ML20134L588
| ML20134L588 | |
| Person / Time | |
|---|---|
| Site: | Duane Arnold  |
| Issue date: | 02/11/1997 |
| From: | Franz J ILLINOIS POWER CO. |
| To: | NRC (Affiliation Not Assigned), NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| References | |
| NG-97-0245, NG-97-245, NUDOCS 9702190216 | |
| Download: ML20134L588 (78) | |
Text
IES Ut>Ittres Inc.
200 First Street S.E.
PO. Box 351 Cedar Raptds, IA S2106-0351 Telephone 319 398 8162 Fax 31s 398 6192 UTILITIES February 11,1997 NG-97-0245 Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Attn: Document Control Desk Mail Station PI-37 Washington. DC 20555-0001
Subject:
Duane Arnold Energy Center Docket No: 50-331 Op. License No: DPR-49 Response to NRC 10 CFR 50.54(f) letter," Request for Information Pursuant to 10 CFR 50.54(f) Regarding Adequacy and Availability of Design Bases Information", dated October 9,1996 File:
A-17d, A-105 On October 9,1996, the NRC issued a 10 CFR 50.54(f) letter," Request for Information Pursuant to 10 CFR 50.54(1) Regarding Adequacy and Availability of Design Bases Infonnation." This letter requests the submittal ofinformation that will provide the NRC l
added assurance that the plant is operated and maintained within the design bases.
The NRC request lists five items for which information is to be provided. The response is also to indicate whether any design review or reconstitution programs have been undertaken and, if not, a rationale for not implementing such a program. The attachment to this letter provides the requested information.
The attached response follows a general overview related to the five requests contained within the 10 CFR 50.54(f) letter.
In response (a), the Duane Arnold Energy Center (DAEC) design control and configuration control processes are discussed. Response (a) also describes how the DAEC has implemented the requirements of 10 CFR 50.59 and 10 CFR 50.71(e).
in response (b), the procedures control processes are discussed.
e Response (c) provides the results of the audits and inspections, and the performance history that provide assurance that the DAEC's configuration and performance are consistent with the design bases.
Response (d) describes the DAEC corrective action program which is used to correct deficiencies or issues related to the activities previously described.
Finally, response (e) presents a summary of the overall effectiveness of the activities and processes used to provide confidence that the DAEC's configuration is consistent with the design bases.
I t
fDh I 9702190216 970211 PDR ADOCK 05000331 P
- An ICS Industnes Company
1 NG-97-0245 February 11,1997 Page 2 As shown in the attachment, the DAEC has sound design control and configuration control programs. The processes in place ensure that they will continue to be effectively implemented and that any identified deficiencies will be resolved through our corrective i
action program.
Procedure and process descriptions contained in the attached response a e provided as evidence of the DAEC processes at the time of the writing of this response and do not preclude changes to these procedures or processes as permitted by 10 CFR 50 Appendix B,10 CFR 50.54(a)(3) and 10 CFR 50.59 or docketed commitments.
The DAEC has an on-going effort based on the guidelines of NUMARC 90-12," Design Basis Program Guidelines" to develop and enhance Design Bases Documents (DBDs).
These efforts are examples of enhancements to our design and configuration control efforts that reflect our commitment to continuing improvement in our programs for safe, efficient and reliable plant operation.
The initial scope of that ffort has produced five " Top Level" DBDs, described in the attachment, which sepresent the design standards and criteria used as the bases for the design of the DAEC. These standards and criteria were implemented through system specifications, drawings, calculations and analyses. In addition, System and Topical DBDs (also described in the attachment) were generated which simplify reference to the applicable design bases specifications, drawings, calculations and analyses. To date, twenty five System DBDs and seven Topical DBDs have been developed and issued.
The DAEC has also completed design basis reconstitution of the calculations for setpoints, both in the current Technical Specifications and the Improved Technical Specifications. In addition, the development of the improved Technical Specifications afforded us the opportunity to validate those areas of the design and licensing basis contained within the Technical Specifications. The DAEC's conversion to the Improved Technical Specifications is currently undergoing NRC review.
At this time, the DAEC is re-evaluating the DBD program and the status ofits design reconstitution efforts based upon recent industry experience. Based upon this re-evaluation, we will determine the scope of further efforts to enhance existing DBDs, develop additional DBDs and reconstitute other design basis information.
This letter makes the following new commitment:
Complete re-evaluation of the er.isting DBD program and the status of design basis reconstitution and provide results to NRC by June 1,1997.
NG-97-0245 February 11,1997 Page 3 i
i l
This letter is true and accurate to the best of my knowledge and belief.
{
IES Utilities Inc.
By M
[ John'F. Fraltz j
Vice President, Nuclear State of tasn&lhM County ofMal Hoh%
Signed and sworn to before me on this I b day of fed)Al40tb1?
,1997, by John F. Franz.
I
(.x AAAAA A AA **^'
[
g d
Robert B. S. Sub g' 4fg g, g, --
O comm. #1105086 Lg CgRN*g Nota 6 Public in and for the State ofIowa l
0 NOMR e
O Comm Erp. July 5,2000 y
~ ~-,
f Commission Expires l
l Attachment cc:
L. Root F. Miraglia (NRC-NRR)
G. Kelly (NRC-NRR)
A. B. Beach (Region 111)
NRC Resident Office DOCU
J Attachment to NG-97-0245 i
k' A
i 4
Duane Arnold Enerev Center i
Res.oonse to NRC Rea.uest for Information Pursuant to 10 CFR 50.54(f) Regarding Adequacy and Availability of Design Bases Information
. _.._-- _._ ~_
i Duane ArnoldEnergy Center Response to NRC 10 CFR 50.54(f) Letter TABII OF CONTENTS RESPONSE (a) 4 1
N Introduction to Response (a) 1 Establishing the Design Basis 2
Top Level Design Bases Documents 2
System and Topical Design Bases Documents 3
Licensing Bases 6
Overview of fnterfaces 6
i Design Control Process 8
Design Document Changes 10 Engineered Maintenance Actions 11 Engineering Changes 12 Engineering Calculations 12 Software QA Program 13-Configuration Control Process 13 i
Design Control 13 Temporary Modifications 14 Plant Maintenance 15 Inspection 15 Procurement Process 15 Other Functions 16 Fuels Control 16 10 CFR 50.59: Safety Evaluation Applicability Reviews and Safety Evaluations 17 SEAR Process 17 Safety Evaluations 18 10 CFR 50.71e: UFSAR Updating Process 20 Changes to the Quality Assurance Program Description (QAPD)(UFSAR 17.2): 20 j
Commitment Tracking System 20 l
10 CFR 50, Appendix B: Nuclear Quality Assurance Program 22 Nuclear Quality Assurance Program 22 Quality Assurance Manual and Implementing Procedures 23 Conclusion to response (a) 23 i
RESPONSE (b) 24 Introduction to Response (b) 24 Overview of Procedure Processes 25 QA Assessment 26 Testing Procedures 27
)
Special Programs 28 Other Assessments of Procedure Adequacy 29 Conclusion to Response (b) 29 i
i
s Duane ArnoldEnergy Center Response to NRC 10 CFR 50.54(f) Letter RESPONSE (c) 30 Introduction to Response (c) 30 Management Oversight 30 i
Committees and Panels 31 Operations Committee 31 Safety Committee 32 Action Request Screening Panel 33 Action Request Evaluation Panel 33 Briefings and Meetings 33 Trending Reports 34 Configuration Reviews 35 Internal Audits 35 External Audits and Inspections 36 ESW SSFI 36 EDSFI 37 Instrument Setpoint Control Inspections 37 Walkdowns 37 Design Bases Reviews 38 Improved Technical Specifications Project 38 Training Simulator Project 38 l
l Operating Cycle Extension 39 Power Uprate Program 39 Design Bases Reconstitution Efforts 39 UFSAR Updating Process 40 UFSAR Improvement Plan 40 l
NEI Initiative 40 l
Quality Assurance Processes 41 Design Control 41 i
Design Document Changes 41 Engineered Maintenance Actions 41 Engineering Changes 42 Engineering Calculations 42 Software QA Program 42 l
Configuration Control 43 Temporary Modifications 43 I
Procurement Process 43 Fuels Control 44 1
Safety Evaluation ApplicabiIu; Rev!:ws and Safety Evaluations 45 Programs, Tests and Inspections 45 Surveillance Program 45 Inservice Inspection (ISI) Program 46 Inservice Testing (IST) Program 47 Instrument Setpoint Control Program 47 ii
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter Environmental Qualification Program 48 Maintenance Rule Program 49 Performance Trending Programs 50 Fire Protection Program rebaseline efforts 50 Seismic Qualification (USI A-46) 50 Power Systems Analysis Program (NRC Generic Letter 88-15) 51 Motor Operated Valve (MOV) Program (NRC Generic Letter 89-10) 52 Regulatory Guide (RG) 1.97 Program 52 Station Blackout (SBO) Program 52 Masonry Block Wall Program 53 IE Bulletin 79-14 on pipe hangers 53 CHAMPS 54 Chemistry 54 Radiation Control 54 Physical Security Plan 55 Operating Experience Program 55 Industry Initiatives 56 Questioning Attitude 57 4
Conclusion to response (c) 58 RESPONSE (d) 60 l
Introduction to Response (d) 60 Action Request (AR) System 60 Employee Safety Concerns 64 Corrective Maintenance Action Request (CMAR) System 64
)
Conclusion to response (d) 65 RESPONSE (c) 66 Design Control 66 Configuration Control 67 10 CFR 50.59 68 UFSAR 68 Quality Assurance 68 Procedures 68 Corrective Action 69 Performance Trend 69 Culture 70 i
i l
Duane ArnoldEnergy Center Response to NRC 10 CFR 50.54(f) Letter NRC REOUEST FOR INFORM ATION (a) Description of engineering design and configuration control processes, including those that implement 10 CFR 50.59,10 CFR 50.71(c) and Appendix B to 10 CFR 50.
j DUANE ARNOLD ENERGY CENTER (DAEC) RESPONSE Introduction to Response (a)
In this response Duane Arnold Energy Center (DAEC) provides descriptions of the design and configuration control process implementation. The major types of design bases documentation are described. The relationship between the design bases documentation, including Design Bases Documents (DBD), and_ licensing bases documentation found in the UFSAR, Technical Specifications and docketed correspondence is discussed.
Procedure-driven design control processes are provided to control:
changes to design documents (DDC),
e maintenance actions that affect configuration but can be accomplished within the existing e
design bases (EMA),
modifications (ECP),
e Temporary Modifications, and e
engineering calculations.
e Configuration controls are primarily accomplished through the design control process.
. Activities that could affect plant configuration are controlled so they invoke design control processes to assure that plant configuration remains consistent with design documentation and bases.
The DAEC employs Safety Evaluation Applicability Reviews (SEAR) to identify the need for Safety Evaluations (SE) for changes in the facility, procedure changes, or to perform special tests or experiments. SEARS and SEs require reference and evaluation of the design bases for the affected structure, system, or component to determine if a proposed change, test or experiment involves an Unreviewed Safety Question that requires prior NRC approval before the change, test, or experiment can be performed. This process implements the requirements of 10 CFR 50.59.
The DAEC Updated Final Safety Analysis Report (UFSAR)is maintained in accordance with administrative control procedures. The UFSAR update process implements the requirements of 10 CFR 50.71(e). The SEAR /SE process identifies changes that affect the descriptions in the UFSAR. A commitment control tracking system is available to simplify retrieval ofinfomiation about licensing bases and commitments. These activities are used to maintain compliance with the plant licensing bases.
1
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter The DAEC Quality Assurance (QA) Program implements the requirements of Appendix B to 10 CFR 50. This program also implements specific Regulatory Guides and industry standards that have received NRC review and approval.
Establishine the Desien Basis Design Bases, as defined in 10 CFR 50.2, are:
"that information which identifies the specific functions to be performed by a structure, system, or component of a facility, and the specific values or ranges of values chosen for controlling parameters as reference bounds for design. These values may be (1) restraints derived from generally accepted " state of the art" practices for achieving functional goals, or (2) requirements derived from analysis (based on calculation and/or experiments) of the effects of the postulated accident for which a structure, system, or component must meet its functional goals."
The DAEC has undertaken an effort to develop design bases documentation. The process was originally issued as a DAEC initiative in 1988, with documentation preparation entering a pilot phase in 1990 using the guidelines of NUMARC 90-12 " Design Basis Program Guidelines." This process is on-going. The Top Level DBDs (described below), and the UFSAR and Technical Specifications serve as the first points ofinput into design activities, 10 CFR 50.59 evaluations, and other activities requiring reference to design and licensing bases. System DBDs are organized as " pointer documents" and primarily contain references to the actual design bases drawings, specifications, calculations, analysis, etc. In combination with Topical DBDs, the System DBDs provide a simple starting point for design and licensing bases reviews.
Too Level Desien Bases Documents The 5 Top Level DBDs described below represent the design standards and criteria which were actually used as the bases for the design of the DAEC. These standards and criteria were implemented through system specifications, drawings, calculations, and analyses. As the design was further developed and implemented in the design and physical construction of the DAEC, greater detail and more documentation was prepared. Examples of this documentation included analyses, calculations, specifications, and configuration drawings.
DAEC's Top Level Design Bases Documents (DBDs) are briefly described as follows:
DBD-A61-001, Duane Arnold Design Safety Standards, consists of the General Electric design safety standards used by General Electric Company BWRs independent of product line. This DBD defines the transients and accidents for which analysis was performed. It identifies unacceptable consequences fbr which protection must be provided. The DBD i
i 2
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter 1
l l
provides a description of system functional relationships and establishes plant-specific system design safety stancards for the DAEC.
DBD-A61-002, Nuclear Safety Criteria (NSC)for Boiling Water Reactors, is the Ceneral e
Electric application manual APED-4600. It establishes engineering functional requirements to assure that the Design Safety Standards will be met.
DBD-A61-003, Duane Arnold Comparison ofAPED-4600 NSC to 1971 AEC General Design Criteria, is a comparison of each 1971 AEC General Design Criterion and the corresponding APED-4600 Nuclear Safety Criteria. The design of the DAEC predated the 1971 AEC General Design Criteria now embodied in Appendix A to 10 CFR 50.
This comparison was performed by GE to show the NRC why our design met the intent of the General Design Criteria (GDC) and was used to obtain our initial license. NRC approval of Option 1 of SECY-92-223 stated that the GDC would not be applied to plants with construction permits issued prior to May 21,1971. The DAEC construction permit was dated June 22,1970.
DBD-A61-004, Classification ofStructures, Systems, and Components, identifies the engineered Structures, Systems and Components of the nuclear power plant that are safety-related in a format consistent with NUREG-0800 " Standard Review Plan." This document is plant specific and provides the basis for the UFSAR 3.2 Safety List of Structures, Systems, and Components.
APED-A61-038, Nuclear Safety Operational Analysis (NSOA), systematically identifies the envelope of acceptable plant operation needed to satisfy the Nuclear Safety Criteria.
It identifies the safety functions perfonned by structures, systems, and components and identifies the operations, transients, accidents, and other events for each reactor operating mode when the function is required to be operable. This document is used extensively to develop safety, operability, and reportability assessments.
System and Tonical Design Bases Documents System and Topical Design Bases Documents are a tool that simplifies reference to the applicable design bases specifications, drawings, calculations, and analyses.
System DBDs were developed as pointer documents to the design documentation for the DAEC (e.g. specifications, calculations, analyses, and drawings). Access to DBDs is provided by the inclusion of these documents in the DAEC Master Document Listing. Open issues and problems identified in the process of developing L)BDs have been documented and reviewed for significance. Open items and issues identified during DBD preparation and review are processed through the DAEC corrcc ive action process described in response (d).
The DAEC has an on-going effort to continue to develop and enhance DBDs. Procedures for developing, issuing, and revising DBDs and for addressing issues and open items are 3
_.____._.___.~.__.__m Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter currently being revised to simplify and consolidate the controls for this process. Our DBD effort is based on the guidelines'of NUMARC 90-12 " Design Basis Program Guidelines."
This effort is considered to be an enhancement of our commitment to continuing improvement in our programs for safe, efficient, and reliable operation.
The following discussion is based on the work completed to date and the goals, expectations, and lessons-learned to date. Twenty five System Design Bases Documents have been developed and issued. Seven Topical DBDs have also been issued. A listing of the DBDs is included as Table 1. At this time,15 of 25 System DBDs have been validated. A comparison of the DBDs completed to date to the list of risk significant systems used in the DAEC Probabilistic Safety Analyses indicates that approximately 22 of 51 risk significant systems do not yet have System DBDs.' There are approximately 193 open items related to DBDs in the DAEC corrective action process. Evaluation of the status of DBDs and design basis reconstitution is underway and a commitment related to this effort is contained in the cover letter of this response.
Design and licensing bases reviews for systems for which DBDs have not been developed is simpler, but the design control processes are still guided by the Top Level DBD, whether or not, a System DBD has been developed.
a i
' The approximate count for risk significant systems not covered by DBDs is based on the potential that a single DBD might cover more than one related risk significant system. For instance, a Control Rod Drive DBD might cover both CRD liydraulic and CRD Electrical which are listed as separate risk significant systems.
i 4
H
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter TABLE 1 List ofIssued Desien Bases Documents (Top Level. System. and Topical)
DHD-Title / Type A61-001 Duane Arnold Design Safety Standards Top Level A61-002 APED-4600 Nuclear Safety Criteria for Boiling Water Reactors Top Level A61-003 Compare APED 4600 Nuclear Safety Criteria to 1971 AEC General Design Criteria Top Level A61004 Classification of Systems, Structures, and Components Top Level A61-005 Setpoints and Margins Topical A61-006 Pipe Break inside Containment Topical A61-007 Mechanical Topical A61-008 Seismic Topical A61-009 Electrical Topical A61-010 High Energy Line Break Outside Containment Topical A61-038 Nuclear Safety Operational Analysis Top Level A64-001 Environmental Qualification (EQ) Topical B21-001 Steam Leak Detection System / Nuclear Steam Supply Shutoff System B21-002 Automatic Depressurization System B31-001 Reactor Recirculation Systesa C31-001 Feedwater Control System C41-001 Standby Liquid Control System C51-001 Neutron Monitoring System C71-001 Reactor t'rotection System D11-001 Process Radiation Monitoring System El1-001 Residual lleat Removal System -- Low Pressure Coolant injection Mode E12-001 RHR Service Water System E13-001 Emergency Service Water System E21-001 Core Spray System E41-001 liigh Pressure Coolant injection System E51-001 Reactor Core Isolation Cooling System N62-001 OfTgas System N71-001 Circulating Water System R20-001 Instrument AC System R22-002 Auxiliary AC Power System R42-001 125 VDC System R42-002 250 VDC System R43-001 Standby Diesel Generator System T23-001 Primary Containment System T48-001 Containment Atmosphere Control System W10-001 River Water System T46-001 Standby Gas Treatment System 5
Duane ArnoldEnergy Center Response to NRC 10 CFR 50.54(f) Letter Licensing Bases The original licensing bases for the DAEC was contained in the FSAR, Operating License, i
and Technical Specifications. Over time, further changes and improvements have been made due to regulatory changes, industry initiatives, and DAEC initiated improvements. Design and Licensing bases documentation were updated as part of these changes. Current licensing l
bases are found in the Updated FSAR, Operating License, Technical Specifications, and docketed correspondence with the NRC.
I Overview ofInterfaces Figure 1 provides an overview of the inte i;e between design and licensing bases i
documentation and the design / configuration control and corrective action processes used at 1
the DAEC. This figure shows the basic interrelationships and information flows involved. It shows that the Top Level DBDs and both original and current design basis documents (e.g.
{
analyses, specifications, calculations, and drawings) are inputs into the design control process. The figure shows how a " pointer" DBD can quickly guide a user (e.g. person
~
responsible for a design, verification, safety evaluation, or operability evaluation) to the relevant design documentation. The figure shows how outputs from the design control l
process appear in the design and licensing documentation (including DBDs) and plant configuration.2 The decision block comparing the configtiration to the design bases represents i
a compilation of configuration control, and the evaluations and assessments described in i
response (c). Finally, the corrective action process is shown without outputs, although the
- outputs could feed into any of the other processes or documents.
i I
- The design control process also includes outputs that initiate procedure updates as described in response (b). This linkage is omitted from the figure for increased clarity.
i 6
6
[
b 5
"f1 input to DBD Preparabon/ Update Pr~.
m E
i m
I A
h Top 5 DBDs.
3 Drawings.
Original Design and Licensing Bases k
Original Design Bat output Spec.ifications, g Po e Calculations, SAR/FSAR or w
Regulation M
g jg3 aiwsa A Q
E 1r
_ mput Process Outp4 Design Modifications.
$*i ' #
Control.
Procedure System and Topicat DBD Configuration DBDs Preparation
- Changes, contns
- Control, m os""
Regulations.
(where developedr and Update De*9" UFSAR Operating Process Updates.
Experience Tech Specs (Dwas.cak:s.
etc) gma rud Pointer Document q
4 (system or q,
(
TopodDBD)
- Drawings, h
k Current Design an Calculations.
W Ucensing Bases
- Anatyses, a
UFSAR Current Design and Licensing Bases LEGEND a
I E
l input to DBD Preparation / Update P~---
>g Q
C Design &
Corrective G
Configuration Action Agree?
g 9
I AS t,
Overview of the interface Between Design / Licensing Bases and Designl a
Configuration Control and Corrective Action Processes k
Duane Arnold Energ Center Response to NRC 10 CFR 50.54(f) Letter l
Design Control Process (See Figure 2 for an overview of the process.)
10 CFR 50 Appendix B Criterion 111 - Design Control states, in pertinent part:
" Measures shall be established to assure that applicable regulatory requirements and the design basis, as defined in section 50.2 and as specified in the lh nse application, for those structures, systems and components to which this appendix applies are correctly translated into specifications, drawings, procedures and instructions.
Measures shall also be established for the selection and review for suitability of application of materials, parts, equipment and processes that are essential to the safety-related functions of the Structures, Systems and Components..
The design control measures shall provide for verifying or checking the adequacy of design, such as by the use of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. The verifying or checking process shall be performed by individuals or groups other than those who performed the original design, but who may be from the same organization
. Design control measures shall be applied to items such as the following: reactor physics, stress, thermal, hydraulic and accident analyses; compatibility of materials; accessibility for inservice inspection, maintenance and repair; and delineation of acceptance criteria for inspections and tests."
Administrative Control Procedure (ACP) 103.0,3 " Design Control Program," is the process that ensures the design standards and criteria of the Top Level DBDs are maintained. ACP 109.0, " Engineering Change Packages" and engineering department (1200 level) are implementing procedures which provide controls to ensure that changes to the facility are accomplished in accordance with the requirements and limitations of applicable codes, standards, specifications, licenses, and predetermined safety restrictions. These requirements include steps to maintain the system / component design bases. Design control is applied to both new designs and changes to the existing design for safety-related structures, systems, and components (SSC) and specific non-safety-related SSC for which design control has been imposed at the DAEC, as defined in the Quality Assurance Program Description (QAPD).
l
' Procedure numbering is only a rough guideline to hierarchy. The DAEC procedures are being reorganized during the course of routine revisions into a two tier hierarchy with "100 Level" i
procedures providing the overview and coordination of"1000 Level" subordinate implementation procedures. The past practices involved distinct numbering of procedures for each department (e.g.
Engineering "1200," Maintenance "l400," and Licensing "1600"). To reduce procedure duplication l
and the effort required for procedure maintenance, procedures may be applicable across departmental boundaries. Procedure links and cross references between departments or by reference from the "100 Level" procedures is commonplace. The reduction in numbers of administrative procedures should contribute to greater procedural awareness and compliance.
8
Duane ArnoldEnergy Center Response to NRC 10 CFR 50.54(f) Letter Overview of the Desien Control Procram Define the Scope of the Change u
identify the item and interfaces to be changed v
Perform Work Request and/or Change to Commercial Change Document Update Non-controlled ves-+
Only Request Form item (DURF) per ACP 1206.9 No u
D2 Physical or Perform Design E
O Document Change functional change No--+
Document Change Only o plant SSC (DDC) per ACP 1206.7 a
o I
E v.s g
g
!E a:
o 3
Change Pe h a meets or exceeds Engineered ves -+
Equivaient Change Maintenance r
re e tha re design functio',
performara ACP 109.1 s/
No om an Chang] revises the "9 "'
"U technical requirements tha ange a age ensure design function (ECP) per pe onnance ACP109.0 Finure 2 9
Duane Arnold Energy Center Response to NRC 1d CFR 50.54(f) Letter Within the Design Control Program, several processes are in place for implementation of changes, ranging from drawing updates to new system installation. Common elements in these processes include a review for impact on the design basis; licensing basis (i.e.
Technical Specifications and Updated Final Safety Analysis Report (UFSAR)); drawings; and operations, maintenance, and surveillance procedures. These processes and procedures include " Nuclear Fuel Control" (ACP 103.1), " Engineering Change Packages" (ACP 109.0),
" Engineered Maintenance Action" (ACP 109.1), " Temporary Modification Control" (ACP 1410.6), " Control of Design Document Changes (DDC)" (ACP 1206.7), " Safety Evaluation Applicability Review Process" (ACP 103.2), " Safety Evaluation Process" (ACP 103.3), and
" Preparation, Review and Processing of UFSAR Change Requests and UFSAR Revisions" (ACP 102.10). As appropriate, these processes specify requirements for design verification and for management review and approval. Additional descriptions and discussions of these processes and their interfaces follows.
The Design Control Program, described in ACP 103.0, assigns design control authority to the Nuclear Generation Engineering Department. This authority is implemented through Engineering Department ACPs. ACP 1203.04 " Classification and Quality Level Determination of Systems, Structures, and Components" specifies the methods for determining quality assurance requirements for SSCs. The DAEC uses a set of 13 databases i
adapted from the Computerized History and Maintenance Planning System by CHAMPS Software Incorporated (CilAMPS). One field within CHAMPS provides access to the results of these determinations and is used in establishing what design and modification controls apply to specific equipment during maintenance and modification planning activities. ACP 1203.04 provides links to the " Top Level" DBDs that contain the design bases for the plant.
It's companion procedure, ACP 1203.05 "DAEC Safety-Related List (Classification of Structures, Systems, and Components)," specifies maintenance and revision requirements for the DAEC Safety-Related List of SSCs. This list is available in UFSAR 3.2 and DBD-A61-004 as stated above.
Additional Engineering Department Administrative Control Procedures have been issued to support the modification process and to support specific programs and tasks. Discussions of these procedures follow, to show how the design control process is managed at the DAEC.
Design Document Changes Design Document Changes are processed in accordance with ACP 1206.7 " Control of Design Document Changes (DDCs)." Design Document Changes may be required as a result of Engineered Maintenance Actions (described below),in response to Action Requests (from the DAEC Corrective Action Program described in response (d)), or as a result of Engineering activities (e.g. new calculations, analysis or drawings resulting from regulatory notices, industry and plant-specific operating experience, plant events, vendor notifications, employee concerns).
The DDC process controls the preparation, issuance, revision, review, approval and distribution of documents in the controlled Master Document List (MDL). The MDL 10
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter includes design control drawings, design bases documentation (including DBDs), plant analysis, specifications, engineering calculations, and significant program documentation.
Rack / Position (R/P) drawings are a subset of the controlled drawings that have been identified by the DAEC to be essential and/or pertinent to the safe operation of the DAEC. A Work in Progress (WIP) drawing is a replica of an R/P drawing used to show pending and construction complete modifications. ACP 1206.6," Control of Work in Progress Drawings,"
defines the requirements for the preparation and issuance of WIP drawings while a drawing change or modification package is open. The Design Documents Affected (DDA) database i
identi'ies those design documents which are included in the MDL and affected by an open DDC or modificatioii(i.e. Engineered Maintenance Action or Engineering Change Package, which are described below).
The DDC process requires review for 10 CFR 50.59 applicability. Should discrepancies between MDL documentation and actual plant configurations be identified through walkdowns, audits, etc., they are expected to be documented by Action Requests in the DAEC Corrective Action Program and resolved through the DDC process.
Engineered Maintenance Actions When a maintenance activity proposes to alter system configuration, or a component's manufacturer, model number, material specifications, or design characteristics, and screening criteria show that the maintenance activity meets or exceeds the original technical requirements (i.e. critical characteristics) that ensure the system / component will perform its intended design / safety function, ACP 109.1 " Engineered Maintenance Action"(EMA) l provides for the conimi of these changes. EMAs apply to Structures, Systems, and Components for which design control applies or when design documentation must be revised to accomplish the maintenance action (e.g. plant drawings). ACP 109.1 establishes requirements to determine and independently verify, that the proposed activity satisfies the design bases for the affected structure, system, or component. The EMA process requires review for applicability of 10 CFR 50.59. Ifit is found that the activity requires a safety i
evaluation, the activity must be revised to an acceptable scope or be transferred into the Engineering Change Process described below.
The EMA process requires identification and updates of affected drawings, databases j
(CHAMPS), design bases documentation, configuration control records, procedures, training, and engineering programs. The process specifies that formal testing requirements, beyond typical post-maintenance testing, should be considered and included, as needed. Closure and operational release of an EMA includes a review to verify that acceptance criteria have been met, and that documentation and other updates are completed. Problems requiring corrective action identified during the EMA process are entered into the DAEC Corrective Action
{
Program described in response (d).
As discussed previously, procedures require identification of affected MDL documents in the DDA database and the utilization of WIP drawings to maintain configuration prior to, during, and upon completion of construction.
11
i Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter Engineering Changes
-ACP 109.0, " Engineering Change Packages," applies to permanent modifications affecting structures, systems, and components for which Appendix B Criterion ill Design Control is required. The procedure establishes a road map for modification planning, design, review, approval, documentation, and implementation. It establishes design controls to establish internal and external design interfaces (as appropriate) and design inputs.
The procedure references program and task-specific procedures and other design considerations and processes. It requires evaluations for applicability of 10 CFR 50.59. It provides for use of the DAEC Corrective Action Program to initiate the Engineering Change Package and to correct identified problems. It requires independent design verification to ensure that the proposed design meets the design requirements and design bases, including DBDs. It calls for review and updates of design and licensing basis documentation, in addition to plant drawings, as needed. The process includes review of training requirements, including the DAEC Training Simulator. It establishes acceptance requirements for installation, testing, and operational release. It provides for reviews and updates of affected administrative, operations, maintenance, and surveillance procedures. Finally it establishes a formal closure process that includes reviews for completion of required actions and documentation and that acceptance requirements have been met lilements evaluated during an Engineering Change include:
- Fire Protection Environmental Qualification e
ASME codes and standards e
Electrical Distribution Design e
- Seismic Radwaste e
Setpoint Control e
Masonry Wall Analysis e
Assessment of Potential Impact on Emergency Operating Procedures e
Regulatory Guide 1.97 e Station Blackout As discussed previously, procedures require identification of afTected MDL documents in the DDA database and the utilization of WIP drawings to maintain configuration prior to, during, and upon completion of construction.
Engineering Calculations ACP 1203.21," Engineering Calculations," govems the format, preparation, revision, verification, approval, and issuance of engineering calculations used to support design activities, analyses, operability evaluations, and responses to regulatory activities. It covers 12 j
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter calculations for which design control is required. The procedure contains requirements for the identification and reference to design inputs. It requires explicit statement of engineering judgments and assumptions. Calculations must be verified. During verification, engineering judgments and assumptions must be evaluated and determined to be reasonable and valid.
The requirements for use of computer programs are provided, including a check to ensure that the software is certified for use in accordance with ACP 102.14," Software Quality Assurance Program," or that the esults of the calculation are verified by means of alternate calculation methods.
i Sof1 ware OA Procram ACP 102.14, " Software Quality Assurance Program," defines the requirements for use of computer codes and software in support of design control activities at the DAEC. It establishes a process for determining the quality assurance requirements for software depending on the safety-significance of the software's functions. It requires that safety-
~
related functions be performed only by Controlled Software. Critical Functions for Controlled Software must be identified and validation and verification requirements for these functions must be established. Testing and documentation of the results are required to demonstrate that the Critical Functions meet validation and verification requirements. Plans for software configuration management and control are also required to ensure that the approved version is used. The processes for installing computer software control or issuing the results of computer analysis employ the same design control procedures as described in response (a) and include provisions for the review of 10 CFR 50.59 applicability, impact on the UFSAR description of the plant configuration and procedures and compliance with Technical Specifications.
Confieuration Control Process Desien Control Maintenance of the DAEC configuration control process is primarily achieved through the same procedures as the design control process (discussed above), through other quality assurance controls (described below), and through the procedure control process (described in our response to request (b)). During operations, maintenance, or surveillances, personnel are encouraged to report any deficiencies, non-conformances, or deviations encountered through Action Requests within the DAEC Corrective Action Program (discussed in our response to request (d)). Resolution ofissues concerning structures, systems, and components is performed in accordance with the Design Control Program. Drawings, procedures, operator aids, tools, and databases and training are used to provide easy access to configuration information.
13
1 Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter Several programs, tools, and processes support maintenance of configuration control. Further infonnation is provided elsewhere in this response, however some examples include-Measurement and Test Equipment Program tracks the calibration and use of test equipment. Each use of test equipment is recorded for future evaluation of potential impacts if a test equipment instrument is found out of tolerance.
Procurement, testing, configuration, and use of software in plant control systems, instrumentation, data retrieval, plant configuration databases, and engineering analysis is subject to ACP 102.14 " Software Quality Assurance."
Engineering databases used as configuration management tools are controlled by plant procedures specifying how the databases are maintained and updated.
1 Operations and Maintenance personnel are required to adhere to written procedures to prevent unauthorized changes to the plant.
Personnel are encouraged to report deficiencies and discrepancies through the DAEC corrective action program.
Temnorary Modifications Another process that has the potential for affecting the design basis is the temporary modification process. Typical temporary modifications include blank flanges, lifted electrical leads, mechanical jumpers, relay blocks, opening secondary containment penetrations, and temporary power connections. Temporary modifications may be used to support corrective maintenance, testing, troubleshooting, or as directed by plant operations, maintenance or surveillance procedures. His process applies to SSCs fbr which Appendix B Criterion III Design Control is applicable. The process is designed to ensure operator awareness of the plant configuration, conformance with original design intent and operability requirements, and preservation of plant reliability and safety.
ACP 1410.6 " Temporary Modification Control" is the governing procedure for temporary modifications. The process requires reviews for 10 CFR 50.59 applicability. Implementing temporary modifications requires development and approval of a formal Plant Effect Evaluation to assess the impact of any temporary modification which is not performed in accordance with an approved procedure previously reviewed by the Plant Operations Committee. Additionally, the Plant Effect Evaluation also identifies any procedures and Rack / Position drawings that are affected by the temporary modification to ensure that they are updated as necessary to reflect current plant configuration during the duration of the temporary modification. The evaluation addresses the design bases of the system / equipment that is being modified, system design parameters, potential failure effects, installation requirements, testing requirements, and any effects on engineered programs such as seismic integrity or environmental qualification. Evaluation of temporary modifications that are perfonned using approved procedures are conducted in accordance with the procedure revision and control process described in response (b) below. Periodic reviews and audits are performed of temporary modifications to ensure configuration centrol is maintained and to detennine if the need for the temporary modification is still valid. Issues and problems 14
Duane Arnold Energy Center Response to NRC 10 CFR 50.5s1(f) Letter identified in the temporary modification process are documented and resolved through the DAEC Corrective Action Program described in response (d) to the request for information.
Plant Maintenance When an equipment failure or problem is discovered, a work request card is prepared. Work request cards are screened by a Fix-It-Now (FIN) team daily to determine if the work is safety-related, affects drawings or configuration, uses replacement parts, or requires reviews by ASME, EQ, or other configuration programs. If so, a Corrective Maintenance Action Request (CMAR)is generated. The CMAR requires procedurally-controlled work planning, procurement, review, authorization, and post maintenance testing and documentation.
CMARs that would affect plant drawings, alter manufacture or model number, change setpoints or otherwise change plant configuration are required to be further processed by the Engineering Maintenance Action (EMA) Process. If work requested by an EMA is found to require a safety evaluation (SE) during screening with a safety evaluation applicability review (SEAR), it must be further processed into an Engineering Change Package (ECP).
Determination of appropriate inspection points for maintenance, surveillance, and modification activities is an integral part of the maintenance planning process and procedure control process. Appropriate inspection points are built into routine and periodic maintenance procedures and surveillance procedures.
Insocction The DAEC undertakes a variety ofinspection activities which are implemented through programs. Included are programs such as water chemistry, ASME Section XI, and erosion / corrosion. The DAEC's primary water chemistry and related inspection results bear directly on maintaining a configuration that minimizes degradation of the primary coolant pressure boundary. As discussed under the Chemistry Program in response (c), DAEC is an industry leader in this area.
Procurement Process The DAEC Procurement Program is implemented in accordance with 10 CFR 50 Appendix B Criterion IV " Procurement Document Control," Criterion VII " Control of Purchased Material, Equipment, and Services," and Criterion VIII " Identification and Control of Materials, Parts, and Components;" and ANSI N18.7 " Administrative Controls and Quality 1
Assurance for the Operational Phase of Nuclear Power Plants." The programs that make up the DAEC Procurement Program are described in the DAEC QA Manual (QAM) and DAEC Procedures. The DAEC Procurement Program is comprised of two components:
Procurement Control and Material Centrol.
The IES Utilities Inc. nuclear procurement control program applies to the procurement of items and services which affect the quality and operation of the DAEC. The purpose of 15
Duane ArnoldEnergy Center Response to NRC 10 CFR 50.54(f) Letter the program is to assure the applicable regulatory requirements, design basis, and other requirements are included or referenced in procurement documents, and that purchased items and services conform to specified technical and quality requirements. Procurement document control applies to documents employed to procure materials, parts, components, and services required to modify, maintain, repair, test, inspect, or operate DAEC.
The IES Utilities Inc. Material Control Program is designed to ensure that the specified i
technical and quality requirements are obtained and maintained for purchased structures, systems, materials, parts, and components. This is accomplished by structured receiving and acceptance activities, positive identification ofitems, proper handling and storage of items, and issuance in a controlled manner.
Other Functions Functions other than design, operations, and maintenance have a more limited effect on design bases or configuration. These activities are also governed by procedures. Examples include:
Chemistry Training Security
. Radwaste Emergency Planning e
Ilealth Physics Information Systems Procedures invoke design control processes or provide appropriate controls where these processes permit activities that could affect design or licensing bases, or plant configuration.
Procedures for these functions are controlled by the DAEC procedure control process. These other functions me also subject to internal and external audits and inspections. The DAEC response to the subject 10 CFR 50.54(f) request focuses on the more direct processes of design and configuration control, and operations, maintenance, and testing procedures.
Fuels Control ACP 103.1 defines responsibilities and activities associated with nuclear fuel and reactor core components in any given reactor core operating cycle from procurement, through design, i
analysis, manufacturing, shipping, delivery, auditing, inspection, loading /off-loading, testing, and storage. This process begins with the development ofdesign inputs for planned cycle duration and capacity factor, inputs for reanalysis of transients, and inputs for reanalysis of Design Basis Accidents, if needed, and ends with the development of the cycle's Core Operating Limits Report (COLR) and plant startup surveillance testing.
16
Duane ArnoldEnergy Center Response to NRC 10 CFR 50.54(f) Letter Most aspects of fuel design and analysis are performed under the General Electric Company's (GE) QA Program. The DAEC prepares the plant-specific design inputs and reviews design outputs. Changes to setpoints or analytic values used in reload transient analyses and accident analyses are procedurally linked by the DAEC Setpoint Control Program. During reviews of GE's Supplemental Reload Licensing Report (i.e. the design output), procedures require preparation of a safety evaluation in accordance with 10 CFR 50.59, as part of the development of the COLR. The DAEC also provides oversight of fuel procurement, fabrication, and delivery.
i 10 CFR 50.59: Safety Evaluation Annlicability Reviews and Safety Evaluations (See Figure 3 for an overview of the process.) ~
~
In accordance with 10 CFR 50.59, proposed changes may be made without prior NRC approval if no unreviewed safety questions exist and a change to the Technical Specifications is not necessary. At the DAEC, the Safety Evalt'ation Applicability Review (SEAR)(ACP 103.2) and the Safety Evaluation (SE) (ACP 103.3) processes fulfill this requirement by a two step process. This process is based on NSAC-125 " Guidelines for 10 CFR 50.59 Safety Evaluations." Formal training and qualification requirements have been implemented for personnel verifying SEARS and for personnel preparing and verifying SEs.
SEAR Process The SEAR is a systematic review of proposed changes to determine if the proposed change constitutes a change to the plant facility and procedures as described in the UFSAR, or a test or experiment not described in the UFSAR. The SEAR determines if the chang or activity requires a formal Safety Evaluation. The administrative control procedure for tir SEAR process provides guidelines to aid in understanding the scope and intent of each screening question of the SEAR. These guidelines include consideration of the potential to impact the ability to perform intended function, to operate outside established limits, to invalidate qualification, and to increase the probability of an event occurring, any of which could adversely affect the design bases.
SEARS are required for a number of processes, including procedure changes, temporary modifications, permanent modifications, design document changes, and EMAs. The SEAR process evaluates the proposed change to identify ifit affects the facility or procedures as described in the UFSAR, whether it impacts a SSC's intended function, whether it increases the possibility of a transient, whether it could create a potential to operate outside required limits, and whether it could compromise equipment qualification or compliance with regulatory requirements, such as physical or electrical separation, environmental qualification, fire protection, etc.
If any of the screening criteria is considered to not be met, then a complete SE is required to determine that no unreviewed safety question or change to the Technical Specifications is required prior to implementing the proposed change.
17
Duane Arnold Energ Center Response to NRC 10 CFR 50.54(f) Letter Safety Evaluations The SE is an evaluation of design changes, procedure changes, special tests, experiments, and other technical issues in order to determine that an unreviewed safety question or change to the Technical Specifications (excluding Technical Specification Bases) or Operating License is not involved. ACP 103.3 for performing a full SE was developed from industry guidelines contained in NSAC-125. The SE is composed of two parts - the Safety Evaluation Basis and the 10 CT R 50.59(b) Questions.
The Safety Evaluation Basis is prepared utilizing the plant Nuclear Safety Operational Analysis (DBD-A61-038), applicable DBDs, and the UFSAR to tie the proposed change (or activity) to the design and licensing bases. Then the reason, purpose, scope, effect, design requirements, etc. for the proposed change are evaluated against those bases. The Safety Evaluation Basis is to be completed in sufficient detail to provide the justification for the answers to the 10 CFR 50.59(b) questions such that a qualified independent reviewer could reach the same conclusions. This application of the Safety Evaluation Basis to answer the 10 CFR 50.59(b) questions is the determination of whether or not an unreviewed safety question is involved. DAEC utilizes a seven question format consistent with NSAC-125 in the conduct of SEs.
Procedures provide for management and independent review committee review and approval of SEs. Char es that involve an unreviewed safety question shall have NRC review and approval prior to operation. Changes that require a change to the Technical Specifications (excluding the Bases) are submitted to the NRC for approval prior to implementing the change.
Additional review is required for those modifications that provide the capability for disarming a safety system, (e.g. overrides of safety functions necessary to implement the Emergency Operating Procedures). Whether or not an unreviewed safety question is involved, the SE for any modification that provides the capability for disarming a safety system will be reviewed by the Safety Committee prior to implementation. This provides a systematic approach to ensure that the proposed modification is consistent with the primary mission of safe plant operation.
With the diverse backgrounds within the independent review committees, there is high confidence that each SE is accurate, thorough, and supports the conclusions.
I8
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter Overview of the Safety Evaluation Process (ref. 10CI R50 59)
Pruseos sepmes s Safety Evoluseum
.- ;p
.n.
y
~ - - -
[kmanned the *5 sissy bestuessus Basss' 4
Use she %fety Evaluesme Dams'se answer ins "lu(TR SO $9 0uestens*
Desumeal the conshmam of thw &afety livsamstaan
. Umeewwed Safeev Quasimmt
. Changes to als Teshnmal Speesfaauens?
.Thages so lhe UF& ART (hnge is the UF$AA1 Yes huham UFSAR CHANGE R60UEST l Vasifmatum of the Esfety kvalueune h
\\
Untevmwed Saracy Quesuan' Leseassig to enems T54)L shange
-w.
nupsosi sulwasised so the NRC mul
_y,,,,
Change to shs Tach Epuss (enshahas T5 eppropewis appecesis absesand pnar to Base only shangasp?
senp' the adressy No t
16ssuseerms rewww and appn=si h
i Laemeng review and approval i
.-.tm Cm_l i
t Modsissatum ilut pnwalm the @ lay
--Yes
$afety Caenmuuss rewww la diesemg a safety eyessm?
g t
l impnsment the aruvay a esmalee muse m - =.th e ap-mm 1
l Ficure 3 l
l l
19
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter 10 CFR 50.71c: UFSAR Undatine Process (See Figure 4 for an overview of the process.)
ACP 102.10 " Preparation, Review, and Processing of UFSAR Cl'ange Requests and UFSAR Revisions" delineates the requirements, responsibilities, and activities for the preparation, review, and processing of changes to the UFSAR. Conditions that require changes to the UFSAR are identified through SEARS and SEs, design control activities, licensing activities / regulatory changes or as a result of Action Requests per the DAEC Corrective Action Program discussed in response (d). The requirements for content and schedule of periodic UFSAR updates are in accordance with 10 CFR. 50.71(e).
Proposed UFSAR changes are reviewed to determine if they are other than editorial in nature.
i If so, an SEAR is performed. An SE will be prepared if the SEAR indicates it is required. If
)
an unreviewed safety question is determined to exist, modifications or procedure changes and j
their attendant UFSAR updates will not be performed without NRC review and approval, in accordance with 10 CFR 50.59.
1 Changes to the Ouality Assurance Procram Descrintion (OAPD)(UFSAR 17.2h Changes to the QAPD are performed in accordance with the provisions of 10 CFR 50.54(a)(3) and coordinated with the UFSAR change process described above. Quality Assurance Department Procedure 1106.9 provides direction for the evaluation of changes with respect to potential reductions in commitment. DAEC QAPD changes are submitted to NRC for review and approval prior to implementation. The most recent change was approved in November 1996.
Commitment Tracking System The DAEC developed and is maintaining an electronic Commitment Tracking System (CTS).
Examples of documentation entered into the CTS include docketed correspondence, commitments, the UFSAR, and Generic Letters. Full electronic text is retrievable through this system using electronic search and retrieval. This tool has been useful in extracting information about licensing bases.
20
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter 1
Overview of the UFSAR Updatine Process (ref: 10CFR50.7)(e))
juillatjen.of UI'SAR CllANGE RI: OUI ST if changes are other than editorial, then a Safety i: valuation Applicability Review or a Safety Evaluation is required Ie independest revww by originating department (not required if initiated by Licensing) r Is Ui:SAR CllANGE RI: QUI:ST related t '
Yes Modification is released a in afication?
for operation No V
l Verify the completed modificatior independent review by 1.icensingle is consistent with the UI'S AR CilANGE Rl!QUl<;ST v
l'inal approval by Licensing v
Create re' ased UI'SAR pages v
Include with periodic UI'SAR update submitted to the NRC Finure 4 21
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter 10 CFR 50. Appendir B: Nuclear Ouality Assurance Program The following excerpt from the Nuclear Quality Assurance Policy memonmdum from the President and Chief Operating Omcer ofIES Utilities Inc. demonstrates the commitment of j
our top management to maintaining design control of the 1)AEC. This statement was issued in May,1995, and was reiterated in January,1997.
"lES Utilities Inc. recognizes the fundamental importance of controlling the design, modification, and operation of the Duane Amold Energy Center (DAEC) by implementing the attached Quality Assur'ance Program that complies with 10 CFR 50 Appendix B and other applicable quality assurance regulations, codes, standarda and commitments to which the DAEC is subject.... Effective implementation of this program by all personnel will achieve the company goal of safe, reliable, and efficient operation of the DAEC, compliance with regulatory requirements, and quality service to -
our customers."
Nuclear Ouality Assurance Program The DAEC Operational Quality Assurance Program (QAP) implements the requirements of 10 CFR 50, Appendix B. The QAP applies to safety-related structures, systems, components and related activities, and other structures, systems, components and related activities for which specific quality assurance requirements have been established in UFSAR Table 3.2-1.
This table ties directly to a formal Design Bases Document, DBD-A61-004 " Classification of Systems, Structures, and Components." The QAP includes those planned and systematic actions necessary to provide adequate confidence that a structure, system or component will perform satisfactorily on demand consistent with its design bases. The bases for the DAEC Quality Assurance Program are Appendix B to 10 CFR 50, pertinent industry Codes and Standards, NRC Regulatory Guides (RG), and the DAEC Facility Operating License, as discussed below.
The DAEC Quality Assurance Program is principally based upon RG 1.33, Revision 2, and ANS-3.2/ ANSI N18.71976 " Administrative Controls and Quality Assurance for the Operational Phase of Nuclear Power Plants." Other significant Quality Assurance Program commitments related to the design and configuration control of the DAEC include: RG 1.64, Revision 2, which endorses ANSI N45.2.11-1974 " Quality Assurance Requirements for the Design of Nuclear Power Plants;" and, RG 1.123, Revision 1, which endorses ANSI N45.2.13-1976 " Quality Assurance Requirements for Control of Procurement ofitems and Services for Nuclear Power Plants." A listing of regulatory guides and standards upon which the DAEC QAP is based is provided in UFSAR Section 17.2, Appendix A. This Appendix also contains the specific clarifications and excepuons to these standards which we have taken. These clarifications and exceptions have all received previous NRC review and i
(
approval.
l 22
l Duane ArnoldEnergy Center Response to NRC 10 CFR 50.54(f) Letter l
1 Ouality Assurance Manual and Imnlementing Procedures l4 l
The provisions of UFSAR Section 17.2 and Appendix A thereto, are then implemented through the DAEC QAM and implementing procedures (ACPs).
Structures, Systems, and Components for which formal 10 CFR 50, Appendix 13 Criterion 111 (Design Control) is established within the DAEC Quality Assurance Program, are subject to the DAEC Design Control Program, which includes configuration control.
Conclusion to resnonse (a)
The DAEC design and configuration control processes. Processes implement the requirements of 10 CFR 50.59,10 CFR 50.71(e), and Appendix B to 10 CFR 50.
h l
)
o 23 e
. -. -. -.. -. - - =
n Duane Arnold Energ Center Response to NRC 10 CFR 50.54(f) Letter i
i NRC REOUEST FOR INFORMATION (b) Rationale for concluding that design bases requirements are translated into t
operating, maintenance, and testing procedures.
)
DUANE ARNOLD ENERGY CENTER (DAEC) RESPONSE i
Introduction to Response (b)
DAEC Technical Specifications Section 6.8 contains a list of procedures involving nuclear safety that must be prepared and maintained. The Technical Specifications requires that these procedures and changes to these procedures shall be reviewed by i
Operations Committee and approved by the Plant Manager.
This response discusses the procedure control processes implemented at the DAEC.
Links to the design and configuration control processes described in response (a) will be identified.
l Operations, maintenance, and testing activities at the DAEC are performed in accordance with written procedures. Written procedures are developed and maintained according to administrative control procedures (ACP 106.2, " Procedure Preparation, Review, and Approval" and ACP 106.3," Procedure Revision Process")
that provide requirements for review of design and licensing bases. Activities that can change plant configuration or design are controlled or require use of the design control processes described in response (a) to implement the change, including procedure changes required by the change.
New procedures and proposed changes to procedures are required to be reviewed by the SEAR /SE process described in response (a). If required, this review will also generate changes to the UFSAR, Technical Specifications and submittals for the appropriate NRC reviews and approvals.
The DAEC Surveillance Testing Program measures the performance of structures, systems, and components to verify they are within acceptance criteria assumed by plant safety analyses. This ensures that the structure, system or component is operable and capable of performing its design and licensing bases functions.
Post-maintenance testing and Modification Acceptance Testing are performed to ensure structures, systems, and components are operable and performing to the design bases requirements prior to return to service.
Procedure control, procedural compliance, and procedure effectiveness are monitored and measured. The surveillance procedures have been, and continue to be scrutinized for adequacy of testing.
24
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter Based on the procedure control processes and the activities subject to procedural control, the rationale for concluding that design and licensing bases are properly translated into operations, maintenance, and testing procedures will be provided.
-)
Overview of Prnmiure Processes l
The procedure control process is implemented in accordance with ACP 106.2
" Procedure Preparation, Review, and Approval," and ACP 106.3 " Procedure Revision Process." These procedures provide guidelines for the preparation, revision, review, I
and approval of procedures. The ACP 106.2 procedure requires reviews of design documentation (including DBDs), outstanding procedure work requests, temporary procedure changes, regulatory commitments, corrective action items (Action Requests), Licensee Event Reports, Lessons-Learned Transmittals, Operating and Industry Experience Reports, and Self-Assessments / Audits.
4 Procedure Owners are assigned to be responsible for the technical accuracy and content of the procedure, and is expected to review design and licensing bases, other i
procedures, the QAPD (UFSAR 17.2 described in response (a)), regulatory requirements and industry codes and standards for input into the procedure.
Procedure Owners are generally selected from personnel considered to be experienced or subject matter experts on the procedure topic. Procedure Owners are required to ensure that requirements contained in upper tier licensing documents (e.g. UFSAR and Technical Specifications) are addressed and incorporated into proedures. The process requires screening for 10 CFR 50.59 applicability using the processes described in response (a) above. Technical reviews of procedures, including cross-disciplinary reviews if needed, are performed by the Owner and others. Procedure validation and verification should be performed for all procedures required for Technical Specifications. Validation and verification of other procedures is at the -
discretion of the Owner. Approval by Owners and appropriate managers are specified. Provisions are made for periodic reviews of procedures. Training on procedure use and compliance is conducted. Procedure users are required to comply j
with procedures or to stop work and initiate the controlled procedure revision processes if difficulties are encountered during performance of the procedure (ACP 101.01).
As part of the Tecimical Specifications change process (ACP 102.11), affected procedures are identified during the development of the change package. Upon NRC i
approval and issuance of the license amendment, this list of affected procedures is re-reviewed as part of the implementation process. This review ensures that any procedure changes that have been made since the original review are accounted for, j
whether additional procedure changes are needed or previously identified changes are no longer necessary. Based upon this review, an " effective date" for the procedure revisions is determined to predude noncompliance with the Technical Specifications, 25
Duane Arnold Energ Center Response to NRC 10 CFR 50.54(f) Letter either the then-existing or the revised requirements, such that the revised procedures are not issued too early or too late.
ACP 106.3 limits the use of temporary revisions to correct " procedural deficiencies or errors that will, without immediate resolution, stop work being performed in the field and/or adversely affect personnel or plant safety and/or plant availability." Temporary revisions are also allowed in unusual temporary situations not covered by normal configuration or procedures and to permit partial closures of modification activities.
Controls of temporary revisions are designed to ensure that the intent of the procedure is maintained and that worker qualifications are not impacted. A SEAR is required for each temporary revision to ensure that technical and regulatory requirements are met. The NRC-licensed Operations Shift Supervisor must approve temporary revisions before work may proceed.
Operations and Maintenance Procedures provide pre-approved actions and methods that can be followed with confidence that those actions will not compromise compliance with design and licensing bases. Operations and Maintenance Procedures are developed and revised in accordance with ACP 106.2 and ACP 106.3 discussed previously, which directs the preparer to incorporate design documemation. Training and procedural compliance provide reasonable assurance that operations and maintenance personnel will not perform unreviewed or unauthorized modifications to the plant or operate the plant outside ofits design bases and analysis. Procedural compliance is required (ACP 101.01, " Procedure Use and Adherence").
ACP 1406.7, " Emergency Operating Procedure Maintenance Program," establishes the responsibilities, requirements, and guidelines for maintaining the Emergency Operating Procedure (EOP) Program. The EOPs implement the accident mitigation strategies outlined in the DAEC Plant Specific Technical Guideline (PSTG), which is derived from the BWR Owners Group Emergency Procedure Guidelines, other applicable guidelines, NUREGs, industry standards, UFSAR, Technical Specifications, and other plant specific design and licensing documents. EOPs derived from the PSTG are presented in flowcharts which provide instructions to restore and/or maintain key plant parameters within prescribed safe limits. The EOP Maintenance Program includes verification and validation activities. Additionally, revisions to the EOP flowcharts and support procedures are governed by the review and approval processes specified in ACP 106.3.
OA Assessment The DAEC QA assessment process includes assessment of the adequacy of programs and procedures for selected functional areas (including Operations, Maintenance, and Engineering) on a quarterly basis. In the Maintenance functional area, the four quarterly assessments for 1996 indicate that the adequacy and usage of procedures was good. For the Operations area, procedure adequacy and usage was generally assessed as good, although issues regarding Reactor Engineering procedures and 26
Duaneifrnold Energy Center Respome to NRC 10 CFR 50.54(f) Letter temporary procedure changes were documented via the corrective actions system (corrective actions regarding the Reactor Engineering procedures are ongoing).
Engineering assessments during 1996 concluded that the adequacy and usage of engineering procedures was generally satisfactory.
Testine Procedures J
Mainienance and modification activities are required to establish acceptance criteria which are ccnfirmed via testing, prior to declaring the affected SSC operational. The overall governing procedure for testing activities is ACP 111.0 " Inspection, Test Control, and Testing." This procedure applies to the control of special processes, inspection of maintenance and modifications, test control, and operating status and control of measuring and test equipment. In the case of post-maintenance testing, these criteria, as documented in testing instructions and/or procedures verify compliance with design drawings / specifications / calculations, etc. During preparation of Modification Acceptance Test Procedures for modifications, procedures require that the tests be based on the Engineering Acceptance Requirements in the Engineering Change Package. These requirements are developed under the Design Control Program described in response (a) and ensure that the tests verify perfonnance required for the SSC by the design and licensing bases.
In addition, surveillance tests and special tests and experiments (as permitted by 10 CFR 50.59) are also subject to controls under ACP 107.0 " Surveillance Tests, Special Tests and Experiments." The Surveillance Testing Program assures that safety-related structures, systems, and components are capable of performing their safety functions, and that critical operating parameters are within specified limits. The DAEC Surveillance Testing Program applies to tests required by Technical Specifications, the ASME Inservice Inspection and Test requirements for mechanical components, and other testing in accordance with commitments or where these controls are deemed to be appropriate.
Changes to surveillance test procedures that could affect the test measurement uncertainties, accuracy, or acceptance criteria require review by the DAEC Setpoint Control Program to maintain compliance to design bases and configuration control of values used in the tests, plant safety analyses, and the setpoint calculations. This procedural link between procedures, analyses, and the setpoint calculations was identified as a strength during the NRC Systems Based Instrumentation and Controls inspection discussed further in response (c).
Special Tests are non-routine operations that are not described in the UFSAR, that are not generally required by Technical Specifications or the ASME Section XI Manual (In-service Testing), and that are performed to determine performance characteristics of a structure, system, or component. Experiments are considered to be Special Tests for the purposes of ACP 107.0. Special Tests require a Safety Evaluation for the scope of the Special Test. Special Tests also require an Operations Committee 27
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter review. One unique requirement for Special Tests is that the Special Test Procedure (SpTP) must have an expiration date that limits the time period when the Special Test may be performed. This is done to ensure that plant conditions have not changed since the Safety Evaluation for the Special Test was prepared, which could invalidate the previous conclusion that no unreviewed safety question existed.
Modification acceptance testing ensures that the engineering requirements are met and that the modified (or newly installed) safety-related structures, systems or components will perform as intended without adversely affecting existing SSC.
Modification acceptance testing procedures are reviewed by Engineering based on the design and licensing bases inputs. These procedures are also reviewed by Operations and the Operations Committee prior to performance. Modification acceptance testing procedures generally do not have a SEAR or SE independent of the modification package. The modification acceptance test results are reviewed and accepted prior to declaring the modification operational.
A Surveillance Test Evaluation and Enhancement Project (STEEP) was completed in the late 1980's in response to an NRC Inspection (IR 87-04). This two year effort performed exhaustive reviews of the adequacy of Technical Specification surveillance tests. This effort involved detailed reviews of surveillance procedures and system designs to ensure surveillance testing was adequate and provided complete testing of control logic, wiring, and relay contacts. During this effort procedures and processes were developed to ensure surveillance procedures would be maintained adequate during procedure changes and modificati.a activities. The DAEC STEEP effort provided a baseline that surveillance testing requirements properly implemented the Technical Specifications requirements. A similar review in response to NRC Generic Letter 96-01 is currently in progress. This current project is reviewing changes and modifications performed since STEEP to ensure that the completeness of these surveillance tests has not been compromised. This effort will be supplemented by reviews, verification, and validation of new surveillance procedures to be issued as part of the DAEC conversion to the Improved Technical Specification format (NUREG-1433). The DAEC conversion to the improved Technical Specification format has been docketed and is awaiting NRC approval.
Snecial Programs The DAEC has instituted a variety of special programs that focus on ensuring that compliance with design and licensing bases, and industry standards and regulatory requirements is maintained. Examples include Environmental Qualification, Instrument Setpoint Control, RG 1.97, and Maintenance Rule. Owners and control procedures are in place for these programs. The Program Owner serves as a reviewer or consultant during design and configuration control activities affecting their programs to ensure that the modifications and changes are consistent with the design bases. Provisions are available for referencing regulatory commitments within procedures,in particular those commitments made to correct identified deficiencies.
28
)
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter l
to ensure those commitments are appropriately maintained through the procedure revision process.
\\
i Other Assessments of Procedure Adequacy Inspections and audits described in response (c) employed a " vertical slice" 1
methodology looking at all aspects of plant processes for plant structures, systems, and components. These activities included evaluations related to the adequacy of procedures to reflect and maintain the plant's design and licensing bases. Refer to response (c) for further discussion of specific audits and inspections.
1 Conclusion to Response (h)
As described in this response, the DAEC procedure control process establishes standards that translate design bases requirements into operations, maintenance, and testing procedures. As described in response (a), design and configuration control j
processes ensure that design bases are implemented in the plant. Procedures limit i
operations and maintenance activities that could result in uncontrolled or unreviewed configuration or design changes. Procedure changes incorporate reviews required by 10 CFR 50.59, and UFSAR updates required by 10 CFR 50.71(e). The DAEC Quality Assurance Program applies to procedure control and use.
j Testing procedures establish that acceptance criteria consistent with design and licensing bases are met. Tests are performed periodically as surveillances and preventive maintenance testing to ensure structures, systems, and components are operable and within limits assumed in plant safety analyses. Tests are also performed for the same purpose following modifications and maintenance.
DAEC monitors and measures procedural control, compliance, and effectiveness through both internal and external audits, surveillances, and inspections. Systematic reviews of testing adequacy have been performed as a result ofindustry experience and regulatory action. The results have indicated that the DAEC program is acceptable.
The results of the reviews of the procedures and methods described above provide reasonable assurance that design and licensing bases are effectively translated into operations, maintenance, and testing procedures.
29
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter NRC REOUEST FOR INFORM ATION (c) Rationale for concluding that system, structure, and component configuration and performance are consistent with the design bases.
I DUANE ARNOLD ENERGY CENTER (DAEC) RESPONSE Introduction to Response (c)
As described in response (a), the DAEC has implemented design and configuration controls to ensure that the configuration of the plant Structures, Systems and Components (SSC) is consistent with the design bases. As described in response (b), the DAEC has also implemented controlled processes to ensure that the design bases are translated into operations, maintenance and testing procedures. As described in responses (a) and (b), the DAEC processes for changes to the plant and to procedures provide for reviews for applicability and evaluations under 10 CFR 50.59 and updates to the Updated Final Safety Analysis Report (UFSAR) per 10 CFR 50.71(e). This response describes the programmatic, audit and inspection activities which lead us to conclude that the processes described above have been effective and that structure, system and component configuration and performance are consistent with the design bases.
This response is organized to show how DAEC has a top-down approach to monitoring and evaluating the effectiveness of processes. Some of these activities such as audits and surveillances are procedurally driven. Other aspects are cultural - such as encouraging problem identification and maintaining a questioning attitude. A commitment to quality depends both on process and culture, for success. The processes will be described in this response, and examples showing how the culture supports the processes will be discussed.
This response begins with a discussion of management oversight of activities at the DAEC.
The Quality Assurance Program (QAP) activities that monitor configuration and design are discussed. Next, the processes and activities that review the plant configuration and design are discussed. Special topics and programs that have been implemented to focus engineering attention on specific aspects of the plant design and licensing bases are described. Finally, the involvement and performance of DAEC personnel is described to support our conclusion that the commitment to maintaining the plant's compliance with the design and licensing bases is evident throughout the organization.
Mannecment Oversicht Managers and supervisors are involved in daily oversight of the plant processes for design controls, configuration controls, procedure controls and corrective action. This involvement is performed through specific organizational activities involving committees or panels, and through two-way communication which feeds equipment and program performance information and trends to management and management returns work priorities and direction back to the staff.
30
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter i
Committees and Panels Operations Committee in accordance with Technical Specifications, the Operations Committee is an advisory body to the Plant Manager on all matters related to nuclear safety. The committee recommends approval or disapproval of plant activities reviewed. The committee determines whether an issue or activity constitutes an unreviewed safety question as defined in 10 CFR 50.59. The Operations Committee provides timely and continuing review of plant operations to assist the Plant Manager in keeping abreast of general plant operating conditions. The Operttions Committee serves to screen subjects of potential concern to the Safety Committee or to perform preliminary investigations, but it does not relieve the Plant Manager of the responsibility for overall safety of plant operations or for timely referral of appropriate i
matters to the Safety Committee.
The membership of the Operations Committee includes members from Operations, Maintenance, Reactor Engineering, Radiation Protection, Quality Assurance, Licensing, Outage / Procedures and Plant Engineering.
Responsibilities of the Committee include:
Assure that all reviews and changes to the facility or to facility procedures are performed in accordance with the UFSAR and 10 CFR 50.59.
Review of procedures as specified by Technical Specification Section 6.8 and changes to these procedures. Review of any other proposed procedure or changes as determined by the Plant Manager or the Operations Committee.
Review of all proposed tests and experiments that affect nuclear safety.
Review of all proposed changes to Technical Specifications.
Review of all proposed changes or modifications to plant systems or equipment that affect nuclear safety.
Investigation of all violations of the Technical Specifications including the preparation and forwarding of reports covering evaluation and recommendations to prevent recurrence to the Vice-President, Nuclear and to the Safety Committee Chairman.
Review of Action Requests (ARs) when required per Administrative Control Procedure (ACP) 114.5," Action Request System." These include all ARs (and attached evaluations) which require a Root Cause Review (RCR).
Review of Licensee Event Reports (LERs).
Review of facility operations to detect potential safety hazards and adverse trends.
Performance of special reviews, investigations or analysis.
Review of the Security Plan and implementing procedures, changes to the plan and l
implementing procedures..
Review of the Emergency Plan and implementing procedures, changes to the plan and l
implementing procedures.
31
Duane Arnold Energy Center Response to NRC 10 CFR S154(f) Letter Review of every unplanned release of radioactivity to the environs for which a report to the NRC is required.
Review of changes to the Offsite Dose Assessment Manual (ODAM) and changes to the Process Control Program.
Review of the Fire Protection Program.
Safety Committee l
The Safety Committee is a review and audit body that advises the President ofIES Utilities.
Its charter is to review plant decisions and activities to ascertain that the plant has been, is being, and will continue to be operated safely. The Safety Committee is required to l
recommend to the President that the plant be shutdown if the Committee concludes that a condition exists which warrants such action. The Safety Committee reviews the work of the Operations Committee and evaluates the performance of the DAEC Quality Assurance Program.
Per the DAEC Technical Specifications, the Safety Committee functions to provide j
independent review and audit of designated activities in the areas of:
Nuclear Plant Operations, Nuclear Engineering, Chemistry and Radiochemistry, e
Metallurgy, e
Instrumentation and Control, e
Radiological Safety.
e Mechanical and, Electrical Engineering, Administration, Quality Assurance practices and Nondestructive Testing.
The membership of the Safety Committee may include personnel from outside the Nuclear Division, and is based on providing expertise and experience in the above areas.
The Safety Committee is responsible for the review of various items, including:
The Safety Evaluations for changes to procedures, and tests or experiments completed under the provision of 10 CFR 50.59, to verify that such actions did not constitute an unreviewed safety question Proposed changes to procedures, equipment or systems which involve an unreviewed safety question as defined in 10 CFR 50.59 Proposed tests or experiments which involve an unreviewed safety question as defined in
+
Section 10 CFR 50.59 Proposed changes in Technical Specifications or Operating License 32
l l
i Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter l
Violations of applicable statutes, codes, regulations, orders, Technical Specifications, e
license requirements, or ofinternal procedures or instructions having nuclear safety significance Significant operating abnormalities or deviations from normal and expected performance e
of plant equipment that affect nuclear safety All Repo table Events e
All recognized indications of an unanticipated deficiency in some aspect of design or operation of safety-related structures, systems, or components Action Request Screening Panel This panel is composed of selected supervisory personnel responsible for reviewing ARs meeting intermediate gate criteria (i.e. specified thresholds for problem severity and/or level of resources needed for corrective action). The panel is responsible for identifying problems, evaluating issues, selecting resolution methodology, allocating resources, establishing expectations for resolution, identification of milestones or completion targets, and other performance measurements that the panel will monitor during issue resolution. Issues addressed can include items relating to design basis and configuration control. For additional details see the discussion of the AR process in response (d).
Action Request Evaluation Panel Senior decision-makers are assigned to this panel to deal with ARs for more significant issues. This panel performs similar functions to the Screening Panel for issues that warrant a higher degree of management involvement and attention. These issues can include items relating to design basis and configuration control. For additional details see the discussion of the AR process in response (d).
Briefings and Meetings Managers and supervisors attend " Plan-of-the-Day" briefings on plant operational status and major support activities. Based on reports from the Operations Shift Manager and representatives from various departments, the Plant Manager establishes the list of priority activities for the day. In addition to plant equipment performance issues, the priority list also addresses any design basis or configuration issues that may have been reported via ARs.
Managers and supervisors also attend inspection and audit entrance and exit meetings as a means of directly identifying personnel responsible for supporting these assessment activities and for resolution ofissues that arise from them. These issues can include specific items relating to design basis and configuration control or to broader programmatic concems that have been identified in these areas.
1 33
Duane Arnold Energy Center Response to NRC 10 CFR 50.51(f) Letter Trending Reoorts Managers and supervisors receive reports and trending information to support their decisions, to help monitor progress towards goals, and to identify systematic or repetitive problem areas that require additional attention and involvement. The following discussions are only a sample of the types of reports provided:
A monthly Nuclear Management information System is prepared that compares DAEC performance to INPO performance indicators and current industry performance, j
The Quality Assurance (QA) Trend Report provides a rolling quarterly review of data and e
is issued monthly. It includes statistics and trending charts for human and equipment i
performance at the DAEC that helps management focus their involvement. Areas covered in this report include iluman Performance Circumstances (e.g. personnel errors, procedural non-compliances); Design, Manufacturing, or Installation Errors (e.g.
labeling errors, incorrect installation of equipment, failure to update drawings or procedures after installing new equipment); Information Resources Discrepancies (e.g.
UFSAR discrepancies, drawing discrepancies); Management or QA Program Deficiencies (e.g. lack of coordination of work processes, lack of management attention or oversight);
Equipment ARs (e.g. equipment found out of calibration tolerance, significant equipment failures); Total Discrepancies - a measure of the volume and significance ofinitiated ARs for the period; and Regulatory Compliance (e.g. NRC violations, Licensee Event Reports). Additional topics or measurements may be added when other areas are identified that require additional attention.
Failures of components in a number of category types (e.g. Instrument transmitters, pumps, or circuit breakers) reported to the Nuclear Plant Reliability Database System (NPRDS) are periodically reviewed against data reported by the rest of the industry. This evaluation permits engineering and management to identify component categories at the DAEC which have higher than expected failure rates. Specific evaluations and recommendations are prepared based on engineering reviews of the DAEC failures.
Component Failure Trending Reports are prepared for mechanical, electrical and instrumentation components. The reviews initiate Component Failure Evaluations when multiple failures of a particular model of equipment or repetitive failures for a specific component or equipment are identified. The evaluations identify potential common mode failures or common causes. Information in these reports enable managers and supervisors to identify high maintenance components and degrading equipment and maintenance trends. Focus can then be applied where the improvements in performance and reliability will have the greatest benefits.
A quarterly Thermographic Survey Report describes the surveys conducted and maintenance recommendations implemented as a result of the DAEC Thermography 34
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Leuer Program. This method of non-intrusive equipment monitoring can reveal " hot spots" indicative of equipment degradation prior to failure.
A cyclic Motor Operated Valve (MOV) Trending and Performance Report describes the results of maintenance history and trending information on MOVs and describes program activities performed during the last operating cycle. Preventive maintenance activities designed to improve long-term performance and reliability of MOVs during the next cycle are also described. The report provides feedback on MOV configuration and performance against design bases consistent with Generic Letter 89-10.
Special Reports may be requested by management in special circumstances, or program owners or other personnel may initiate special reports to management. These reports typically deal with emergent issues or documentation of the results found during the nc: mal work processes. Two examples:
A " Material Condition Study of Emergency Service Water Small Bore Piping" was performed to develop recommendations on the remaining operable life expected for the subject piping based on ultrasonic measurements of piping wall thickness.
A " Post-Outage Risk Review and Comparison" memorandum was prepared to discuss lessons that were learned during the 1996 refueling outage. That outage employed a computerized risk assessment tool to evaluate the outage schedule for its impacts on risk associated with safety-functions required for the outage, and in particular, for the risk associated with adequate decay heat removal.
A monthly Maintenance Rule Monitoring and Status Report summarizes information about systems approaching or exceeding their raaximum Maintenance Preventable Functional Failure criteria established in accordance with 10 CFR 50.65. Failures are described and trends are reviewed. Plans for correcting or improving long-term performance of the system are also detailed. A Maintenance Rule " Status Board"is accessible through the DAEC computer network to provide a simple color coded status indication showing those systems or Maintenance Rule performance criteria that are of concern. These tools pennit management to quickly identify systems requiring additional attention.
Confieuration Reviews Internal Audits The DAEC Quality Assurance organization implements a comprehensive assessment program to meet the requirements for internal audits as defmed by the UFSAR, Section 17.2.18. These assessments include the performance of activities required by the Quality Assurance Program to meet the criteria of 10 CFR 50, Appendix B. The effectiveness of the 35
1 Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter QA Assessments program has been independently evaluated through the Joint Utilities Management Assessment (JUMA) process and by independent audits sponsored by the Safety Committee. The most recent JUMA assessment (October 1995) concluded that the DAEC QA Department has developed and is effectively implementing a comprehensive assessment process that assures concerns are effectively identified, reported, corrected, verified to be correct and closed. The most recent Safety Committee audit (December 1996) assessed design control processes and concluded that the QA Engineering Assessments were very comprehensive and effective. These independent reviews of the QA Assessment process support the conclusion that QA is providing effective and comprehensive oversight of activities at the DAEC.
i External Audits and Inspections While the primary responsibility for measuring the effectiveness of the DAEC design and configuration controls rests with IES, the NRC and other organizations also provide an independent insight into our processes through their inspections and audits.
Inspections and audits that examine a safety system by examining a " vertical slice" from design bases, through design, installation, configuration, test and maintenance are sometimes termed Safety System Functional Inspections or Audits (SSFIs or SSFAs). Examples of some of these inspections conducted at the DAEC follow.
Emergency Service Water (ESW) SSFL in early 1990, the NRC conducted a Safety Systems Functional Inspection of the operational readiness and functionality of the ESW System. (IR 90-03) The NRC team reviewed calculations and supporting documents, conducted system walkdowns and reviewed DAEC activities associated with the ESW system. The team determined that the ESW system was operable and, in general, the design control program was adequate.
The NRC team identified strengths, concerns and violations. Strengths included the experience level and technical competence of the DAEC engineering staff, management involvement regarding the Power Systems Analysis Program, the aggressive corrective actions take in 1984 in response to IEB 79-14 and the Instrument Trending Program.
Concerns were identified regarding the A umentation of quantification of ESW flows, design basis documentation, procedural i utrol of Control Building Chiller operation and root cause analysis.
The DAEC submitted responses to the notices of violations that identified specific corrective actions and initiated improvement activities. Corrective actions addressed the specific examples cited in the inspection, and also involved broader actions, including walkdowns of thermal overloads and motor-control centers to verify and document proper settings, and enhancement of procedures to ensure proper control ofinstrumentation used for Inservice Testing (IST), an evaluation of deviations in IST reference values, and control of measuring 36
l l
Duane ifrnold Energy Center Response to NRC 10 CFR 50.54(f) Letter and test equipment. In addition, the comprehensive Power Systems Analysis Program that was then in-progress was expected to address certain of the documentation issues.
Electrical Distribution System Functionalinspection (EDSF1)
An NRC team conducted a special EDSFI in early 1991 (IR 91-02). The team assessed the design, implementation and engineering technical support through a selective review of records, installed equipment and interviews. The team reported that the design and operation of the electrical distribution system were generally acceptable. Several strengths and concerns were identified, including two violations concerning control of fuses and implementation of surveillance testing.
R i
The DAEC's actions to correct the specific violations and concerns identified in the EDSFI were reviewed by the NRC in 1992 (IR 92-18) and found to be adequate. The inspection team noted several initiatives including development of a Power Systems Analysis Program, a Drawings and Other Operational References Accuracy / Usage Improvement Program, the j
Digital Imaging / CAD Project and the Design Bases Project.
j Instrument Setpoint ControlInspections j
in 1994, a third party audit of the QA process focusing on the Setpoint Control Program was perfonned. The NRC performed a System-Based Instrumentation and Controls Inspection in j
1995. These two inspections are discussed under the Instrument Setpoint Control Program in the " Program" section of this response.
Walkdowns Another means of verifying that the configuration of the plant is in accordance with its design basis is by performing walkdowns.
l System Engineers are expected to perform periodic walkdowns of their systems. A December 29,1995 memo states that as the " owner of the system, the System Engineer is to ensure that the system and its components are operated and maintained properly, and that the design bases for the system are maintained correct and current.
In order to proactively ensure an appropriate level of performance, this requires routine monitoring and trending of data...and periodic plant walkdowns to assess material condition."
Walkdowns are performed periodically by management.
Operations personnel perform walkdowns and tours as part of their daily routine.
Regulators and third party teams also tour the plant periodically.
in addition, the DAEC has performed specific walkdowns devoted to examining specific l
configurations. These have included walkdowns of supports for large bore seismic piping in response to NRC Bulletin 79-14 and walkdowns of masonry block walls in response to l
Walkdowns have been conducted to identify labeling discrepancies.
t 37
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter As part of the Seismic Qualification Utility Group General Implementation Procedure, e
extensive walkdowns of structures, systems, and components were completed.
As part of the Environmental Qualification Program, walkdowns were used to verify locations, model and manufacturing information and installation details.
Other walkdowns were used to suppori development of the Maintenance Rule and Probabilistic Risk Assessment efforts.
Plant walkdowns to confirm plant configuration are occasionally performed as part of the QA assessment process. For example, equipment walkdowns during the 1995 EQ audit verified configuration for most EQ equipment inspected (some minor deficiencies identified were documented and resolved through the DAEC corrective actions process).
Also, walkdowns performed during the 1996 DAEC Safety Committee design control audit found that plant configuration and as-built drawings were generally adequate.
Design Bases Reviews Improved Technical Specifications Project The process for conversion of the current DAEC Technical Specifications to the Improved Technical Specifications (ITS), based upon the new Standard Technical Specifications (NUREG-1433), was controlled by a Project Plan that was approved by DAEC management.
This Project Plan provided the necessary controls for the development, review and approval of the Improved Technical Specifications, including the validation of the Limiting Conditions for Operation (LC s), Surveillance Requirements (SRs) and, in particular, the Technical Specifications Bases, against the DAEC design and licensing basis. The draft sections of the ITS were reviewed by Engineering and Licensing for conformance to the design and licensing basis. The plant staff, primarily Operations and Surveillance Testing, reviewed the draft sections to ensure that the existing plant configuration and testing practices would support the ITS LCOs and SRs. Comments that were generated during these reviews were documented and tracked until closure, per the Project Plan. Where specific issues were identified that required further engineering evaluation, Action Requests were written to track the resolution of those items (e.g. review of BWR Owners' Group topical reports for applicability to the DAEC).
Training Simulator Project As part of the construction of the DAEC Training Simulator, a validation of the Simulator against the plant configuration was performed. As part of this validation process, the simulation of plant operations and transient and accident behavior was benchmarked to both actual plant operating data, where available, as well as analytical predictions of plant response to the design and licensing basis events. This validation process afforded an opportunity to review the design basis.
38
Duane ArnoldEnergy Center Response to NRC 10 CFR 50.51(f) Letter Operating Cycle Extensw, As part of the preparation of the Technical Specification change which extended the DAEC operating cycle from 12 to 18 months (Amendment # 143), the plant design and licensing basis; maintenance and testing practices; and operating experience were reviewed to ensure that the longer operating cycle would not reduce equipment reliability. The DAEC has been operating on this longer cycle for over 10 years, with no adverse affects.
Power Uprate Program Similarly, as part of the preparation of the Technical Specification change which uprated the DAEC licensed power level (Amendment #115), the plant design and licensing basis were j
systematically reviewed and revised. where needed, to support the higher power level. Key areas re-analyzed were the plant response to Design Basis Accidents, and off-site dose consequences for the limiting events. The program reviews included the Balance-of-Plant equipment to ensure that these systems would not be challenged at the extended power level, such that plant transients would not be more likely. The DAEC has been operating at this higher power level for over 10 years, with no adverse affects.
1 Design Bases Reconstitution Efforts As discussed in response (a), the DAEC has undertaken an on-going effort to develop design bases documentation. System and Topical Design Basis Documents (DBDs) have been prepared and issued as discussed in response (a). The Top Level DBDs described in response (a) provide the high level design standards and criteria. This preparation and validation of these documents has included reviews of existing configuration with design documentation.
Issues and open items were identified and processed under the guidelines of the DBD Program.
Review of the DBD program has been included in assessments performed by QA and the DAEC Safety Committee. Early DBD assessments (May 1993) concluded that the DBD program effectively supported the stated purpose of collating design basis information and supporting design information for use in selected plant activities that support the continued safe operation of the plant. Recent QA assessments have identified some recommendations regarding DBD procedures and DBD ownership expectations; these recommendations were documented in the DAEC corrective actions process and ongoing corrective actions continue to be tracked. Additionally, an independent audit of the DAEC design control process sponsored by the DAEC Safety Committee concluded that the use of DBDs in the design change process is apparent and that DBDs are effective in providing engineers with design basis information in support of modifications, safety evaluations and other project interfacing documents such as standards and calculations.
In August 1996, an assessment reviewed the status of the liigh Pressure Coolant injection (IIPCI) DBD and followed up on aspects of the DBD program identified during assessments in June,1996, and November,1995. The assessment also specifically reviewed the IIPCI 39
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter DBD against the UFSAR descriptions of the llPCI system. The assessment identified that a number of open items still existed in various DBDs. Action is underway to close or address the open items. The review of the IIPCI DBD found that while not all of the DBD information is contained in the UFSAR, no conflicts exist between the two documents. A minor discrepancy (the UFSAR's description of the manual push-button as an automatic signal) was noted and an UFSAR Change was generated to resolve the discrepancy.
UFSAR UpdatingProcess The DAEC UFSAR change process was included in reviews by both the QA assessment process (August and September 1996) and the DAEC Safety Committee design control audit (December 1996). Although these assessments did result in recommendations relating to UFSAR detail, timeliness and classification of minor UFSAR changes, the reviews generally concluded that UFSAR changes are managed effectively to ensure that the UFSAR/ Licensing Basis is maintained. Recommendations from the assessments were documented via the corrective actions process and several corrective actions are ongoing.
UFSAR Imnrovement Plan NRC Information Notice (IN) 96-17 discussed developments at another nuclear facility in which refueling activities may have been inconsistent with the UFSAR. The DAEC determined that the UFSAR change process was acceptable, but improvements could be made. In May of 1996, the DAEC developed an UFSAR Improvement Plan based on the IN 96-17 lessons learned. Several of the UFSAR 1mprovement Plan 's main points are:
G idance on the UFSAR change process was provided to facilitate more consistent documentation of UFSAR changes.
A review of the UFSAR was performed which checked for inconsistencies between the UFSAR and current DAEC configuration or performance. ARs or UFSAR changes are initiated for inaccuracies identified during UFSAR reviews. As discussed in the response to request (d), the AR process requires a review for reportability and operability.
Training was given to emphasize the importance of accurately maintaining the UFSAR.
A letter from the Vice President, Nuclear to DAEC personnel reinforced this training.
The DAEC plans to perform further enhancements to improve the accuracy of the DAEC UFSAR and the efficiency of the UFSAR change process. The scope and nature of this plan is presently under development.
NEI Initiative The DAEC has elected to conduct a systematic review of design and configuration control effectiveness for selected systems as proposed in the NEl Formal Industry Initiative. The effort is currently underway and is being performed to the guidelines of NEl 96-05,
" Guidelines for Assessing Programs for Maintaining the Licensing Basis " This review will 40
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter provide feedback on a sampling basis of the effectiveness of design and configuration controls in place since initial plant design, construction and licensing. Four systems are being reviewed including 125V DC, Offsite Power, Feedwater and Control Rod Drive flydraulic.
Qt;ality Assurance Processes Design Control Assessments of the structure and implementation of the DAEC design control process have recently been performed by the QA Assessment organization and by the DAEC Safety Committee. Ongoing QA internal assessments of design control implementation are generally performed on a quarterly basis and are discussed individually in other sections of this response. A QA assessment performed in January 1996 evaluated the newly revised design control procedures and concluded that the defined process contained the required aspects of the DAEC's design control commitments as specified in ANSI N45.2.11, RG 1.64 and the UFS AR. Additionally, a recent independent design control audit was sponsored by the Safety Committee (December 1996). For typical modifications, the DAEC Safety Committee audit concluded that there is very good consideration of design processes, safety implications, procedural adherence and overall project coordination. However, for some recent emergent and unusual modifications (e.g. a non-hardware based modification involving software control on the plant process computer), the DAEC Safety Committee audit identified weaknesses in the application of design control processes, but did not identify any plant performance issues. These weaknesses were documented in the DAEC corrective actions process and are ongoing corrective actions.
Design Document Changes QA asscssments performed in April, June, and November 1996 concluded that the Design Document Change (DDC) process is effectively implemented and controlled, although individual performance items were identified.
Enginected Maintenance Actions The DAEC QA organization performs assessments of selected Engineered Maintenance Actions (EMAs) and the EMA process to provide confidence that design control is properly implemented for these equivalent changes. QA assessments performed throughout 1996 as well as the DAEC Safety Committee design control audit (December 1996) have identified issues associated with EMAs that have been documented via the DAEC corrective actions process; these issues have generally involved EMA planning and dacumentation (closure) issues rather than technical design problems. Overall, the EMA process is recognized as increasing plant safety and performance by providing an equivalent change process to upgrade and improve plant equipment.
41
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter l
l The EMA process has also been the subject of NRC inspections. NRC 1R 95-04 found l
design changes and modifications were well implemented and modification packages were complete and well documented. "The self-assessment of the EMA process was well performed and self-critical and was also considered a strength." NRC IR 96-02 identified a violation for a failure to adequately correct weaknesses in the EMA process. In January i
1996, incorrect oil was added to river water supply pump motors during a maintenance activity. The motors had been replaced with motors from a different manufacturer with different lubrication requirements in November 1995. Ilowever, the preventive maintenance action request (PMAR) and referenced procedure still specified the original lubrication information. The EMA process, which covered the motor replacement, did not have the proper controls to ensure that PM ARs or maintenance procedures were updated before the equipment was returned to service. As discussed in our response to the violation, a formal root cause evaluation led to substantial enhancements in the EMA process and complete 1
procedure revision (new procedure), ACP 109.1. Management has re-iterated its expectations regarding the application of the EMA process as part of these corrective actions.
1 Engineering Changes The DAEC QA organization performs assessments of selected Engineering Change Packages (ECPs) to provide confidence that the design control process is properly implemented.
Recent QA assessments of ECPs were performed in June, August, and November 1996.
Additionally, an independent design control audit sponsored by the DAEC Safety Committee reviewed design control implementation for five ECPs in December 1996. The results of these assessments indicate that the design control process for ECPs is effective. Issues identified during the assessments that require ongoing corrective action (such as the weaknesses discussed earlier regarding emergent ECPs identified by the Safety Committee design control audit) are documented via the DAEC corrective action process to track the issues to resolution.
Engineering Calculations The preparation and use of engineering calculations at DAEC were recently reviewed by both QA assessment (June 1996) and the DAEC Safety Committee design control audit (December 1996). These reviews identified some issues relating to the performance and timeliness of formal engineering calculation processes (preparation and verification) that were not in accordance with ACP 1203.21. No problems with the final design were identified. These issues are documented via the DAEC corrective actions process and corrective actions are ongoing.
Software QA Program The DAEC Software QA Program was last assessed by the DAEC QA organization in November 1995. The assessment concluded that the program was being implemented in a satisfactory manner.
l 42
Duane Arnold Enery Center Response to NRC 10 CFR 50.5.l(f) Letter As discussed previously, the recent Safety Committee design control audit identified a weakness involving software quality assurance controls applied to a software modification.
An AR was issued to address this problem and the generic issue of the application of design control processes for software modifications.
Configuration Control Configuration control has been examined and reported during various NRC inspections.
These NRC inspections have reported discrepancies between operating procedures, actual plant configuration and design drawings. One such instance is discussed in IR 95-11, where the DAEC identified a discrepancy concerning chiller valve position between a controlled drawing and the operating instruction. An AR was issued and corrective action initiated. In general, these types of configuration control discrepancies are addressed with Action Requests under the DAEC Corrective Action Program described in response (d).
Additionally, systematic efforts to preclude these types of configuration control discrepancies are in the scope of the Document Improvement Project.
The Document Improvement Project includes:
redrawing, verifying and issuing Piping and Instrumentation Diagrams (P& ids) that have been identified as needing improvement in legibility and quality; evaluating potential applications ofinformation technology to simplify access to MDL e
information; consolidate and streamline existing procedures into a single administrative control e
procedure that describes the complete document update process for MDL documents.
Configuration documentation is also continually being updated through the identification of drawing discrepancies which are documented in the AR System. These issues include labeling errors, missing labels, unreadable letters / symbols on drawings, etc. which are identified and corrected.
Temporary Modifications Assessments of temporary modifications through the DAEC QA Assessment process (June 1995 and February 1996) and the Safety Committee Design Control Audit (December 1996) indicate that the temporary modification process is effective.
Procurement Process in 1992, the NRC conducted an inspection to review the implementation of the DAEC's program for the procurement and dedication of commercial grade items (CGIs) used in safety-related applications (IR 92-201). This was the founh of a series of five pilot inspections in the industry conducted by the NRC. The inspection team reviewed the 43
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter procurement and dedication program to assess its compliance with the quality assurance l
(QA) requirements of 10 CFR 50 Appendix B.
While the inspection report identified some weaknesses, such as relying on a functional or performance test to demonstrate that certain CGIs would perfonn the intended safety function (rather than evaluating the material),it identified major program strengths. The inspection team identified a major program strength in that DAEC's policy was to purchase safety-related spare and replacement items from original equipment manufacturers with approved 10 J
CFR 50, Appendix 13, Quality Assurance Programs when available, thus reducing the number ofitems that needed to be purchased commercial grade and dedicated for use in safety-related applications. Another strength identified was the DAEC's receipt inspection and testing
)
capabilities for performing material verification performed by independent quality control i
inspectors qualified to ANSI N45.2.6.
Fuels Control In response to a plant identified issue concerning the GE calculation of reactivity shutdown margin following the 1995 refueling outage, the DAEC identified that design control and verifications of vendor design products contributed to this concern (voluntary LER 95-003).
In part due to the above event, DAEC initiated a process review and improvement effort for i
fuels control activities. The DAEC is currently incorporating INPO SOER 96-02," Design and Operating Considerations for Reactor Cores,"into this improvement process. Fuel Controls, both internal and vendor, have been extensively audited by the DAEC QA Program and third party auditors. These assessments concluded that, while the design and licensing bases have been adequately maintained, our overall design controls in this area have been
" people driven," not " process driven." Current efforts are intended to enhance this by providing more effective controls.
Review of nuclear fuels control bas been included in both internal QA assessments of the nuclear fuels program and extemal assessments of the fuel supplier. An internal nuclear fuels audit performed in June 1994 found that the nuclear fuels program is well established and effectively ensures satisfactory fuel performance without compromise to nuclear safety, design and/or fuel limitations. The June 1994 audit also identified some issues regarding nuclear fuels program procedures, which were documented via the corrective actions process.
Actions to resolve the identified procedure issues were implemented and were determined to be adequate based upon follow-up assessments in May and October 1996. The latest QA assessment of the nuclear fuels program conducted in May 1996 states that the nuclear fuels program is effective as demonstrated by conservative reactivity management which has resulted in high capacity factors and no fuel leaks at DAEC. The one area of program concern, regarding the previous (June 1994) procedure issues, was resolved in October 1996 through the DAEC corrective actions process.
Supplier audits are also performed to ensure design inputs are being properly controlled at the fuel vendor and reflected in the design output. Changes in design inputs for the most recent reload analysis were all properly utilized in support of transient and reload analyses.
44
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter Safety Evaluation Annlicability Reviews and Safety Evaluations QA assessments in May 1995 as well as February, April, and August 1996 generally concluded that the DAEC Safety Evaluation and Safety Evaluation Applicability Review (SEAR) processes are effective. These assessments did identify some weaknesses which were documented via the DAEC corrective actions process. Corrective actions are either completed or continue to be tracked by the DAEC corrective actions process.
NRC IR 96-05 cited a violation for a safety evaluation not considering worst case conditions.
A safety evaluation written to support low emergency service water makeup flow rate to the spent fuel pool had assumed a nonconservative value for heatup rate, as it did not assume full core off-load during the refuel outage. The safety evaluation was revised to assume the worst case heat load. This issue will be presented to plant management and technical staff to re-iterate the need to fully recognize plant conditions that must be considered in a review against 10 CFR 50.59. This action is being tracked by the DAEC corrective action process.
Programs. Tests and Inspections The DAEC has developed various programs to ensure that the integrity of the design is maintained or that changes thereto are appropriately evaluated. These include:
Surveillance Program e
The periodic testing performed on plant systems and components helps ensure continuing consistency between design bases and plant configuration and performance. This testing verifies that SSC conform with design bases documentation, as well as demonstrating the capability of the SSC to meet the acceptance criteria of the test and ensure that components are capable of satisfying Technical Specifications requirements. An example is the surveillance test procedure (STP) which demonstrates that the essential batteries will meet the design requirements of the associated DC power system by performing a service discharge (load profile) test. The procedure requires the load profile to be traceable to the design documents.
The DAEC QA or;;anization periodically assesses the conformance of facility operations to provisions contained within the Technical Specifications. These assessments for the past two years (March 1995 and February, July, and September 1996) have indicated that the DAEC continues to operate within the parameters of the Technical Specifications and License Conditions. In addition, as part of these assessments, the Improved Technical Specification Project Plan implementation was evaluated. These assessments concluded that the processes and project team were effective and conformed to the approved plan requirements.
45
l l
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter Added assurance that our current surveillance testing program properly confirms the operability of Technical Specifications instrumentation, since the STEEP (described in i
response (b)), was gained as part of our Instrument Setpoint Design Basis Reconstitution effort (described below). An example of where the DAEC identified a deficiency in surveillance testing during the development of this program is documented in NRC IR 95-07. In July 1995, the DAEC identified that the test method being used for the End-Of-Cycle Recirculation Pump Trip (EOC-RPT) response time was not correct since 1989, when during the STEEP effort, a test method chance was made in error based upon a misreading of the Technical Specifications rquirements, such that the test only measured part of the total response time and compared u to the original acceptance criteria. Both the surveillance test and Technical Specifications have been revised to reflect the proper testing. In this example, the error was attributsNe to confusion introduced by the wording in our " custom" Technical Specifications. We believe that opportunities for future confusion in the Technical Specifications requirements will be minimized by the conversion to the Improved Technical Specifications.
Inservice Inspection (ISI) Program ISI activities help ensure that the physical integrity of plant SSC is in accordance with appropriate design bases documentation. The DAEC ISI Program was updated for the third 10 year interval in 1996 and is currently being reviewed by the NRC staff. The DAEC ISI Program is based on ASME Section XI 1989 Edition with no Addenda. The ISI Program categorizes systems into Class 1 (reactor coolant pressure boundary), Class 2 (ECCS) and Class 3 (systems in support of ECCS).
A Basis document has been prepared to justify these boundaries along with colored P&lDs which identify the location of the boundaries. The colored P&lDs are part of the Master Document List and are updated with changes made to the regular P&lDs.
The ISI Program has an Administrative Procedure which establishes responsibilities and controls for implementation of the program. The ISI Program uses Surveillance Test Procedures (STPs) for performance of Pressure Testing of complete systems. The Authorized Nuclear Inservice Inspector (as required by ASME Section XI) oversees all the activities of the ISI Program.
The effectiveness of the DAEC ISI Program has been assessed by both DAEC QA personnel as well as external technical specialists. These assessments (recently performed in May 1995 as well as June, September and November 1996) concluded that the ISI Program achieves effective results in assuring the integrity of plant pressure boundaries.
i 46
Duane ArnoldEnergy Center Response to NRC 10 CFR 50.54(f) Letter Inservice Testing (IST) Program The Inservice Test Program conducts periodic testing of active mechanical components such as pumps, valves and snubbers to ensure that they are performing svithin acceptance criteria. The DAEC IST Program is based on ASME Section XI 1989 Edition with no Addenda. The IST Program utilizes the ISI Class boundaries to classify the valves and pumps within the program. The ASME Section XI 1989 Edition, no Addenda references the O&M Standards for the IST Program.
The IST program requires periodic testing of pumps and valves to monitor performance and degradation. This is accomplished by establishing values which are known to be acceptable and monitoring deviation from these values.
The IST Program has an Administrative Procedure which establishes responsibilities and i
controls 'or implementation of the programs. The IST Program utilizes Surveillance Test l
Procedures (STPs) for implementation of the testing of valves and pumps. The l
Authorized Nuclear Inservice Inspector (as required by ASME Section XI) oversees all the activities of the IST Program.
l The effectiveness of the DAEC IST Program has been assessed by both DAEC QA personnel as well as external technical specialists. These assessmenM (recently performed in April 1994 as we!! as March, September and November 1996) concluded that the IST Program is defined and implemented in accordance with established requirements and effectively tests safety-related pumps and valves to ensure their continued operability.
An NRC inspection of the DAEC IST program was conducted in October 1994 (IR 94-11). This inspection included the DAEC's incorporation of Generic Letter (GL) 89-04,
" Guidance on Developing Acceptable Inservice Test Programs," into the Inservice Testing (IST) Program, the DAEC's program on check valves and the DAEC's self-assessment in these areas. According to the report, the implementation of the IST and check valve programs were considered " acceptable." The report further states that our
" implementation of self assessments and quality assurance (QA) audits in the IST area was considered a strength. The audits performed an in-depth review of the program and identified several good findings and observations, which were adequately resolved in a timely manner. Several QA findings were similar to issues identified during this inspection. The use of an experienced outside consultant provided knowledge of Code requirements and other expertise to the QA audit team."
Instrument Setpoint Control Program The DAEC Instrument Setpoint Program consists of design basis reconstitution of calculations to support safety-related setpoints, and the design and configuration controls 47 l
l l
i Duane Arnold Enery Center Response to NRC 10 CFR 50.54(f) I,etter 1
necessary to maintain safety margins and to ensure calculations are not invalidated by changes to equipment or procedures. This program upgraded the design basis for setpoint calculations to the current ISA standards. The Sctpoint Control Program is formally tied to the process for plant transient and safety analysis.
A Safety Committee audit was conducted of the DAEC Setpoint Control Program in 1994 with no significant problems found. NRC IR 95-11 (October 29 through December 14,1995) included the results of the Systems Based Instrumentation and Control Inspection. Key performance elements evaluated included the setpoint methodology used to develop setpoints, the control of design inputs and setpoints, surveillance testing, measuring and test equipment (MTE) control, and design engineering personnel training.
The inspectors concluded that the DAEC had implemented a good setpoint program and had good controls in place for the other key performance elements evaluated. The report stated that the inspectors " considered the performance trending program to be a strength."
In addition, the inspectors noted that the DAEC has in place a means to control design-input information contained in surveillance procedures. Procedure calibration tolerances and MTE accuracy were design inputs used in the development of a setpoint and/or total loop accuracy calcuktion.
"Duane Arnold was the first licensee to consider this in the six SBICI type inspections performed by Region III. Procedure NGD 106.3," Procedure Change, Revision and Cancellation," had acceptable steps for controlling design input infonnation contained in procedures. Changes to this information required an engineering review for setpoint control applicability. Overall, the licensee's control of setpoint information was good."
Environmental Qualification Program The DAEC Environmental Qualification (EQ) Program maintains compliance with 10 CFR 50.49 " Environmental Qualification of Electrical Equipment important to Safety for Nuclear Power Plants." It assures that electrical equipment which may be exposed to harsh environmental conditions during operation, transierrs, or accidents is qualified to accomplish its safety function when required. ACP 102.9," Environmental Qualification Program," establishes the top level administrative controls defining the responsibilities, requirements and references for the implementation and control of the EQ program. It specifies that a master list will be maintained of equipment required to be qualified. For each equipment or component, an Environmental Qualification Record is maintained identifying the environmental conditions, the equipment's critical characteristics for accomplishing its function, and documenting the basis for qualification.
In 1989, the DAEC received a violation and civil penalty due to deficiencies in the EQ Program. EQ issues included improperly taped butt-splices, unqualified terminal blocks, electrical enclosures installed in a configuration other than the tested configuration (i.e.
without weepholes), and pressure switches and radiation monitors installed without seals 48
Duane Arnold Enery Center Response to NRC 10 CFR 50.51(f) Letter to prevent moisture intrusion. IES acknowledged the EQ Program deficiencies and implemented corrective actions, not only to correct the identified equipment deficiencies.
but also to establish formal controls in the program to ensure that equipment would i
remain qualified as a result of maintenance activities and that proper documentation of equipment qualification would be established.
]
I As a result of these past performance problems, special periodic audits of the EQ program were conducted by the DAEC Safety Committee, which have utilized outside experts in this field. While these audits have identified minor documentation deficiencies in the EQ record files, no items have been identified that invalidate the qualification ofinstalled equipment. Based upon these positive results, the Safety Committee recommended that the special audits be discontinued and that future audits of the EQ program be i
incorporated into the routine audits of design control process.
The effectiveness of the DAEC EQ Program was most recently assessed by the QA organization (with the expertise of an external technical specialist) in August 1995. This assessment concluded that the DAEC EQ Program was well designed and effectively managed and that the program provides effective controls to assure that maintenance and modification activities will not adversely impact EQ equipment. Isolated issues, weaknesses and recommendations resulting from this assessment were promptly identified and resolved via the DAEC corrective action process.
Maintenance Rule Program 10 CFR 50.65 requires plants to monitor the performance or condition of plant equipment to provide reasonable assurance that the equipment can fulfill its intended function
{
commensurate with plant safety. A periodic review of these activities is also required.
j The objective is to balance the work necessary to prevent failure of equipment with the need for minimizing unavailability. Probabilistic Safety Analysis (PSA) techniques were i
used to aid in determining which plant systems were the key contributors to safety.
1 The DAEC Maintenance Rule Program currently monitors the performance of some sixty Startup Systems, using approximately ninety performance criteria to trend parameters such as availability and reliability (failure rate). PSA methodology has been used to help validate the effect of meeting these criteria upon plant safety. Another thirty-five systems are monitored via their effect on overall plant parameters, such as scram rate. If Performance Criteria are not met, an investigation into the cause is undertaken, and the corrective actions are tracked by means of assigning goals for improved performance.
i The DAEC QA organization assessed implementation of the Maintenance Rule at the DAEC in April 1996. The assessment concluded that the DAEC has planned and j
implemented an effective Maintenance Rule program which meets the intent of 10 CFP 50.65 and the NEI Guideline 93-01. The assessment also indicated that the program has strong engineering ownership.
49
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter Perfonnance Trending Programs The PSA output of the DAEC Maintenance Rule Project was used by DAEC equipment monitoring personnel when developing their programs in areas tuch as Vibration Monitoring, Oil Analysis, Thermography, Instrument Trending and MOV-related activities. These efforts, in turn, help ensure that adequate performance at the system and train level, as monitored by the Maintenance Rule, is maintained.
In February 1996, the DAEC QA organization assessed the plant trending and monitoring programs at DAEC. The assessment found good progress in providing an integrated and organized approach to equipment monitoring, and also found some excellent engineering work for specific equipment monitoring and trending areas.
Fire Protection Program rebaseline efforts The Fire Protection Program at the DAEC is implemented to ensure that safe plant shutdown can be achieved and maintained for a fire in any plant area. The programs that make up the Fire Protection Program are described in the UFSAR, the Fire Plan and the Fire llazards Analysis. A topical Design Basis Document (DBD) was developed to document our design and licensing basis in the fire protection area. The DBD is currently going through a review process.
To respond to recent industry fire protection issues, the DAEC initiated an Appendix R Rebaseline project to clearly identify compliance strategies for each fire area.
Modifications and procedure changes were implemented in cases where the DAEC chose to change compliance strategies. For example, cables were rerouted out of some fire areas to eliminate the need to rely on Thermo-lag installed in the plant. The Appendix R reanalysis is complete; supporting documentation is now being updated in accordance with our change processes.
QA assessments of the DAEC Fire Protection Program (April 1994 and April 1996) using external technical specialists concluded that the program continues to demonstrate the capability of detecting, preventing and suppressing fires while maintaining the ability to safely shutdown the plant.
Seismic Qualification (USI A-46)
The seismic designs of Category I structures, systems and components at DAEC are based on the requirements of regulatory documents, codes and standards, as well as commitments made in such programs as IEB79-14 and others. The seismic design basis is described in the UFSAR and a topical DBD. The seismic qualifications ofindividual structures, systems and components are documented in the applicable design records, 50
i l
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter including specifications, calculations and drawings. These records are controlled as part of the Master Document List (MDL) and the controlled equipment data bases.
The seismic adequacy of changes or additions to seismically-qualified structures, systems, or components are controlled by plant administrative control procedures ACP 109.0 for Engineering Change Packages and ACP 109.1 fbr Engineered Maintenance Actions. Proposed changes require a Safety Evaluation Applicability Review per ACP 103.2, and if necessary, a 10 CFR 50.59 Safety Evaluation per ACP 103.3.
By letter dated November 15,1995, IES Utilities Inc. submitted the results of the Unresolved Safety Issue (USI) A-46 evaluation for the DAEC. The NRC is currently i
reMewing this evaluation.
Power Systems Analysis Program (NRC Geeric Letter 88-15)
The Power System Analysis Program is an examination of the electric power distribution j
system at the DAEC and verifies the adequacy of the existing design, implementation and maintenance of the DAEC electrical distribution systems. The AC analysis encompasses the 4.16 KV system and 480v motor control centers (MCC) with all major 480v motor loads modeled separately and other 480v panel loads combined as an equivalent load, i
The DC analysis encompasses the source, major motor loads and combines the minor panel loads into an equivalent load.
Administrative Control Procedures are established to maintain the accuracy of the power system analysis and control the modification of plant electrical systems.
The Power Systems Analysis program was initiated by the DAEC to optimize a number of areas, including electrical coordination, configuration management and electrical distribution enhancements. New calculations have been prepared for the electrical distribution system which are more complete and accurate than previous calculations.
The Electrical Distribution Information System (EDIS) is used to provide ready access to the electrical configuration ofcircuits, power supplies and loads. EDIS has extended the configuration management tools to the non-safety related lighting panel level. EDIS is also a tool for Operators to understand the impact of various tagouts on systems.
l Additionally, a computer database of electrical distribution information has been assembled which is accessible through CIIAMPS.
Generator loading and load sequencing are controlled by UFSAR Table 8.3-1 " Single Diesel Generator Loading Sequence and Response - Loss of Coolant Accident Plus Loss of Offsite Power." Changes to the generator loading sequence are controlled via ACP 1203.228 " Power System Analysis."
c 51
~
1 Duane ArnoldEnergy Center Response to NRC 10 CFR 50.54(f) Letter Motor Operated Valve (MOV) Program (NRC Generic Letter 89-10)
The DAEC MOV program, developed in response to NRC Bulletin 85-03 and Generic Letter (GL) 89-10, establishes an engineering-based program on motor operated valves, the documentation of their design bases, and the establishment of testing requirements to demonstrate acceptable performance under worst-case Design Basis Accident conditicas.
Fortral controls have been established to ensure that this design basis is maintained ana that the in-plant configuration is consistent with the program requirements, in particular, that proper maintenance and testing is performed.
The close-out inspection of GL 89-10 (IR 95-11) was conducted on October 29 through December 14,1995. This inspection determined that the DAEC MOV program and implementation are acceptable and meet the intent of GL 89-10. " Program documentation and test data provided an adequate basis to conclude that all GL 89-10 program MOVs would perform their intended safety functions under worst-case design-basis conditions. Assessments in the MOV area consistently provided good technical findings and effectively monitored the progress made toward program closure.
Corrective actions to the issues raised during the assessments were addressed or were considered for program enhancements."
Recent assessments of the DAEC MOV Program have been performed by the DAEC QA organization in September 1995 as well as February and May 1996. The assessments concluded that the MOV Program is effective in assuring that safety-related MOVs will perform their safety functions under design basis conditions.
Regulatory Guide (RG) 1.97 Program The RG 1.97 program established design and licensing bases for instrumentation used to monitor the plant and environment during and following a design basis accident. An NRC inspection March 1991 (IR 91-07) determined that the DAEC's implementation of post-accident monitoring instrumentation was not complete. The DAEC RG 1.97 Program was subsequently inspected in December 1991 (IR 91-20). The inspection did not identify any violations of NRC requirements. A list of seven Licensee Commitments was identified for completion by September,1992. The program commitments were completed, as documented in an IES letter dated December 18,1996 (NG-96-2680).
Station Blackout (SBO) Program The DAEC SBO Program was developed to demonstrate the ability of the DAEC to cope with a loss of all AC power, as required by 10 CFR 50.63. The DAEC performed an engineering compliance review of the Station Blackout Program to 10 CFR 50.63 using guidance from RG 1.155 and NUMARC 87-00. Internal compliance reviews have been prepared which address the programs, procedures, systems, modifications and analysis necessary for 10 CFR 50.63 compliance. The results of these reviews were summarized 52
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) L ' ster in a submittal to the NRC (Letter from Franz (lES) to Murley (NRCL Response to Safety Evaluation by NRC-NRR " Station Blackout Evaluation Iowa Electric Light and Power Company Duane Arnold Energy Center", NG-92 0283, dated February 10,1992). The NRC concluded that the DAEC is in compliance with 10 CFR 50.63 in a Supplemental Safety Evaluation (Letter from Shiraki (NRC) to Liu (IES), Station Blackout Rule Conformance Evaluation, dated June 15,1992). The DAEC has since implemented additional modifications, including battery load reductions, that have further strengthened the plant's capability to mitigate a station blackout event. Corrective actions are implemented through the AR System.
Masonry Block Wall Program The design of masonry walls at DAEC are based on the requirements of original applicable codes and standards. Masonry block walls within the scope ofI.E. Bulletin (IEB) 80-1 I were re-evaluated for design adequacy and the results documented in the DAEC IEB80-11 Bulletin program NRC submittals. The application ofIEB 80-11 Program requirements on DAEC masonry block walls is summarized in the UFSAR and a topical DBD. The specific design qualifications of masonry block walls are documented in the applicable design records, including calculations and drawings. These records are controlled as part of the Master Document List (MDL) and the controlled equipment data bases.
Changes or additions to qualified masonry block walls are controlled by plant administrative control procedures ACP 109.0 for Engineering Change Packages, and ACP 109.1 for Engineered Maintenance Actions. All proposed changes require a Safety Evaluation Applicability Review per ACP 103.2, and if necessary, a 10 CFR 50.59 Safety Evaluation per ACP 103.3.
IE Bulletin 79-14 on pipe hangers Pipe hangers at DAEC are classified as part of piping systems according to service and location. The piping service will determine the appropriate design codes and applicable design requirements for pipe hangers. The design bases for piping systems are summarized in the UFSAR and a topical DBD. The level of documentation for each hanger varies and is based on the process pipe service, classification and size. The design and detailed information (when applicable) for pipe hangers are provided in the calculations and the design drawings which are included in the MDL. The existing documentation also includes the results of the inspections and modifications performed as a result of the NRC Bulletins 79-02 and 79-14 for each affected pipe hanger.
Changes or additions to qualified piping systems are controlled by plant administrative control procedures ACP 109.0 for Engineering Change Packages, and ACP 109.1 for Engineered Maintenance Actions. All proposed changes require a safety evaluation 53
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter applicability review per ACP 103.2, and if necessary, a 10 CFR 50.59 safety evaluation
'i per ACP 103.3.
CIIAMPS The DAEC established a computerized data base for equipment, as discussed m response (a). This effort also included a walkdown of the plant, recording serial numbers, model i
numbers, equipment identifications, and placement ofidentification labels on equipment.
Chemistry The chemistry program is implemented to monitor and control reactor coolant water chemistry in order to prevent adverse effects on fuel and pressure boundary materials (e.g. stress corrosion cracking of stainless steel, excessive corrosion rate) and to provide assurance that the initial conditions assumed in accident analyses are maintained (e.g.
iodine radioactivity level). Additionally, chemistry sampling and analysis are utilized as acceptance of the fuel for emergency diesel generators to provide assurance that expected performance will be achieved. Parameters to be monitored and the acceptance criteria are established by the Technical Specifications. Therefore, the implementing procedures j
require review by the Operations Committee in accordance with the procedure change process which invoke the 10 CFR 50.59 process, and any requirement changes will be implemented through the Technical Specification change process.
Radiation Control e
The radiation control program is implemented to maintain personnel and public exposure As Low As Reasonably Achievable (ALARA), control radioactive material, and provide environmental monitoring in the vicinity of the plant.
In support of the DAEC policy to maintain exposures ALARA, temporary shielding is i
utilized within administrative controls to ensure that the installation of temporary shielding does not degrade system / equipment operability. Engineering reviews of temporary shield requests require consideration of safety related concerns, loading restrictions,10 CFR 50.59 applicability and independent review.
Implementation of the temporary shielding program at DAEC was assessed by QA during the 1996 refueling outage. The assessment concluded that the temporary shielding program requirements were satisfactorily implemented.
The radiological environmental monitoring is required by 10 CFR 20,10 CFR 50 Appendix I and 10 CFR 100 and is implemented by the Technical Specifications via the Offsite Dose Assessment Manual (ODAM). Therefore, the implementing procedures require review by the Operations Committee in accordance with the procedure change process, which invokes the 10 CFR 50.59 process.
i 54
Duane ArnoldEnergy Center Response to NRC 10 CFR 50.5.l(f) Letter j
QA assessment of the Radiological Effluent Centrols Program (RECP) and the Radiological Environmental Monitoring Program (REMP) performed in the second quarter of 1996 concluded that these programs function effectively to meet program requirements.
Physical Security Plan The DAEC Security System, i.e. intrusion deterrence and detection and access control hardware, are subject to the DAEC design and configuration control processes. The j
drawings, specifications and calculations that support the design and licensing basis of the DAEC Physical Security Plan are considered part of the Master Document List (Ref.
ACP 109.0). Although this information is classified as Safeguards information and controlled on a "need to know" basis, as defined in 10 CFR 73.2, engineering procedures (ACP 1203.11) direct that plant design changes be reviewed for impact on the Physical Security System.
Operating Erperience Program The DAEC has an Operating Experience Program that employs the Action Request form as a tracking document for the review and actions taken in response to industry operating experience, Notices per 10 CFR 21, Vendor Notices and Service Letters, NRC Generic Letters, Bulletins, Information Notices, Administrative Letters, INPO SOERs, SERs. and other industry notices. Operating experience information receives broad informational distribution to provide additional opportunity for review and feedback and has prompted further informal reviews.
In January,1997, a self-assessment was performed of the DAEC Operating Experience Program. Overall, the operating experience program appears to effectively support the DAEC staff and management with relevant industry information. The DAEC staff and management, in turn, continue to place a high value on industry information and effectively use it in maintaining the safe and reliable operation of the DAEC. The following examples of effective utilization of Operating Experience Information for insights into the design and licensing bases were identified:
Industry operating experience information on installations of digital feedwater controllers contributed to the success of the DAEC installation and startup testing of a digital feedwater control system. Negative industry experience with computer-aided controller tuning led to the conscious decision to eliminate the use of this technology from the test plan. The controllers have performed exceptionally well during the plant transients that have occurred since startup.
A trip of the main turbine and feedwater at another plant on reactor high water level caused the DAEC to re-examine the design bases for the high level trip 55
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter function. The DAEC concluded that the documentation of this design basis is lacking. An AR has been initiated to address this issue.
Reviewing industry events allows the plant to re-allocate resources in anticipation of changes in regulatory focus. For example, reports ofindustry concerns regarding potential piping overpressurization following postulated i OCAs were reviewed closely by plant engineering. Analysis revealed that there were systems which could be vulnerable to this problem and a plant modification process was initiated prior to receipt of NRC Generic Letter 96-06 " Assurance of Equipment Operability and Containment Integrity During Design Basis Accident Conditions."
The DAEC staff has derived clear benefits from the use ofindustry experience in performing self assessments of the plant configuration and design bases based on the lessons learned from other plants.
Industrv Initiatives DAEC has actively participated in industry initiatives and committees to create solutions and improvements to plant safety. This effort yields dividends in the knowledge of design and licensing bases. A few recent examples have included:
BWR Owners Group RG 1.97 Committee -- design bases and qualification requirements for Neutron Monitoring System. Also examined design bases issues for Rod Position Information Systems and lessons learned from August 1991 event at Nine Mile Point involv' y loss of control room instrumentation and power supplies.
Scram Solenoid Pilot Valve -- issues related to Viton diaphragm adhesion and slow control rod scram response times. In resolving this problem, the design and licensing basis for the scram times was re-reviewed to determine that no immediate safet! <wern existed. DAEC has since replaced the Viton diaphragms with Buna-N to ensure performance is consistent with the design basis time requirements for rod movement to position 46.
Reactor Pressure Vessel Level Instrument Reference Leg Degassification issue -- re-examined the behavior of this instrumentation during a LOCA blowdown phase and concluded that potential non-conservative inaccuracies existed in the existing design.
Modifications were made at the DAEC to install a bacidill system to compensate for the non-condensable gas effect.
Main Steamline Radiation Monitor Committee -- re-examined the original design bases for the monitors and their setpoints, and based upon this re-review recommended elimination of the reactor protection system function for these sensors.
56
Duane Arnold Energy Center Response to NRC 10 CFR 50.5.l(f) Leuer ECCS Suction Strainer Committee --is rs viewing the design basis to address the potential for increased post-LOCA fouling from that previously assumed in the design of the system.
DAEC assigns personnel to support industry groups and initiatives. Employees have been loaned to other utilities as technical specialists to support audits and evaluations. Employees have been assigned as peer evaluators for INPO. One employee actively participated in support of the development of emergency operating procedures for nuclear plants in the former Soviet Union. Knowledge and experience from these efforts have been shared and adds to the ability to understand and maintain the design bases.
Ouestionine Attitude The conduct of routine work at the DAEC is guided by clear statement of mission, values, and expectations. Workers are encouraged to maintain a questioning attitude, to perform self-verification, to report problems and issues, and to do quality work. It is not possible to show a procedure that accomplishes these qualitative goals, but it is possible to show a few examples of how this effort contributes to continuous improvement.
While conducting design basis reconstitution work on instrument setpoints, DAEC engineers identified an inaccuracy in the setpoint for reactor vessel level instruments for ESF actuations (Low-Low-Low level) due to a miscommunication ofinformation between us, the vendor (Yarway), and GE, via SIL-299, "High Drywell Temperature Effect on Reactor Vessel Water Level Instrumentation", dated July 25,1979. This SIL notified licensees of an inaccuracy in Yarway instrumentation under certain accident conditions resulting from very high drywell temperature and recommended applying a correction factor to the Yarway instruments to compensate for this inaccuracy. Because of the miscommunication, the appropriate correction factor was not applied in the original setpoint calculation at the DAEC. Based upon our discovery, GE issued a supplement to the SIL correcting the miscommunication (Supplement 2, dated January,1992). As noted i
in the NRC Inspection Report, no notice of violation was issued, in part, due to DAEC's identification of the problem as part of the DAEC design reconstitution effort. As stated in the IR, the DAEC has "made great strides in discovering and resolving the level setpoint inaccuracies and the NRC strongly encourages the licensee to continue with the design reconstitution program."
A similar situation occurred in our setpoint program with the GE SIL on determining the Main Steamline High Flow instrument trip setpoint that also required a revision to the SIL.
In November 1992, during an engineering review of calculations used for containment integrated leak rate testing, a DAEC engineer identified an error in a 1971 calculation used to compute drywell free volume. The calculation, performed by an architect 57
4 Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter i
engineer, failed to account for 10 vertical feet of the drywell's cylindrical portion. That resulted in an error that reported the drywell volume was approximately 8000 cubic feet less than actual volume. Analyses and documentation have been updated to reflect the correct volume.
1 The DAEC QA assessment process in 1996 included assessment of the safety focus, e
problem identification / resolution, and the quality of work for each functional assessment area (Operations, Maintenance, Engineering, Radiation Protection, and Security). The summarized results of assessment areas are generally included in the executive summaries of each quarterly report for each functional assessment area. For 1996, the assessment reports indicate that performance in these areas ranged from satisfactory to excellent. Specific deficiencies and recommendations were documented; however, the general conclusion from the 1996 assessments is that the DAEC effectively focuses on safety, identifies and resolves problems, and produces quality work to ensure safe operation.
Conclusion to resnonse (c)
In this response we have described the programs, audits, inspections, and cultural values that have been used to monitor our compliance with design bases.
Our work in developing DBDs has focused engineering attention on high level design and licensing bases, design standards, and safety criteria and the structures, systems, and components implementing these requirements (Top Level DBDs), on system specific design and licensing bases (System DBDs), and on engineering disciplines or special topics (Topical DBDs). DAEC has also emphasized the use of Engineering Programs that focus engineering review and effort on significant aspects of our design and licensing bases (e.g. Setpoint Control, Environmental Qualification and Fire Protection Systems).
Management and supervisors are actively involved in activities which establish goals and priorities, and which monitor, measure, and support compliance with design and licensing bases. We employ internal auditing, surveillance and review processes that measure the effectiveness of our processes. Trends are identified, evaluated and communicated to decision makers for action.
We require procedural compliance and independent verification. We encourage employees to perform self-verification, to self-identify problems, and to maintain a questioning attitude.
We have a low threshold for problems that are processed through our corrective action program. We closely follow industry experience and issues, because by applying the lessons leamed from other plants, we improve our own knowledge, understanding, and compliance with our own design and licensing bases.
DAEC has received several system-based " vertical slice" inspections, including an NRC EDSFI, an NRC ESW SSFI, the Safety Committee Audit of the DAEC Setpoint Control 58
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter Program and the NRC SBICI. The design, configuration, and procedural controls described in responses (a) and (b) were implemented following the EDSF1 and. the ESW SSFl. The later Safety Committee Audit and SBICI considered the engineering design, configuration, and procedure controls to be effective.
The numerous audits, assessments, walkdowns and NRC inspections conducted at the DAEC also provide assurance that the design bases are being maintained consistent with plant configuration and performance. We utilize external inspections and audits as opportunities for improvement. We insist on open, honest and professional communication on problems.
Problems that have been identified such as those concerning the EMA process and configuration control are being resolved via the AR process described in response (d).
The processes, programs, audits and inspections discussed above provide reasonable assurance that system, structure and component configuration and performance are consistent with the design bases.
59
~
4 s
Duane Arnold Energy Center Response to NRC 10 CFR 50.5.t(f) Letter NRC REOUEST FOR INFORMATION (d) Processes for identification of problems and implementation of corrective actions, including actions to determine the extent of problems, action to prevent recurrence, and reporting to the NRC.
4 DUANE ARNOLD ENERGY CENTER (DAEC) RESPONSE Introduction to Response (d)
The DAEC Corrective Action Program is defined by ACP 114.4," Corrective Action Program." The Corrective Action Program is established to ensure that conditions adverse to quality such as failures, malfunctions, deficiencies, deviations, defective material and equipment, abnormal occurrences, and nonconformances are promptly identified, reported, and corrected. Conditions adverse to quality may be identified by a number of techniques such as:
Action Requests (AR) e i
Maintenance Action Requests, corrective (CMAR) and preventive (PMAR) e Training Management Action Requests (TMAR), which provide a means to e
identify /suggest actions to improve / maintain the training process Quality Assurance Assessments, which will initiate the appropriate document (e.g. AR, e
CMAR, TMAR) for problems identified during the assessment Procurement Action Requests (PAR), which provide a means to document and control issues identified as a result of receiving inspection activities Security Corrective Actions, which provide a means to document and ensure appropriate e
management review of conditions adverse to security This response describes the AR and CMAR systems, including their ties to the plant design bases and configuration.
Action Request (AR) System (see Figure 5 for an overview of the process).
60
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter Overview of'the Action Reauest System
~
(issues, concerns, improvement opportunities)
I iniustoon of origsnal as addendum l
Action Recuent ( AR)
I i
h h
l Review for potential reportabihty l
l Review for operabilety l
h h
l Imuase/ complete required l
l y,
,,,g,,,,
l t
notifications I
I I
1 I
.1 Tiered approach to the assignment of seguired actions based on sigm6cance, cost and schedule-
- AR Admmistrator
. Screemng Penel(supervisory personnel)
. Evalussson Panel (sensor decision-inskers) l Perform RCA, including recommendation for wr = m
,_y,,
corrective action (s) to tRCA) -
preclude recurrence No Responseble Supervisor concurrence with the RCA g;,,g,,,, p,,,,,,,,
Yes-*
solutions and
9""
develop recommendasson 1r e
Solutions Team recoroubendation is reviewed Responsible Manager concurrence and the selsted with the RCA No for implementation l
1P w
Complete action (s) to resolve the Operations Committee sasue, which may include other reviews the RCA tracking documents and asssgns the (e g, addendum AR, correctsve action (s)
Procedure Work Request, for implementation Corrective Mamtenance Action Request, Trasmas Material Action Request)
Instsate addendum AR(s) to tvack implementation of correctsve actions.
Tsered approach to the required as necessary concurrenccheview for AR closure Admemstrative closure of the AR Iw l
f Feedback to the AR initiator NOTE. If the AR initsator disagrees with the AR resolution, he can amtsste en addendum AR sequesting that the resolution be reviewed by an AR Panel Figure 5 61
i Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter A key element in the Corrective Action Program at the DAEC is the Action Request System.
An Action Request (AR) is initiated to document items that may require action that are discovered during normal plant activities, QA audits /self-assessments, new program / process development, and NRC inspections, such as:
conditions " adverse to quality," as defined in the Quality Assurance Program Description e
(QAPD), which includes plant equipment concerns, as well as process and program implementation concerns nonconformances in design documents, such as "as-built" plant configuration drawings, e
equipment databases, design specifications, and DBDs procedure deficiencies or noncompliances e
conditions reportable to outside agencies operability concerns, including unanticipated equipment responses during operation or e
equipment problems noted during surveillance testing safety-related component failures e
balance-of-plant equipment failures which could affect the safe, continued full-power e
operation of the facility technical issues which require engineering resolution, including industry operating e
experience, vendor bulletins / service letters, regulatory issues (BNs, GLs, & ins) any condition or event for which the Operations Shift Supervisor determines further e
review is required ARs provide for immediate evaluation of problems for impact on structure, system or component operability and NRC reportability requirements. ACP 1402.3," Regulatory Reporting Activities," provides guidance for the preparation, review and approval of various reports required by regulatory agencies. The AR System provides for graded response and prioritization to resolve the problems based on significance through screening and gating criteria. A systematic process to investigate a problem and to identify root causes is employed to steer corrective actions to the real problem. The process provides for use of a multi-disciplinary or inter-departmental solutions team to identify and evaluate alternative solutions and to recommend the optimum solution. The process provides for supervisory and management reviews and approvals to assure the corrective actions taken are complete and adequate to prevent recurrence.
j The management philosophy and cultural climate at the DAEC promote a low threshold for initiating ARs. This low threshold provides high confidence that potential design basis issues will be promptly identified by personnel during their daily activities, which then allows the AR System to implement its timely reviews for reportability to outside agencies and operability. Following the initial reportability and operability reviews, a tiered approach is utilized for the assignment of required actions.
Gate criteria are in place to trigger review and assignment of the issue by the appropriate level of the organization. The gate criteria are in broad categories such as nuclear safety, regulatory compliance, equipment performance / reliability, plant performance / capacity factor, 62
Duane Arnold Energ Center Response to NRC 10 CFR 50.54(f) Letter cost and schedule. As the significance of an issue and/or the level of resources for resolution increases, the level of management involvement also increases through the involvement of the review panels.
The lower-tier panel is the Screening Panel, whose members are selected supervisory personnel, while the higher-tier panel is the Evaluation Panel, whose members are senior decision-makers responsible for dealing with the more significant issues of the plant. Each panel is responsible for evaluation of the problem, identification of the full scope of the issues, selection of methodology for resolution, allocation of resources, establishment of expectations for resolution, identification of milestones or completion targets, and other performance measures that the panel may monitor during the implementation of an issue resolution.
To ensure timely corrective action, changes to AR scope or schedule are initially reviewed and approved at the same tier as the original AR. However, if the level of resources or schedule for completing a corrective action increase by predetermined amounts, the change in scope or schedule is reviewed and approved at the next higher tier, either Screening Panel or Evaluation Panel.
SSC nonconformances with QA and design requirements are tracked and resolved through the AR process. If the disposition of the nonconformance is "use-as-is," or " repair," the procedures require performance of a technical justification including Safety Evaluation Applicability Review.
j Routine QA assessments are performed to measure the performance of the AR process. The DAEC QA assessment process in 1996 included assessment of problem identification and resolution (results of corrective actions) for each functional assessment area (Operations, j
Maintenance, Engineering, Radiation Protection, and Security). The documented results of these corrective action assessments are included in the quarterly report for each functional assessment area. For 1996, the assessment reports indicate that performance in this area was satisfactory. Issues identified during results of corrective action assessments are documented via the DAEC corrective actions process.
NRC evaluations of the DAEC AR process have been documented in several inspections.
NRC IR 96-02 states that the corrective action process appeared to continue to be well utilized with only occasional, minor instances noted where items were not entered into the system. NRC IR 95-07 concluded that the Action Request system was a strength. "This system appeared to be of significant value since it provided plant personnel with a method to identify potential plant issues on a variety of topics." The report stated that, overall, the DAEC maintains an effective corrective action program with strong management support for critical self-assessments. NRC IR 95-04 found that the " Action Request (AR) process appeared to be an excellent program and was a notable improvement over the previous multiple program approach. There was strong management support for the AR process as evidenced by management's ensuring appropriate resources were available and used in resolving problems."
63
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter A Root Cause Analysis (RCA) is required to be performed when a performance issue resulted in a major impact on plant safety, personnel safety or capacity factor or was deemed by plant management to be a "near miss,"i.e. several process / programmatic barriers that ensure positive results were breached. The RCA report should include:
description of the event or condition e
analysis of effect on plant operation and safety e
immediate and short term compensatory corrective actions (as appropriate)
+
problem history and previous similar events e
root causes and contributing factors for the event or condition e
long-term or programmatic corrective actions to reasonably preclude recurrence a
Each RCA report is reviewed for concurrence by the responsible supervisor, the responsible manager and the Operations Committee. The Operations Committee makes the assignments for any corrective actions to be implemented but have not been completed, including verification that appropriate tracking mechanisms are in place.
As discussed in response (c), the Quarterly Quality Assurance Trend Report provides statistics and trending charts for human and equipment performance at the DAEC that helps management focus their involvement.
Employee Safety Concerns Additionally, there is an Employee Safety Concerns program that provides an opportunity to confidentially communicate to IES Utilities Inc. management any nuclear safety, quality, regulatory compliance, radiation protection or industrial safety concerns. This program does not replace existing channels of communication or existing reporting mechanisms (e.g. AR System).
Corrective Maintenance Action Reauest (CMAR) System ACP 1408.1," Maintenance Action Requests," defines the method and means by which maintenance activities within the DAEC shall be initiated, controlled and documented. The need for maintenance is documented by the initiation of a Work Request Card. Within criteria established in ACP 1408.1, the deficiency may be corrected by the Fix-It-Now (FIN)
Team. ACP 1408.1 specifies when a CMAR is required to perform the maintenance.
The CMAR is used to track, plan, control, test and document the results of corrective maintenance. If the results of maintenance requested under a CMAR will impact plant configuration or design bases, the EMA or ECP process is applicable as described in response (a). ACP 1408.1 specifies the requirements for CMAR planning and reviews.
Planning and implementation include controls for materials, processes, testing and documentation. Prior to implementation, review by Operations is performed including the 64
~
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter effect on plant operations, applicability of Technical Specifications, and operebility testing requirements. Post-work review includes activities to ensure that database updves have been submitted.
Conclusion to response (d)
In this response we described the DAEC Action Request system which forms the heart of our corrective action program. We showed how this process is used to perform evaluations for operability, reportability and priority. Significant issues and trends are subjected to a root cause determination. The process provides for inter-departmental or multi-disciplinary response through a Solutions Team approach for complex issues. As explained under Management Oversight in response (c), we have provisions for management reviews and approvals. We monitor the effectiveness of our corrective action. We trend problems for recurrent themes and systematic problems.
The DAEC Corrective Maintenance process is another corrective action process. When equipment fails or is found to be degraded during operations, inspections walkdowns, tests, or other activities, the corrective maintenance process provides controls to replace it or restore the equipment to within required limits. The process is linked to the design control and configuration management processes described in response (a) to ensure compliance with design and licensing bases is maintained.
We have described DAEC's process for addressing employee safety concerns.
DAEC Corrective Action Program provides processes to determine the extent of problems, to identify corrective actions, and to implement effective corrective actions to prevent recurrence.
4 4
65
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter NRC REOUEST FOR INFORMATIQN 1
4 (e) The overall effectiveness of your current processes and programs in concluding that the configuration of your plant (s) is consistent with the design bases.
DUANE ARNOLD ENERGY CENTER (DAEC) RESPONSE We conclude that the DAEC processes and programs are effective for maintaining plant configuration consistent with the design basis.
Our rationale for this conclusion follows.
Design Control In response (a), we described the DAEC processes for design and configuration control. The processes for performing changes to the plant provide controls for full modifications (ECP),
maintenance action affecting the configuration (EMA), changes to documentation (DDC),
and engineering calculations used to translate design bases into the plant design or to analyze new questions and issues about the existing plant configuration.
j l
We described the design and licensing documentation for the plant starting with Top Level DBDs containing Design Safety Standards and Nuclear Safety Criteria. We consider the availability of the original top level design bases documentation to be a significant advantage l
in addressing questions about design basis for a plant of the DAEC vintage. When a specific design output or calculation is not available, it is possible to start from original design intent and standards during the effort to reconstitute the output or calculation. System and Topical DBDs simplify the task ofidentifying the design bases.
A fundamental aspect of maintaining compliance with the design basis is effective translation oflimits assumed in plant safety analyses into trip setpoints for the reactor protection systems, emergency core cooling systems, and other plant engineered safety systems. We have reconstituted the calculations that support the setpoints specified in the current DAEC Technical Specifications and have developed additional calculations to support the setpoints proposed in DAEC's conversion to the Improved Technical Specifications, which was submitted to the NRC in Fall 1996. The DAEC Setpoint Control Program is considered to be very strong based on internal and external audits and inspections.
The DAEC Surveillance Testing Program has incorporated these setpoints. After completing one major review and improvement effort for surveillance test adequacy (STEEP), additional reviews in support of conversion to the Improved Technical Specifications, and subject to a second systematic review (GL 96-01) underway, our conclusion is that the Surveillance Testing Program provides assurance that safety systems will operate within the limits assumed by the plant safety analyses.
66
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter The DAEC mechanical programs (e.g. Erosion Corrosion Program, Inservice Inspection Program, Inservice Test Program) provide confidence that active and passive mechanical 1
Structures, Systems and Components meet applicable standar6. Similarly, the DAEC Motor Operated Valve, and electrical component and system testing, trending and predictive maintenance activities provide assurance that electrical equipment is in compliance with applicable standards. Calibration and trending programs provide the same assurance for instrumentation and controls systems and components.
Other engineering programs were described in response (c). The use of engineering programs also adds confidence that we have maintained compliance to the design bases for the plant. By focusing engineering reviews and fostering expertise on specific events (e.g.
4 Station Blackout), qualification programs (e.g. seismic or environmental), or issues (e.g.
masonry block walls, pipe hangers) we have improved and retained our knowledge of the plant and its design.
Design Control has been evaluated through a wide range of programs, audits, NRC inspections, QA assessments, surveillances, and assessments by engineering peers and third parties. In general, these evaluations have confirmed that the DAEC design control process is effective. Problems identified in the EMA process received significant attention and resulted in process improvements that are now in-place. Recently identified issues and weaknesses have not identified safety-significant concerns.
Configuration Control Configuration management is the process of ensuring that the design bases are incorporated into the plant and that compliance with design bases is maintained over time through operations, maintenance, and testing. As licensing bases evolve, the plant design changes.
The output of design control activities ensures that the configuration required by the design is documented. DAEC has incorporated tools (e.g. CHAMPS, EDIS) to simplify retrieval of plant configuration information.
Procedures establish limits for plant activities that can affect plant configuration (e.g.
operations, maintenance, and test procedures; tagouts; or temporary modifications). The plant effects of activities (e.g. maintenance, tests, tagouts) are required to be considered before permission is given to begin work. Operator rounds, walkdowns, management tours, labeling improvement efforts, procurement and material controls, and other routine activities contribute to the maintenance of accurate plant configuration data.
Engineering programs and system engineering ownership provide a focus on evaluating compliance between plant configuration and design. The availability and retrievability of drawings and other documentation is steadily improving as information technology improves (e.g. electronic drawing system, electronic documentation retrieval for the commitment tracking system). The identification of drawing discrepancies and their correction has become simpler. In this regard, we believe the larger number of recent drawing corrections 67
Duane Arnold Enery Center Response to NRC 10 CFR 50.54(f) Letter discussed in response (c) may be indicative of a culture that promotes the reporting and correction of problems.
The configuration of the plant has been assessed continually in audits, inspections and assessments. These include several vertical slice inspections conducted by the Safety Committee and the NRC. The results of these activities support the conclusion that DAEC control processes and programs are effective in assuring that the plant configuration is consistent with the design bases, and that identified discrepancies are corrected.
10 CFR 50.59 In response (a) we described the two step Safety Evaluation Applicability Review and Safety t
Evaluation process that implements the requirements of 10 CFR 50.59. Internal and external audits of the DAEC compliance with 10 CFR 50.59 have concluded that this process is generally effective. Development of DBDs, (especially the NSOA described in response (a)),
have simplified retrieval ofinformation about design bases. Electronic search and retrieval oflicensing bases information, and conversion to improved Technical Specifications should generate further gains in the effectiveness of this process.
I UFSAR J
We described our processes for updating the UFSAR in response (a). In response (c) we have described the on-going UFSAR review and improvement project and our participation i
in the NEI 96-05 initiative to perform an evaluation of design and configuration control based on the UFSAR descriptions of a sample of four systems. The results of audits and QA assessments concluded that this process was effectively managed and implemented.
j Identified weaknesses were documented and corrective actions were initiated.
l Ouality Assurance s
i In response (a) we described the DAEC Quality Assurance Program that implements the requirements of 10 CFR 50. Appendix B. The QA Program defines processes that provide confidence that the safety-related SSCs at the DAEC are consistent with the design and licensing bases. Additionally, the QA assessment process provides continual in-house monitoring of the effectiveness of QA Program implementation. The evaluations and audits of the DAEC QA Program conducted through Safety Committee audits and outside auditing organizations, including NRC inspections, have concluded that DAEC has developed and is effectively implementing a comprehensive assessment process that assures that concerns are effectively identified, reported, corrected, verified to be correct, and closed.
Proced.urrs In response (b) we described the processes used to develop and maintain procedures governing design activities, operations, maintenance and testing. As explained above the extensive reviews of surveillance procedures (e.g. STEEP, design basis reconstitution of 68
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter i
i setpoint calculations, conversion to Improved Technical Specifications, and response to GL 96-01) has provided high confidence in the quality of our surveillance procedures. Inputs to l
surveillance procedures from the Setpoint Control Program and other engineering programs are controlled and effective.
Our procedure change processes include references to other programs and processes to assure that the impacts of procedure changes are reviewed and acceptable to maintain compliance with design and licensing bases. Our design control process, described in response (a),
includes provisions to ensure that changes to plant configuration are not put into service until associated changes to operating, maintenance and test procedures are implemented.
QA assessments of procedures for operations, maintenance, and engineering described in response (b) concluded that procedures are adequate and procedural use and compliance is satisfactory.
Corrective Action In response (d) we described the corrective action process for the DAEC. The process provides a low threshold for identification of problems. It includes procedural requirements to evaluate an issue for effect on operability of plant structures, systems, and components. It includes a check for repo-tability in accordance with NRC regulations, including 10 CFR 50.72 and 10 CFR 50.73. It has clear criteria for management review and approval of corrective actions. It considers the significance ofissues to initiate root cause determinations. Solutions teams form multi-departmental or inter-disciplinary teams to 1
evaluate complex issues.
The DAEC corrective action program has been evaluated by internal and external agencies as a strength. The Action Request system is considered to be a very good process.
l Performance Trend In 1991, DAEC received a Strategic Assessment of Licensee Performance (SALP) report with Engineering rated as a SALP Category 3 - the minimum acceptable rating for operating a nuclear power plant. In October,1991, the NRC conducted a Moditied Operational Safety Team Inspection (OSTI) at DAEC that concentrated on the Engineering /rechnical Support and Maintenance areas with a lesser focus on Safety Assessment / Quality Verification and Plant Operations (See IR 91-17 dated November 21,1991). The purpose of the inspection was to focus on troubled areas from the SALP report. Inspectors noted that the DAEC had instituted significant changes in procedures and programs, and had increased staffing in order 3
to improve performance. The report concluded that the plant personnel, including those newly hired, were knowledgeable and professional, and capable of operating the plant safely.
The report stated that, because the new programs, processes and personnel had only been in place for a short time, the inspection team was unable to assess the effectiveness of the new processes and programs Most deficiencies identified in the report had occurred before these 69
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter processes and programs were instituted. The Inspectors, however, stated in the report that the new processes and programs " looked promising."
We believe the promise has been borne out. In the most recent SALP report, Engineering received a rating of SALP Category 1. This same trend is also visible in the assessments and audits described in response (c). Although we continue to End problems and weaknesses. we take corrective action, then measure and monitor its effectiveness. Over time, the signincance of weaknesses has become less. Tne increased number ofissues and problems being documented in the AR system also reflects the lower threshold for initiating corrective actions and improvements in the processes for identifying problems.
Culture In response (c) we included two sections describing the cultural characteristics of Management Oversight and Questioning Attitude. Recent industry issues have cited poor management response to employee concerns, inadequate management attention or prioritization of work, and/or a lack of knowledge of design and licensing bases. This motivated the inclusion of these topics.
Managers and supervisors are involved in daily activities related to plant operations, and maintenance. They establish expectations and goals and receive status and trending reports on performance to these goals. Charters for the Operations Committee and Safety Committee involve plant managers and senior personnel in reviewing and monitoring the effectiveness and safety of plant activities. Managers have proceduralized responsibilities for oversight of the corrective action program.
Management alone cannot implement effective controls on plant design and con 6guration.
This depends on our staff, including operations, maintenance, engineering and support groups, having the commitment to quality, adherence to procedures and willingness to identify problems and opportunities for improvement. We encourage these traits through training and routine communications. Procedures are only a part of the process that makes this happen; but we believe that the DAEC team has established an effective environment to promote this culture. We encourage a questioning attitude and self verification. We commit resources to monitor industry developments. We provide members of our staff to support audits of other utilities, and to participate in industry initiatives and committees. We provide an employee safety concerns program to handle issues when an employee wishes to report a concern anonymously. Our record of self-identiHeation ofissues and response to those issues is positive evidence that this safety culture exists and is working.
Fina'iy, the trend in our performance history shows that the DAEC has made significant progress during the last 5 years. Our continuing improvement efforts have paid offin safety system performance and a reduction in the frequency and signiGcance of problems. At the same time, these efforts have contributed to improvements in plam reliability and ef6ciency.
70
Duane Arnold Energy Center Response to NRC 10 CFR 50.54(f) Letter 1
The results of all of these efforts provide reasonable assurance that the current proce.sses and programs are effective in ensuring that the configuration of the DAEC is consistent with its design bases.
-Y
.i 71