ML20134L590
| ML20134L590 | |
| Person / Time | |
|---|---|
| Site: | Cooper  |
| Issue date: | 02/14/1997 |
| From: | Horn G NEBRASKA PUBLIC POWER DISTRICT |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| References | |
| NLS970036, NUDOCS 9702190219 | |
| Download: ML20134L590 (71) | |
Text
-
GENERAL OFFICE Nebraska Public Power District Nbl$
G.R.Hom Senior Vice hesident of Ene,yy Supply NLS970036 February 14,1997 U.S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, DC 20555
Subject:
Request for Information Pursuant to 10CFR50.54(f) Regarding the Adequacy and Availability of Design Jases Information Cooper Nuclear Station, NRC Docket No. 50-298, DPR-46
Reference:
- 1) Letter to W. R. Mayben (NPPD) from J. M. Taylor (NRC) dated October 9,1996, same subject.
- 2) Letter NLS970027 to NRC from G. R. Horn (NPPD) dated February 10,1997, same subject.
Gentlemen:
The Nebraska Public Power District (District) herewith provides its corrected response to the NRC's October 9,1996, request for information concerning the adequacy and availability of design bases information (Reference 1). Subsequent to mailing our original response (Reference 2), errors resulting from editing and repagination were discovered that affected several pages of the attachment.
Therefore, a complete corrected response is being submitted to replace the Reference 2 response.
The District has completed a number of efforts that, together with several key programs and processes, collectively provide the rationale for concluding that ADY[I Cooper Nuclear Station (CNS) is configured and operated in accordance with its design bases. These efforts are detailed in the attachment.
I, The District assembled a team with representatives from Engineering, Operations, and the Nuclear Licensing and Safety (Licensing) departments to provide the requested information for this response. The team retrieved information from the various process, program, and procedure owners; assembled a variety of past internal and NRC assessment documents; and reviewed, summarized, and assembled this information into detailed responses to each of the five specific 9702190219 970214
~
PDR ADOCK 05000298-rhTrrr.n m -
n=======
=
= - - -
= - - - - - -
i p
1
)
U.S. Nuclear Regulatory Commission l
February 14,1997 Page 2 of 4 i
t i
information requests. The accuracy of the responses was then verified by the
[
same process, procedure, and program owners. The Chief Executive' Officer (CEO) of the District has been involved in the process in an overview capacity, has met with the team on two occasions, and has been thoroughly briefed on the scope, methodology, and content of the response. While the CEO was significantly involved in reviewing drafts of this response, he was not involved in the past j
j events discussed in the response, or in the recent process improvements. For that reason and because the signatory to this response was deeply involved in past events and solutions, the CEO delegated the responsibility for the response letter to l
the District's Senior Vice President of Energy Supply.
s As discussed in greater detail in the attachment, the District has completed several l
efforts to collect, identify, and verify design bases information, and validate its 4-5 implementation into plant configuration and procedures. Improvements have been j
made recently to configuration control processes to ensure continuing maintenance of the design bases, and to the CNS Corrective Action Program to ensure ongoing 4
identification and correction of design bases and other issues. Other efforts have i
been completed that provide additional confidence in specific focus areas.
t 4
j The programs and processes that control the Cooper Nuclear Station (CNS) design l_
bases, plant configuration, corrective actions, and the Updated Safety Analysis i
Report (USAR) are not static. The District appreciates and understands the need to I
maintain configuration control of the CNS design bases and has therefore revised and enhanced its programs and processes in this area over the past few years to i
address problems identified through its own internal assessments and NRC reviews.
l Some of these process improvements are fairly recent. The District recognizes that i
I additional enhancements to these programs may be warranted based on future l
l internal assessments, and ongoing NRC developments. As the District continues to l
assess and improve its performance in this area, it will make changes to applicable programs and processes as necessary.
l I
The District recognizes that there may be minor inconsistencies and ambiguities in L
old design documents and the USAR, and that to achieve superior performance, j
CNS must continue to examine its practices in a self-critical fashion and make i
improvements where needed. The preliminary results of the recent NRC Safety System Functional Inspection (SSFI) identified some additional examples of minor i
.USAR inconsistencies and ambiguities. Although the identified issues are i
considered of minor safety significance and did not affect plant operability, the l
District has awarded a contract to perform a comprehensive USAR update and l
validation. The District will provide a detailed description of the scope of this i
l i
J 1
- - ~ - -
I 1
2 U.S. Nuclear Regulatory Commission February 14,1997 Par,a 3 of 4
-i i
project by March 31,1997. In addition, the ongoing Phase 3 Performance Improvement Plan and the Business Plan focus on continuing improvement. We i
believe that the completion of the Phase 3 Performance improvement Plan, i
implementation of the Business Plan, and the USAR update effort will enhance the j
?
District's configuration management efforts further and will help CNS achieve its goal of top quartile performance.
If you have any questions on the District's response to this request for information, please call Philip Graham, Vice President Nuclear Energy, (402)825-5769 or Brad Houston, Manager Nuclear Licensing, (402) 825-5819.
Respectfully submitted,
)
y. Ho D 4
Sen r Vice President of Energy Supply
/kbt j
Attachment cc:
Regional Administrator i
USNRC-Region IV 1
Director USNRC-NRR 4
Senior Project Manager i
USNRC-NRR Project Directorate IV-1 Senior Resident Inspector USNRC i
Nuclear Energy Institute J
j NPG Distribution ti a
4 l
6 U.S. Nuclear Regulatory Commission February 14,1997 Page 4 of 4 i
STATE OF NEBRASKA)
)
PLATTE COUNTY-
)
Guy R. Horn, being first duly sworn Jeposes and says that he is an authorized representative of the Nebraska P.sblic Power District, a public corporation and political subdivision of the State of Nebraska; that he is duly authorized to submit this response on behalf of Nebraska Public Power District, He says that he has read the contents of the attached letter and, in reliance on the processes discussed in the letter, hereby affirms that the statements contained herein are true to the best of his knowledge, information and belief.
i
/m Gu' orn a
Subscribed in my presence and sworn to before me this I
/M* day of MdYuan,/
,1997.
lf( Y $ A b A NOT RY NBLIC
~
Ml****d h l,
RITA L.PrlASTERER j
@ MyComaEmDec.It,lege i
My Commission expires 'd/ /
t 94
Attachment to NLS970036 Page i of ii Table of Contents Executive Su m marv..........................................
1 Response to ltem (a)
.........................................4 (a).1 Design Control....................................... 4 (a).1.1 Modification Process.............................. 4 (a).1.2 Temocrarv Modification............................
6 (a).1.3 Engineering Evaluation.............................
7 (a).1.4 Design Verification
...............................9 (a).2 Configuration Control Processes..........................
10 (a).2.1 Design Criteria Documents.........................
10 (a).2.2 Design Calculation Control.........................
10 (a).2.3 Svstem Comoonent Checklists......................11 (a).2.4 Protective Tagging...............................
1 '
(a).2.5 Post-Maintenance Testing..........................
13 (a).2.6 Procurement Document Control......................
14 j
(a).2.7 Reolacement Comoonent Evaluation
..................14 (a).2.8 Drawing Control Process
..........................15 (a).3 50.71(e) Process. USAR Undates.........................
15 (a).4 10CFR50.59 Safety Review
............................16 (a).5 Quality Assurance
..................................17 (a).6 Engineering Self Assessment............................
18 Response to ltem (b)
........................................19 (b).1 Procedural Controls...................................
20 (b).1.1 Procedure Change Process.........................
20 (b).2 Procedure Verification Efforts............................
22 (b).2.1 Design Criteria Documents.........................
22 (b).2.2 Surveillance Test Validation Program..................
23 (b).2.3 Logic Svstem Functional Test Review
.................23 (b).2.4 Maintenance Procedure Uograde.....................
24 (b).2.5 System Comoonent Checklist Verification
..............25 (b).2.6 Emergency Ooerating Procedures Develooment...........
25 (b).2.7 Inservice Testing Program
.........................27 (b).2.8 Motor Ooerated Valve Program......................
27 (b).2.9 Vendor Manual Program...........................
28 (b).2.10 Fire Protaclion Program
...................29 (b).3 Assessments /Insoections...............................
29 (b).3.1 Self Assessm ent................................
2 9 (b) 3.1.1 Limited Scooe USAR Review.....................29 (b).3.2 N R C Asses sment................................
3 0 (b).3.2.1 Service Water Svstem Ooerational Performance insoection. 30
. - -. - ~ - - -. - - - - -. - - - -
d i
L Attachment to 1
NLS970036 Page ii of ii I
(b).3.2.2 Restart Readiness insoection
.....................30 l-(b).4 Generic items.......................................
31 l
(b).4.1 Station Blackout Rule..............................
31 (b).4.2 Reactor Vessel Water Level Instrumentation in BWRs......
32
.i (b).4.3 Debris Plugging of Emergencv Core Cooling Svstem Suction i
Strainers
.....................................32 Response to ltem (c)
........................................34
}
(c).1 Performance improvement Plan
..........................34
{
'(c).1.1 System Readiness Reviews.........................
35
[! -
(c).1.2 Plant Configuration Verification......................
36 (c).1.3 Surveillance Test Validation Pro 9 tam..................
37
}
(c).1.4 Inservice Testing Program
.........................37 i
i (c).1.5 Logic Svstem Functional Testing.....................
37 (c).2 Design Criteria Document Program........................
39 (c).2.1 Drawing Verification Pro _iect........................39 i
(c).2.2 Design Criteria Document Develonment Program..........
39
~
(c).3 Other Configuration Verification Efforts.....................
43 (c).3.1 Pre-conditioning
................................43 (c).3.2 Seismic Qualification.............................
43 (c).3.3 Environmental Qualification Program
..................44 (c).3.4 Motor Onerated Valve Program......................
45 (c).4 Plant Status Control..................................
46 (c).4.1 Limiting Conditions for Ooeration Tracking..............
46 (c).4.2 Work Planning. Scheduling and Control
................47 j
(c).4.3 Surveillance Testing..............................
48 (c).4.4 Pl a n t To u r s....................................
4 9 (c).4.5 Accident Analysis and Nuclear Safetv Ooerational Analvsis i
U pd ate..........................
............49 (c).5 Additional Ongoing Efforts..............................
50 (c).5.1 Anoendix R Prooram Evaluation......................
50 (c).5.2 Imolementation of the Imoroved Technical Snecifications....
50 (c).5.3 Setooint Control Program Ungrade....................
51 (c).5.4 Imolementation of SAFER /GESTR Analysis..............
51 (c).5.5 Unauthorized Modifications.........................
51 Response to ltem (d)
........................................54 (d).1 Corrective Action Program..............................
54 (d).2 Reportability Determinations
............................58
- (d).3 Part 21 Notifications............. !....................
5 9 (d).4 Operating Experience Review............................
59 (d).5 Inf9mpi. Reports.....................................
61 Response to ltem (e)
........................................62
l s
4 j
Attachment to NLS970036 i
Page 1 of 65
+
1 l
Executive Summarv i
Cooper Nuclear Station (CNS) is a General Electric (GE) BWR Model 4 with a Mark I Containment. The station was designed by Burns and Roe, Inc. (B&R) and the turbine i
generator set was furnished by Westinghouse Electric Corporation. The original Final Safety Analysis Report (FSAR) was submitted in 1971 under Section 104 (b) of the Atomic Energy Act of 1954, as amended, and the regulations in effect at that time.
The station began commercial operation on July 1,1974.
{
Since CNS began operation, the District has implemented many changes to the design i
of the plant to improve safety and reliability, or to implement repairs or replacements.
l These modifications have been implemented in response to self-identified concerns, industry initiatives, and regulatory issues. Initially, the FSAR was not systematically updated to reflect all the changes that were implemented. The FSAR was not required to be updated until 10CFR50.71(e) was promulgated. The information regarding prior modifications was retrievable, but it was not always efficiently I
retrievable.
Since the initial submittal of the Updated Safety Analysis Report (USAR) in January 1983, the level of detail in the CNS USAR and other design-related records has j
increased. CNS has taken steps to improve design-related records and design control processes. Some of these process improvements are fairly recent. Therefore, CNS recognizes that further enhancements to these processes may be warranted in the j
future.
Since the mid-1980s, CNS has developed programs to better document its design 3
bases, to ensure the plant design satisfies the design bases, and to ensure that the
)
plant is operated in accordance with the design bases. CNS has also enhanced plant change processes to ensure that final design documentation is maintained current with the plant configuration. The principal design-related programs are discussed in section (a) below. Details regarding the implementation of these programs, as well as 1
other related initiatives, are discussed in the responses to the specific information requests, as appropriate. Internal and external assessments of CNS design practices in the early 1990s identified weaknesses in design control and configuration management. Since then, CNS has made improvements to these processes to 4
address the identified weaknesses, e
The District's efforts in performing drawing verifications, developing the Design Criteria Documents (DCDs), upgrading the plant change and configuration management processes to maintain the plant configuration consistent with the physical plant, and implementing the Phase 1 and 2 Performance improvement Plans represent significant efforts to ensure CNS is configured and operated in accordance
Attachment to NLS970036 Page 2 of 65 with the design bases. These efforts also ensure that controls are sufficient to maintain that configuration. The drawing verification project produced "as-built" Control Room plant drawings. The DCD development ver!fied the plant design against the updated drawings, the USAR, and the design bases. These efforts identified many discrepancies, and it is recognizer' that other discrepancies may still exist. The Phase 1 Performance improvement Plan addressed significant issues identified by internal and external assessments that had to be resolved prior to plant startup in 1995, such as Design Control and Configuration Management, Procedural Control, Engineering Support, Corrective Action Program, Work Control and Plant Testing. The Phase 2 Performance Improvement Plan addressed additional performance improvement actions in areas such as conduct of operations, surveillance program, plant configuration, and integrated planning and scheduling.
Collectively, these efforts, along with the current processes for controlling design and plant configuration, provide reasonable assurance that CNS is configured and operated in accordance with its design bases and that there are no safety significant issues at CNS. Internal assessments and audits since the completion of the Phase 1 and 2 Performance improvement Plans also indicate improved performance, including our ability to self-identify and correct problems. In addition, the District's current Phase 3 Performance Improvement Plan provides continued focus on performance improvement.
Specifically, the Phase 3 Plan refocuses improvement efforts from shorter-term issues to address long-term, strategic direction. It establishes an overall framework for improving CNS performance, starting with the vision and top level goals, and translates them into strategies with associated implementing programs. The Phase 3 Plan will transition into the CNS Business Plan. The District is confident that the completion of the Phase 3 Performance Improvement Plan, implementation of the Business Plan, and the USAR update effort will enhance its configuration management efforts and will help CNS achieve its goal of top quartile performance.
The District assembled a team with representatives from Engineering, Operations, and the Nuclear Licensing and Safety (Licensing) departments to provide the requested information for this response. The team retrieved information from the various process, program, and procedure owners; assembled a variety of past internal 6nd NRC assessment documents; and reviewed, summarized, and assembled this information into detailed responses to each of the five specific information requests.
The accuracy of the responses was then verified by the same process, program, and procedure owners. An independent review was then performed to validate the responses.
The District recognizes that there may be minor inconsistencies and ambiguities in old design documents and the USAR and, to achieve superior performance, CNS must i
Attachment to NLS970036 Page 3 of 65 continue to examine its practices in a self-critical fashion and make improvements where needed. The preliminary results of the recent NRC SSFIidentified some additional examples of USAR minor inconsistencies and ambiguities. Although the identified issues are considered to be of minor safety significance and did not affect plant operability, the District will perform a comprehensive USAR update and validation. Together with the ongoing Phase 3 Performance Improvement Plan, implementation of the Business Plan, and the USAR update effort will enhance the District's configuration management efforts further and will help CNS achieve its goal of top quartile performance.
Attachment to NLS970036 Page 4 of 65 (a) Description of engineering design and configuration control processes, including those that implement 10 CFR 50.59,10 CFR 50.71(e), and Appendix B y
to 10 CFR Part 50.
Response to item (a)
Overview Internal and external assessments of CNS design practices in the early 1990s identified weaknesses in design control and configuration management. Since then CNS has made improvements to these processes to address the identified weaknesses. The efficacy of recent process improvements has not been demonstrated. The forthcoming refueling outage may identify the need for additional enhancements to these processes. Currently, CNS controls its design and configuration through several interconnecting processes which address 10CFR50.59, 10CFR50.71(e), and 10CFR50 Appendix B. These processes provide defense in depth through administrative controls to ensure that plant structures, systems, and components conform to design bases and licensing basis requirements, and that the plant's physical and functional characteristics are consistent with the design bases and other plant documents (e.g., drawings, procedures). The principal processes, as described below, are augmented by training and independent reviews, s
(a).1 Design Control l
10CFR50 Appendix B and design-related ANSI standards provide the basis for the CNS design control processes. There are three principal processes that are used to implement changes to systems, structures and components: the Modification Process; the Temporary Modification Process; and the Engineering Evaluation Process. These processes are briefly described below.
(a).1.1 Modification Process A change which alters the design, configuration, function, or method of j
performing the function of a structure, system, or component (SSC) is i
considered a station modification. Development and implementation of station modifications are described and controlled by Engineering Procedure 3.4, " Station Modifications." Procedure 3.4 defines the level of documentation required for a station modification, as well as the procedure used to document the station modification. Procedure 3.4 also directs the user to other engineering procedures, depending upon the SSCs affected by the proposed modification.
_. _ _ _. ~ _. _
i Attachment to f
NLS970036 l
Page 5 of 65 Modification Packages are prepared by CNS engineering personnel or a i
qualified contractor. When appropriate, a team of engineers may be used l
for complex modifications. The engineer develops the design from a variety i
of design input documents including: industry codes, standards, design i
specifications, vendor manuals, drawings, DCDs, calculations, Technical i
Specifications, the USAR, Licensing commitments, etc. Design activities may result in the preparation of new or revised calculations, drawings, and specifications. The engineer also initiates changes to other documents that are impacted by the proposed modification (e.g. operating, maintenance and surveillance procedures, USAR), orders material, establishes installation requirements, and specifies any post modification testing requirements. A variety of checklists has been developed to help the enginee :dentify affected documents and required reviewers.
if required, the engineer also prepares a 10CFR50.59 Safety Review using the process discussed in section (a).4 below. The engineer then coordinates the multi-discipline design review which may include Operations, ALARA, System Engineers, Program Engineers, Maintenance, Fire Protection, Training as appropriate, and an independent review by Quality Assurance.
These groups evaluate aspects of the proposed modification that affect their areas of expertise. Also, an independent design review, described in section (a).1.4 below, is to be performed if required.
The modification package, the 10CFR50.59 Safety Review, and any procedure changes requiring revision that have the potential to affect nuclear safety are presented to the Station Operations Review Committee (SORC)
I for review and approva.
The engineer then forwards the modification package to Work Planning.
Work Planning develops the installation package based on the engineer's 3
instructions and their knowledge of construction practices. The engineer reviews the installation package to ensure that the package will properly install and test the modification, and that the installation instructions correspond with the assumptions and conclusions in the 10CFR50.59 Safety Review.
The engineer provides technical support for the installation, testing, and field changes. The engineer also verifies that the installation was correctly performed, acceptance criteria were met, and any deficiencies were resolved and documented. After the installation is completed he coordinates an as-built" review of the modification and updates any documentation affected by field changes. Affected documents could include instructions, procedures,
n Attachment to NLS970036 Page 6 of 65 drawings, design specifications, calculations, or other configuration
}
documents.
i Following installation and testing, the engineer prepares a completion report that summarizes the work performed, the results of the testing, and any additional changes to documents including databases and programs as a 3
result of the modification. After review by Engineering Management, the j
completion report is sent to Nuclear Records for distribution and storage.
l An engineer's knowledge and experience is evaluated by his supervision, and l
is supplemented as necessary prior to the engineer being allowed to independently perform a design modification. To supplement these basic skills, CNS provides plant specific training on its design bases and licensing i
basis, and on the applicable codes, standards, and specifications. Initially, design engineers prepare modifications under the guidance of more 3
experienced qualified design' engineers 'who train them in the process and j
management's expectations for completeness and accuracy. After i
satisfactory performance, the engineer will be qualified by his supervisor to l
perform modifications independently. Engineers performing independent design reviews must also have this qualification. Contractors preparing modification packages must have their work reviewed by a qualified design t
enc.4eer or must be qualified in accordance with the CNS requirements.
(a).1.2 Temocrarv Modification rn
[
Temporary minor alterations made to the plant are considered Plant Temporary l
Modifications (PTMs). Examples of PTMs include items such as lifted leads,
. electrical jumpers, fuse removal, etc. Procedure 2.0.7, " Plant Temporary Modifications," provides requirements for controlling and documenting PTMs for safety-related and non-safety-related systems.
This procedure requires the originator to identify the reason for the PTM, the expected duration, the equipment and functions that are affected, and reference 4
applicable drawings, procedures, and design documents. The originator must i
also provide appropriate change requests for Control Room drawings and/or procedures affected as part of the PTM package, identify if any Technical l
Specification Limiting Conditions for Operation are required to be entered due to
}
installation of the PTM, and provide instructions for installation or removal of the PTM. The originator may request assistance from Engineering or Operations in the preparation of the PTM package.
5 The on-duty Shift Technical Engineer (STE) and the on-duty Shift Supervisor or 1
Control Room Supervisor, with assistance from the System Engineer, or i
~
i l
B Attachment to NLS970036 Page 7 of 65 i
assigned engineering personnel perform the PTM Technical Review and prepare
}
the Safety Review, if required. The originator or the originator's supervisor
)
' resolves the reviewer's comments and presents the PTM package to SORC.
j.
SORC approves PTM packages prior to installation. SORC's primary responsibility is to review the PTM for issues relevant to nuclear safety (i.e., to assure nuclear safety implications are recognized and properly dispositioned).
The Shift Supervisor has overall control of PTMs during his assigned shift. He reviews the PTM package to ensure that it is complete, that all required reviews l
and approvals have been obtained, and that it is compatible with existing plant conditions. He then determines how the installation will be verified, and implements any Special Instructions or Technical Specification requirements.
1 PTMs are then installed in accordance with the instructions included in the PTM package.
l Procedure 2.0.7 also requires periodic reviews of PTMs. The Shift Supervisor l
ensures a monthly plant PTM review is performed. The monthly review l
consists of an inventory of the PTM tag storage, a check of all affected Control Room drawings and procedures to ensure they are properly updated, and a physical check of accessible installed PTMs. Design Engineering reviews the
{
log to identify those PTMs that are no longer needed or are past their expected l
j duration. If it is determined that a PTM should be made permanent, Design Engineering initiates a modification package.
In the past, temporary alterations to the plant that could not be categorized as 3
minor were to be documented as Temporary Design Changes (TDCs) per j
Procedure 3.4.4. However, management has limited its use to the close out of j
existing TDCs such that no new TDCs are permitted. New non-minor j
temporary modifications are now being made using the previously described Modification Process.
a j
j (a).1.3 Engineering Evaluation (EE) i Plant SSCs which require repair or are in a condition that is not appropriately j
i supported by any engineering, design basis, or design output document are i
dispositioned by an evaluation in accordance with Procedure 3.4.5, j
" Engineering Evaluation." An EE can also be used to authorize specified non-essential modifications that require configuration document control, 1
authorize removal / scrapping of items no longer required to be in place, or document the evaluation of a technical issue where such evaluations are not i
part of an established process, program, or procedure. There are several I
categories of EEs which are briefly described below:
I l
l
_ _ _ _.. _ _ _ ___ _ _.. ~ ~ _.- _ _ _ _ _ _.. _ _ _ _. _
i Attachment to NLS970036 Page 8 of 65 Use-As-Is Engineering Evaluation (UAIEE) - An evaluation that authorizes the e'
use of an acceptable design configuration that already exists but either has no defined design basis or does not conform to an existing design basis, i
Repair Engineering Evaluation (REE) - An evaluation that authorizes restoring equipment to a condition that allows reliable and safe function, even though the equipment may.not conform to the original design specifications. The REE updates the component specification.
Rework Engineering Evaluation (RWEE) - An evaluation that authorizes the i
restoration of an existing unauthorized design configuration to the approved i
and authorized configuration.
i
. Scrap Engineering Evaluation (SEE)- An evaluation that authorizes the I
removal from service of an item that is no longer required to be in place, without replacement of the item.
Configuration Control Engineering Evaluation (CCEE)- An evaluation that authorizes the implementation of inconsequential non-essential modifications i
(i.e., there is no direct or indirect impact on nuclear safety or essential SSCs where configuration control is desired.
j Informational Engineering Evaluation (IEE) - An evaluation that is used to document the evaluation of a technical issue where such evaluations are not part of an established program, procedure, or process. For example, the Corrective Action Program provides the format and content requirements for evaluating problems, the Surveillance Program provides a method of j
evaluating test discrepancies, and Procedure 3.4.7, " Design Calculations,"
provides guidelines for preparing, reviewing, approving, and controlling design calculations. An IEE can include mathematical computations which support the evaluation provided they are independent of any approved l
calculation and are not required to be documented as a design or licensing basis calculation.
The responsible engineer contacts the cognizant system engineer and other involved and affected individuals (e.g., craft personnel, Operations, Radiolopbel/ALARA, applicable program owners, etc.) to review the proposed EE. The responsible engineer then performs a walk-down of the affected SSCs, if applicable. The responsible engineer issues a copy of the EE to Quality Assurance, the engineering supervisor, the system engineer, and the applicable program owners. Quality Assurance reviews all EEs prior to implementation, excluding CCEEs and IEEs. If required, an Independent Design Review is then performed as described in section (a).1.4 below. After all comments are
i i
Attachment to l
NLS970036 l
Page 9 of 65 i
resolved, the EE is approved by the cognizant engineering supervisor or i
designee. _ EEs that require an Unreviewed Safety Question Evaluation are i
presented to SORC for review and approval.
The responsible engineer coordinates the procurement, construction, 1
installation, and post-modification testing of the EE, if applicable, and ensures that the associated documents (procedures, drawings, calculations, etc.) are i
updated, as necessary.
i (a).1.4 Desian Verification The extent of the design verification, when required by the modification process f
or the temporary modification process, is a function of the safety significance l
of the item under consideration, the complexity of the design, the degree of standardization, and the similarity with previously proven designs. Where changes to previously verified designs have been made, design verification is i
required for the changes, including evaluation of the effects of those changes on the overall design.
In accordance with Procedure 3.4.8, " Design Verification," the Design Engineering Supervisor determines which design verification method is used and i
who performs the' design verification. Acceptable verification methods are l
Individual or Group Design Reviews, Alternate Calculations and Qualification Testing. Design Verification by individual Review is performed by an individual
[
design verifier. When the document being reviewed involves more than one discipline, the design verifier may request that the other disciplines provide l
supplemental verifiers to provide assistance on their portion of the document.
Design Verification By Interdisciplinary Review is performed by a team of -
designated individuals with a lead design verifier. The team is composed of i
individuals with collective expertise to provide an adequate evaluation of all engineering design aspects of the system or structure. Design Verification By j
Alternate Calculations may be performed to verify the correctness of the j
original calculations or analyses. When alternate calculations are performed, a review is also required to address the appropriateness of assumptions, input data, and code or other calculations method used. Design Verification By Qualification Testing may be performed with a prototype or initial production unit. This testing is to be performed under the most adverse design conditions.
Design verification by this method is considered to be a method of last resort and is used only when no other method is suitable.
The design verifier and/or team members review the applicable design input attachment and verify that the documents used for the basis of the design are appropriate and reflect the latest information available. The design engineer i
l
. - _ ~ _ ___
__m j
Attachment to j
NLS970036 Page 10 of 65 4
then revises the document being reviewed, as necessary. to incorporate changes that result from the design verification.
(a).2 Configuration Control Processes In addition to the design control processes described above, the District has
{
several administrative controls to ensure that the plant configuration is maintained I
j in accordance with the design bases and that the design documents are maintained I
consistent with the physical plant. Configuration Controlincludes topics such as:
i l
decign criteria, design calculations, drawings, fire barriers, excavations, l
environmental qualification, safety and relief valves, instrument setpoints, and
'l l
motor operated valves. The principal programs and practices that maintain plant
)
configuration control are described below.
(a).2.1 Design Criteria Documents (DCDs) i 1
The District is maintaining the Design Criteria Documents as a living program.
4 Each document undergoes a formal review and is updated periodically. Since original development, each DCD has been subjected to a multi-disciplined effectiveness review. This review involved critical design engineering l
l personnel, as well as other users, such as Operations and System Engineers.
j
.These reviews resulted in a critical evaluation of the existing content of the j
DCDs and an assessment of the enhancements that would make these documents more valuable to end users.
9 The plant change processes include the requirements necessary to ensure that i
the DCDs are maintained as design bases and design description information is j
changed. The procedures governing the processes for station modifications, i
calculations, and others require that the DCD be utilized and be updated to
[
reflect the post-change configuration and requirements. In addition, over the past several years, mant gement has realized the importance of maintaining the l
design bases available and accessible. The engineering culture at the plant has i
improved such that the DCDs are recognized as an important source of design j.
information that must be maintained.
l (a).2.2 Design Calculation Control l
Engineering Procedure 3.4.7, " Design Calculations," establishes the guidelines i
for preparing, checking, reviewing, design verifying, approving, and controlling I
design calculations. This procedure applies to the preparation of all non-essential and essential design calculations, including those related to new j
designs and design reviews. The preparer is responsible for searching for 4
i 4
a Attachment to Ni.S970036 Page 11 of 65 existing design calculations that already cover the SSC to be addressed and for associated calculations that may be affected by this new or revised calculation.
The preparer also screens the design calculation to determine if additionalinput from personnel is needed due to potential effects to plant operations or procedures. In addition to preparing the design calculation, the purpose, assumptions, methodology, conclusion, references, and attachments are also provided. The preparer also reviews applicable DCDs and if any changes are required, completes a DCD Change Request per Procedure 3.32.1. The final step in the process is to submit the entire design calculation package, including attachments, to the Engineering Supervisor for approval after it has been signed by Preparer, Checker, and Design Verifier.
(a).2.3 System Comoonent Checklists Plant system lineups and component positions are controlled by component j
checklist procedures for individual systems. These checklists dictate the i
position of the applicable component as directed by General Operating, System Operating, and Instrumentation Operating Procedures. These checklists were developed to verify that the plant is configured in accordance with the design.
bases. System line-ups and component positions are verified to be consistent with these checklists a minimum of once per operating cycle. Furthermore, Administrative Procedure 0.31, " Equipment Status Control," contains additional requirements for performing component checklist verifications after maintenance and outages (refueling and non-refueling).
Procedure 0.4, " Procedure Change Process," controls the initiation, review, and approval of system checklists. This process contains provisions to assure that design bases requirements are adequately reflected in station procedures. In
. addition, Administrative Procedure 0.31, provides instructions for maintaining equipment status control along with Operations Procedure 2.0.2, " Operations Logs and Reports," which controls locked and sealed valves. Administrative' Procedure 0.9, " Tagging Orders," provides guidance for the preparation and use of Tagging Orders, Caution Tag Orders, and Test Tag Orders. Together, these procedures establish and maintain equipment configuration in the field.
(a).2.4 Protective Taoping Protective Tagging at CNS is an important aspect of maintaining plant configuration consistent with the design bases during all modes of plant operation. Procedure 0.9, " Tagging Orders," controls the initiation and use of protective tagging at CNS. Proper use of Tagging Orders ensures personnel and equipment protection, prevents inadvertent equipment operation, and controls configuration during maintenance, testing, and operational activities. The Shift
l Attachment to NLS970036 4
l Page 12 of 65 Supervisor determines that a Tagging Order does not violate any procedure or Technical Specification Limiting Conditions of Operation before authorizing the placement of tags. Tagging Orders used at CNS include:
Clearance Order (danger tags)
=
Danger tags and associated documents are used to safely isolate equipment for repairs, testing, etc. Clearance Orders are used when it is required that equipment not be in service or used without the knowledge of all personnel involved, to ensure personnel and/or equipment safety.
l Caution Tag Order
=
Caution tags and associated documents provide a temporary means of:
a) Notifying station personnel of additional precautions or instructions that affect safe operation of station equipment.
b) Identifying and tracking components that are not in their normal position and are not being controlled by any other station procedure or
- process,
)
l A Caution Tag Order is only concerned with the operation of station equipment, not with personnel safety. When personnel safety is involved, a Clearance Order is used.
Test Tag Orders Test tags and associated documents provide a means to allow non-operations personnel, directly associated with a test, to operate designated plant components during certain SORC approved testing (e.g.,
i Local Leak Rate Testing (LLRT), Motor Operated Valve (MOV) testing, hydrostatic testing, etc.). Test tags are concerned with system line-ups during testing and are not used to provide for personnel safety.
As previously stated, Tagging Orders are important for maintaining plant configuration. To ensure that components affected by Clearance Orders, Test Tag Orders, and Caution Tag Orders are returned to their proper configuration, j
all components which physically change position are independently verified to be returned to their correct position. If a component is not returned to its normal position and is not being controlled by another station procedure or process, another Clearance Order or Caution Tag Order is generated to document and track the component's status. The normal position of
_ _ _ _.. ~ -_ _ _ _.. _ _. _.
O Attachment to NLS970036 Page 13 of 65 components is dictated by individual System Operating Procedure Checklists.
These checklists are used to determine the normal position of components when releasing Tagging Orders. This process ensures that the plant configuration is returned to its design bases configuration.
Only those persons certified as Tagging Order Performer may hang and pick up Tagging Orders. Only those persons certified as Tagging Order independent l
Verification may perform the Independent Verification for Tagging Orders.
)
Operations, l&C, and Radiological Department personnel may be required to l
manipulate valves in accordance with Procedure 0.31 during performance of j
Tagging Orders.
(a).2.5 Post-Maintenance Testina (PMT)
Procedure 7.0.5, " Post-Maintenance Testing," establishes a process for the consistent selection, performance, and documentation of Post-Maintenance Testing (PMT) to ensure that: 1) equipment will perform its intended function when returned to service following maintenance activities; 2) the original deficiency is corrected; and 3) a new deficiency has not been created. The Maintenance Work Planners specify the required PMT when they prepare the Maintenance Work Request (MWR). The Engineering Department reviews and approves the PMT.for equipment affected by codes or Technical Specifications prior to maintenance. This review ensures incorporation of testing required by the applicable codes and Technical Specifications. Engineering Department assistance may also be requested for complex tasks even where no code or Technical Specification requirements apply. Operations Department may also assist Maintenance and Engineering in specifying appropriate PMT.
The Operations Department ensures the PMT is properly authorized, performed, and documented prior to returning the equipment to service. Operations also ensures that all delayed tests are performed prior to or in conjunction with returning the equipment to service, makes the final equipment operability determination prior to returning the equipment to service, and restores systems and components to their correct operating or standby configurations following testing.
The supervisor responsible for the work reviews the completed PMT to ensure that the results have been properly recorded, and any discrepancies have been resolved. Discrepancies may be editorialissues that are corrected by a procedure change, or they may require a Problem identification Repoit (PIR) and evaluation under the CNS Corrective Action Program.
4 i
Attachment to NLS970036 Page 14 of 65 (a).2.6 Procurement Document Control i
1 a
l Design control measures include the review for suitability of application of items that are essential to the safety-related function of the system involved. CNS j
procedures define the applicable requirements and processes for procurement of 1
spare parts, materials, equipment, and services for essential nuclear systems.
These procedures include provisions for assuring that the necessary quality requirements are incorporated directly into the procurement documents for
}-
essential spare parts, materials, equipment, and services. These procedures i
1-also include provisions for assuring that the necessary records are specified and
(
provided to the District by the supplier to ensure the components, equipment j
and services meet the requirements for the application.
I 1
In those instances where the normal methods of procurement cannot be i
applied, it may be necessary to purchase " commercial grade" items for use in
- essential applications. Verification is performed to ensure that the part utilized l
is functionally acceptable for the essential application. This verification may
.l j
-include dedication upon receipt, analysis, or other definitive methods.
l i'
Procurement procedures require an independent Quality Assurance (QA) review i-of " essential" and " quality commercial grade" purchasing documents; QA i
I review and approval of suppliers; and QA audit of contractor and supplier l
activities. This includes revisions to procurement documents.
All suppliers of safety-related items or services to CNS are required by the District to implement a Quality Assurance Program which complies with the applicable portions of 10CFR50 Appendix B or perform their activities under the i
District's Quality Assurance Program. The Quality Assurance Programs submitted by the suppliers are evaluated by District QA to assess whether they l
meet the criteria established in 10CFR50 Appendix B.
i (a).2.7 Reolacement Comoonent Evaluation (RCE) Process 4
Procedure 3.25, " Replacement Component Evaluation," is used to evaluate j
replacement of component / parts with equivalent spare component / parts. An i
engineer performs an equivalency evaluation comparing the critical l
specifications for the original component to the specifications for the i
replacement. If this evaluation determines that the replacement 1
component /part is equivalent to the original component /part, the replacement j
j can be performed as a maintenance activity, rather than a change in the facility, j
and does not require a 10CFR50.59 evaluation.
1 i
)
i' d
)
i Attachment to NLS970036 Page 15 of 65 (a).2.8 Drawina Control Process Procedure 3.7, " Drawing Change Notice," provides guidance for the -
preparation, review, approval, and control of Drawing Change Notices (DCNs).
j' Two types of DCNs occur; those associated with the modification process and j
those not associated with the modification process. The modification process procedurally requires that a 10CFR50.59 Safety Review be performed. Any DCNs performed as a result of the modification are enveloped by the modification package's Safety Review. The modification package therefore
^
ensures that the CNS licensing and design bases are maintained. DCNs not associated with a modification package (stand-alone DCNs) are evaluated in I
accordance with Procedure 3.4.5, " Engineering Evaluations." The Engineering Evaluation determines if the proposed drawing change requires a separate 10CFR50.59 Safety Review. Stand-alone DCNs may be initiated to correct labels, close DCD open items, or update affected drawings that were not l.
identified in the original modification package. Routinely, identified i
discrepancies between the drawings and the physical plant configuration, j
licensing documents, and/or design documents are evaluated through the l
Corrective Action Program described below in the response to item'(d).
(a).3 50.71(a) Process. USAR Undates i
i l
Prior to the promulgation of 10CFR50.71(e), the FSAR was not normally updated on a routine basis, in January 1983, the first update to the FSAR was submitted 4
i to the Commission. At that time, a formal process for USAR updates had not been developed. Changes to the USAR were initiated by various methods, often by means of a memo. However, in 1986, Procedure 0.29, " Administrative Control of I
License Amendments," was developed to provide direction for the implementation of changes to both the USAR and the Technical Specifications. Under this l
procedure, a change to the USAR could be requested by anyone working in or for j
the Nuclear Power Group (NPG) and was submitted to the Licensing Manager for processing.
l i
In late 1995 the need for additional process improvement was identified.
Subsequently, the District developed Procedure 0.29.2, "USAR Change Requests,"
i to strengthen the controls on the USAR change process. The most significant
{
aspect of this new procedure was the requirement that a USAR change request be l
accompanied by a SORC-approved 10CFR50.59 Safety Review when it is
[
. submitted to Licensing. Formerly, this expectation was not clearly defined by procedure.
j Any individual working in or for the NPG may initiate a USAR change request. In accordance with Procedure 0.29.2, the initiator must identify whether required 3
i 4
h
3-Attachment to i
NLS970036 4
Page 16 of 65 changes to the facility have already been completed or provide an anticipated a
i completion date. This practice ensures that changes to the USAR are incorporated i
at the appropriate time. The appropriate Department Manager reviews the change I
request and ensures a supporting 10CFR50.59 Safety Review is provided. The j
10CFR50.59 Safety Review must be approved by SORC before the change request is processed by Licensing.
Similarly, the process for incorporating drawing changes to USAR figures has also j
been strengthened over the past year. USAR drawing changes could previously be made without a 10CFR50.59 Safety Review. This practice is no longer allowed.
USAR change requests affecting USAR figures must be accompanied by an appropriate SORC-approved 10CFR50.59 Safety Review.
The District recognizes that its previous controls over the USAR were not sufficiently rigid to prevent USAR inaccuracies. Therefore, the District plans to perform a comprehensive USAR update and validation effort.
(a).4 10CFR50.59 Safety Review The CNS 50.59 evaluation process was recently revised to' enhance the process and to address changes in regulatory expectations. This process is controlled by Administrative Procedure 0.8, " Safety Assessments and Unreviewed Safety Question Determinations." Individual change processes such as the modification i
process, setpoint change processes, or the drawing change process, specify when a 10CFR50.59 Safety Review is required. Safety Review is a new term which describes the three separate evaluations briefly discussed below.
The Safety Analysis describes the proposed change and evaluates the impact on safety. The originator of the change must prepare, or have prepared, a Safety Analysis. It includes nuclear, industrial, radiological, and personnel safety. If the review determines the activity is not safe, compensatory measures must be taken to make the activity safe or the change will not be implemented. The preparer distributes the Safety Analysis for review. The disciplines required to review the document are selected based on the technical or administrative expertise required to evaluate the proposed activity. The preparer then completes an Applicability Screen.
The Applicability Screen determines, for example, if the proposed change is a change to the information in the USAR, or a test or experiment not previously described in the USAR. If the answer to any of the screening questions is yes and the preparer is not directed to another change evaluation process (such as a revision to the Security Plan or Emergency Plan), the proposed change must be evaluated under the scope of 10CFR50.59.
4 i
Attachment to 1
NLS970036 i
l Page 17 of 65 j
l The Unreviewed Safety Question Evaluation addresses the questions in i
10CFR50.59 on margin, probability, and consequences of an accident, if the evaluation determines that the proposed change is an unreviewed safety. question, NRC approval is required prior to implementing the change. The Safety Analysis,
)
j
'the Applicability Screen, and the Unreviewed Safety Question Evaluation, if required, are assessed by an independent safety reviewer for completeness and the 4
accuracy of the conclusions. The complete package is then presented to SORC
{
with the proposed change for final review and approval as required by the j
individual change processes.
4 1
i Supervisors are responsible for assigning trained and qualified preparers and independent reviewers to perform Safety Reviews. Five lessons are currently l.
required prior to obtaining this certification: Licensing Basis Orientation; Codes, l
l Standards, and Classification; Chapter 14 and Appendix G Accidents; Transient and Overpressure Protection; and 10CFR50.59. - In addition, trainees must i
complete a functional qualification guide before they are certified to work independently.
l (a).5 Quality Assurance (QA) i Separate lines of responsibility are maintained between those responsible for the operation of Cooper Nuclear Station and those responsible for Quality Assurance l.
oversight. The QA program documents identified below describe the implementation of the requirements of 10CFR50 Appendix B. The design and configuration control processes previously described also incorporate the relevant requirements of 10CFR50 Appendix B.
1 Quality Assurance Program for Operations (Policy Document) - This document translates the requirements of Appendix B and describes generally how CNS is to l
meet those requirements. Within this document is a description of the applicable requirements and commitments associated with design control and configuration
]
management. In addition to describing some fundamental design control requirements this document describes the applicable standards and portions of i
standards that CNS is committed to with respect to design control.
i Quality Assurance Plans (QAPs)- The purpose of a QAP is to define the nature and i
j extent of QA for the specified area and to provide criteria to be used in carrying out the QA audit and surveillance functions associated with that area. There are five QAPs: QAP 1.0, " Plant Operations"; QAP 2.0, " Maintenance"; QAP 3.0,
)
" Engineering"; QAP 4.0, " Plant Support"; and QAP 5.0, " Diverse Activities and f
Programs." QAP 3.0 includes a table which shows the enteria of 10CFR50 Appendix B and describes the general expectations for those criteria considered j-applicable to Engineering activities.
m _
m
.m i
Attachment to NLS970036 Page 18 of 65 Scheduled and unscheduled audits are conducted to assess the effectiveness of the performance of programs and personnel within the scope of the CNS QA Program. District Management may request audits of specific activities of concern to them. Audits are performed in accordance with written instructions or checklists and conducted by trained personnel not directly responsible for the areas being audited. Upon completion of the audit, a formal report is prepared and transmitted to the organization audited, which includes an evaluation statement
)
regarding the program's effectiveness. All audit findings identified are documented and appropriate follow-up actions are taken to assure that corrective action has been implemented.
(a).6 Engineaniisa Self Assessment In February 1996, CNS performed an Engineering Self Assessment using the guidance in NRC Inspection Procedure 37550. The purpose of this essessment was to evaluate the effectiveness of the Engineering Division to perform routine and emergent activities, including the identification and resolution of technical issues and problems. The assessment identified several improvements due to the relocation of Engineering to the plant site, allowing more effective interaction and integration with the plant. However, the assessment results also indicated that the Engineering reorganization and the transition toward meeting the new Engineering -
j mission were incomplete and several areas needed further significant improvement.
i An integrai part of the assessment was a vertical slice assessment of the Emergency Diesel Generator and High Prassure Coolant injection (HPCI) systems.
)
The purpose of the vertical slice assessment was to determine if the design organization had established and communicated system margins, their limits and i
interrelations, to the appropriate plant organization. Also, vertical slice assessment j
was to determine if the plant organization ned incorporated this information in j
procedures and established clear references to the design bases. The results of the j
vertical slice of HPCI and Emergency Diesel Generator systems indicated that each of these systems can perform its intended function in accordance with the design bases.
Station management initiated action plans to address the Engineering Self Assessment findings and improve performance in these areas. As described previously, the Safety Review process has been enhanced. The design change process was streamlined, and management expectations for Operability Assessments have been promulgated. The remaining corrective actions are being j
pursued through the Phase 3 Performance improvement Plan and other ongoing initiatives.
.-=.
=
1 t
Attachment to NLS970036 Page 19 of 65 (b) Rationale for concluding that design bases requirements are translated into operating, maintenanec, and testing procedures.
Response to item (b)
Overview Station procedures are a part of the District's method for ensuring the safe and reliable operation of the plant and for ensuring that the plant is operated consistent with its design bases and license requirements. These procedures provide administrative controls so that work can be performed consistently and with minimal additional instruction or interpretation. It is expected that procedures will be followed in all facets of our work. Deviation from or omission of procedural steps is not t
acceptable unless otherwise specifically stated in the procedure. In the event that an i
unforeseen situation occurs, or the procedure cannot be performed as written the user is expected to stop and inform supervision. If a procedure change is necessary, one will be made in accordance with Procedure 0.4, " Procedure Change Process," before work resumes.
To ensure that the plant design bases are adequately transferred into station procedures when a change to design is made, CNS's design change programs and i
processes require that affected procedures be revised (or created) to reflect the modified design. Procedure changes must be made in accordance with CNS's procedure change process which includes various checks and balances to ensure that the station design is correctly translated. Once changes are identified, the procedure J
change process transfers the new or modified design information into station procedures which ultimately ensures safe plant operation. The District's procedure change process is described in more detail in section (b).1.1 below. In addition, other processes, such as Design Calculations, Relief Valve Setpoint Control, instrument Setpoint and Meter Banding Control, Relay Setpoint Control, and DCD Program, also ensure that station procedures adequately reflect the design by requiring a review of associated procedures to ensure they remain unaffected or are changed as necessary.
Operating, maintenance, and testing procedures were developed for CNS and have evolved with plant modifications, enhancements, and upgrades. The accuracy of the j
translation of the design bases into procedures has been verified by a number of efforts including the development of the DCDs, the Surveillance Test Validation Program, and others as described in section (b).2 below. The District's design change processes, procedure change process, and the various verification efforts conducted since 1994 provide the District with reasonable assurance that CNS's design bases requirements are translated into operating, maintenance, and testing procedures.
I
Attachment to NLS970036 Page 20 of 65 (b).1 Procedural Controls The District's procedure change process is designed to ensure that design bases information is translated and maintained in station procedures when procedures are revised or generated. This process is briefly described below.
' (b).1.1 Procedure Chance Process Procedure 0.4, " Procedure Change Process," controls the initiation, review, and approval of all operating, maintenance, and testing procedures. This process has matured over time and in 1995 major improvements were made to the program. These improvements consisted of the establishment of procedure owners and the development of verification and validation instructions. The establishment of procedure owners was an important improvement because it established accountability for the technical content of procedures and provides for a consistent and thorough review of procedure changes. The verification i
and validation instructions and their importance are described in more detail below.
Procedure 0.4 provides two principal flow paths for approval; the instant process and the standard process. The instant process is limited in scope to non-intent changes such as obvious errors, thus disallowing changes that would affect the design bases. This process allows for approval by two Senior -
i Reactor Operators (SROs), with post-implementation reviews by the procedure owner, SORC, and the Plant Manager.
The standard process requires SORC approval for all non-editorial changes to procedures that could affect nuclear safety. This process has the procedure owner develop the change package and identify all necessary actions required prior to implementation. These actions include:
- 1. Identification of procedures requiring concurrent implementation;
- 2. Performance of 10CFR50.59 Safety Review;
- 3. Performance of 10CFR50.54(q) review;
- 4. Performance of verification and validation (see below);
- 5. Determination of pre-implementation or post-implementation actions, such as, training, computer updates, and component line-up changes;
Attachment to NLS970036 Page 21 of 65
- 6. Determination of appropriate cross-disciplinary reviews.
l_
The procedure owner ensures all identified actions are completed, any j
. comments are resolved, and SORC approval is obtained prior to implementation of the procedure change.
i' As stated above, SORC approval is required for all procedure changes that could affect nuclear safety. Procedure 0.3, " Station Operations Review l
Committee," describes and governs SORC activities. SORC review / approval l
typically focuses on:
4 l
Safety aspects of the item, change, or modification including the installation, pre-installation, and post-installation, as applicable.
l Technical aspects of the change or itern, as they relate to the potential I
impact to the safety aspects of installed plant equipment or facilities, j
operator actions, or systems interactions.
Adequate completion of the item or document (required signatures, forms -
completed, questions answered, and attachment of pertinent references).
I-SORC comments / directions may take any of tiie following forms:
l, Discussion of any or all aspects noted above.
F Identification of inadequacies in the Safety Review or lack of a proper j
l Safety Review.
t j
Identification of editorial errors or suggested editorial clarification l
changes.
1 identification of omissions, errors, or inconsistencies that require revision or correction.
When procedure changes have the potential for affecting the design bases or configuration control, procedure owners implement a design verification and procedure validation in accordance with Procedure 0.4. Design verification is i
performed by personnel assigned by Design Engineering. The verification j
checklist ensures that design bases and configuration control documents, such as the USAR, DCDs, calculations, etc., are unaffected by the change. Any j
deficiencies identified during this verification are resolved prior to procedure approval. Procedure validation is performed by personnel assigned by the procedure owner. As a minimum, the validation checklist ensures that the I;
1 Attachment to NLS970036 Page 22 of 65 procedure conforms to the CNS procedure writers guide, commitments are met, and acceptance criteria are correct. Procedure owners and reprosentatives have been trained on the need to maintain design / configuration control and implementation of the verification and validation of procedure changes when appropriate.
Additionally, periodic procedure reviews are performed in accordance with
^
Procedure 0.4 to check for correct application / incorporation of setpoints, vendor recommendations, Technical Specifications, station modifications, I
acceptance criteria, component lineups, etc. The specific periodicity for procedure reviews is maintained on a computerized procedure tracking program and is generally once every five years. This process involves comparing the procedure to the applicable documents and, if necessary, conducting physical walkdowns to ensure the procedure is correct. These reviews provide further assurance that the design bases are correctly translated into procedures.
i (b).2 Procedure Verification Efforts In addition to the controls the District maintains over procedures, CNS has j
implemented several programs and performed efforts that have verified that the design bases have been translated into procedures. These programs and efforts are described below.
(b).2.1 Desian Criteria Documents As described in more detail in section (c).2.2 below, CNS developed Design Criteria Documents (DCD) which compiled design bases information for certain systems. This proceduralized effort consisted of the collection, verification, and 4
validation of design bases information for plant safety systems, selected non-safety systems, and a number of specific topics. As part of the validation process associated with DCD development, the DCD was compared against operating and surveillance procedures. The operating and surveillance procedures for the selected system were reviewed for two purposes. First, the 4
procedures were reviewed and compared to ensure that the plant is operated and tested in accordance with its design bases. The secondary purpose was to ensure that the procedures were consistent with other documents, such as the Technical Specifications, USAR, and drawings. This review consisted of a review of operating and surveillance procedures to verify that specific design criteria was correctly translated into the procedures. This process verified that, for those procedures reviewed, the design had been properly translated into operating and surveillance procedures.
Attachment to NLS970036 Page 23 of 65 (b).2.2 Surveillance Test Validation Proaram (STVP)
In 1994, the STVP was initiated to verify that surveillance test procedures appropriately tested the design functions of systems and contained the proper-acceptance criteria, consistent with the design bases. This program was a component of the District's Phase 1. Performance improvement Plan, initially, the objective was to validate surveillance precedures for Core Standby Cooling Systems (High Pressure Coolant injection, Core Spray, Residual Heat Removal (RHR), and Automatic Depressurization System); the Reactor Protection System; the Standby Gas Treatment (SBGT) System; the Control Room Heating, Ventilation, and Air Conditioning (HVAC) System; and the Reactor Building HVAC System. However, because this program identified deficiencies, the decision was made to expand the program to all existing surveillance procedures. This review was completed in March 1995.
The STVP consisted of a line-by-line review of the USAR, Technical Specifications, IST, ASME code, and NUREG-1482, as applicable. A comparison to surveillance procedures was conducted to ensure all testing requirements were being met. Deficiencies were identified that ranged from minor procedural enhancements to missed testing requirements to USAR errors and Technical Specification enhancements. Identified deficiencies were screened for safety significance and the appropriate process (procedure change, licensing change request, etc.) was implemented to correct the deficiency.
However, during the course of preparing this response letter it was determined that approximately 90 deficiencies were apparently not brought to documented closure. The items represented minimal safety significance and did not affect plant operability. Most of the Technical Specification enhancement items will be closed by the conversion to improved Technical Specifications (NUREG-1433). CNS took action to resolve these remaining open items through procedure changes, drawing changes, USAR changes, etc.
(b).2.3 Loaic System Functional Test Review (LSFT)
The District has confidence that CNS design for logic systems is translated into testing procedures because the District has reviewed these procedures against the design. The District initiated a LSFT review as part of the corrective actions for a Condition Report (CR 94-0245). This review was designed to ensure that logic system relay and switch contacts required to be tested were being appropriately tested. The scope of this review included a comparison of the electrical schematic and logic diagrams to surveillance procedures and Technical Specifications. The review was validated and verified against the USAR, DCDs, Technical Specifications, and other documents to ensure it was complete and thorough. A comparison was also made to the Surveillance Test Validation
f i
d Attachment to l
NLS970036 Page 24 of _65 Project (discussed above) which validated that the logic system functional test review performed was thorough.
i Subsequently, Generic Letter (GL) 96-01, Testing of Satety-Related Logic Circuits, was issued. Since the LSFT project had already been completed, only.
the modifications performed since the completion of the LSFT project were evaluated. Out of 145 modification packages screened,19 required detailed i
l reviews. The review concluded that the existing test procedures were acceptable and that the modification process is effective in translating design requirements into relay and switch contact testing.
(b).2.4 Maintenance Procedure Unarade The District's maintenance procedure upgrade effort is yet another check that ensures design is translated into procedures or that the design is not being changed by procedures.
In 1994 the District began a Maintenance Procedure Upgrade Project. The original objective of this project was to enhance and ensure the administrative j
and technical adequacy of approximately 250 maintenance procedures. This initial scope was based on procedures screened as possibly inadequate. As the project developed; however, more than four hundred maintenance procedures were reviewed and revised. The project team also reviewed and revised several program procedures as well as developed several new program and maintenance procedures. Several examples of these new procedures are:
Trouble Shooting Plant Equipment, Protective Relays Setting and Testing Program, Limitorque Maintenance, Relay Testing and Maintenance, Valve Packing Maintenance, Bolting and Torque Program, and Rotating Equipment Alignment.
To perform these procedure upgrades the project team reviewed and compared Technical Specifications, the USAR, Vendor Manuals, industry events, the QA policy document, and the procedure writer's guide to ensure these upgrades
)
were accurate. All changes that were more than just of an editorial nature were I
walked down to ensure correctness. These procedures were then sent to I
appropriate engineering personnel for their review and approval of the changes.
These procedures were then reviewed and approved by the procedure change l
process in place at that time. This project was completed in the Fall of 1995.
The Maintenance Procedure Upgrade Project provides the District with reasonable assurance, for the maintenance procedures reviewed, revised, or generated, that station design bases requirements are adequately maintained during plant maintenance activities.
i Attachment to l
NLS970036 Page 25 of 65 (b).2.5 System comoonent Checklist Verification i
System Component Checklists are an important aspect of maintaining plant configuration control. These procedures control the configuration of all plant systems (valves, breakers) and are used to verify system configuration on a j
routine basis, at least once per cycle, and after returning equipment to service j
following protective tagging. Based on self assessment findings in 1994, the
[
District conducted several reviews prior to the startup from the 1994/1995 l
outage in order to ensure that system component checklists maintain and reflect CNS's design. These reviews are briefly described below.
l As pilot systems, the District compared and verified configurations for the B l
RHR Loop (Low Pressure Coolant injection (LPCI) mode only) and the SBGT i
system. The results of these comparisons would then be used to determine if other system reviews would be performed. For the B RHR loop (LPCI mode i
1 j
only) and the SBGT system the District performed a comprehensive review that j
involved comparing valve, switch, breaker, and damper positions against system component checklists and against design documentation to determine j-whether the system and its associated checklists were consistent with design.
Several minor discrepancies were found and corrected. Due to the small number (6) and minor nature of the discrepancies, the District concluded further i
e j
system design reviews were not warranted.
Due to concerns surrounding the translation of design requirements from plant modifications into system component checklists the District also conducted a l
review of past station design changes against the associated system component checklists. Approximately 1900 design changes were reviewed
- I dating back to the early 1970s. Discrepancies were identified which required procedure changes. The types of discrepancies found included missing i
components, incorrect component positions, and incorrect component descriptions. These discrepancies were addressed by the appropriate change
{
process. Other aspects of this effort are discussed in section (c).1.2.
j Collectively, these reviews provided another means of ensuring the design has been correctly translated into system checklists.
l l
(b).2.6 Emergencv Ooerating Procedures Develonment i
CNS Emergency Operating Procedures (EOPs) were developed from the generic BWR Owners Group Emergency Procedure Guidelines (EPGs). This i
develry> ment involved comparing CNS's design with the generic EPGs and j
incorporating that design into the EOPs. This development and implementation ensured that CNS's design was properly translated into the CNS EPGs. CNS j
EPGs, which form the basis for CNS EOPs, incorporated plant-specific data 4
6
t Attachment to I
NLS970036 Page 26 of 65 derived from various design and licensing related documents (Technical i
Specifications, USAR, Calculations, etc.) and drawings. This data ranged from equipment configuration unique to CNS, to specific design parameters or
[
limitations. All plant-specific parameters that were transcribed into the EOP l
l development effort were documented and independently verified by the EOP development team for accuracy and applicability. Calculations were performed using Procedure 3.4.7, " Design Calculation," for those plant-specific parameters 4
requiring a supporting calculation. In accordance with this procedure, these
]
calculations received an independent in-house Design Engineering review, i
l assuring that the calculation reflected the current plant design bases.
1' During development, a verification and validation (V&V) was periumed to assure the technical accuracy and usability of the CNS EOPs. The verification process included a line-by-line review of the CNS EPG, CNS EPG Deviations / Justifications Document, and EOPs to ensure that all plant-specific
{
data was accurately translated and consistent with CNS design. It also ensured that the CNS EPG and EOP strategies were consistont with the generic -
i guidelines, and that deviations were identified and evaluated appropriately. The validation process ensured the EOPs were usable and understandable.
L At the final stage of the project, an EOP maintenance process, Procedure 0.22, I
"EOP Maintenance Program," was developed to ensure EOPs remain consistent l
with CNS EPGs and BWR EPGs, and with changes to plant design and -
1 j
operation. This ongoing process is assisted by searchable databases that can be used to assess the impact to EOPs during Operations review of design 4
modifications.
l Additionally, Procedure 3.4, " Station Mod;fications," has provisions to assure EOPs remain consistent with the plant design bases. The process requires Design Engineering to review the proposed modification for impact to CNS EOPs by completing a checklist as part of the modification package. This establishes a flag to perform an in-depth review for EOP impact and initiates procedure revisions as necessary.
These processes and administrative controls provide the District with confidence that the CNS design is translated into the EOPs -- an important set of procedures for dealing with postulated plant events and accidents.
A NRC inspection (IR 88-200) reviewed the EOP development documents, operator training, the V&V process, conducted walkdowns, and observed table-top EOP scenarios. The inspectors concluded that the EOPs were technically accurate, their actions could be physically carried out, and that the plant staff could correctly perform the procedures. The NRC team identified a number of
- - - -..-..-. ~. - _.-.- -.,
i-Attachment to l
NLS970036 l
Page 27 of 65 weaknesses relating to the development and implementation of the EOPs.
These weaknesses were corrected and satisfactorily reinspected (IR 90-06).
(b).2.7 Inservice Testing Program (IST)
[
Another effort that verified the translation of design bases into testing l
l.
procedures was the development of an Inservice Testing Basis Document and l
F completion of Phase 1 Performance improvement Plan, Action item 6.2. These efforts consisted of a complete review of the IST Program and the ASME XI boundaries prior to startup from the 1994 outage in response to testing issues identified by the District and the NRC.
l 1
Phase 1 Plan Action Item 6.2 was implemented to improve four key areas in the l
lST program. One of these key areas was the establishment of a link between i
the design bases and the IST acceptance criteria and assurance of the adequacy j
of the IST surveillance test program.
l l
The existing IST program and test procedures were evaluated using a draft IST l
l Basis Document to identify and resolve discrepancies with the design bases, l
and any inaccuracies in relief requests. This evaluation was accomplished by comparing the IST procedures and relief requests to the draft IST Basis Document and the design bases. The draft IST Basis Document was developed i
to update the IGT Program for the next inspection interval using the guidance in l
l NUREG-1482, " Guidelines for Inservice Testing at Nuclear Power Plants,"
l design bases documents, and licensing basis documents. Since the update of
{
the program was not completed at that time, the IST Basis Document was still I
considered a draft. The discrepancies were evaluated. Where needed, additional testing to resolve discrepancies was performed prior to startup and new relief requests were prepared and submitted to the NRC. Following 4
[
omissions.
i
{
This effort ensures that the IST program and procedures are consistent with the
{
design bases.
i (b).2.8 Motor Ooerated Valve Program (MOV)
[
The District has developed and implemented a MOV program in response to NRC Bulletin 85-03, GL 89-10, and its supplements. This program reviewed I
the design bases for selected MOVs and established a testing program to I
i demonstrate that MOV performance meets design bases requirements. It also established controls to maintain MOV configuration and to ensure that future 4
.,--.---,,m
-n_
-y
,J
- -. - - - - = - -
1 r
i i
Attachment to
~
NLS970036 j
Page 28 of 65
)
performance remains in accordance with the design bases. As part of the continuing implementation of this program, procedures have been developed or upgraded to ensure that MOV performance continues to meet design bases s
requirements.
Engineering Procedure 3.33, " Motor Operated Valve Program," was developed 4
to provide the programmatic controls necessary to maintain MOVs. Concurrent i
with the irt.plementation of Engineering Procedure 3.33, was the establishment 3
l of a controlled MOV Program configuration database. This database is controlled by Procedure 3.33.1, " Operating the MOV and Configuration Database," and contains both valve and actuator configuration information which can be used, as necessary, when developing or revising MOV related j
station procedures. Additionally, Procedure 7.C.11, "Limitorque Actuator _
l Configuration Control," and the Limitorque maintenance procedures provide the l
1 necessary guidance for maintaining MOV actuator configuration.
4-j In 1996, the NRC concluded in its GL 89-10 closure inspection of the District's
[
MOV program (!R 96-10) that CNS had appropriately implemented GL 89-10
[
l and that the program was strong and had greatly improved from previous inspections. According to the NRC, this was exhibited by excellent j
assessments of MOV failures, a good trending program, a well specified i
program for post-modification and post-maintenance testing, and precise and j
comprehensive engineering efforts to demonstrate the design bases capability j
of the program valves.
I j
(b).2.9 Vendor Manual Program Preventive maintenance is another aspect of maintaining the design of plant
]
f equipment. Preventive maintenance is performed in accordance with procedures that are based, in part, on vendor recommendations. The control l
and processing of vendor information can be found in Engineering Procedure i
3.11, " Vendor Manual Control Process." This procedure ensures that up to
{
date vendor manuals are available for reference during procedure development, l
I troubleshooting, and work package development.
l-A vendor contact / interface program was first established at CNS in 1987 in L
response to NRC Generic Letters (GL) 83-28 and was later modified to meet GL l
90-03 and GL 90-03 Supplement 1. The scope of the CNS periodic vendor contact program covers safety-related components within the Nuclear Steam Supply System (NSSS) and key safety-related components. In 1994, the j
vendor manual program was extensively revised to bring the program up to j
current industry standards.
i i
,,,,e,m n
r-,, -
. = _
I Attachment to NLS970036 Page 29 of 65 (b).2.10 Fire Protection Program The Fire Protection Upgrade Program is another program that has verified the translation of design requirements into procedures. The Fire Protection program at CNS has evolved over the years as a result of changing regulations, regulatory clarifications, industry generic issues, and several self assessments.
Evaluations performed in this area included reviews of station procedures to ensure that fire protection is adequately addressed. These reviews have resulted in enhancements to CNS procedures as well as the District's Fire Protection and Appendix R programs.
in addition, certain issues have been raised in these assessments that have recently caused the initiation of a comprehensive Appendix R validation project.
This project, as described in section (c).5.1 below, provides the District with further assurance that the CNS Appendix R Fire Protection design bases is adequately documented and translated into station procedures.
3 (b).3 Assssaments/insnections j
Assessment / inspection activities at CNS have also verified the translation of design bases requirements into procedures. The more significant assessment / inspection activities are described below.
(b).3.1 Self Assessment (b).3.1.1 Limited Scoce USAR Review i
in early 1996, the District conducted a limited scope USAR review of two systems: HPCI and RHR. All applicable USAR sections and associated operating procedures were first identified for the systems in question. Then a line-by-line review / comparison of the USAR and procedures was performed to determine whether HPCI and RHR operating procedures accurately reflected plant design as described in the USAR. When findings or questions were identified additional documents such as Technical Specifications, DCDs, drawings, GE Service Information Letters, INPO Significant Event Reports (SERs), and vendor manuals were reviewed. Issues that were l
identified as part of this review fellinto one of three categories.
1 Inaccuracies between documents.
=
Apparent missing, inaccurate, or confusing description (s) in the USAR or procedures.
Implied preventive maintenance not found in station procedures.
Attachment to NLS970036 Page 30_of 65 The identified issues have been entered into the Corrective Action Program and will be resolved through the planned USAR update and validation.
(b).3.2 NRC Assessment (b).3.2.1 Service Water Svstem Ooerational Performance insoection f
In late March and early April of 1994 the NRC conducted a Service Water System Operational Performance Inspection (IR 94-04). The inspection consisted of an examination of various documents including service water system procedures (maintenance, operating, and testing), USAR, Technical Specifications, service water system DCD, drawings, calculations, and representative records. The NRC also conducted interviews and plant walkdowns. Overall, the NRC found that the service water system was capable of performing its intended functions, but the NRC identified examples where the design was not accurately reflected in the output documents, and the system was operated inconsistently with the design as reflected in the updated USAR and in the service water system design criteria document.
In general, the NRC concluded that the procedures were adequate to perform the required system operations although some weaknesses were identified. Specifically, the NRC found that the windmilling operation of the service water booster pumps was inconsistent with the USAR description and procedural guidance was lacking in several areas (pump discharge strainers, river temperature, and certain valve operations). The NRC also
[
found that an evaluation performed to support a design bases temperature change was not adequately reflected in the USAR. Additionally, the NRC reviewed approximately 20 service water system surveillance procedures during this inspection and did not identify any discrepancies. In response, the District revised the USAR and service water system DCD to reflect i
windmilling operations and the new temperature. The District also made
(
several programmatic changes (Operability Evaluations, Procedure Change j
Process, DCD process) to prevent recurrence of the identified deficiencies.
(b).3.2.2 Restart Readiness insoection in March of 1995 the NRC conducted a Restart Readiness Inspection (IR 95-01). The purpose was to determine whether activities at CNS were conducted safely and in accordance with NRC regulations. Additionally, the inspection was to determine if performance was adequate to support restart of the plant. With respect to procedures, the NRC walked through several procedures and found them adequate. Specifically, the NRC walked down t
~.
Attachment to NLS970036 Page 31 of 65 several systems and compared them to their respective component checklists. While several minor errors were identified (wrong locations, missing label plates, and one valve shown twice on a drawing), the NRC did not identify major errors or mis-positioned components. These minor errors have been corrected. Overall, the NRC concluded that improvements to component checklists had been effective.
The NRC also reviewed the adequacy of several operating procedures and found them.to be adequate and operationally sound. Specifically, the NRC reviewed and walked through six procedures concerning the startup and shutdown of the plant and one procedure concerning a shutdown from outside the Control Room. The NRC did find one annunciator response procedure that contained steps inconsistent with having an inerted 1
containment. Thic procedure has been revised. The NRC also reviewed several surveillance procedures and found them to be generally adequate. In other areas, the NRC concluded that the STVP provided increased assurance in the adequacy of surveillance testing and that the IST review was well structured and comprehensive.
l (b).4 Generic items The District has reviewed the translation of design requirements into procedures for specific systems and specific issues. Several examples are provided below.
(b).4.1 Station Blackout Rule (SBO)
In 1988,10CFR50.63 was promulgated which required each light-water-cooled nuclear power plant be able to withstand and recover from a SBO of a specified j
duration. The new rule specified, that for the SBO duration, the plant be capable of maintaining core cooling and appropriate containment integrity. The District evaluated CNS's design against the requirements of the SBO rule using guidance from NUMARC 87-00 and Regulatory Guide 1.155. This evaluation compared the design bases of those systems necessary to mitigate the effects of a SBO (High Pressure Coolant Injection, Reactor Core Isolation Cooling (RCIC), Safety Relief Valves, etc.) against the SBO rule and NUMARC 87-00 to ensure that safe shutdown could be achieved and maintained. Based on this evaluation, the District identified several procedure changes that were necessary to meet the guidelines of NUMARC 87-00. These procedures have i
been revised and implemented per the procedure change process as described above.
In 1994, during a review of valve stroke times, CNS determined that RCIC l
would not meet SBO requirements due to a valve being AC powered I
.__-... ~
Attachment to NLS970036 Page 32 of 65 (Licensee Event Report (LER)94-018). The valve was then modified to be DC powered. Later in 1995, due to an NRC-identified concern, the SBO j
calculations and procedures were reviewed for consistency with commitments (LER 95-013). This review resulted in a procedure revision clarifying HPCI operation and development of a procedure concerning NRC correspondence l
control.
- (b).4.2 Reactor Vessel Water Level Instrumentation in BWRs 1
NRC Generic Letter (GL) 92-04, " Resolution of the issues Related to Reactor 3
Vessel Water Level Instrumentation in BWRs," was issued in' August of 1992.
l The GL requested certain actions to address the adequacy of, and the
{
carrective actions for BWR water level instrumentation with respect to the effect of non-condensible gases on system operation.
J
+
i To address GL 92-04, the District reviewed and analyzed related designs, l
operating history, and procedures. These results were then compared to the l
, GE report on the same issue. Plant walkdowns and enhanced monitoring of BWR Owners Group report on reactor vessel water level instrumentation and a j;
4 vessel water level during plant cooldowns was also performed. With respect to procedures, CNS verified that station procedures provide for proper short-and long-term operator actions during licensing basis accidents and transients.
These procedures were also augmented by special guidance and training.
F (b).4.3 Debris Pluaaina of Emeroenct Com Joolina Svstem (ECCS) Suction i
l Strainers 4
l.
As a result of suction strains clogging events at foreign and domestic BWRs, the NRC has issued several Inrarmation Notices and Supplements regarding ECCS suction strainer clogging ultimately resulting in the issuance Bulletin 93-02 and Supplement 1. In response to the original Bulletin, the District conducted detailed walkdowns of the drywell to identify sources of fibrous material. 'The District also reviewed design documentation and drawings to 4
further identify potential sources of fibrous material. The District identified l.
Kaowool and unjacketed fibarglass insulation in the drywell which was not designed to withstand a Loss Of Coolant Accident (LOCA). The majority of this material was removed from the drywell in 1993. Additional material is -
i scheduled to be removed during the 1997 refueling outage. Furthermore, CNS 1
procedures used to install and remove temporary air filters were reviewed to j
ensure that the proper controls were in place to remove these filters prior to plant startup.
4 4
i i
~
.l
l Attachment to NLS970036 Page 33 of 65 Bulletin 93-02, Supplement 1, summarized the various NRC notices and actions. It also specified additional actions. In response, the District developed and provided detailed training to Operations personnel. The focus of this training was recognizing conditions for and indications of ECCS suction strainer clogging, executing contingency actions for alternate injection, and providing guidance concerning economizing ECCS use. The District also performed detailed procedure reviews to ensure that they provided the proper guidance and actions to mitigate the effects of suction strainer clogging. These procedures were determined to provide adequate compensatory actions.
In late 1995 the NRC issued Bulletin 95-02,." Unexpected Clogging of RHR Suction Strainers." Part of the District's response to this Bulletin involved upgrading CNS's Foreign Material Exclusion (FME) program and procedure.
The District also developed Procedure 0.45.1," Working Over or in Torus,"
which specifically controls FME for the torus.
(
b
Attachment to NLS970036 Page 34 of 65 i
i (c) Rationale for concluding that system, structure and component configuration I
and performance are consistent with the design bases.
t Response to item (c)
Overview The District has completed a number of efforts to provide assurance that CNS plant structures, systems, and components are configured and perform in accordance with the CNS design bases. These efforts include the drawing verification program and the Design Criteria Document development program which together represent a comprehensive collection, review, and verification of the CNS design bases, and validation of the translation of the design bases into plant configuration, programs, and processes. Recent system evaluations, walkdowns, and surveillance procedure validation efforts provide further assurance that CNS is configured and performs in accordance with its design bases. A number of specific system and program evaluations along with the development of new programs provide assurance in specific focus areas that the plant is configured and capable of performing as assumed in the design bases. Collectively, these efforts and programs provide reasonable assurance that CNS structures, systems, and components are configured and will perform in accordance with its design bases. Other specific efforts are ongoing.
These efforts and programs are discussed in further detail below.
(c).1 Performance Imorovement Plan In 1994 a Diagnostic Self Assessment and NRC Special Evaluation Team identified weaknesses that involved the engineering modification process, configuration management, and the corrective action program. In order to address these weaknesses, CNS took several steps to improve management oversight and configuration control. The management team focused on culture changes to identify and fix problems correctly the first time, and implemented improved standards for problem identification and resolution. The District also embarked on a three phase performance improvement plan. Phase 1, completed in February of 1995, focused on the activities necessary to demonstrate that plant operations were safe and that public health and safety were protected. Phase 2, completed in June of 1995, included a complete reorganization of the Engineering Division and relocation of the corporate Nuclear Engineering Department to the site. Phase 3, the long-term, strategic portion of the Performance improvement Plan is currently in progress.
The Phase 1 Plan contained action plans that addressed: Design Control and Configuration Management; Procedural Control; Engineering Support; Corrective
+
~ - - -
Attachment to NLS970036 Page 35 of 65 Action Program; Independent Oversight and Self Assessment; Work Control; Plant i
Testing; and Operational Experience Review.
l The Phase 2 Plan concentrated on reorganizing the Engineering Division, including relocation of the corporate Nuclear Engineering Department to the site; Conduct of Operations; Surveillance Program: Managing the Plant Configuration; integrated Planning, Scheduling and Work Control; Corrective Action Program; and Self Assessment.
The Phase 3 Plan refocuses improvement efforts from shorter-term issues to address the long-term, strategic direction. It establishes an overall framework for p
improving CNS performance, starting with the vision and top level goals, then i
translating them into strategies with associated implementing programs.
i Some of the Phase 1 Action items are described below:
(c).1.1 Svstem Readiness Reviews Prior to restart from the 1994 forced outage, the District performed multi-disciplined team system reviews and walkdowns to provide an added degree of assurance that CNS was prepared to start and support operations to the 1995 refueling outage without incident. This effort was embodied in Action item 4.8 of the Phase 1 Performance Improvement Plan.
Guidelines were developed to perform these system evaluations and walkdowns. These efforts consisted of broad reviews, evaluations and walkdown of systems meeting the following criteria:
Safety-related, Probabilistic Risk Assessment (PRA) evaluated systems; Non-safety-related systems ranked high by the CNS PRA; i
Non-safety-related systems, that have exhibited a history of performance problems; or Non-safety-related systems, that were of significant management concern.
l The applicable Technical Specifications, USAR sections, GE design specifications,,and available DCDs were reviewed to give the review teams a broad knowledge of the system, key functions, operation, components and equipment locations, and to confirm that the system design and operation were I
Attachment to NLS970036 Page 36 of 65 i
l.
consistent with the applicable Technical Specifications, USAR sections, and GE j
design specifications.
L
?
In addition, system operation reviews and walkdowns were performed to j
identify significant conditions or discrepancies which had the potential to i
impact system operability. Any concerns identified during these system reviews and walkdowns were documented and screened to determine whether resolution was required prior to plant restart. Issues screened for action were 1
resolved prior to restart. Perhaps the most significant result of this effort was j
that no new significant material condition or operability concerns were 4
l identified during the multi-discipline system walkdowns, providing some i
i indication of the effectiveness of the CNS Corrective Action Program in identifying potentially deficient conditions. These system evaluations and walkdowns provided an independent assessment of the status of CNS plant system configuration.
i i
(c).1.2 Plant Confiauration Verification j
. As part of the Phase 1 Performance improvemant Plan, the District performed l
j walkdowns to verify that the physical position of valves, switches, breakers, j
and dampers of CNS plant systems were consistent with the system configuration checklists. Additionally, a review of completed CNS design changes was performed to ensure that valve checklists, power supply and i
l breaker indexes had been updated as necessary, valves were shown on the j
affected P&lDs, power supplies were shown on the affected one-line diagrams, i
and the Equipment Data File (EDF) valve descriptions matched the valves l
l installed, size, use, etc. This effort encompassed the review of approximately i
j 1900 design changes dating back to initial operation in 1974.
The results of the design change review were evaluated and identified i
discrepancies were field-verified. The field verification packages included -
i procedure and/or drawing changes, EDF changes, and labeling changes proposed to resolve the configuration discrepancies. The packages were then field-verified to ensure the identified corrective actions were appropriate.
i Following these reviews, the appropriate document changes were initiated.
i i
An outcome of this process.was the development and implementation of new Procedure 0.31, " Equipment Status Control," which provides administrative j
controls for maintaining physical configuration control of plant equipment.
3 This effort provided assurance that valves, switches, breakers, and dampers I
were properly positioned and that procedures controlling the positions reflected the proper component configuration. These efforts assist in providing i
t Attachment to NLS970036 Page 37 of 65 l
reaconable assurance that valves, switches, breakers, and dampers are i
configured in accordance with the design bases.
i (c).1.3 ' Surveillance Test Validation Program As described previously in section (b).2.2, the District recently completed a Surveillance Test Validation Program. This effort reviewed the CNS Technical Specification and USAR system testing requirements against the corresponding surveillance procedures to validate that applicable plant systems are being appropriately tested to demonstrate their design bases capability.
(c).1.4 Inservice Testing Program The District performed a complete review of the IST Program prior to startup from the 1994 outage in response to testing issues identified by the District and the NRC. Also included in this effort was a review of the ASME XI class boundaries.
Two project teams were assigned to this effort. As previously described in section (b).2.7, one team evaluated the IST program and test procedures. The second team was tasked with evaluating and resolving boundary classification discrepancies using the draft boundary basis document and the Equipment i
Safety Classification procedure. The draft boundary basis document was prepared from system isometric drawings, flow diagrams, and design j
documents for the update of the next inspection interval. Regulatory Guide 1.26 and Section 3.2.2 of NUREG-0800 were used for guidance.
Seismic walkdowns of installed equipment and commercial grade dedications were performed to support the classification boundaries. The walkdowns verified that the installed equipment was adequately supported for the design bases earthquake. The dedications verified that the critical characteristics of the equipment were adequate to support the safety function. These activities were also completed prior to startup from the 1994 outage. Follow-up activities resulted in USAR changes to capture the information developed during the boundary reclassification.
(c).1.5 Logic System Functional Testing (LSFT)
Prior to startup from the 1994 CNS forced outage, the District completed a review of the adequacy of the LSFTs. The LSFT review was performed to ensure that safety-related and other operationally significant contacts in logic systems for important system were adequately tested. This review included the following systems:
1
. - - - ~ -
-. - - - ~
i Attachment to NLS970036 Page 38 of 65 4
l
- Standt,y Gas Treatment Reactor Core Isolation Cooling Reactor Bulding HVAC
- Reactor Protection Diesel Generator HVAC
- Control Room HVAC Reactor Equipment Cooling i
Residual Heat Removal Core Spray l
- Alternate Rod insertion
- Fire Protection
- Low-Low Set Automatic Depressurization
- Diesel Generator Lube Oil Standby Liquid Control Diesel Generator Auto Start Diesel Generator Fuel Oil Primary Containment Isolation (Gr 1-7)
Diesel Generator Starting Air Anticipated Transient w/o Scram The elementary logic diagrams for these systems were reviewed agair:st the existing surveillance procedures to determine if contacts which performed a safety-related function or other operationally significant function _were tested in existing surveillance procedures. Since testing of a logic system involves, in many cases, multiple surveillance procedures, a review of individual procedures l
l was performed to confirm overlap with other procedures for a complete LSFT.
The surveillance test scope and overlap points were documented by highlighting j
the logic tested by each procedure on a set of CNS electrical schematic drawings. Where testing was not performed, either appropriate procedures were revised or special test procedures were written, and the logic systems were tested. Following this effort, surveillance procedures were revised as necessary to incorporate testing performed in those special test procedures.
Additionally, as discussed in sections (b).2.2 and (c).1.3, the District performed i
a Surveillance Test Validation Program which ensured that surveillance testing l.
identified in the CNS Technical Specifications and the USAR was adequately i
implemented in the appropriate surveillance procedures. This effort further
}
verified the LSFT effort performed, and ensured that Technical Specification j.
LSFT requirements were adequately implemented. Completion of those efforts and associated testing confirmed the functionality of important CNS logic systems.
Subsequent to this effort, in response to NRC Generic Letter 96-01, " Testing of l
Safety-Related Logic Circuits," the District reviewed the evaluation and testing l
performed during the 1994 forced outage. This review determined that the effort performed during the outage, plus subsequent procedure changes 3
implemented, ensured adequate testing of the Engineered Safety Feature logic l
systems. Modifications implemented at CNS since the 1994 LSFT review were i
reviewed to ensure that any impact to required LSFT were captured, and had been appropriately incorporated into surveillance procedures.
t
)
Attachment to NLS970036 Page 39 of 65 l
t The existing surveillance procedures at CNS are considered adequate in ensuring complete LSFTs as required by the Technical Specifications. They also provide reasonable assurance that the logic circuits of required safety systems i
will perform their intended design function when called upon.
1 (c).2 Design Criteria Document Program The following discussion provides a description of several of the more significant i
efforts completed to ensure CNS is configured and performs in accordance with its 4
design bases.
i l
(c).2.1 Drawing Verification Proiect (DVP)
During the late 1980s and early 1990s CNS completed a program of plant walkdowns. Approximately 240 Control Room drawings, elementary drawings and P&lDs, were walked down and verified against the physical plant. Portions of approximately 1300 associated electrical and mechanical drawings were also verified. These drawings are used for daily operational activities in support of maintenance and testing, and for reference in off normal events and emergencies. Numerous discrepancies between the physical plant and the drawings were identified. Most of these discrepancies concerned minor drawing inconsistencies such as symbols and nomenclature, or missing labels in the plant. These types of discrepancies were corrected via drawing changes, i
labeling changes, or the addition of labels. However, some of the discrepancies identified required further evaluation. These types of discrepancies were evaluated by Design Engineering, and were closed based on additional information in the design records, corrective maintenance, or by revised i
calculations and analyses.
Although the focus of this project was updating the "as-built" status of the plant drawings, system component checklists and the EDF were also updated, terminal and pull boxes were labeled, and cables and fuses were tagged. Some minor, non-safety significant discrepancies from the original list remain open
.and are being addressed through the Corrective Action Program. They will be resolved in accordance with their assigned priority. Ongoing plant work and engineering activities occasionally identify drawing discrepancies which are placed into the Corrective Action Program for resolution.
(c).2.2 Design Criteria Document Develooment Proaram As discussed briefly in sections (a).2.1 and (b).2.1, the District initiated a Design Criteria Document (DCD) Development Program in 1987. The initial program guidelines were revised significantly to incorporate the guidance in
- 9
,v.-,
e
,f v-,
Attachment to NLS970036 Page 40 of 65 NUMARC 90-12, # Design Bases Program Guidelines," and the NRC comments provided in a November 9,1990, letter to NUMARC. The CNS guidelines were eventually converted to plant procedures.
Thirty DCDs have been completed for plant safety systems, selected non-safety systems, and selected specific topics. Develcpment of these DCDs represents a comprehensive collection of the CNS design bases information and a verification of the design bases and validation of the design bases information J
into controlling programs and processes. These efforts provide significant J
assurance that CNS is configured and performs in accordance with its design t
bases.
1 The objectives for developing, verifying, and validating DCDs were to:
l Document the design bases and design criteria for each safety system, along with selected supporting information; Perform verification and provide documented evidence that safety
]
systems can perform their required safety functions; Ensure that the physical plant and selected design documents meet the des;gn bases; and
~
Validate that the plant is operated, maintained and tested in accordance with the design bases.
The development of a DCD was accomplished by first assembling all available information and documentation associated with the selected system. This involved an extensive search of film, hard copy and database records.
Examples of information collected include:
Draft 1967 General Design Criteria j
GE Specifications GE System Descriptions B&R Engineering Criteria Document B&R System Descriptions Original Contract Specifications Calculations and drawings GE Nuclear Safety Criteria for BWRs Cooper Nuclear Safety Operational Analysis FSAR Questions and Answers NRC Safety Guides Preoperational and Startup Testing doeurnentation
Attachment to 3
NLS970036 Page 41 of 65'
- Vendor Specifications, drawings, and calculations Applicable industry Codes and Standards (IEEE, ANSI, etc.)
Other GE NEDO,' NEDE, NEDC and NEDM documents Cooper LOCA Analysis and Operating Plant Limits documents Correspondence with AEC, NRC, GE, B&R and others i
Original Technical Specifications and bases Original NRC Safety Evaluation Report (SER)
Station Modifications NRC Correspondence e
i I
- NRC SERs
[
License Amendments and NRC SERs j~
Setpoint Changes Special Test Procedures NRC Information Notices, Bulletins, Circulars, Generic Letters, and responses INPO Significant Event Reports, Significant Operating Experience Reports, and responses Calculations and revisions to calculations Analyses, evaluations, and studies since licensing
- Vendor Service Information Letters Past and pending Engineering Work Requests i
Licensee Event Reports and NRC Inspection Reports and responses i
During this effort the District also procured available design basec information i
from the original Architect / Engineer (B&R) and NSSS supplier (GE). Qualified teams of engineers were assembled to perform this work. In addition, the District supplemented these teams with ex-employees of GE and B&R who contributed first hand CNS design experience.
- This information was collated, verified, and independently re-verified to ensure the draft DCDs accurately reflected the CNS design bases. The identified discrepancies or questions concerning the ability of a structure, system, or component to meet its design bases were tracked, categorized and resolved in accordance with the open item process developed for use during the project.
Those items verified to be an inconsistency with or failure to meet the plant design bases were entered into the CNS corrective action program for resolution.
The DCDs developed were then validated against the as-built drawings, supplemented by additional field walkdowns as necessary, and other plant equipment and component information developed to ensure that the DCDs reflected actual plant configuration. -Similarly, the DCDs were validated against modifications performed, licensing basis documentation, the USAR, and station
Attachment to NLS970036 Page 42 of 65 procedures to ensure that these accurately reflected design bases information collected.
The District has developed twenty-two system Design Criteria Documents to date. These include all of the essential (safety-related) systems at Cooper Nuclear Station, as well as several risk significant nonessential (non-safety-related) systems. The system Design Criteria Documents completed include:
Service Water Diesel Generators Standby Gas Treatment
{
DC Electric Primary Containment Fire Protection Residual Heat Removal Instrument Air
- Control Rod Drive Standby Liquid Control Neutron Monitoring High Pressure Coolant injection AC Electric Process Radiation Monitoring Nuclear Pressure Relief Control Room Emerg. Filtration Core Spray
- Reactor Protection Reactor Equipment Cooling Reactor Core Isolation Cooling Reactor Vessel Nuclear Boiler Instrumentation The Topical Design Criteria Documents completed to date include:
Internal Flooding Environmental Qualification Secondary Containment Single Failure Station Blackout Electrical Separation High Energy Line Break Electrical Protection Four additional Topical DCDs are under development:
Piping IST Testing Requirements Component Classification Component Cooling The District expects to complete these DCDs by the end of 1997.
The DCD development efforts completed and those currently ongoing represent comprehensive collation and verification of CNS design bases information, and validation of the design information into the CNS plant. These efforts have identified several design bases deficiencies, which the District subsequently corrected. Examples include the identification and correction of a significant design error in the Service Water System impacting its ability to meet its design bases post-accident cooling water flows (LER 93-01), and the identification and correction of a number of containment penetration deficiencies (LER 94-011).
l Attachment to NLS970036 j
Page 43 of 65 The DCD development project represents both a broad and detailed effort to j
ensure that CNS is configured in accordance with its design bases, and to improve availability of design bases information for quality activities. For those DCDs completed, this effort has provided an independent validation of plant configuration to its applicable design bases. For those DCDs not yet fully completed, this validation will provide that independent validation of plant design and configuration as well. These efforts provide an additionallevel of
[
assurance that'CNS is configured and capable of performing in accordance with its design bases.
1 l
(c).3' Other Configuration Verification Efforts (c).3.1-Pre-conditioning i
j-During the 1994-95 outage the District also addressed the potential for pre-conditioning of plant equipment prior to, or during surveillance testing. This 4
l issue concerned operating, stroking, or otherwise changing plant or equipment j
conditions prior to surveillance testing which could mask actual equipment as-
)
found condition. The District reviewed surveillance proc'edures to identify and i
{'
correct pre-conditioning issues, and integrated surveillance testing and 2
preventive maintenance (PM) to address potential pre-conditioning concerns.
!l This effort included a review of surveillance, engineering, instrument and i
control, maintenance, and chemistry procedures to identify and corr 9ct any potential pre-conditioning concerns. Management expectations and philosophy on the issue were communicated to site personnel and have been incorporated into the site General Orientation Training. These actions provide assurance that plant equipment is tested in the as-found condition, and thus provide additional assurance that equipment testing results demonstrate performance in accordance with the design bases.
(c).3.2 - Seismic Qualification Efforts to achieve resolution of Unresolved Safety issue (USI) A-46, Seismic Qualification have resulted in the development of a safe shutdown equipment list, walkdown of systems and components identified therein, and evaluation of these components and their configuration to ensure that CNS can achieve safe shutdown following a safe shutdown earthquake.
The purpose of the Seismic Qualification Utility Group (SQUG) effort is to address USl A-46 at CNS using the Generic Implementation Procedure (GIP).
This methodology, in part, required the District to develop a Safe Shutdown
.. ~ - - -. -. -
. ~. - -.. ~ - - - -.. - -., - - - _ -
4 1
1-Attachment to j
NLS970036 Page 44 of 65 l
Equipment List (SSEL) and perform the necessary walkdowns to ensure that the i
equipment meets the applicable GlP criteria.
i-An independent peer review of the CNS seismic evaluation was performed.
l The review consisted of selecting representative items from the seismic SSEL, performing an independent walkdown of those items, and reviewing the seismic review team's evaluation of these items.
i i
These efforts, including the plant configuration walkdowns, have verified the capability of those plant structures, systems, and components necessary to achieve safe shutdown under design bases seismic conditions.
l (c).3.3 Environmental Qualification Prooram (EQ)
The CNS EQ program represents another program which was developed to i
ensure that plant equipment is capable of meeting its design bases
}
requirements. The EQ program provides the basis for ensuring that given the potential harsh environmental conditions following postulated accidents specific plant events, that safety-related equipment is capable of performing its intended i
function, non-safety-related equipment will not impair safety-related equipment j
from performing its intended function, and certain post-accident monitoring l
equipment is capable of performing its monitoring function.
I Development of the CNS EQ program involved completion of the following j
primary tasks:
l Evaluation of analyzed accidents to identify the systems credited to i
respond to accomplish the required safety functions; Evaluation and classification of each component in these systems to i
identify required safety functions at the component level, resulting in the Q-List; Sorting cf the Q-List to identify safety-related electrical equipment j
required to perform its function while subjected to a harsh environment, resulting in the Master Equipment List (MEL);
~
Identification of Regulatory Guide 1.97 post-accident monitoring equipment requiring qualification to harsh environments; i
Characterization of post-accident environmental conditions for various l
plant areas; I
i
Attachment to NLS970036 Page 45 of 65 Evaluation of each safety-related and Regulatory Guide 1.97 component identified above for minimum performance requirements; Evaluation of equipment performance under postulated post-accident conditions.
Evaluation of each MEL item is documented in an Equipment Qualification Data Package, which provides the basis for qualification of each identified component. These packages are revised as appropriate to incorporate plant changes, industry experience, and CNS operating experience. Non-safety-related components which could impact operation of a safety-related component were qualified or isolated from the associated safety-related equipment to prevent adverse interaction.
Interfaces with the plant preventive maintenance program, procurement program, maintenance program, and modification program were developed and incorporated into plant procedures. Procedures were developed to determine when new equipment is added to the MEL and to perform the required evaluations.
This program has undergone two separate validations. The first validation was performed shortly after implementation by an independent consultant to assure the program was sound and had captured all required equipment. This effort reviewed the development of the MEL. The second validation was performed after the program responsibility was transferred to Design Engineering and assured that plant changes had been appropriately incorporated into the EQ program. This validation focused on the content of the MEL, the plant interfaces, and the procedures to maintain the MEL and the EQ program.
The CNS EQ program as developed and implemented, provides additional i
assurance that CNS equipment and components are capable of performing their design functions, and that plant configuration is maintained to assure the validity of these evaluations.
(c).3.4 Mator Ooerated Valve Proaram As briefly described in section (b).2.8 above, the District recently completed the establishment of a MOV program, initiated in response to NRC Bulletin 85-03 and completed in response to NRC GL 89-10, and its supplements. The goal of the MOV program was to provide assurance that MOVs with active safety functions were designed, set-up, maintained, and where possible, tested at or near design-basis conditions to demonstrate their capability to perform in accordance with their design bases.
m m i
Attachment tr i
4 NLS970030 i
Page 46 of 65 i
This effort consisted of system-level reviews to establish the design bases
)
conditions for the operation of the MOVs, a component level review to determine the MOV torque and thrust requirements, a limiting component analysis to ensure the valve / actuator structural loading would remain within acceptable limits, and an electrical design bases review to establish the bounding electrical conditions for design bases operation. Using diagnostic equipment, MOVs within the program were ntically tested and where practicable, tested under dynamic conditions. Programmatic measures have been established to ensure MOV limit and torque switch settings are controlled in accordance with the established design-basis conditions. A program for periodically testing MOVs within the program scope has been established to monitor, on a continual basis, MOV conditions to provide added assurance of continued operability. Procedural controls have been established to ensure ongoing maintenance of MOV switch settings and MOV program engineer review of modifications potentially affecting MOV operation. Therefore, the District has a high degree of confidence that the configuration and performance of MOVs included in this program are consistent with their design bases.
(c).4 Plant Status Control Plant physical configuration control, or plant status control," is maintained by a series of programs and processes which collectively provide the administrative means to ensure that CNS is physically maintained in accordance with the design i
bases. These administrative controls provide for continuous monitoring of critical i
plant equipment configuration and condition, and ensure that an adequate contingent of standby systems are available to respond to unplanned events.
These programs and processes interface with the design modification, evaluation, and other processes to provide controls for maintaining the physical configuration of CNS in accordance with its design bases. Several of these controls are discussed below.
(c).4.1 Limiting Conditions for Ooeration (LCO) Tracking The CNS Technical Specifications, Appendix B of the CNS Operating License, provides limitations, restrictions, and performance requirements for critical plant structures, systems and components to ensure the analyzed basis for the operating license remains valid. One means used in the Technical Specifications for providing these controls is through institution of LCOs.
t These controls provide a high level of assurance that important CNS structures, systems, and components will be able to respond as assumed in the CNS accident analyses and other analyzed events, and fulfill their intended design functions. Maintaining compliance with the CNS Technical Specification LCOs
- ~- --,.
. - ~
I Attachment to I
NLS970036 j
Page 47 of 65 i
therefore provide a positive control mechanism for maintaining the physical plant configuration consistent with its design bases.
i i
As part of the Phase 1 Performance improvement Plan, the District developed l
an improved system for tracking Technical Specification LCOs. Previously, these LCOs were tracked via use of a status board which identified inoperable equipment, its corresponding LCO, date and time of inoperability and required i
Technical Specification surveillances. The improved LCO tracking system is a l
I computer database that incorporates the information previously identified with l
the plant status board, and added specific details concerning the associated Condition Report (now referred to as " Problem identification Report") and the work item that controls and corrects the deficiency. This system provides more complete information for the Control Room Shift Supervisor's use in managing CNS plant equipment.
j CNS Technical Specification LCOs, which delineate specific license i
requirements, provide an important means of maintaining plant status control, l
and accordingly, maintaining CNS physical plant configuration in conformance with its design bases. The recent improvements made to the system used to i
track LCOs provides added assurance that compliance with these license requirements will be sustained.
I (c).4.2 Work Plannina. Schedulina and Control l
Structured administrative processes exist governing work planning, scheduling and control. These processes control the preparation, coordination, and authorization of work performed in the plant. Appropriately designed and i
effectively implemented, these processes provido positive control of the physical plant configuration. During the 1994 CNS outage, the District assembled a Diagnostic Self Assessment Team (DSAT), comprised of independent evaluators to assess a number of plant program, process, and management areas. The DSAT determined that CNS did not have a comprehensive work control system that included work package and work instruction development, parts and logistics planning function, and centralized short and mid-term scheduling and coordination functions.
in response to these findings, the District developed an action plan to address these issues, resulting in modification of the CNS work control system. CNS
)
now has a dedicated work control organization comprised of experienced personnel and corresponding guidance to ensure effective scheduling of work I
packages. Organizational changes were implemented which added a number of positions to the scheduling organization. Procedural guidance was developed to provide instructions for scheduling on-line maintenance activities based on CNS i
4 b
4 Attachment to b
NLS970036 Page 48 of 65 Technical Specification requirements, system availability, and preventative maintenance requirements. Each week, segments of the 12-week rolling schedule are reviewed to identify support needs, such as procedures and material, and monitor progress in obtaining these items.
CNS has implemented procedural changes which provide the Operations department with authority for establishing priorities for repair of equipment. A Work Control Center has been established to centralize control of all work activities. The Work Control Center performs Senior Reactor _ Operator (SRO) screening, validation, mode assignment, and priority of all maintenance activity t
problem identification reports, and implementation of the minor maintenance program.
CNS now schedules established work windows based on system availability and divisional separation. A 12-week rolling schedule has been established to i
provide better planning and control of work activities.
)
These improvements have resulted in a more efficient work control process.
Additional benefits of these process improvements include a reduction in Control Room distractions, reduction of maintenance backlog, reduced system outage times, and improved plant configuration control. The reduced system outage times and improved work coordination and review assist in ensuring maintenance of the plant in accordance with the design bases.
I (c).4.3 Surveillance Testina As part of the process for ensuring, on an ongoing basis, system and
~
component readiness for responding to postulated events, all plants, including CNS are required to maintain surveillance programs. Surveillance testing periodically demonstrates that important plant systems and components are capable of fulfilling their design functions. These tests are an integral element of ensuring continued plant system readiness, and provide a means for continual assessment of plant system and component status.
As discussed in sections (c).1.3 and (c).1.4 above, the District recently completed comprehensive reviews and assessments of the CNS surveillance and IST programs. The STVP effort reviewed the surveillance procedures to certain plant system drawings, the Technical Specifications, and the CNS USAR to ensure that required testing was being performed and that it was being performed in accordance with its design bases. The IST program review provided assurance that plant equipment is tested in accordance with the requirements of the ASME Code. These efforts, and the conduct of the i
4 1
)
~..
Attachment to NLS970036 Page 49 of 65 periodic tests required by these programs, provides assurance that plant equipment performance is maintained consistent with its design bases.
(c).4.4 Plant Tours Plant configuration is surveyed on a periodic basis via operator shift tours to provide an ongoing check of equipment function and status. Comprehensive operator tours are conducted twice each day. During these tours, equipment is checked for proper lubrication, temperature, flow, pressure, vibration, and noise level. Switchgear is checked for tripped breakers, abnormal current, noise, indicating lights, relay targets, and grounds. Areas are checked for abnormal leakage, odors, and adequate ventilation. Ventilation systems are checked for vibration, loose or broken belts, steam leaks and dirty filters. Discrepant conditions or identified problems are brought to the attention of the shift supervisor for assessment and immediate corrective action as necessary.
Although not part of daily plant status control, system engineers periodically perform plant system walkdowns as part of their normal duties. Guidance for these walkdowns is contained in Engineering Department instruction (EDI) 91-03 entitled " System Walkdown Checklist." This instruction provides specific guidance for system engineer use in identifying conditions which could indicate potential system problems, including those which might impact the system design bases. While EDI 91-03 requires that these system walkdowns be performed once per operating cycle, system engineers typically spend much more time in the field than this minimum expectation.
These walkdowns, as well as the periodic station operator tours provide an ongoing overall assessment of plant configuration and status to ensure that plant systems and equipment are functioning properly or are ready to respond i
to plant conditions as needed.
(c).4.5 Accident Analvsis and Nuclear Safetv Ooerational Analvsis Uodate
~
As part of the District's fourteenth revision to the CNS USAR, submitted to the NRC by letter dated July 16,1996, the District incorporated changes resulting from comprehensive review and revision of USAR Chapter XIV, " Station Safety Analysis," and USAR Appendix G, " Nuclear Safety Operational Analysis."
These revisions resulted from review efforts to ensure that these sections accurately reflected plant design and current analyses. Where operator actions were credited in the transient and accident analyses, plant procedures were reviewed to ensure that actions were in accordance with the actions assumed in the analyses. No procedural deficiencies were identified. This effort assists in ensuring that the plant design and operation are in accordance with that
e i
)
i Attachment to j
NLS970036 Page 50 of 65 assumed in the CNS transient and accident analyses, and accurately reflected in I
i i
t (c).5 Additional Onaoina Efforts
}
The following discussion describes additional efforts currently ongoing which provide additional assurance that the plant is configured and/or tested to ensure conformance with the design bases.
l (c).5.1 Annendix R Program Evaluation 4
4 As briefly described in section (b).2.10, the District initiated a self-assessment of its Fire Protection Program in 1994, which included a limited review of the CNS Appendix R Safe and Alternate Shutdown Analysis Report (SSAR). Issues raised during that review led the District to conduct a more detailed review of its Appendix R safe shutdown analysis. This effort included a third party 1
review of the analysis. Based on this detailed review, the District concluded that the analysis was technically sound, but portions of the original analysis 3
i were in need of enhancements. To address these enhancements, the District 3
expanded its review to validate and update those identified portions of the safe shutdown analysis. The validation was performed in accordance with more j
rigorous analytical methodologies developed since the original analysis. As a result of this effort, the District identified a number of fire induced j
vulnerabilities that were subsequently resolved.
As a result of these identified vulnerabilities, the District has expanded the l
scope of its validation effort to rebaseline the entire analysis starting with i
system and component selection assumptions, methodologias and their j
technical basis. Once the documented technical bases were' determined, the j
analysis results were provided with a documented compliance summary basis j
for each fire zone analyzed. The compliance summaries were utilized to 4
develop revisions to post fire safe shutdown procedures. These procedure revisions are currently being validated with respect to manpower, timing, availability of Emergency Lighting and component identification. Once validated, the procedures will be submitted to SORC for approval. These efforts will provide additional assurance that the plant is configured as assumed in the Appendix R analyses and can respond safely to fire initiated events.
(c).5.2 Imolementation of the Imoroved Technical Soecifications (ITS)
In 1995, the District initiated an effort to convert the CNS Technical Specifications into the improved Technical Specifications (ITS) following the format of Standard Technical Specifications. This effort constitutes the i
4 Attachment to NLS970036 Page 51 of 65 1
4 I
complete revision to the CNS Technical Specifications in accordance with NUREG-1433, Revision 1. The resulting changes will be submitted along with
- j the basis for each change from the existing Technical Specifications. Reviews of the associated system design bases are being performed to ensure that the existing plant design is appropriately translated into the ITS basis. Additionally, required reviews, revisions, and validation of associated plant procedures are being performed to implement the ITS requirements. When completed, this effort will have re-baselined the revised Technical Specification surveillances to i
ensure that the plant is capable of performing within the design bases. The CNS Improved Technical Specifications are scheduled to be submitted to the NRC in April 1997, and implementation of the ITS is expected by Spring 1998.
j (c).5.3 Setooint Control Program Uograde t'
in parallel with the ITS implementation effort, the District is proceeding with a i
regeneration of the associated allowable values and setpoint control i
calculations. This effort is regenerating the setpoint calculations using the GE 3
setpoint methodology. This effort will provide additional assurance that these plant system setpoints are established with sufficient margin to ensure that j
plant systems will respond as assumed in the design bases.
j.
(c).5.4 Imolementation of SAFER /GESTR Analvsis The District is also in the process of performing CNS LOCA analysis using a revised accident analysis code, called SAFER /GESTR. The SAFER /GESTR code represents a more realistic modeling of the CNS plant response to design bases accidents. Implementation of this analysis results requires review, evaluation of all input parameters and validation that the input parameters correspond to actual plant response. Completion of this effort will provide further assurance that the plant performs in accordance with the design bases. The revised LOCA analysis is scheduled to be submitted in April 1997.
(c).5.5 Unauthorized Modifications in 1995, the District concluded that its past practice of implementing minor statien modifications under the maintenance program created configuration controlinconsistencies (LER 95-018). These modifications received an undocumented evaluation wherein, if they were determined not to change the facility as described in the USAR, they were implemented without going through the formal design control process. At that time Design Control procedures and maintenance procedures did not adequately interface. The maintenance procedures did not provide for a documented 10CFR50.59
" screen" of proposed maintenance work that involved the installation of
.~
t.
Attachment to NLS970036 Page 52 of 65 i
components not previously installed. Modifications made in this manner are i
now considered unauthorized modifications.
The District has subsequently performed plant walkdowns and actively 3
i searched for other instances of potential unauthorized modifications. The Maintenance Work Request (MWR) database was searched to identify MWRs not associated with design documents, that installed, modified, added, removed, or deleted something to determine if any station modifications were l
inappropriately made. A total population of approximately 20,000 MWRs were i
identified based on the selected search criteria. A 10% sample of these MWRs was selected for further review based on a commitment to the NRC (IR 96-04).
PMs and Minor Maintenance were not included in this sample. PMs were i
excluded because modifications were very unlikely to occur under the PM i
program. Minor Maintenance activities were excluded since they were i
previously reviewed. An initial screening of the sample was conducted by i
reviewing the work description entries provided in the database. After this initial screen, the actua! work control document was retrieved and reviewed if there was not enough information in the database to determine if an unauthorized modification had been made. Finally, a plant walkdown was performed if there was not enough information in the documentation to determine if a potential unauthorized modification had been made.
i i
Approximately 6% of the MWRs in the sample identified potential unauthorized modifications. The corrective action program was used to document and evaluate these potential unauthorized modifications. None of these l
modifications were safety significant. In general, these modifications were j
minor enhancements to non-essential structures, systems, and components to r
improve plant operation. The remainder of the originallot of 20,000 MWRs is j
currently planned to be reviewed by the end of 1997. The District j
acknowledges that it may still find instances of unauthorized modifications, but, based on the results of the sample performed, these instances are not expected j
to have a significant safety impact. Any potential unauthorized modifications i
identified by this review will also be addressed through the corrective action program described in the response to item (d).
s l
Procedure 3.4.5, " Engineering Evaluation," has been established to disposition identified " unauthorized modifications." The disposition may result in the h
removal of the " unauthorized modification" or provide the basis for its j
acceptance, if required, a 10CFR50.59 Safety Review will be performed. This l
new procedure also provides controls to update design-related documents consistent with the results of the evaluation. In addition, CNS has taken j
broader based corrective actions to prevent future implementation of unauthorized modifications. These actions include revising plant procedures, i
i 4
r
l j.
Attachment to NLS970036 Page 53 of 65 educating the plant staff, and communicating to station personnel management expectations regarding improved standards of performance.
i
Attachment to NLS970036 Page 54 of 65 i
(d) Processes for identification of problems and implementation of corrective actions, including actions to determine the extent of problems, actions to prevent recurrence, and reporting to NRC.
Response to item (d) l Overview There are several ways that problems are identified including observation by tra:ned personnel, equipment failures, CNS inspection activities, and " generic " industry information. Once identified, problems are placed in the Corrective Action Program for prioritization, evaluation, and correction. This process is described in detail below along with the District's reporting processes.
In the early 1990s, CNS was not totally effective in identifying problems or implementing corrective actions to prevent recurrence. Improvements to the Corrective Action Program were implemented and a considerable effort was made by station management to force a culture shift. Plant management encourages everyone to report any potential problems they may find. Internal assessments indicate that CNS personnel are effectively using the Corrective Action Program to report problems.
However, CNS recognizes that the timeliness and adequacy of corrective actions is stillin need of improvement. The preliminary resulm of a recent NRC Inspection (IR 96-25), ofw indicate that the Corrective Action Program is effective overall, but that weaknesses remain in the area of corrective actions.
(d).1 Corrective Action Proaram (CAP)
The CAP is used to identify, evaluate, and correct problems at CNS. The current process is contrc,lled by Procedure 0.5, "Fn blem Identification and Resolution."
The process was designed as a single entry pregram to resolve various types of problems. Problems can be identified in many ways including audits and inspections, equipment failures, through discrepancies during testing, evaluation of Operating Experience Review (OER) issues, during field observations, or during the development of instructions, procedures, drawing changes, or DCDs. Any individual at CNS who identifies a problem or potentie! croblem is responsible fer initiating a Problem Identification Report (PIR). The origmator of the PIR must promptly notify the Shift Supervisor or their Supervisor of any condition :equiring immediate action. The PIR is assigned one of four categories of significance defined as:
Attachment to NLS970036 Page 55 of 65 SCAO (Significant Condition Adverse to Quality) - a condition which does or could directly affect nuclear or personnel safety or plant availability. This type of problem requires prompt action, evaluation, or management attention.
CAO (Condition Adverse to Quality) - conditions which indicate less than adequate performance of equipment, people, programs, or procedures. The evaluations required could include root cause, apparent cause, or none (correct deficiency only). These are items that, if left uncorrected, could lead to SCAQs.
Departmental Dispositions - activities that are betterment items which require tracking to ensure positive closure. These conditions, when considered individually, do att represent a CAO but, if left uncorrected, could lead to a
]
CAQ. Evaluations, racking, or resolution of Departmental Dispositus do not require an apparent or root cause.
Trends - conditions requiring no further evaluation or corrective action beyond that already initiated.
4 The Supervisor of the PIR originator reviews the PIR for immediate personnel or equipment safety concerns not already addressed, completeness, and actions necessary for the preservation of evidence which may be needed for a root cause analysis. The supervisor also recommends interim actions to minimize recurrence until permanent corrective actions are identified and implemented, recommends an appropriate category and disposition of the identified problem (e.g., Work Item only, Condition Report, Engineering Project Request, etc.), and promptly notifies the Shift Supervisor of any condition requiring immediate' action. Guidance is provided in Procedure 0.5 for categorization of the PIR.
The Shift Supervisor then reviews PIRs marked as requiring a Condition Report I
(CAO or SCAQ) for immediate personnel or equipment safety concerns not already addressed and promptly notifies the appropriate CNS Manager of any condition requiring immediate management action. The Shift Supervisor also identifies equipment having Technical Specification requirements and any Technical Specification Limiting Conditions for Operation (LCO) entered, determines the operability of affected systems, structures, or components, and identifies any immediate reportability requirements (10CFR50.72).
1 Operability Assessments (OA) are performed as part of the PIR review process using the ins ructions provided in Procedure 0.5. The Shift Supervisor evaluates the effect of the condition stated in the PIR on the SSC to assess the impact on its operability and to determine what immediate actions need to t'e taken if the SSC is inoperable or degraded. These actions include applicable Technical Specification
Attachment to NLS970036 Page 56 of 65 I
LCO Action Statements, if additional assistance is needed, he can obtain help from the STE or the Engineering Division. The basis for the OA is documented and attached to the PIR. Repairs or compensatory measures may be required to restore operability. Repairs would be accomplished through the MWR process.
Compensatory measures could include procedure changes, modifications, etc. If repairs or compensatory measures cannot be implemented in a timely fashion, a l
j justification for continued operation may be prepared by Licensing and submitted i
to the NRC.
The Corrective Action Program Group (CAP Group) processes PIRs and evaluates and assesses PIRs each workday to validate the recommended category and disposition of the originator's supervisor. The CAP Group also ensures that PIRs categorized as " Departmental Disposition" do nol represent a SCAO or CAQ. The PIRs are then presented to the Condition Review Group (CRG). The CRG is a management review group comprised of front line managers that perform the following key functions:
i Maintain an overview of operational limitations to ensure safety is not being compromised and ensure economically significant issues are being pursued.
Categorize PIRs, assign the Responsible Manager, and assign priorities for SCAO and CAO Condition Report evaluations.
Designate other actions for Condition Reports as necessary.
Review PIRs marked as Departmental Disposition.
=
After presentation to the CRG, the CAP Group obtains Licensing's review for any reportability issues not already reported by the Shift Supervisor. The Licensing Department provides a comprehensive review of PIRs for reportability (10CFR50.73) and makes final decisions on reportability issues. They submit any justifications for continued operation to the NRC. The CAP Group then distributes the PIR to the responsible manager, assigns the trend code (s), and inputs the PIR information into the CAP database.
The responsible manager reviews assigned PIRs and assigns a Leader (for SCAQ Condition Reports) or Owner (for CAO Condition 63oorts) for the evaluation and i
disposition. He also identifies any operational restrair:ts not apparent during the i
CRG review and notifies the Shift Supervisor immediately whenever the investigation of the condition indicates that a system, structure, or component, declared operable may be inoperable. The manager approves the completion of corrective actions, ensures the timeliness of the actions to address or correct the condition, or, if appropriate, initiates interim actions to resolve or mitigate the
Attachment to i
NLS970036 Page 57 of 65
[
condition. The manager also monitors open actions associated with the initial
[
disposition or corrective action plan to meet scheduled completion dates.
1 The assigned owner or team leader has the principal responsibility for evaluation i
and resolution of the problems identified. The owner or team investigates the
. condition, performs the required evaluation, develops the corrective action plan, i
takes other actions as assigned by the CRG to disposition the SCAO or CAQ j
Condition Report, and assesses the effectiveness of the corrective action plan.
{
Root Cause Analysis provides the formal framework for evaluating SCAQs to 4
determine their cause and to determine effective corrective actions to prevent i
recurrence. In the context of the CAP program a " problem, condition, or event" is defined as an equipment deficiency, a human error or a work process related
}
administrative deficiency (which could be indicated by a negative trend). In most ases, a team approach is preferred for performing a root cause analysis. One of i
the team members must be certified to the Root Cause Investigation Training 4
program. In addition a CAP Evaluator is assigned to the team as a " mentor" to provide a guidance. The process requires an evaluation of the extent of the problem, and a determination of the generic implications (transportability). The evaluation is accomplished by reviewing available information on similar problems at CNS and throughout the industry to determine if the problem applies to other equipment or processes.
The training for a root cause investigator requires completion of two training plans:
Kepner/Tregoe Analytical Troubleshooting, which is a course on problem solving; and Root Cause Investigator, which is an in-house course developed from commonly used investigation techniques including Event and Causal Factor Charting, Common Cause Analysis, Organization Program Interface Charting, and Barrier Analysis. CAP mentors are also certified root cause investigators, Upon completion of the SCAQ root cause investigation a report is prepared and presented to the Corrective Action Review Board (CARB). The report summarizes how the investigation was performed, the techniques and tools used, the results found, and the conclusions drawn to reach the root cause. The recommended corrective actions are also presented and explained with regard to the resolution of the root cause. The CARB typically consists of a Senior Manager (Chairman), CAP Group personnel, the Responsible Manager, and a QA representative. The CARB review provides reasonable assurance that the correct root cause has been identified and that appropriate corrective actions have been assigned to prevent recurrence of the condition.
As part of the Phase 3 Performance improvement Plan various trend reports were developed to provide a tool to monitor the CAP program. In addition to monthly
Attachment to NLS970036 Page 58 of 65 reports on the generation, evaluation, closure, and distribution of PIRs with respect to totals for each department, the CAP Group inputs discovery method codes, program / function codes, system and component identifiers, and root cause codes.
These codes enable the CAP Group to generate trend reports that focus on human performance related problems and identify recurrent problems within departments.
These types of trend reports are routinely provided to management. As an example of the trend information provided, the CAP Group identified a declining trend in procedure adherence. Management took action and conducted site wide training sessions to focus attention on this issue.
(d).2 Beoortability Determinations The Shift Supervisor is trained to make reportability determinations when evaluating PIRs. The training covers the requirements of the applicable regulations and the implementing procedures as well as management expectations, and the guidance in NRC Inspection Manual, Part 9900, and NUREG-1022. In addition, the Shift Supervisor may contact Licensing or senior management for advice, if needed. When it has been determined that a report to NRC is required, the Shift Supervisor or Control Room Supervisor immediately contacts the Shift Communicator to make the report or assigns an alternate if the Shift Communicator is unavailable.
The Shift Supervisor ensures the information for the report is accurate. The Shift Supervisor may utilize the STE, Control Room Supervisor, Licensing, and/or CAP personnel to review the information to be reported for accuracy and appropriate detail. Then the Shift Supervisor ensures the oral report is made to the NRC in the required time. As much factual information as possible is provided to aid the NRC in understanding the situation. If the NRC requests information for which accurate data is not yet available, then the requested information will be provided in follow-up communications. Follow-up reports are made as needed to keep the NRC informed of further degradation in the level of safety of the plant or other worsening conditions.
A copy of the information used for the oral report and any supporting information is forwarded to Licensing. If an oral report is not required, a copy of the PIR is sent to Licensing for preparation of the written LER.
In addition, Licensing reviews the PlRs sent to the CRG for reportability. Licensing is responsible for preparing the LER and submitting it to the NRC in accordance with the regulations. Input for the report is obtained from the PIR owner and others involved in the event as necessary. The PIR process is also used to track the submittal of the LER.
1 l
~
Attachment to NLS970036 Page 59 of 65 (d).3 Part 21 Notifications Any individual may identify a potential 10CFR21 reportable issue through the j
Corrective Action Program described in section (d).1 above. The PIR should i
identify the possibility of this condition being reportable per 10CFR21. Per 4
Procedure 0.11, "10CFR Part 21 Evaluations," the date of the PIR is considered l
the date of discovery. An action item is assigned in the tracking system to have an evaluation performed within 60 days. Evaluations of potential defects in basic components must consider failure of functionally redundant basic components in determining whether a loss of safety function could occur. A condition, circumstance, or deviation which could cause a failure of the functionally redundant component must be considered in evaluating potential losses of safety function or major reduction in the degree of protection provided the public health and safety. Deviations in basic components which are delivered and accepted by CNS, but are not installed in the plant, must still be evaluated and reported under 10CFR21.
Part 21 evaluators are assigned by station management to perform evaluations.
The evaluation package, including appropriate documentation and any completed attachments, is delivered to Licensing for an independent review. This review ensures that the evaluation and attachments support the conclusions of reportability. If reportability cannot be ascertained, the concern is escalated to the Vice President - Nuclear Enorgy who then decides.
If the concern is determined to be reportable, Licensing presents the evaluation to i
SORC for review. If SORC concurs that tho item is reportable, the item is then presented to the Vice President - Nuclear Energy and reported to the NRC in accordance with regulatory requirements.
(d).4 Operatina Exnerience Review (OER) Proaram The OER program ensures that pertinent issues, concerns, and lessons learned from industry experience are disseminated to CNS personnel and are incorporated in processes, procedures, programs, and training courses as appropriate.
The OER program is implemented by a dedicated OER Group who report to the Events Analysis Manager. Incoming Operating Experience (OE) documents are screened for both event-based and programmatic concerns. OE documents formerly issued by INPO and the NRC make up the majority of documents reviewed. Also reviewed, however, are OE documents generated by other utilities, daily 10CFR50.72 reports, and NRC notifications. When an OE document is received by the OER Group, it is screened for issues that may be of immediate interest to departments or for conditions that require immediate action.
i Attachment to NLS970036 Page 60 of 65 Existing degraded or non-conforming conditions adverse to safety identified or confirmed during operating experience document evaluations or conditions requiring immediate action have a PIR generated and action initiated per CNS Procedure 0.5. Conditions that are of immediate interest to a specific group or department are routed to the cognizant manager (s), supervisor (s), and/or staff.
Department Managers and Supervisors, with the assistance of the Nuclear Training Department, ensure pertinent information associated with industry experience is made available to all working levels of their departments.
The OER program was upgraded in 1994 in response to both internal and NRC concerns (CAL 4-94-08) regarding the effectiveness and thoroughness of the District's review of industry events and incorporation of lessons learned. Action taken to address these concerns included an initial screening of approximately 5,000 historical OE documents, including revisions and supplements to determine their applicability and safety significance. These documents included:
NRC Bulletins, Generic Letters, Information Notices, Circulars, and 10CFR Part 21 notifications.
INPO documents: Significant Operating Experience Reports, Significant Event
)
Reports, Significant Event Notifications, and Operating & Maintenance Reminders.
Vendor documents: GE-Service Information Letters, GE-Rapid Information Communications Services Information Letters, GE-Service Advisory, Westinghouse-Availability improvement Bulletins, Westinghouse-Operations and Maintenance Memos, and Westinghouse-Customer Advisory Letters.
Other industry information notices.
Of the 5,000 documents screened, approximately 2,000 were determined to require further evaluation. The closure documentation for these 2,000 documents was then reviewed for adequacy. The majority of these were considered 4
acceptable. In those cases where the closure documentation was not considered adequate, the document was reassessed by the responsible group and, if necessary, appropriate updated responses were developed and approved. Some of these reviews were caused by the inability to retrieve documented responses from the files. The reassessments resulted in 33 actions to address potentially safety significant OE document concerns. This review addressed all known historical OE documents. The NRC reviewed these program improvements (IR 96-05), and noted that the existing OER program appeared to be adequate.
t
i Attachment to NLS970036 Page 61 of 65 The identification of.potentially safety significant concerns at CNS prompts a review of operating experience for both root cause analysis and corrective action purposes. As appropriate, these OE documents and the associated responses are reviewed again in an effort to ensure that technical issues and lessons learned at other nuclear installations are properly addressed at CNS.
(d).5 Informal Renorts In addition to the formal reporting mechanisms described above, the NRC is made aware of developing issues through other communication channels. For example, the NRC Resident inspector frequently attends the plant morning meetings and can learn first hand about developing issues. It is also the expectation of plant management that the NRC Resident be informed of developing issues as soon as possible, and that updates be provided whenever new information becomes available. In addition, the Licensing Manager discusses a variety of issues with the NRC Project Manager on a regular basis. This discussion provides an opportunity to update the Project Manager on the status of various issues, and identify other issues that are being evaluated. Furthermore, Plant Management discusses plant status and other issues with NRR and Region IV management as needed.
1 i
Attachment to NLS970036 Page 62 of 65 (e) The overall effectiveness of your current processes and programs in i
concluding that the configuration of your plant (s) is consistent with the design bases.
I i
Response to item (e)
The District has made substantial progress over the past few years in addressing prior weaknesses in its design documentation, its design and configuration control, and its corrective action processes. CNS's design documentation, design control processes, and configuration control processos, as with other older vintage plants, have evolved over its 23 years of operation to reflect changing management, industry, and regulatory expectations.
(
The District is confident that its current engineering design and configuration control processes, as described in the response to item (a) above, provide effective controls j
for maintaining the configuration of the plant consistent with the design bases. Most i
of these processes have been evaluated and revised since toe 1994 outage to address
)
identified weaknesses. Additional enhancements to some of these processes are being considered as part of our ongoing Phase 3 Performance Improvement Plan.
1 The accuracy of the translation of the design bases into procedures has been verified by a number of efforts including the development of Design Criteria Documents, the Drawing Verification Program, the Surveillance Test Validation Program, the Logic System Functional Testing Program, Limited Scope USAR Verification, and others.
The District's design change processes, procedure change process, and the various verification efforts conducted over the years provide the District with reasonable assurance that CNS's design bases requirements have been translated into operating, maintenance, and testing procedures.
Described below is a summary of the District's bases for concluding that the plant configuration is maintained in accordance with the design bases:
The Drawing Verification Program updated Control Room drawings to "as-built."
The Design Criteria Document Program gathers the design bases information for
=
essential systems in one place and compares the DCD to other plant documents to ensure that the design bases information had been translated into plant operation.
I j
... - -.. -,.. - - - - - -. - - - - ~ ~ - - - - - -
w i
Attachment to j
NLS970036 Page 63 of 65 l
i Performance improvement Plans i
l 4
Surveillance Test Validation Project verified that surveillance test procedures appropriately tested the design functions of systems and contained the proper 1
i acceptance criteria, consistent with the design bases.
I System Checklist Varification ensured that system configuration checklists maintained and reflected CNS's design.
l Restart Readiness Reviews provided a horizontal slice through key plant 4
programs on a system basis to ensure those programs were successfully identifying and dispositioning plant issues.
J Logic System Functional Testing ensured that logic system relay and switch i
l contacts were being fully tested.
f i.
i 1
l Inservice Testing Program Upgrade reestablished the Safety Related Pressure
[
Boundaries consistent with the design bases, established a link between the design bases and the IST acceptance criteria, provided assurance of the 4
j.
adequacy of the IST surveillance test program, and updated the USAR.
Limited Scope USAR Verification performed a line-by-line review / comparison of the 4
USAR and procedures to determine whether HPCI and RHR operating procedures accurately reflected the plant design as described in the USAR.
4 i-Maintenance Procedure Review enhanced the administrative and technical j
adequacy of mechanical and electrical maintenance procedures.
Environmental Qualification Program performed evaluations or tests to determine if equipment was able to meet the minimum performance characteristics in the specified environment.
The Ongoing Fire Protection Program Upgrade is reviewing, analyzing, comparing, and revising or developing the appropriate documents as related to Appendix R requirements.
.. The implementation of ITS will re-baseline the revised Technical Specificat:an surveillances to ensure that the plant is capable of performing within the design bases.
Vendor Manual Program Upgrade provides personnel'with current and technically accurate documents and information.
Attachment to NLS970036 Page 64 of 65 Emergency Operating Procedure Development compared CNS's design with the generic EPGs and incorporated that design into the plant specific EOPs.
MOV Program developed procedures to insure that MOV switch settings were appropriately controlled and maintained to provide a high degree of assurance that the affected valves would be capable of performing their design bases functions when called upon.
The OER program ensures that CNS and industry operating experierce is reviewed and evaluated for effects on plant operations and the design bases.
The USl A-46 evaluation for CNS provides additional assurance of the capability to safely shutdown following a design basis seismic event.
Engineering Self Assessment performed both horizontal reviews of Engineering support and program functions, and vertical-slice reviews of two systems.
QA Audits assess the effectiveness and performance of programs and personnel within the scope of the CNS QA Program.
The District's efforts in developing the DCDs, performing drawing and procedure verifications, and implementing the Phase 1 and 2 Plans as described in the responses to items (b) and (c) above,. provide reasonable assurance that there are no significant safety issues at CNS created by the weaknesses in prior design-related control processes at CNS. Furthermore, internal and external assessments since the completion of the Phase 1 and 2 plans indicate improved performance, especially in the District's ability to self-identify problems. As described in the response to item (d), if a safety issue or discrepancy in the plant configuration is identified, regardless of its safety significance, the CNS program for problem identification provides the controls necessary to assure that corrective measures are taken. The District acknowledges that in recent years a number of deficiencies have been identified in design related processes and programs. However, as described in this letter, a number of design verification efforts, program upgrades, and process improvements have been completed. On this basis, the District is confident that its current processes and programs are effective and that there has been sufficient verification of past and present programs and processes to conclude that the configuration of the plant is consistent with the design bases.
The District recognizes that there may be minor inconsistencies and ambiguities in old design documents and the USAR, and that to achieve superior performance, CNS must continue to examine its practices in a self-critical fashion and make improvements where needed. The preliminary results of the recent NRC SSFl identified some additional examples of USAR inconsistencies and ambiguities.
i Attachment to NLS970036 Page 65 of 65 Although the identified issues are considered of minor safety significance and did not affect plant operability, the District will perform a comprehensive USAR update and j
validation. Together with the ongoing Phase 3 Performance improvement Plan, implementation of the Business Plan, and the USAR update effort will further enhance l
the District's configuration management efforts and will help CNS achieve its goal of top quartile performance.
i 4
k U
l i
l I
i
)
e
l ATTACHMENT 3 LIST OF NRC COMMITMENTS l
Correspondence No: NLS970036 The following table identifies those actions committed to by the District in this document.
Any other actions discussed in the submittal represent intended or planned actions by the District.
They are described to the NRC for the NRC's information and are not regulatory commitments.
Please notify the Licensing Manager at Cooper Nuclear Station of any questions regarding this document or any asscciated regulatory commitments.
l COMMITMENT CCMMITTED DATE OR OUTAGE The District will provide a detailed description of the March 31, 1997 scope of the USAR Project The District will perform a comprehensive USAR update and
[4/A validation 1
l 1
1 l
PROCEDURE NUMBER 0.42 l
REVISION NUMBER 3 C1 l
. PAGE B OF 9 l