 (Reference 300) l and resulted from detailed analyses of Notices of Violation, Licensee Event Reports, j l' NRC inspection findings, internal problem reports, and corrective action requests issued over a four year period. Among these recommendations, the more significant '

were as follows: '

e Reorganize from the three engineering organizations into two with design engineering functions consolidated into one department.

)

j l e Devote more resources to design-related engineering and conduct more design I within Edison to improve the quality of engineering products generated.

• Initiate a DBD Program.

I Edison committed to implement the Task Force recommendations (References 7 and 8). Among the actions instituted to improve understanding of and accessibility to the l design bases were: obtaining design calculations and other bases information not in '

Corporate Document Management Center (CDMC) from Bechtel and ASEA Brown Boveri-Combustion Engineering (ABB-CE); and initiating the DBD Pilot Program in 1989 with full program activities beginning in 1990.

In late 1989, the NRC conducted an Electrical Distribution System Functional Inspection (EDSFI) of Units 2 and 3 (Reference 53). This inspection found issues ,

similar to those identified during the CCW/SWC SSFl. Nonetheless, the NRC inspection team noted several design strengths and observed that the design bases i reconstitution and documentation effort was a way of resolving the identified discrepancies. Within the scope of the DBD Program, Edison initiated a i comprehensive safety related controls setpoint reevaluation and a formal electrical l

calculation reconstitution program. '

- In early 1991, the NRC conducted a Setpoints Methodologies Team Inspection (SMTI) i of Units 2 and 3 (Reference 55). This review identified shortcomings similar to those  !

identified during the SSFl and EDSFl and expressed concerns regarding the timeliness and effectiveness of San Onofre' engineering quality improvement initiatives.

ENCLOSURE F Page 3 Nonetheless, the NRC acknowledged Edison's efforts to improve the setpoint methodology program and observed that setpoint calculations performed under the new program appeared to be adequate and absent the types of errors noted in older )

l calculations. In response to the SMTl, Edison identified the causes of the engineering quality concerns and implemented corrective action. Further, Edison broadened the scope of its setpoint program and, in July 1992, issued the Setpoint Calculation Program.

Over the next several years, as the DBD Program matured and additional design bases issues surfaced, the DBD effort was used as the vehicle to facilitate resolution.

Since 1990, the emphasis that Edison has placed on effectively implementing the 1-\ETS Task Force recommendations and other efforts to improve plant performance can be measured, in part, by NRC observations and SALP Category ratings of Edison engineering. Engineering performance has steadily improved, For the most recent period, July 1994 through December 1995, which included an NRC Integrated l Performance Assessment Program audit (Reference 58), Engineering was rated superior, SALP 1.

Edison continues to evaluate plant specific and industry concerns as well as conduct self assessments to assure the design bases is current and consistent, and takes necessary actions where appropriate.

Ill. DBD PROGRAM DESCRIPTION i As mentioned above, Edison's design review and reconstitution activities began with a DBD Pilot Program in 1989. The Pilot Program was conducted in accordance with written procedures contained in a controlled Pilot Program Manual. For Units 2 and 3, the Instrument Air System (IAS) was selected as the pilot system. 1 Throughout 1989, and as an integral part of developing the Pilot Program, Edison participated in the industry initiatives focused on establishing design bases program ,

guidance. In particular, Edison was a primary contributor to the Region V Engineering '

Manager's Forum document entitled, " Guidelines for the Establishment of Design l Bases Documentation Programs" This document, issued in May 1989, provided much of the framework and information contained in NUMARC 90-12, " Design Bases Program Guidelines."

The Pilot Program concluded with an in-depth self-assessment of the IAS DBD and, thereby, the effectiveness of the program. Assessment personnel received SSFI training and employed vertical slice methodology. The assessment identified significant shortcomings in Pilot Program assumptions, research process techniques, and DBD content and format. The lessons learned from the Pilot Program, together with Region V and NUMARC guidance, were incorporated into the full DBD Program that commenced in January 1990.

l

~

ENCLOSURE F Page 4 Full DBD Program activities were conducted in accordance with written and approved program guidelines and procedures. Table F-1 lists these documents. The program was designed to be comprehensive, including both verification of the correct incorporation of information into the DBD as well as validation that plant configuration l and processes were consistent with the design bases. Trained, dedicated, multi-i disciplined resources were assigned to an independent organization, reporting to a DBD Project Manager.

Throughout program implementation Edison closely monitored industry developments  ;

and NRC activities. When NUREG-1397,"An Assessment of Design Control Practices  ;

and Design Reconstitution Programs in the Nuclear Industry"(Reference 29) was issued, Edison assessed its program plan and associated procedures to assure that common weaknesses identified by the NRC did not exist. In its documented assessment, Edison concluded that its program identified the documents necessary to demonstrate that the structures, systems, and components (SSCs) would function  ;

properly, included procedures for generating missing design documents, and contained validation provisions for output documents. Similarly the NRC policy statement, " Availability and Adequacy of Design Bases Information at Nuclear Power Plants"(57FR35455), was reviewed with the DBD Project Team and subsequently incorporated into Edison's DBD Manual and the DBD Program Plan. ,

Edison's design review and reconstitution efforts were continuously modified and  ;

enhanced to incorporate lessons learned and meet plant needs and industry l

expectations. Throughout the DBD Program, Edison kept the NRC appraised of program progress and of any significant changes. Program plan revisions were  !

periodically submitted, and program activities were discussed at NRC/ Edison management meetings. The original program plan scope identified approximately forty-five candidate DBDs (comprising both Systems and Topicals) for preparation on Units 2 and 3. Production prioritization was developed based on safety significance, industry issues, and plant specific needs. i As the program progressed, scope expansions and DBD development schedule modifications were instituted to address emerging and urgent plant specific and industry developments. As discussed earlier, major design reconstitution efforts in the areas of instrument setpoints and electrical design issues were incorporated as a result of NRC reviews. Likewise, additional DBDs such as the Plant Level DBD were added to the program when deemed beneficial to understanding of and accessibility to the design bases. Under the purview of the DBD Program, missing or deficient analyses and calculations were acquired or reconstituted. Additionally, new drawings were developed such as instrument loop diagrams and Appendix R safe shutdown logic diagrams.

In September 1993, Edison conducted a comprehensive evaluation and re-examination of the DBD Program scope. The analysis identified nineteen DBDs as potential scope reduction candidates as well as possible reductions in research activities. Each candidate DBD was evaluated taking into consideration safety importance, safety

i ENCLOSURE F Page5 l

l classification, risk significance based on the Units 2 and 3 probabilisitic risk j

assessment, and the extent of available design bases information. Other ongoing engineering programs were also reviewed from a redundancy / duplication of effort perspective. Edison concluded that of the nineteen candidates evaluated, sufficient justification existed for reducing the program scope by thirteen System and four ,

Topical DBDs. Details of this program change were provided to the NRC (Reference 12).

The work performed under the auspices of the DBD Program and by the dedicated DBD Project Team was completed during 1994. Incomplete tasks were assigned to the applicable line organization for completion as part of a documented turnover process (Table F-1). Through the end of 1994, the total DBD Program man-hours exceeded ,

400,000. As listed in Table F-2, DBD Program efforts resulted in twenty-eight (28) l Units 2 and 3 System and Topical DBDs and several essential design reconstitution i projects.

IV. DBD RESEARCH AND DEVELOPMENT Based on the nature of the issues that led Edison to the commitment of initiating a DBD Program, the San Onofre Design Basis Reconstitution and Documentation Program evolved to become one of the more ambitious programs undertaken in the industry.

The San Onofre DBD program used a two-step process to assure that the design bases documents accurately reflected the source design documentation, the design output documents accurately reflected the design bases, the plant configuration was maintained in accordance with the design output documents, and the operating instructions and licensing documents accurately reflected the design bases. Since 1 SSFis had identified weaknesses at San Onofre, the philosophical approach was to challenge the adequacy and integrity of the facility against its design bases rather thun to presume the existence of a condition of functionality and operability. j The first phase of the process was an extensive review and verification of the design bases, design, operations, configuration, maintenance, testing, and licensing i commitments of a system or topical (Plant level design issue) and normally took over one year to complete. The second phase of the process was a series of multi disciplinary reviews of the completed Design Bases Document by DBD supervision, an independent Review Engineer, and cognizant personnel from the Nuclear Engineering Design Organization (NEDO), Nuclear Fuel Management (NFM), Station Technical, Operations, and Licensing as well as a separate validation by an outside entity when deemed appropriate.

i The program used the 10CFR50.2 definition of Design Bases to establish its primary focus and, thus, undertook to define the functions of the system or topical as well as the controlling parameters and their value or range of values necessary to assure those functions. The primary functional requirements and controlling parameters were determined based on a review of upper tier documents such as the Code of Federal

i ENCLOSURE F Page 6 1

, Regulations and Standard Review Plan. Additional lesser functional requirements and l controlling parameters were identified during the review process. '

After establishing the prirnary functions and parameters to be validated, the plant  !

documents that supported safety functions, important to plant safety functions, and the '

associated controlling parameters were identified and reviewed. The cornerstone of this process was a technically rigorous review of design calculations and analyses, (Reference Table F-1) which focused heavily on the adequacy of assumptions, inputs, and design approach. Specialized reviews were also performed to address areas previously noted to be potentially inadequate. As appropriate to the system or topical, these special reviews included review of setpoints, motor operated valves, environmental qualification, and spurious circuit actuation and were conducted in accordance with quality procedures (Table F-1). j The reviews noted above established the design bases and overall design of the plant.

However, to meet the intent of the DBD Program, it was necessary to take the process to the next level and confirm that as-designed, as-built, as-operated, as-maintained, and as-licensed conditions were consistent with the design bases. The DBD Program made extensive use of walkdowns to confirm the configuration of the system, and the requirements for these are contained throughout the DBD research procedures. In addition, the program imposed requirements for review of licensing bases and i commitments, technical specifications, plant operating instructions, inservice testing, post-modification testing, and electrical interlock functional testing (Table F-1), as i applicable. Research for later DBDs also included the assessment of margin, which ,

could be utilized for such issues as subsequent design changes, licensing changes, or operational flexibility.

An essential element of the DBD preparation process was plant procedure review, which was performed on system DBDs and additionally to pertinent portions of plant systems discussed in topical DBDs. The plant procedure review provided reasonable assurance ,

that the procedures were consistent with the design bases and that the design bases requirements cited in the procedures were accurate and current and, where possible, based on revision controlled documents. Applicable Operating Instructions, Abnormal Operating Instructions, Emergency Operating Instructions were reviewed, as well as Surveillance Test Procedures that confirm compliance to the Technical Specification requirements, and Test Procedures that confirm safety related electrical interlocks. Later vintage DBDs had slightly less rigorous research requirements imposed on them. The requirements removed were deemed to be redundant to existing plant initiatives or of marginal benefit to the DBD. Examples of those reductions associated with the review of plant procedures include elimination of review of temporary change notices and component level surveillances, review of surveillance instructions for the Technical Specification Surveillance Program implementation (Reference 161), and review W post-l modification testing of items other than electrical interlocks. Those items deemec j marginal to safety were generally information that did not impact the design bases of the l system or plant consistency validations that had been found to produce minimal results on earlier DBDs. The justifications for these reductions are documented, and the DBD 1

i ENCLOSURE F Page 7 preparation checklist for each DBD was annotated in accordance with quality procedure l requirements to indicate where' reductions were taken.

Research was performed by a DBD engineer and reviewed by an independent reviewer,- {

in addition, some elements also required the review of the DBD supervisor. When open )

issues were identified; Open item Reports (OIRs) or other appropriate plant reports were j generated to capture the concern and categorized as to the significance of the issue I (Reference 181). The DBD Engineer assessed operability and reportability of OIRs.

Operability and reportability were evaluated at initiation and resolution of the OIRs, and  !

where appropriate, as additional information became available. The processes for .I conducting these reviews were consistent with NUREG-1397, Section 4.3 (Reference 29).

Items deemed inoperable were processed into the NCR system for validation whereas  ;

items deemed potentially reportable were coordinated with NEDO and Licensing for J validat;on and reporting to the NRC, as required. l l

The second phase of this process to develop complete and accurate DBDs consisted of '

multidisciplinary, multi-departmental reviews of the document at various stages of completion (Reference 175). For systems, these reviews were designed to assure that the DBDs adequately addressed the functions; system operability requirements; component  :

parameters for system functionality; system interfaces; codes, standards, and regulatory l documents; and programmatic issues and additional design considerations as well as l

significant design modifications and summaries of design bases affecting calculations. 1 These reviews had the added benefit of familiarizing the various San Onofre organizations with the DBDs.

The San Onofre DBD Program was es aluated against NRC and industry initiatives and plant considerations throughout the course of the program to assure that the program would meet or exceed the various requirements imposed upon it.

V. DBD VALIDATION As outlined in section 3.7.1 of NUREG 1397, "DBD Verification" is the process of checking that the information contained in the DBDs has been correctly and consistently translated from source documents, whereas " Validation" is the process of assuring that the physical plant and the DBDs are consistent (also called field validation), that system configuration and functionality is accurately represented by design documents as well as that information contained in other plant documents is consistent with the information in the DBDs. 'Nhile this was not the precise use of terms adopted during DBD development, they will be used in this description to distinguish between different aspects of the process used to confirm the accuracy of the DBDs and related plant documents and configuration.

The research phase of the DBD developmeht, discussed above, performed by the DBD Engineer and the DBD Independent Reviewer within the individual research procedures included the full spectrum of verification and validation elements, as defined above. The review phase of DBD development was designed to assure that the DBDs adequately described system (or topical) design, configuration, functionality, operational, and I

ENCLOSURE F Page 8 licensing aspects within the context of the design bases. When conducted, independent  ;

third party vertical assessments addressed the full spectrum of verification and validation -

for the segment of the system (or topical) selected for review. The results of the independent vertical assessments were also used to assess the adequacy of the research requirements contained in the DBD procedures. '

The Design Bases Document Reconstitution Program Plan (Reference 184) outlines the DBD program validation technique elements imposed by quality procedures. These  ;

techniques were: '

i

1. Walkdowns by the DBD author during the research phase  !

2. Supervisory review throughout the DBD preparation stages a 1

l

3. Documented evaluation by an Independent Review Engineer (IRE)

4. Interdisciplinary review by cognizant technical staff from NEDO, Licensing, Station Technical, and other organizations, as appropriate

5. Independent vertical assessment (based on SSFI methods) of select areas, where appropriate.

Validation of DBDs was completed in accordance with quality procedures (Reference 175). Procedural actions with respect to field validation required the DBD Engineer to perform the walkdown according to approved guidance and to document discrepancies in accordance with the DBD Open item Report Procedure (Reference 181),

i The walkdown guidelines (Reference 175) required that the walkdown be conducted with attention to thoroughness. Specific items reviewed during the walkdown included:

• Confirmation that assumptions and calculations remain valid for the current configuration.

i e Verification that drawings reflect the plant configuration or the actual configuration as a calculation assumption.

e Verification that the general arrangement / layout of the components, piping, electrical, instrumentation and controls, and other items pertinent to the safety functions are consistent with the design bases. '

• Evaluation whether barriers, seismic restraints, equipment supports, and snubbers appear sufficient to fulfill essential function.

e inspection for evidence of adverse degradation due to age, atmosphere, or physical interactions which could impact essential functions.

ENCLOSURE F Page9 e Using nameplate data, verification that major equipment are consistent with the system design bases parameters and values.

The walkdowns were well documented, including descriptions of any significant observations and supplementary photographic documentation.

Assessment and oversight involvement was also of paramount importance throughout program implementation. In the case of seven (7) Units 2 and 3 DBDs, an independent contractor, United Energy Services Corporation, was retained to perform an essessment of DBD quality. This included assessments of the pilot DBD in 1989, and later four (4)

System DBDs and two (2) Topical DBDs. Beginning in 1990, Edison's Nuclear Oversight Division conducted annual audits and reviews of the DBD Program (References 301-305, 318). During the development of DBDs for San Onofre Unit 1, problems were identified with the correctness and consistency of the DBDs. Appropriate actions were taken to improve procedures and provide additional training to DBD engineers to improve attention to detail. Throughout the production of DBDs for San Onofre Units 2 and 3, the audits determined that the DBDs were generally prepared in accordance with procedures and that given the size and complexity of the DBDs that the preparation was competent and thorough. Nonetheless, areas of improvement were general!y identified and appropriate actions taken on recommendations.

These reviews also assessed the OIR process and control. The reviews found that the OIRs were processed consistent with procedures and were effective in identifying probing questions concerning the plant design bases. Nonetheless, significant improvements were made to the OIR process throughout the program. Procedural upgrades were made to document assessment of reportability and operability issues at the time of OIR initiation and again at OIR resolution.

)

l 1

Throughout the program, methods of categorizing OIRs were continually updated and l improved to assure that plant personnel and DBD management could readily assess '

significance of the concern and establish work priorities. The OIR process and closure rates were trended, and reports were transmitted to those organizations with significant numbers of open OIRs. In addition, the procedural requirement in the preparation 1 procedures and style guide (Table F-1) that OIR issues be identified at the relevant '

location of the DBD text using a bold type as well as a requirement to summarize OIRs open at the time of issuance in Appendix A of the DBD existed throughout the program and assured the integrity of the DBD despite the existence of open OIRs.

In addition to the above mentioned audits, the NRC examined the DBD Program. NRC Inspection Report 92-20 dated August 13,1992, (Reference 70) stated, "A Region V inspector performed an informal review of the licensee's design bases documentation (DBD) program during the weeks of May 18 to 21 and June 8 to 11,1992. This review l primarily focused on inspection of plant systems to assure that these systems actually l exhibited selected safety significant design characteristics documented by the DBD Program. The inspector reviewed each system's DBD, identified several verifiable safety significant characteristics for each system, and then inspected each system to verify the

l ENCLOSURE F Page 10 characteristics.. Results of the plant system DBDs [five were examined] during this review indicated that these documents appeared adequate.. "

Another inspection was conducted in 1993 (Reference 57). The results of this inspection were favorable and the inspector concluded that " the DBD efforts contributed substantially to improving plant safety."

The DBD Program was validated time and again by various organizations to generate thorough and accurate Design Bases Documents as well as to conduct detailed reviews of interfaces between the design bases and plant documentation, configuration, and other processes. Likewise, the OIRs provided fuither assurance of the thorough and probing l nature of the verification and validation processes demanded by the DBD Program and l outlined in its quality procedures.

,t:

VI. DBD ACCESSIBILITY AQCONTROL l

Edison had expended significant resources during the five year program to develop the DBDs and recognized the importance of maintaining this investment. As such, since the l DBDs constituted a new plant document, several steps were taken to assure accessibility I to, use of, and control of the DBDs. The DBDs were classified as Design Disclosure l Documents and are controlled in accordance with approved San Onofre administrative procedures (Reference 2).

Control of and accessibility to the DBDs was of paramount importance since the plant staff {

would be unlikely to use the documents if they were not accurate, complete, and readily l available. Applicable NEDO design control procedures were revised to include  ;

requirements to review and update the DBD, as appropriate, for both physical changes to I the plant and documentation related changes to the design / design bases of the plant l (References 101 through 107, and 176). In addition, requirements were proceduralized  !

with respect to the level of review and approval required, the number of outstanding I change notices permitted, and the like. I l

To assure accessibility to the DBDs, the DBDs were designated to be issued in hardcopy i to select CDMC controlled document stations. In addition, the DBDs and their change I notices were scanned into the Nuclear Consolidated Data Base (NCDB) to allow viewing l (and printing) from any network computer at San Onofre. To further encourage i acceptance and use, hardcopies of the Revision 0 DBDs were provided to the NEDO Design Engineer and Station Technical System Engineer for their designated system or  !

topical. l Vll. PROGRAM STATUS AND PENDING ACTIONS With regard to the documentation and reconstitution projects outlincd in Table F-2, the j following activities remain to be completed:

l l

ENCLOSURE F Page 11 e DBD-SO23-TR-AA. Accident Analysis i 1

DBD-SO23-TR-AA, Accident Analysis, contains a summary and historical record of the safety analyses of each San Onofre Unit based upon the Analyses of Record )

(AORs) for each event. Part I has been issued and covers 29 events. Part II, i addressing the remaining 29 events, has been written but not issued. Both Part I  :

and Part ll will be updated to reflect the Units 2 and 3 Cycle 9 AORs and issued by ,

the end of 1997. '

l The safety analysis design bases of the San Onofre Units are contained in the i Reload Ground Rules (RGR) and AORs. The AORs are reviewed every cycle and l the results are documented in the Reload Analysis Report (RAR). The review is performed by affected San Onofre engineering groups. Based upon these results, i the AORs may be revised to reflect the reload design and other plant changes as  ;

reflected in the RGR. The RGR, RAR, and up to date AORs are complete and i available to San Onofre engineers to resolve issues related to the plant safety j analyses. j Completion of this DBD is an existing commitment made to the NRC in 1988 (Reference 7).

e Setooint Calculation Proaram In response to NRC inspections conducted in 1989 and 1991, Edison initiated a i Setpoint Calculation Program. This program is providing Ngorous engineering  ;

bases for safety related instrumentsetpoints, values in Emergency Operating i Instructions, Technical Specification instrument setpoints, and Technical j Specification surveillance test acceptance critena.  :

i in 1993, Edison completed the first phase of this program which evaluated safety  !

related instrument setpoints and associated surveillance test requirements (with the i exception of those related to a not yet installed upgrade of the radiation monitor l system). As part of this phase, a number of areas were addressed. Edison  ;

reviewed setpoint values to establish consistency with the design bases. It reviewed instrument loop calibration techniques and tolerances against associated surveillance test requirements and generated total loop uncertainty calculations.

In 1994, Edison completed the second phase of the program which evaluated instrument uncertainties for those values in Emergency Operating Instructions used  ;

to support substantive operator decisions. Edison generated instrument uncertainty ]

calculations for these parameters. Post Accident Monitoring instrumentation and l Remote Snutdown Monitoring Instrumentation covered by the Technical  ;

Specifications were included in this phase of the program.

l l

Edison initiated the third phase of the program in 1993. This phase focuses on l l

Technical Specification instruments whose values represent settings that function l

ENCLOSURE F Page 12 to mitigate accidents or indicate parameters which represent limiting initial conditions assumed for postulated accident or abnormal operational occurrences.

Preparation of calculations is being performed consistent with the guidance in CE-  ;

NPSD-925 (Reference 32). To date, Edison has completed approximately 40% of these calculations.

k The fourth and final phase of the program will address instrument uncertainties where the Technical Specifications do not provide specific surveillance test acceptance criteria but instead require a system or component to be " operable".  !

Edison will begin this phase in 1997. Both the third and fourth phase of the l Setpoint Calculation Program will be completed prior to October 1998.

• DBD Open item Closure in mid-1996, as part of the ongoing assessment of DBD related issues, closure of the remaining open OIRs was determined to warrant attention. During the DBD  ;

Program Edison allowed resolution of less significant issues to be deferred )

consistent with other scheduled work based on documented operability and reportability assessments. Edison will expedite resolution of these OIRs to assure l closure by July 1997.

e Additional Safety System Functional Assessments (SSFA)

Recognizing the benefits of self-assessments to maintain confidence that the ,

design bases continues to be reflected in plant structures and procedures, Edison will expand its existing vertical assessment programs to include a SSFA of the j Control Room Emergency Air Cleanup System and the Class 1E 120V AC System. l These assessments will include in-depth vertical slice reviews of actual design i basis documentation and comparisons with the as-built and as-operated plant i following processes similar to those described in NRC Inspection Procedure 93801,

" Safety System Functional inspections." Edison will complete these efforts prior to October 1998.

• Additional DBDs Edison believes that its decision in 1994 to reduce the original scope of the DBD Program was appropriate. However, Edison is raising its standards in light of the rising expectations within the industry and the NRC. Therefore, Edison is reactivating its DBD Program for the purpose of developing DBDs for the Emergency Diesel Generator and for the Containment Systems. This effort will be  !

performed to the same rigorous standards of Edison's original DBD effort and will be completed prior to October 1998.

l l Upon successful completion of these actions and any ancillary activities derived out of these reviews, San Onofre will have a well documented ar>d readily accessible design l bases as well as plant configuration and documentation that have been validated to be '

l

l ENCLOSURE F Page 13  !

consistent with that design bases. The enhancements made to design control processes over the last several years will assure that the design bases remains current and that its l integrity is not compromised.

I viii. CONCLUSION Edison committed to the development of Design Bases Documents based on the positive impacts to understanding and control of the design bases and the ancillary improvements to consistency of operations, efficiency and adequacy of modifications, and improved performance of technical staff. The twenty-eight DBDs were developed in a complete, thorough, and well-documented process designed to assure correctness and adequacy of the design basis information and to validate the plant and plant documentation against this design bases. The DBD Program provided added assurance that the design bases remains current and accessible.

l l

l

i i

l ENCLOSURE F Page 14 i

l TABLE F-1 l DBD PROGRAM DOCUMENTS AND PROCEDURES CONTROLLED PROCEDURES SO123-XXXV-1.1 Guidelines for System DBD Preparation SO123-XXXV-1.2 Calculation Review Methodology SO123-XXXV-1.3 Setpoint Review Methodology SO123-XXXV-1.4 Margin Assessment SO123-XXXV-1.5 System Functional and Boundary Definition Methodology SO123-XXXV-1.6 Plant Operating Instructions Review Methodology SO123-XXXV-1.7 Motor Operated Valve Review Methodology '

SO120 XXXV-1.8 Technical Specification Review Methodology  ;

SO123-XXXV-1.9 Licensing Bases and Commitments Review Methodology 1 SO123-XXXV 1.10 Electrical Interlock Functional Testing Review Methodology '

SO123-XXY,V-1.12 Evaluating the Environmental Qualification Master List SO123-XXXV-1.13 in-service Testing Review Methodology SO123-XXXV-1.14 Post-Modification Testing Review Methodology SO123-XXXV-1.15 Spurious Circuit Actuation Evaluation SO123-XXXV-2.1 Guidelines for Topical DBD Preparation SO123-XXXV-5.1 Design Bases Documentation Open item Report SO123-XXXV-5.2 Design Bases Documentation Responsibility Turnover SO123-XXXV-5.5 Validation, Approval, and issue of Design Bases Documents PROJECT DESK TOP GUIDANCE DBD-1 DBD Program Plan DBD-1 A DBD Commitments List DBD-3 Style Guide for DBD Writers and Text Processors DBD-5 Standard for DBD Simplified Drawings / Diagrams DBD-9 Ultimate Heat Sink Operability Review Methodology (DBD Guidance related to NRC Generic Letter 89-13, Service Water Systems Licensing Bases Review)

DBD-11 DBD Glossary and Abbreviations NA Checklist of Sources of Design Bases Reference Materials and Corresponding Electronic Data Retrieval Systems.

NA Designated DBD Reference Codes for DBD Activity for Nuclear Document Files (San Onofre-CDM)

NA Guidance to DBD Engineers on Procedure Reviews I

l l

ENCLOSURE F Page 15 TABLE F-2 UNITS 2 AND 3 SYSTEMS. TOPICALS AND RECONSTITUTION PROJECTS SYSTEM DBDs DBD-SO23-120 6.9kV, 4.16kV, and 480V Electrical Systems DBD-SO23-140 1E 125V DC and 250V DC Systems DBD-SO23-145 Non-1E 125V DC and 250V DC Systems DBD-SO23-360 Reactor Coolant System DBD-SO23-365 Steam Generators and Secondary Side DBD-SO23-390 Chemical and Volume Control System DBD-SO23-400 Component Cooling Water System DBD-SO23-410 Saltwater Cooling System DBD-SO23-470 Excore Nuclear Instrumentation System DBD-SO23-540 instrument Air and Backup Nitrogen Systems DBD-SO23-590 Fire Protection and Detection Systems DBD-SO23-690 Radiation Monitoring System DBD-SO23-710 Plant Protection System DBD-SO23-740 Safety injection, Containment Spray, and Shutdown Cooling Systems DBD-SO23-780 Auxiliary Feedwater System DBD-SO23-800 Emergency Chilled Water System TOPICAL OBDs  !

DBD-SO23-TR-AA Accident Analysis DBD-SO23-TR-AR Appendix R Safe Shutdown DBD-SO23-TR-CS Codes and Standards DBD-SO23-TR-EQ Environmental Qualifications DBD-SO23-TR-FP Fire Protection DBD-SO23-TR-HF Human Factors Engineering DBD-SO23-TR-HZ . Hazards Analysis DBD-SO23-TR-IS In-Service Testing,1 st Ten Year Interval DBD-SO23-TR-IS2 In-Service Testing,2nd Ten Year Interval DBD-SO23-TR-OA Operator Actions DDD-SO23-TR-PL Plant Level Topical DBD-SO23-TR-SF Single Failure MAJOR ANALYSES. CALCULATION AND DRAWING RECONSTITUTION PROJECTS o Instrument Setpoint Design Bases Calculation Program j o Instrument Loop Drawing Development Project o Electrical System Design Bases Calculation Development Program i o GL 89-10, Motor Operated Valve Program (Design Bases Calculation Development) l

a -a , m .a

(

l l

l ENCLOSURE G 1

I l

f 1

1

ENCLOSURE G Page1 l The following is a list of acronyms used throughout this document.

ABB-CE - ASEA Brown Boveri- Combustion Engineering AC - Alternating Current AFW - Auxiliary Feedwater ANSI - American National Standards Institute AOR - Analysis of Record AR - Action Request ASME - American Society of Mechanical Engineers BDD - Bases and Deviations Documents BOM - Bill of Material CAP - Corrective Action Program CAR - Corrective Action Request CC - Configuration Control CCN - Calculation Change Notice CCW - Component Cooling Water '

CDMC - Corporate Document Management Center CE - Combustion Engineering CETB - Combustion Engineering Technical Bulletin CFDM - Cognizant Functional Division Manager CFR - Code of Federal Regulations CGI - Commercial Grade item COLSS - Core Operating Limits Supervisory System CPC - Core Protection Calculator CWO - Construction Work Order DBD - Design Bases Document / Documentation DC - Direct Current DCN - Design Change Notice DCP - Design Change Package DIR - Division investigation Report DPTF - Design Process Task Force EC - Equipment Control ECCS - Emergency Core Cooling System EDG - Emergency Diesel Generator EDSFl - Electrical Distribution System Functional Inspection EEC - Engineering Evaluation for Cause EOl - Emergency Operating Instruction EPG - Emergency Procedure Guidelines EPRI - Electric Power Research Institute EQ - Environmental Qualification ER - Event Report ESFAS - Engineered Safety Features Actuation System ETEC - Energy Technology Engineering Center FAC - Flow Accelerated Corrosion FCE - Facility Change Evaluation FCN - Field Change Notice

I ENCLOSURE G Page 2

FIDCN - Field Interim Design Change Notice FSAR - Final Safety Analysis Report GA - General Atomic Company l GL - Generic Letter HELB - High Energy Line Break HRRM - High Range Radiation Monitor HVAC - Heating, Ventilating and Air Conditioning HX - Heat Exchanger IAB -Interim As-Built lAETS -Independent Assessment of Engineering and Technical Support IAS - Instrument Air System l&C - Instrumentation and Control ICCN -Interim Cajculation Change Notice IDCN -Interim Design Change Notice IDIR -Interdiscipline Division Investigation Report IDV - Independent Design Verification ILRT - Integrated Leak Rate Test INPO - Institute for Nuclear Power Operations IPAP - Integrated Performance Assessment Program IRE - Independent Review Engineer ISI - In-Service Inspection ISEG - Independent Safety Engineering Group IST - In-Service Testing LCS - Licensee Controlled Specifications Li R - Licensee Event Report LLRT - Local Leak Rate Test MAS - Master Audit Schedule MDER - Maintenance Division Experience Report MMP - Minor Modification Package MO - Maintenance Order i MOV - Motor Operated Valve i M&TE - Measuring and Test Equipment MT&R - Material Test and Receipt MSSV - Main Steam Safety Valve i NATS - Non-Regulatory Action Tracking System NCDB - Nuclear Consolidated Data Base NCR - Nonconformance Report NDIS - Nuclear Document Information System NDMS - Nuclear Document Management System NEDO - Nuclear Engineering Design Organization NFM - Nuclear Fuel Management I NOD - Nuclear Oversight Division l NRA - Nuclear Regulatory Affairs l NRC - Nuclear Regulatory Commission NSAC - Nuclear Safety Analysis Center NSSS - Nuclear Steam Supply System NTD - Nuclear Training Division

l ENCLOSURE G Page 3 NUMARC - Nuclear Management and Resources Council NUREG - Nuclear Regulation ODER - Operations Division Experience Report OER - Operating Experience Report

' OIR - Open item Report  :

OPG - Operations Procedures Group P&lD - Piping and Instrumentation Diagram PBO - Performance Based Observation l l PE - Procurement Engineering  ;

PEP - Procurement Engineering Package PM - Preventive Maintenance '

POG - Plant Operations Group PPS - Plant Protection System PRA - Probabilistic Risk Assessment  ;

PRR - Problem Review Report  ;

QA - Quality Assurance QC - Quality Control i RAR - Reload Analysis Report  ;

RCE - Root Cause Evaluation '

RCGVS - Reactor Coolant Gas Vent System RCS - Reactor Coolant System RCM - Reliability Centered Maintenance  ;

RCTS - Regulatory Commitment Tracking System  !

RGR - Reload Ground Rules RMO - Repetitive Maintenance Order RPS - Reactor Protection System -

SALP - Systematic Assessment of Licensee Performance SCC - Structures, Systems and/or Components SCE - Southern California Edison SDE - System Design Engineer SEE - Substitution Equivalency Evaluation  ;

l SER - Significant Experience Report /(NRC) Safety Evaluation Report SFP - Spent Fuel Pool SIAS - Safety injection Actuation Signal i SMTl - Setpoint Methodologies Team Inspection SONGS - San Onofre Nuclear Generating Station SOER - Significant Operating Experience Report SRP - Standard Review Plan SSFA - Safety System Functional Assessment SSFl - Safety System Functional Inspection  :

STEC - Station Technical SWC - Salt Water Cooling TCN -Temporary Change Notice TDIR - Technical Division investigation Report TE - Technical Evaluation l TER - Test Exception Report l TFM - Temporary Facility Modification

ENCLOSURE G Page 4 TGIS - Toxic Gas isolation System ,

l TLU - Total Loop Uncertainty TMI - Three Mile Island j TOPIC " TOPIC"(computer information retrival program) ,

I TOAM - Topical Quality Assurance Manual  :

TS - Technical Specification l TSIP - Technical Specification improvement Program ,

UFHA - Updated Fire Hazards Analysis l l

UFSAR - Updated Final Safety Analysis Report  !

VT - Visual Test i WA - Work Authorization WAR - Work Authorization Request  ;

l l

l 1

1

^

l l

I

4 i

ENCLOSURE H i

1

I

ENCLOSURE H Page1 l

l REFERENCES r i

Edison Commitments and Letters to NRC l

i 1 Topical Report SCE-1-A, " Quality Assurance Program" i 2 San Onofre Topical Quality Assurance Manual (TQAM) l 3 Topical Report Section 17.2.20.1, " Independent Safety Engineering Group"  !

4 TQAM Chapter 1-F, " Corrective Action System"  !

5 SONGS 2 and 3 Updated Final Safety Analysis Report, Rev.12 6 Letter, D. J. Fogarty (Edison) to D. G. Eisenhut (NRC), Dockets 50-361 and 50-362, i dated April 5,1982 i 7 Letter, K. P. Baskin (Edison) to J. B. Martin (NRC), independent Assessment of Engineering and Technical Support, dated October 3,1988 8 Letter K. P. Baskin (Edison) to J. B. Martin (NRC), Systematic Assessment of l

Licensee Performance, dated January 13,1989 9 Letter, R. Dietch (Edison) to H.R. Denton (NRC) dated December 3,1981 l

10 Letter, R. Dietch (Edison) to H.R. Denton (NRC) dated December 29,1981 t 12 Letter, W. C. Marsh to USNRC Document Control Desk, " Design Bases Documentation Reconstitution Program," dated October 6,1993 13 Letter, D. E. Nunn to USNRC Document Control Desk dated April 22,1996 14 Letter, R. M. Rosenblum (Edison) to J. B. Martin (NRC), Generic Letter 89-13: '

Service Water System Problems Affecting Safety-Related Equipment, SONGS 2 and 3, dated January 26,1990 ,

15 Letter, W. C. Marsh (Edison) to NRC Document Control Desk, Implementation of Guidelines of Generic Letter 89-04, dated October 30,1992 16 Letter, Dwight E. Nunn to NRC Document Control Desk, Updated Final Safety Analysis Report (UFSAR), dated April 22,1996 NRC Generic Requirements & Guidance 20 10CFR Part 50, Appendix B," Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants"

21 NRC Regulatory Guide 1.64, Rev 2 " Quality Assurance Requirements for the Design of Nuclear Power Plants" 22 NRC Generic Letter 83-28 " Vendor Interface For Safety Related Components" 23 NRC Generic Letter 90-03 " Relaxation of Staff Position on GL 83-28 Item 2.2 Part 2"

24 NRC Generic Letter 91-18, "Information to Licensees Regarding Two NRC Inspection Manual Sections on Resolution of Degraded and Nonconforming Conditions and on Operability" 29 NUREG 1397,"An Assessment of Design Control Practices and Design Reconstitution Programs in the Nuclear Industry," February 1991

ENCLOSURE H Page 2 j Industry Generic Guidance 30 ANSI N45.2.11-1974 " Quality Assurance Requirements for the Design of Nuclear  !

Power Plants" 31 NSAC-125 (June 1989) " Guidelines for 10CFR50.59 Safety Evaluations" .

32 CE-NPSD-925, " Guideline for Addressing Instrument Uncertainties in Emergency Operating Procedures and Technical Specifications", January 1994 34 CEN-152, Revision 3, " Emergency Procedure Guidelines" NRC Transmittals to Edison ,

50 NUREG-0712, Safety Evaluation Report related to the operation of San Onofre Nuclear Generating Station, Units 2 and 3 dated February 1981; Supplement 1 dated February 1981; Supplement 2 dated May 1981; Supplement 3 dated I September 1981; Supplement 4 dated January 1982; Supplement 5 dated February 1982; and Supplement 6, dated June 1982.

51 Letter, J. B. Martin (NRC) to D. J. Fogarty (Edison), NRC Inspection of Gan Onofre ;

Nuclear Generating Station Units 2 and 3 (CCW/SWC), dated August 3,1988  ;

52 Letter, J. B. Martin (NRC) to K. P. Baskin (Edison), Systematic Assessrr.ent of Licensee Performance, dated November 25,1988 r 53 Letter G. M. Holahan (NRC) to H. B. Ray (Edison), NRC Inspection Report No. 50-361 and 362/89-200 (EDSFI), dated January 12,1990  ?

54 Letter, J. E. Tatum (NRC) to H.B. Ray (SCE) et al, Gene ~ic Letter 89-13, Service i Water System Problems Affecting Safety Related Equipment, SONGS 1,2 and 3,  ;

dated February 23,1990 55 Letter, R.P. Zimmerman (NRC) to H.B. Ray (Edison), NRC Inspection of SONGS Units 2 and 3, dated April 12,1991 56 Letter, J. B. Martin (NRC) to H. B. Ray (Edison) Systematic Assessment of Licensee Performance, dated October 3,1991 57 _ Letter C. A. Van Denburgh (NRC) to H. B. Ray (Edison), NRC Inspection Report l Nos. 50.206, 361, 362/93-26, dated September 27,1993.  !

58 NRC Inspection Report No. 50-361/95-201 and 50-362/95-201 (Final IPAP) dated l December 21,1995  ;

59 Systematic Assessment of Licensee Performance (SALP) Report 95-99, dated  !

February 7,1996 l' 60 NRC Inspection Report 96-02, dated April 11,1996 61 NRC Inspection Report 96-05, dated July 8,1996 64 Letter, T.P. Gwynn (NRC) to H. B. Ray (Edison) dated December 16,1996, NRC  !

Inspection Report 50-361/96-17; 50-362/96-17 and Notice of Violation j 65 NRC Inspection Report 95-26, dated January 19,1996 ,

66 NRC Inspection Report 96-08, dated August 12,1996  ;

67 NRC Inspection Report 96-10, dated December 13,1996 i 68 NRC Inspection Report 96-15, dated December 17,1996 69 Letter, D. E. Hickman (NRC) to K. P. Baskin (Edison), Safety Evaluation of Natural Circulation Cooldown Test, dated February 24,1988 1 70 NRC Inspection Report 92-20, dated August 13,1992

. . . . - - - . . - .n. . , - i , - .. a-. ~ .-- - . - . . . - xa w - 4 ._a.s a a l

i ENCLOSURE H Page 3 i l

l t- Licensee Event Reports l l

80 LER 2-95-007 dated May 26,1995 81 LER 2-95-009 dated June 12,1995 .

82 LER 2-95-014 dated September 15,1995

{

83 LER 2-95-016 dated December 26,1995 l 84 LER 2-95-017 dated January 3,1996  :

85 LER 2-96-005 dated July 10,1996 .

86 1 ER 3-96-005 dated October 28,1996 San Onofre Procedures, Directives, Orders, Forms, Program Descriptions, internal Reports 100 Overview: Design Bases Documentation and Reconstitution Program, dated August 5,1994, CDM C940811S6101 101 Procedure SO123-XXIV-10.9 Rev 2 and TCN 2-1 and 2-2 " Des!gn Process Flow I' and Controls" 102 Procedure SO123-XXIV-10.16 Rev 2 and TCN 2-1 " Development, Review, Approval and Release of Concaptual Engineering Packages (CEPs) and Design Change Packages (DCPs)"

103 Procedure SO123-XXIV-10.21 Rev 6. " Field Change Notice (FCN) and Field Interim Design Change Notice (FIDCN)" ,

104 Procedure SO123-XXIV-10.17 Rev 3 and TCN 3-1 " Interim Design Change Notice l (IDCN) and Design Change Notice (DCN)" l 105 Procedure SO123-XXIV-8.7 TCN 0-9 " Drawings and Design Change Notice (DCN)

Conversion" 106 Procedure SO123-XXIV-7.15 Rev 1 and TCNs 1-1 and 1-2 " Preparation and Verification of Design Calculations" 107 Procedure SO123-XXIV-1.1 TCNs 3-2 and 3-3 " Document Review and Approval Control" 108 ProceJure SO123-XXIV-37.30.41 TCNs 0-5 and 0-6 " Specifications / Mini-Specifications" 109 Procedure SO123-XXIV-37.8.26 TCN 0-7 " Processing of Supplier Documents" 110 Procedure SO123-XXX-2.3 Rev 1 " Preparation of Amendment Applications for Facility Operating Licenses" 111 Procedure SO123-XXX-2.4 Rev 1 " Preparation, Review and Approval of Changes to Licensee Controlled Specifications" 112 Procedure SO123-XXX-5.2 TCN 1-5 " Control of Licensing Document Changes" 113 ' Procedure SO123-XXXVI-1.4 Rev 0 " Documentation of Safety Analysis" 114 Procedure SO23-XXXVI-4.2 Rev 0 and TCN 0-1 " Reload Ground Rules Control Methodology" 115 Procedure SO123-XXXVI-2.2 TCN 0-2 " Installation of CECOR Geometry and Coefficient Libraries" 116 Procedure SO123-XXXVI-2.3 TCN 0-3 " Shuffling the CECOR Exposure Files" 117 Procedure SO123-XXXVI-2.5 TCN 0-2 " Preparation of the Plant Physics Data Book"

ENCLOSURE H Page 4 l 118 Procedure SO123-XXXVI-2.7 Rev 0 " Control of Nuclear Fuel Management Reduced Instruction Set Computer 600 Computer Network" 119 Procedure SO123-XXIV-5.1 TCN 1-1 " Engineering, Construction and Fuel Services Software Quality Assurance" 120 Procedure SO123-XXXII-2.1 Rev 4 " Quality Affecting Technical Evaluation / Procurement Classification and Acceptance Process"

! 121 Procedure SO123-XXXil-2.18 Rev 2 " Substitution Equivalency Evaluations (SEES)"

l 122 Procedure SO123-XXIX-2.1 Rev 2 " Preparation, Review and Approval of Nuclear j l Construction Administrative Procedures" ,

l 123 Procedure SO123-XXVI-2.4 TCNs 1-3 and 1-4 " Preparation, Review and Approval )

of Component Test Procedures" I 124 Procedure SO123-XXVI-2.5 TCN 1w " Preparation, Review and Approval of . l Preoperational Test Procedures '

125 Procedure SO123-XXVI-2.6 TCN 1-5 " Review, Evaluation and Approval of Test Results" 126 Procedure SO123-XXIX-2.10 TCN 1-2 " Design Change Process" l 127 Procedure SO123-XXIX-2.14 Rev 2 " Construction Work Orders" l 128 Procedure SO123-XXIX-2.16 Rev 2 " Construction Problem Report" 129 Procedure SO123-XXIX-2.31 Rev 1 " Component Testing" 130 Procedure SO123-XXVI-2.32 TCNs 1-5,1-7 and 1-9 "DCP Turnovers" 131 Procedure SO123-XXIX-2.33 TCNs 0-5,0-6 and 0-7 " Conduct of Work" 132 Procedure SO123-XXIX-2.35 Rev 3 " Field Change Notices" 133 Procedure SO123-XV-5.1 Rev 2 " Temporary Modification Control" 134 Procedure SO123-V-4.71 Rev 2 " Software Development and Maintenance" 135 Procedure SO123-I-1.3, Rev 5 " Work Activity Guidelines" 136 Procedure SO123-1-1.7, TCN 5-3 " Maintenance Order Preparation and Processing" 137 Procedure S0123-11-15.3 Rev 5 "Temporarv System Alteration and Restoration" 138 Operating Procedures Group Writer's Guide.

139 Procedure SO123-VI-0.9 Rev 5 " Author's Guide for Preparation of Orders, Procedures and Instructions" 140 Procedure SO123-VI-1 TCN 16-1 " Review / Approval Process for Orders, Procedures and Instructions" 141 Procedure S0123-0-20 Rev 3 "Use of Procedures" 142 Procedure S0123-0-22 Rev 1 " Temporary Facility Modification Control" 143 Procedure SO123-VI-1.0.1 Rev 11 " Temporary Change Notices" 144 Procedure SO23-6-29 Rev 5 " Operation of Annunciators and Indicators" 145 Procedure SO123-XX-5 Rev 4 " Work Authorizations" 146 Procedure SO123-XX-5.1 Rev 1 " Work Authorizations issue, Release and Modifications" 147 Procedure SO123-0-23 Rev 3 " Control of System Alignments" 148 Procedure SO123-XV-5 Rev 6 " Nonconforming Material, Parts or Components" 149 Procedure SO123-VI-1.3 Rev 4 "Unreviewed Safety Question Screening Criteria j and Environmental Evaluations for Orders, Procedures and Instructions" 150 Form PF(123)109-1 Rev 5, "Unreviewed Safety Question Screening Criteria"

, 151 Procedure SO123-XXI-1.11 Series " Training Program Descriptions" l 152 SO23-XV-2.2 TCN 0-2, " Vendor Information Review Program Manual Compilation, l Review, and Approval"

ENCLOSURE H Page5 153 MPG-SO123-S-8 Rev 5, " Maintenance Engineering and Services Document Assessment and Tracking System" 154 SO123-XIV-4.1 TCN 4-5, " Configuration Document Change Control for Vendor 3

Information" 155 SO123-V-5.10 Rev 5, " Temporary Facility Modifications" 156 SO123-XVll-10.13 Rev 5 " Control of Computer Based Systems" 157 Procedure SO123-XX-1, Rev 3 " Action Request / Maintenance Order Initiation and Processing" 158 Procedure SO123-Xil-16.3, Rev. O, TCN 0-3, " Corrective Action Requests" 159 Procedure SO123-XV-39, Rev 4 " Regulatory Commitment Tracking System (RCTS)"

160 Procedure SO123-0-14, " Notification and Reporting of Signficant Events" l 161 Procedure SO23-XV-3, Rev. 7, " Technical Specification / Licensee Controlled l Specification Surveillance Program implementation" 162 Procedure SO23-V-3.4, Rev. 9, " inservice Testing of Pumps Program" 163 Procedure SO23-V-3.5, Rev.13 " Inservice testing of Valves Program" 164 Procedure SO23-XV-4.500, Rev. O, EC 0-5, " Control of SONGS 2 and 3 Barriers" 1 165 Order D-005, Rev 2 " Root Cause Program" l i

166 SO123-Xil-2.8, Rev 1 " Evaluation and Reporting of Problems to the NRC Pursuant I to 10CFR21 and 10CFR50.9" 167 SO123-XII-2.24, Rev 0 " Independent Safety Engineering Group Functions" 168 SO123-XII-16.6, TCN 0-2 " Control, Issuance and Closure of Problem Review Reports" 169 SO123-Xil-18.1, Rev 1 " Planning and Scheduling of Audits" 170 SO123-XV-3.3, Rev 2 "NRC Reporting Requirements" '

171 SO123-XV-50, TCN 0-1 " Event Report Program" 4 172 SO123-XV-50.39, Rev 0 " Root Cause Program Standards and Methods"  ;

. 173 SO123-XV-50.39.2, TCN 2-1 " Root Cause Evaluations" 174 SO123-XXX-3.4, Rev 1 " Licensee Event Report (LER) System" 175 Procedure No. SO123-XXXV-5.5, TCN 0-2 " Validation, Approval and !ssuance of Design Bases Documentation" 176 Procedure SO123-XXXV-1.1 TCN 1-3 " Guidelines for System DBD Preparation" 177 Procedure No. SO123-XXXV-1.6, TCN 0-1 " Plant Operating Instructions Review Methodology" 178 Procedure No. SO123-XXXV-1.8, Rev 1 " Technical Specification Review Methodology" 179 Procedure No SO123-XXXV-1.10, Rev 0 " Electrical Interlock Functional Testing Review Methodology" 180 Procedure No. SO123-XXXV-1.14, Rev 0 " Post-Modification Testing Review Methodology" 181 Procedure No. SO123-XXXV-5.1, Rev 1 " Design Bases Documentation Open item Report (OIR)"

182 Procedure SO123-XXXV-2.1 TCN 1-1 " Guidelines for Topical DBD Preparation" 183 Procedure No. SO123-1-1.10, Rev 0 " Maintenance Procedure Writer's Guide" 184 DBD-1, Program Plan, Design Bases Document (DBD) Reconstitution Program, Revision 7, dated August 19,1993

ENCLOSURE H Page 6 185 Procedure SO123-Xil-20.1 Rev 2 " Material Test and Receipt Lab Program implementation" 186 Procedure SO123-Xil-20.2 Rev 2 " Material Test and Receipt Personnel Qualifications Standards" 187 Procedure SO123-Xil-20.4 Rev 2 " Receiving inspection" l 188 Procedure SO23-V-4.7 Rev 10 " Control of Core Protection Calculator Addressable l Constants" l 189 Procedure SO23-V-13 Rev 2 " Control of Plant Physics Data Books, COLSS i Addressable Constants and Reactor Engineering Data Transmittals" '

190 Procedure SO123-ill-5.20 Rev 9 " Assignment, Maintenance, Control and Distribution of Offsite Dose Calculation Manuals" l 191 Procedure SO123-XXXV-1.5 TCN 1-1 " System Functional and Boundary Definition l Methodology" 192 "UFSAR Review Plans and Guidelines," Revision 1, August 1996 t 193 Procedure SO123-XXXV-1.2 TCN 0-1 " Calculation Review Methodology" 194 Procedure SO123-XXXV-1.3 Rev 0 "Setpoint Review Methodology"  :

195 Procedure SO123-XXXV-1.7 Rev 0 " Motor Operated Valve Review Methodology"  !

196 Procedure SO123-XXXV-1.12 Rev 1 " Evaluating the Environmental Qualification Master List"  !

197 Procedure SO123-XXXV-1.15 Rev 0 " Spurious Circuit Actuation Evaluation" 198 Procedure SO123-XXXV-1.9 Rev 1 " Licensing Bases and Commitments Review Methodology" 199 Procedure SO123-XXXV-1.13 Rev 2 "In-service Testing Review Methodology" 200 Procedure SO123-XV-51 Rev 0, " Identifying and Assessing impact to Site Programs and Procedures" i

Edison Audits, Assessments, Surveillances, Task Force Results 300 Independent Assessment of Engineering and Technical Support Task Force Report, August 1988, CDM C881005G0004 ,

301 Surveillance Report SOS-075-95, " Radiation Monitoring System DBD Open item Reports", dated November 29,1995 302 Audit Report SCES-024-90 " Design Control" l 303 Assessment Report SEA-92-001, "DBD Open item Report Process", dated March j 20,1992  :

304 Audit Report SCES-346-93, " Design Bases Documentation, November 5,1993 305 Assessment Report SEA-94-002, " Design Bases Documentation Packages", March l 2,1994 306 Audit Report SCES-507-95 " Station Welding and ASME Code Section XI Repair / Replacement Program" 307 Audit Report SCES-508-95 " Plant Systems (MSSV, MSIV, ADV, AFW Pumps, System, Emergency Chilled Water)"

308 Audit Report SCES-519-95 " Procurement Document Development" 309 Audit Report SCES-524-95 " Design Control Processes implemented by NEDO" 310 Surveillance Reports SOS-032-95 (6-6-95) and SOS-061-95 (8-2-95), "MMP 2060 Operations and Maintenance Procedure Changes"

ENCLOSURE H Page 7 311 SEA 95-002, "Vedical Assessment of DCP 2&3-6984.00SJ, Excore Safety Channel Neutron Flux Detector Replacement) (6-13-95) 312 SEA 95-006, " Vertical Assessment of DCP 2&3-6926.00 and .01SJ, Radiation Monitoring System Replacement (12-5-95) and reference surveillance reports SOS-234-94, SOS-006-95, 80S-011-95, SOS-025-95, SOS-068-95, SOS-073-95, SOS-075-95 and SOS-076-95 l 313 Surveillance Report SOS-079-95, "FCN.50.59 Evaluations (12-15-95) i 314 Audit Report SCES-603-96 " Reactor Protective System Instrumentation and ESFAS" l 315 Audit Report SCES-604-96 " Reactor Coolant System" l 316 Audit Report SCES-605-96 "AR/NCR Program" L 317 Audit Report SCES-627-96 " Motor Operated Valve Program"

318 Assessment Report SEA 96-001, "DBD OIR Resolution Process", February 6,1996 l 319 SEA 96-003, " Assessment of Action Request Process"(2-28-96) 320 Surveillance Report SOS-013-96, " Spent Fuel Pool Cooling Documentation"(3 l 96) 321 Surveillance Repod SOS-012-96, " Nuclear Fuel Management Engineering"(3 96)  ;

322 SEA-96-004," Configuration Control Assessment"(7-3-96) 323- Report SEA 96-007, "Self Assessment of Engineering and Fire Protection,"

November 7,1996 324 Surveillance Reports SOS-042-96 (12-13-96), SOS-043-96 (12-16-96), and SOS-045-96 (12-26-96)"50.59 Evaluations"  :

325 Surveillance Report SOS-046-96, "FCE for Unit 2 Cycle 9 Core Reload"(1-4-97) 326 Audit Report SCES-615-96 " Biannual Corrective Action Audit" 327 Surveillance Report SOS-018-96 " Operator Licenses, NRC Reports and Notifications" 328 Audit Report SCES-616-96 " Biannual Corrective Action Audit" 329 Surveillance Report SOS-024-95 "NOV Response Verification inspection Report 95-05" l

~

l l

L,- - -

__ ,