ML20138L031
| ML20138L031 | |
| Person / Time | |
|---|---|
| Site: | Cooper  |
| Issue date: | 02/10/1997 |
| From: | Horn G NEBRASKA PUBLIC POWER DISTRICT |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| References | |
| NLS970027, NUDOCS 9702200101 | |
| Download: ML20138L031 (75) | |
Text
(X)OPER NUCLEAR STATION P.O. BOX 98, BROWNVLLE NEBRASKA 68321 Nebraska Public Power District "O*=%""
3d b:
G.R.Hom gp senior vice emwent or enern om s
Pyg gg[
g NLS970027 PV W February 10,1997 guefc2 h
J U.S. Nuclear Regulatory Commission G
Attention: Document Control Desk Washington, DC 20555
Subject:
Request for information Pursuant to 10CFR50.54(f) Regarding the Adequacy and Availability of Design Bases Information Cooper Nuclear Station, NRC Docket No. 50-298, DPR-46
Reference:
Letter to W. R. Mayben (NPPD) from J. M. Taylor (NRC) dated October 9,1996, same subject.
Gentlemen:
The Nebraska Public Power District (District) herewith provides its response to the i
NRC's October 9,1996, request for information concerning the adequacy and availability of design bases information (Reference). The District has completed a number of efforts that, together with several key programs and processes, collectively provide the rationale for concluding that Cooper Nuclear Station (CNS) is configured and operated in accordance with its design bases. These efforts are detailed in the attachment.
The District assembled a team with representatives from Engineering, Operations, and the Nuclear Licensing and Safety (Licensing) departments to provide the requested information for this response. The team retrieved information from the various process, prcigram, and procedure owners; assembled a variety of past internal and NRC assessment documents; and reviewed, summarized, and assembled this information into detailed responses to each of the five specific information requests. The accuracy of the responses was then verified by the same process, procedure, and program owners. The Chief Executive Officer (CEO) of the District has been involved in the process in an overview capacity, has met with the team on two occasions, and has been thoroughly briefed on the scope, rnethodology, and content of the response. While the CEO was significantly involved in reviewing drafts of this response, he was not involved in the past i
I events discussed in the response, or in the recent process improvements. For that reason and because the signatory to this response was deeply involved in past
,f 9702200101 970210 PDR ADOCK 05000298
[ p.
P PDR NEsausameseaumr/r=umem7piWMwmaat#G* n MdEM===y
==
~
~==
=
=
==
=
=_
U.S. Nuclear Regulatory Commission February 10,1997 Page 2 of 4 events and solutions, the CEO delegated the responsibility for the response letter to the District's Senior Vice President of Energy Supply.
As discussed in greater detail in the attachment, the District has completed several efforts to collect, identify, and verify design bases information, and validate its implementation into plant configuration and procedures. Improvements have been made recently to configuration control processes to ensure continuing maintenance of the design bases, and to the CNS Corrective Action Program to ensure ongoing identification and correction of design bases and other issues. Other efforts have been completed that provide additional confidence in specific focus areas.
i The programs and processes that control the Cooper Nuclear Station (CNS) design bases, plant configuration, corrective actions, and the Updated Safety Analysis Report (USAR) are not static. The District appreciates und understands the need to maintain configuration control of the CNS design bases and has therefore revised and enhanced its programs and processes in this area over the past few years to address problems identified through its own internel assessments and NRC reviews.
Some of these process improvements are fairly recent. The District recognizes that additional enhancements to these programs may be warranted based on future internal assessments, and ongoing NRC developments. As the District continues to assess and improve its performance in this area, it will make changes to applicable programs and processes as necessary.
The District recognizes that there may be minor inconsistencies and ambiguities in
)
old design documents and the USAR, and that to achieve superior performance, CNS must continue to examine its practices in a self-critical fashion and make improvements where needed. The preliminary results of the recent NRC Safety System Functional Inspection (SSFI) identified some additional examples of minor USAR inconsistencies and ambiguities. Although the identified issues are considered of minor safety significance and did not affect plant operability, the District has aasided a contract to perform a comprehensive USAR update and validation. The District will provide a detailed description of the scope of this project by March 31,1997. In addition, the ongoing Phase 3 Performance improvement Plan and the Business Plan focus on continuing improvement. We believe that the completion of the Phase 3 Performance improvement Plan, implementation of the Business Plan, and the USAR update effort will enhance the District's configuration management efforts further and will help CNS achieve its goal of top quartile performance.
4 U.S. Nuclear Regulatory Commission February 10,1997 Page 3 of 4 i
If you have any questions on the District's response to this request for information, please call Philip Graham, Vice President - Nuclear Energy, (402)825-5769 or Brad Houston, Manager Nuclear Licensing, (402) 825-5819.
l Resp ctfully submitted, k%
G y R.
- orn, Sen
/ ice President of Energy Supply i
/kbt Attachment cc:
Regional Administrator USNRC-Region IV Director USNRC - NRR Senior Project Manager USNRC-NRR Project Directorate IV-1 Senior Resident inspector i
j USNRC Nuclear Energy Institute
]
NPG Distribution 3
4
-l 1
f 1
i i
_ - ~
1 l
l 1
l U.S. Nuclear Regulatory Commission -
i February 10,1997 Page 4 of 4 l
STATE OF NEBRASKA)
)
i NEMAHA COUNTY
)
Guy R. Horn, being first duly sworn, deposes and says that he is an authorized representative of the Nebraska Public Power District, a public corporation and political subdivision of the State of Nebraska; that he is duly authorized to submit this response on behalf of Nebraska Public Power District.
1 He says that he has read the contents of the attached letter and, in reliance on the
. processes discussed in the letter, hereby affirms that the statements contained i
herein are true to the best of his knowledge, information and belief.
De W
G u' orn Subsgribed in my presence and sworn to before me this lo day of YMade 1997.
O
%LA)trikkg sto A su1]EcstL NgTARY PUBLIC
(
GDRALNOTAR $th of hirssha MARY FrdNCES ARMSTRONG Wy come, hp.Jan. t1. tese My Commission expires 4/iw//./998 O
l l
I
f Attcchm:nt to NLS970027 Page i of ii 1.
Table of Contents Executive Summarv..........................................1 Response to ltem (a)
.........................................4 (a).1 - Design Control....................................... 4 (a).1.1 Modification Process..............................4 (a).1.2 Temocrarv Modification............................
6 (a).1.3 Engineering Evaluation.............................
7 (a).1.4 Design Verification...............................
9 (a).2 Configuration Control Processes..........................
10 (a).2.1 Design Criteria Documents.........................
10 (a).2.2 Design Calculation Control.........................
10 (a).2.3 Svstem comoonent Checklists......................11 (a).2.4 Protective Tagging...............................
1 1 (a).2.5 Post-Maintenance Testing..........................
13 (a).2.6 Procurement Document Control.....................
14 (a).2.7 Reolacement Comoonent Evaluation
..................14 (a).2.8 Drawing Control Process
..........................15 (a).3 50.71(a) Process. USAR Undates.........................
15 (a).4 10CFR50.59 Safety Review
............................16 (a).5 Quality Assurance
...................................17 (a).6 Engineering Self Assessment............................
18 Response to ltem (b)
........................................19 (b).1 Procedural Controls...................................
20 (b).1.1 Procedure Chance Process.........................
20 (b).2 Procedure Verification Efforts............................
22 (b).2.1 Design Criteria Documents.........................
22 (b).2.2 Surveillance Test Validation Program..................
23 (b).2.3 Logic Svstem Functional Test Review
.................23 (b).2.4 Maintenance Procedure Ungrade.....................
24 (b).2.5 Svstem comoonent Checklist Verification
..............25 (b).2.6 Emergenev Ooerating Procedures Develooment...........
25 (b).2.7 Inservice Testing Program
.........................27 (b).2.8 Motor Ooerated Valve Program......................
27 (b).2.9 Vendor Manual Program...........................
28 (b).2.10 Fire Protection Program
...........................29 l
(b).3 Assessments /Insoections...............................
2 9 l
(b).3.1 Self A sses sment................................
2 9 (b).3.1.1 Limited Scone USAR Review.....................29 (b).3.2 N R C Assessme nt................................
3 0 l
(b).3.2.1 Service Water Svstem Ooerational Performance Insoection. 30
q I
I I
Attechm:nt to NLS970027 Page ii of ii (b).3.2.2 Restart Readiness insoection
.....................30 (b).4 Generic items.......................................
31 (b).4.1 Station Blackout Rule.............................
31 (b).4.2 Reactor Vessel Water Level Instrumentation in BWRs
......32 (b).4.3 Debris Plugging of Emergencv Core Cooling Svstem Suction Strainers
.....................................32
)
i Response to ltem (c)
........................................34 (c).1 Performance Imorovement Plan..........................34 (c).1.1 Evstem Readiness Reviews.........................
35 (c).1.2 Plant Configuration Verification......................
36 I
(c).1.3 Surveillance Test Validation Program..................
37 t
(c).1.4 Inservice Testing Program
.........................37 (c).1.5 Logic Svstern Functional Testina.....................
37 (c).2 Design Criteria Document Program........................
39 (c).2.1 Drawing Verification Project........................39 1
(c).2.2 Design Criteria Document Develooment Program..........
39 I
(c).3 Other Configuration Verification Efforts.....................
43 (c).3.1 Pre-conditioning
................................43 (c).3.2 Seismic Qualification.............................
43 l
(c).3.3 Environmental Qualificatioit Proaram
..................44 i
~
(c).3.4 Motor Ooerated Valve Program......................
45 (c).4 Plant Status Control..................................
4 6 (c).4.1 Limitino Conditions for Ooeration Trackino..............
46 (c).4.2 Work Planning. Scheduling and Control
................47 (c).4.3 Surveillance Testing..............................
48 l
j (c).4.4 Pl a n t To u r s....................................
4 9 (c).4.5 Accident Analvsis and Nuclear Safetv Ooerational Analvsis Uodate.......................................49 (c).5 Additional Ongoing Efforts..............................
50 (c).5.1 Anoendix R Program Evaluation......................
50 (c).5.2 Imolementation of the Imoroved Technical Soecifications....
50 (c).5.3 Setooint Control Program Uograde....................
51 (c).5.4 lmolementation of SAFER /GESTR Analvsis..............
51 (c).5.5 Unauthorized Modifications.........................
51 Response to ltem (d)
..................54 (d).1 Corrective Action Program........
.....................54 (d).2 Reoortability Determinations
............................58 (d).3 Part 21 Notifications..................................
5 9 (d).4 Operating Experience Review............................
59 (d). 5 Informal Reports..................................... 61 Response to ltem (e)
........................................62
Attachment to NLS970027 Page 1 of 65 l
Executive Summary Cooper Nuclear Station (CNS) is a General Electric (GE) BWR Model 4 with a Mark l Containment. The station was designed by Burns and Roe, Inc. (B&R) and the turbine generator set was furnished by Westinghouse Electric Corporation. The original Final Safety Analysis Report (FSAR) was submitted in 1971 under Section 104 (b) of the Atomic Energy Act of 1954, as amended, and the regulations in effect at that time.
The station began commercial operation on July 1,1974.
Since CNS began operation, the District has implemented many changes to the design of the plant to improve safety and reliability, or to implement repairs or replacements.
These modifications have been implemented in response to self-identified concerns, industry initiatives, and regulatory issues. Initially, the FSAR was not systematically updated to reflect all the changes that were implemented. The FSAR was not required to be updated until 10CFR50.71(e) was promulgated. The information regarding prior modifications was retrievable, but it was not always efficiently
)
retrievable.
Since the initial submittal of the Updated Safety Analysis Report (USAR) in January 1983, the level of detail in the CNS USAR and other design-related records has i
increased. CNS has taken steps to improve design-related records and design control J
processes. Some of these process improvements are fairly recent. Therefore, CNS recognizes that further enhancements to these processes may be warranted in the future.
I Since the mid-1980s, CNS has developed programs to better document its design j
bases, to ensure the plant design satisfies the design bases, and to ensure that the plant is operated in accordance with the design bases. CNS has also enhanced plant change processes to ensure that final design documentation is maintained current with the plant configuration. The principal design-related programs are discussed in section (a) below. Details regarding the implementation of these programs, as well as other related initiatives, are discussed in the responses to the specific information requests, as appropriate. Internal and external assessments of CNS design practices in the early 1990s identified weaknesses in design control and configuration l
management. Since then, CNS has made improvements to these processes to address the identified weaknesses.
The District's efforts in performing drawing verifications, developing the Design Criteria Documents (DCDs), upgrading the plant change and configuration management processes to maintain the plant configuration consistent with the physical plant, and implementing the Phase 1 and 2 Performance improvement Plans represent significant efforts to ensure CNS is configured and operated in accordance 4
L
l Attachmsnt to NLS970027 Page 2 of 65 with the design bases. These efforts also ensure that controls are sufficient to l
maintain that configuration. The drawing verification project produced "as-built" Control Room plant drawings. The DCD development verified the plant design against l
the updated drawings, the USAR, and the design bases. These efforts identified l
many discrepancies, and it is recognized that other discrepancies may still exist. The Phase 1 Performance improvement Plan addressed significant issues identified by internal and external assessments that had to be resolved prior to plant startup in l
1995, such as Design Control and Configuration Management, Procedural Control, Engineering Support, Corrective Action Program, Work Control and Plant Testing. The Phase 2 Performance Improvement Plan addressed additional performance improvement actions in areas such as conduct of operations, surveillance program, plant configuration, and integrated planning and scheduling.
i Collectively, these efforts, along with the current processes for controlling design and plant configuration, provide reasonable assurance that CNS is configured and operated in accordance with its design bases and that there are no safety significant issues at CNS. Internal assessments and audits since the completion of the Phase 1 and 2 j
Performance Improvement Plans also indicate improved performance, including our ability to self-identify and correct problems. In addition, the District's current Phase 3 Performance improvement Plan provides continued focus on performance improvement.
Specifically, the Phase 3 Plan refocuses improvement efforts from shorter-term issues to address long-term, strategic direction. It establishes an overall framework for improving CNS performance, starting with the vision and top level goals, and translates them into strategies with associated implementing programs. The Phase 3 Plan will transition into the CNS Business Plan. The District is confident that the completion of the Phase 3 Performance Improvement Plan, implementation of the j
Business Plan, and the USAR update effort will enhance its configuration management efforts and will help CNS achieve its goal of top quartile performance.
i The District assembled a team with representatives from Engineering, Operations, and the Nuclear Licensing and Safety (Licensing) departments to provide the requested information for this response. The team retrieved information from the varioJs process, program, and procedure owners; assembled a variety of past internal and NRC assessment document. 'nd reviewed, summarized, and assembled this information into detailed responses to each of the five specific information requests.
l The accuracy of the responses was then verified by the same process, program, and l
procedure owners. An independent review was then performed to validate the i
responses.
l The District recognizes that there may be minor inconsistencies and ambiguities in old design documents and the USAR and, to achieve superior performance, CNS must l
Attachment to NLS970027 Page 3 of 65 continue to e' amine its practices in a self-critical fashion and make improvements x
where needed. The preliminary results of the recent NRC SSFl identified some additional examples of USAR minor inconsistencies and ambiguities. Although the identified issues are considered to be of minor safety significance and did not affect plant operability, the District will perform a comprehensive USAR update and validation. Together with the ongoing Phase 3 Performance improvement Plan, implementation of the Business Plan, and the USAR update effort will enhance the District's configuration management efforts further and will help CNS achieve its goal of top quartile performance.
)
i l
4 i
_=
i Attachment to NLS970027 Page 4 of 65 (a) Description of engineering design and configuration control processes, including those that implement 10 CFR 50.59,10 CFR 50.71(c), and Appendix B 3
to 10 CFR Part 50.
j Response to item (a)
Overview Internal and external assessments of CNS design practices in the early 1990s identified weaknesses in design control and configuration management. Since then CNS has made improvements to these processes to address the identified weaknesses. The efficacy of recent process improvements has not been demonstrated. The forthcoming refueling outage may identify the need for additional enhancements to these processes. Currently, CNS controls its design and j
configuration through several interconnecting processes which address 10CFR50.59, 10CFR50.71(e), and 10CFR50 Appendix B. These processes provide defense in depth through administrative controls to ensure that plant structures, systems, and components conform to design bases and licensing basis requirements, and that the plant's physical and functional characteristics are consistent with the design bases and other plant documents (e.g., drawings, procedures). The principal processes, as described below, are augmented by training and independent reviews.
(a).1 Design Control 10CFR50 Appendix B and design-related ANSI standards provide the basis for the CNS design control processes. There are three principal processes that are used to implement changes to systems, structures and components: the Modification Process; the Temporary Modification Process; and the Engineering Evaluation Process. These processes are briefly described below.
(a).1.1 Modification Process A change which alters the design, configuration, function, or method of performing the function of a structure, system, or component (SSC) is considered a station modification. Development and implementation of station modifications are described and controlled by Engineering Procedure 3.4, " Station Modifications." Procedure 3.4 defines the level of documentation required for a station modification, as well as the procedure used to document the station modification. Procedure 3.4 also directs the user to other engineering procedures, depending upon the SSCs affected by the proposed modification.
Attechm:nt to NLS970027 Page 5 of 65
)
Modification Packages are prepared by CNS engineering personnel or a qualified contractor. When appropriate, a team of engineers may be used for complex modifications. The engineer develops the design from a variety of design input documents including: industry codes, standards, design specifications, vendor manuals, drawings, DCDs, calculations, Technical Specifications, the USAR, Licensing commitments, etc. Design activities may result in the preparation of new or revised calculations, drawings, and specifications. The engineer also initiates changes to other documents that are impacted by the proposed modification (e.g. operating, maintenance and surveillance procedures, USAR), orders material, establishes installation requirements, and specifies any post modification testing requirements. A variety of checklists has been developed to help the engineer identify affected documents and required reviewers.
If required, the engineer also prepares a 10CFR50.59 Safety Review using the process discussed in section (a).4 below. The engineer then coordinates the multi-discipline design review which may include Operations, ALARA, System Engineers, Program Engineers, Maintenance, Fire Protection, Training as appropriate, and an independent review by Quality Assurance.
These groups evaluate aspects of the proposed modification that affect their areas of expertise. Also, an independent design review, described in section (a).1.4 below, is to be performed if required.
The modification package, the 10CFR50.59 Safety Review, and any procedure changes requiring revision that have the potential to affect nuclear safety are presented to the Station Operations Review Committee (SORC) for review and approval.
The engineer then forwards the modification package to Work Planning.
Work Planning develops the installation package based on the engineer's instructions and their knowledge of construction practices. The engineer reviews the installation package to ensure that the package will properly install and test the modification, and that the installation instructions correspond with the assumptions and conclusions in the 10CFR50.59 Safety Review.
i i
The engineer provides technical support for the installation, testing, and field changes. The engineer also verifies that the installation was correctly performed, acceptance criteria were met, and any deficiencies were resolved and documented. After the installation is completed he coordinates an "as-built" review of the modification and updates any documentation affected by field changes. Affected documents could include instructions, procedures, j
Attachm:nt to NLS970027 Page 6 of 65 drawings, design specifications, calculations, or other configuration documents.
Following installation and testing, the engineer prepares a completion report that summarizes the work performed, the results of the testing, and any additional changes to doc",nents including databases and programs as a result of the modification. After review by Engineering Management, the completion report is sent to Nuclear Records for distribution and storage.
An engineer's knowledge and experience is evaluated by his supervision, and j
is supplemented as necessary prior to the engineer being allowed to independently perform a design modification. To supplement these basic skills, CNS provides plant specific training on its design bases and licensing J
basis, and on the applicable codes, standards, and specifications. Initially, design engineers prepare modifications under the guidance of more experienced qualified design engineers who train them in the process and management's expectations for completeness and accuracy. After j
satisfactory performance, the engineer will be qualified by his supervisor to perform modifications independently. Engineers performing independent design reviews must also have this qualification. Contractors preparing modification packages must have their work reviewed by a qualified design engineer or must be qualified in accordance with the CNS requirements.
(a).1.2 Temocrarv Modification i
Temporary minor alterations made to the plant are considered Plant Temporary Modifications (PTMs). Examples of PTMc include items such as lifted leads, electrical jumpers, fuse removal, etc. Procedure 2.0.7, " Plant Temporary Modifications," provides requirements for controlling and documenting PTMs for safety-related and non-safety-related systems.
This procedure requires the originator to identify the reason for the PTM, the expected duration, the equipment and functions that are affected, and reference applicable drawings, procedures, and design documents. The originator must also provide appropriate change requests for Co.ntrol Room drawings and/or procedures affected as part of the PTM package, identify if any Technica' Specification Limiting Conditions for Operation are required to be entered due to installation of the PTM, and provide instructions fer installation or removal of the PTM. The originator may request assistance from Engineering or Operations in the preparation of the PTM package.
The on-duty Shift Technical Engineer (STE) and the on-duty Shift Supervisor or Control Room Supervisor, with assistance from the System Engineer, or
i Attechm:nt to NLS970027 Page 7 of 65 assigned engineering personnel perform the PTM Technical Review and prepare the Safety Review, if required. The originator or the originator's supervisor resolves the reviewer's comments and presents the PTM package to SORC.
SORC approves PTM packages prior to installation. SORC's primary responsibility is to review the PTM for issues relevant to nuclear safety (i.e., to assure nuclear safety implications are recognized and properly dispositioned).
The Shift Supervisor has overall control of PTMs during his assigned shift. He reviews the PTM package to ensure that it is complete, that all required reviews and approvals have been obtained, and that it is compatible with existing plant conditions. He then determines how the installation will be verified, and implements any Special Instructions or Technical Specification requirements.
PTMs are then installed in accordance with the instructions included in the PTM package.
Procedure 2.0.7 also requires periodic reviews of PTMs. The Shift Supervisor ensures a monthly plant PTM review is performed. The monthly review consists of an inventory of the PTM tag storage, a check of all affected Control Room drawings and procedures to ensure they are properly updated, and a physical check of accessible installed PTMs. Design Engineering reviews the log to identify those PTMs that are no longer needed or are past their expected duration. If it is determined that a PTM should be made permanent, Design Engineering initiates a modification package.
In the past, temporary alterations to the plant that could not be categorized as minor were to be documented as Temporary Design Changes (TDCs) per Procedure 3.4.4. However, management has limited its use to the close out of existing TDCs such that no new TDCs are permitted. New non-minor temporary modifications are now being made using the previously described Modification Process.
(a).1.3 Engineering Evaluation (EE)
Plant SSCs which require repair or are in a condition that is not appropriately supported by any engineering, detJgn basis, or design output document are dispositioned by an evaluation in accordance with Procedure 3.4.5,
" Engineering Ev@mtion." An EE can also be used to authorize specified non-essential modifications that require configuration document control, authorize removal / scrapping of items no longer required to be in place, or document the evaluation of a technicalissue where such evaluations are not part of an established process, program, or procedure. There are several categories of EEs which are briefly described below:
-. - -. ~
Attachment to i
NLS970027 Page 8 of 65 t
1 Use-As-Is Engineering Evaluation (UAIEE) - An evaluation that authorizes the use of an acceptable design configuration that already exists but either has 4
)
no defined design basis or does not conform to an existing design basis.
Repair Engineering Evaluation (REE) - An evaluation that authorizes restoring
]
equipment to a condition that allows reliable and safe function, even though the equipment may not conform to the original design specifications. The i
REE updates the component specification.
1 0
Rework Engineering Evaluation (RWEE) - An evaluation that authorizes the restoration of an existing unauthorized design configuration to the approved j
and authorized configuration.
i Scrap Engineering Evaluation (SEE) - An evaluation that authorizes the removal from service of an item that is no longer required to be in place, without replacement of the item.
l Configuration Control Engineering Evaluation (CCEE)- An evaluation that
}
authorizes the implementation of inconsequential non-essential modifications I
(i.e., there is no direct or indirect impact on nuclear safety or essential SSCs j
where configuration control is desired.
I informational Engineering Evaluation (IEE) - An evaluation that is used to I
document the evaluation of a technical issue where such evaluations are not i
part of an established program, procedure, or process. For example, the Corrective Action Program provides.the format and content requirements for evaluating problems, the Surveillance Program provides a method of
[
evaluating test discrepancies, and Procedure 3.4.7,~ " Design Calculations,"
provides guidelines for preparing, reviewing, approving, and control ling j
design calculations. An IEE can include mathematical computations which j
support the evaluation provided they are independent of any approved
. calculation and are not required to be documented as a design or licensing 4
i basis calculation.
h The responsible engineer contacts the cognizant system engineer and other -
involved and affected individuals (e.g., craft personnel, Operations, Radiological /ALARA, applicable program owners, etc.) to review the proposed i
EE. The responsible engineer then performs a walk-down of the affected SSCs, if applicable. The responsible engineer issues a copy of the EE to Quality
[
Assurance, the engineering supervisor, the system engineer, and the applicable program owners. Quality Assurance reviews all EEs prior to implementation, a
excluding CCEEs and IEEs. If required, an Independent Design Review is then j
performed as described in section (a).1.4 below. After all comments are
Attachment to NLS970027 Page 9 of 65 resolved, the EE is approved by the cognizant engineering supervisor or designee. EEs that require an Unreviewed Safety Question Evaluation are prescnted to SORC for review and approval.
The responsible engineer coordinates the procurement, construction, installation, and post-modification testing of the EE, if applicable, and ensures that the associated documents (procedures, drawings, calculations, etc.) are updated, as necessary.
(a).1.4 Desian Verification The extent of the design verification, when required by the modification process or the temporary modification process, is a function of the safety significance of the item under consideration, the complexity of the design, the degree of standardization, and the similarity with previously proven designs. Where changes to previously verified designs have been made, design verification is required for the changes, including evaluation of the effects of those changes on the overall design.
In accordance with Procedure 3.4.8, " Design Verification," the Design Engineering Supervisor determines which design verification method is used and who performs the design verification. Acceptable verification methods are Individual or Group Design Reviews, Alternate Calculations and Qualification Testing. Design Verification by Individual Review is performed by an individual design verifier. When the document being reviewed involves more than one discipline, the design verifier may request that the other disciplines provide supplemental verifiers to provide assistance on their portion of the document.
Design Verification By Interdisciplinary Review is performed by a team of designated individuals with a lead design verifier. The team is composed of individuals with collective expertise to provide an adequate evaluation of all engineering design aspects of the system or structure. Design Verification By Alternate Calculations may be performed to verify the correctness of the original calculations or analyses. When alternate calculations are performed, a review is also required to address the appropriateness of assumptions, input data, and code or other calculations method used. Design Verification By Qualification Testing may be performed with a prototype or initial production unit. This testing is to be performed under the most adverse design conditions.
Design verification by this method is considered to be a method of last resort and is used only when no other method is suitable.
The design verifier and/or team members review the applicable design input attachment and verify that the documents used for the basis of the design are appropriate and reflect the latest information available. The design engineer
Attcchment to NLS970027 Page 10 of 65 then revises the document being reviewed, as necessary, to incorporate changes that result from the design verification.
l (a).2 Configuration Control Processes In addition to the design control processes described above, the District has several administrative controls to ensure that the plant configuration is maintained in accordance with the design bases and that the design documents are maintained consistent with the physical plant. Configuration Controlincludes topics such as:
design criteria, design calculations, drawings, fire barriers, excavations, environmental qualification, safety and relief valves, instrument setpoints, and motor operated valves. The principal programs and practices that maintain plant configuration control are described below.
(a).2.1 Design Criteria Documents (DCDs)
The District is maintaining the Design Criteria Documents as a living program.
j Each document undergoes a formal review and is updated periodically. Since original development, each DCD has been subjected to a multi-disciplined effectiveness review. This review involved critical design engineering personnel, as well as other users, such as Operations and System Engineers.
These reviews resulted in a critical evaluation of the existing content of the DCDs and an assessment of the enhancements that would make these documents more valuable to end users.
The plant change processes include the requirements necessary to ensure that the DCDs are maintained as design bases and design description information is changed. The procedures governing the processes for station modifications, calculations, and others require that the DCD be utilized and be updated to reflect the post-change configuration and requirements. In addition, over the past several years, management has realized the importance of maintaining the design bases available and accessible. The engineering culture at the plant has improved such that the DCDs are recognized as an important source of design information that must be maintained.
(a).2.2 Desian Calculation Control Engineering Procedure 3.4.7, " Design Calculations," establishes the guidelines for preparing, checking, reviewing, design verifying, approving, and controlling design calculations. This procedure applies to the preparation of all l
non-essential and essential design calculations, including those related to new
{
designs and design reviews. The preparer is responsible for searching for l
Y
Attachmsnt to NLS970027 Page 11 of 65 existing design calculations that already cover the SCC to be addressed and for associated calculations that may be affected by this new or revised calculation. The i
preparer also screens the design calculation to determine if additionalinput from personnelis needed due to potential effects to plant operations or procedures. In addition to preparing the design calculation, the purpose, assumptions, methodology, conclusion, references, and attachments are also provided. The preparer also reviews applicable DCDs and if any changes are required, completes a DCD Change Request per Procedure 3.32.1. The final step in the process is to submit the entire design calculation package, including attachments, to the Engineering Supervisor for approval after it has been signed by Preparer, Checker, and Design Verifier.
(a).2.3 Svstem Comoonent Checklists Plant system lineups and component positions are controlled by component checklist procedures for individual systems. These checklists dictate the position of the applicable component as directed by General Operating, System Operating, and Instrumentation Operating Procedures. These checklists were developed to verify that the plant is configured in accordance with the design bases. System line-ups and component positions are verified to be consistent with these checklists a minimum of once per operating cycle. Furthermore, Administrative Procedure 0.31, " Equipment Status Control," contains additional requirements for performing component checklist verifications after maintenance and outages (refueling and non-refueling).
Procedure 0.4, " Procedure Change Process," controls the initiation, review, and approval of system checklists. This process contains provisions to assure that design bases requirements are adequately reflected in station procedures. In addition, Administrative Procedure 0.31, provides instructions for maintaining equipment status control along with Operations Procedure 2.0.2, " Operations Logs and Reports," which controls locked and sealed valves. Administrative Procedure 0.9, " Tagging Orders," provides guidance for the preparation and use of Tagging Orders, Caution Tag Orders, and Test Tag Orders. Together, these procedures establish and maintain equipment configuration in the field.
(a).2.4 Protective Tagging Protective Tagging at CNS is an important aspect of maintaining plant configuration consistent with the design bases during all modes of plant operation. Procedure 0.9, " Tagging Orders," controls the initiation and use of protective tagging at CNS. Proper use of Tagging Orders ensures personnel and equipment protection, prevents inadvertent equipment operation, and controls configuration during maintenance, testing, and operational activities. The Shift Supervisor determines that a Tagging Order does not violate any procedure or
Attechment to NLS970027 t
Page.12 of 65 4
1 Technical Specification Limiting Conditions of Operation before authorizing the placement of tags. Tagging Orders used at CNS include:
r Clearance Order (danger tags)
?
j Danger tags and associated documents are used to safely isolate.
equipment for repairs, testing, etc. Clearance Orders are used when it is 1
required that equipment not be in service or used without the knowledge of all personnel involved, to ensure personnel and/or equipment safety.
i V
[
Caution Tag Order 4
l
]
Caution tags and associated documents provide a temporary means of:
I a) Notifying station personnel of additional precautions or instructions.
that affect safe operation of station equipment.
)
b) Identifying and tracking components that are not in their normal j
position and are not being controlled by any other station procedure or i
process.
f.
A Caution Tag Order is only concerned with the operation of station I
equipment, Dat with personnel safety. When personnel safety is involved, a Clearance Order is used.
Test Tag Orders l
Test tags and associated documents' provide a means to allow non-operations personnel, directly associated with a test, to operate designated plant components during certain SORC approved testing (e.g.,
Local Leak Rate Testing (LLRT), Motor Operated Valve (MOV) testing, hydrostatic testing, etc.). Test tags are concerned with system line-ups during testing and are not used to provide for personnel safety.
As previously stated, Tagging Orders are important for maintaining plant I
configuration. To ensure that components affected by Clearance Orders, Test Tag Orders, and Caution Tag Orders are returned to their proper configuration, i
all components which physically change position are independently verified to be returned to their correct position. If a component is not returned to its normal position and is not being controlled by another station procedure or process, another Clearance Order or Caution Tag Order is generated to document and track the component's status. The normal position of components is dictated by individual System Operating Procedure Checklists.
1 Attachment to NLS970027 Page 13 of 65 manipulate valves in accordance with Procedure 0.31 during performance of Tagging Orders.
I i
(a).2.5 Post-Maintenance Testina (PMT)
)
f i
Procedure 7.0.5, " Post-Maintenance Testing," establishes a process for the consistent selection, performance, and documentation of Post-Maintenance Testing (PMT) to ensure that: 1) equipment will perform its intended function when returned to service following maintenance activities; 2) the original deficiency is corrected; and 3) a new deficiency has not been created. The Maintenance Work Planners specify the required PMT when they prepare the l
Maintenance Work Request (MWR). The Engineering Department reviews and approves the PMT for equipment affected by codes or Technical Specifications l
prior to maintenance. This review ensures incorporation of testing required by the applicable codes and Technical Specifications. Engineering Department i
assistance may also be requested for complex tasks even where no code or Technical Specification requirements apply. Operations Department may also j
assist Maintenance and Engineering in specifying appropriate PMT.
l The Operations Department ensures the PMT is properly authorized, performed,
~
l and documented prior to returning the equipment to service. Operations also ensures that all delayed tests are performed prior to or in conjunction with returning the equipment to service, makes the final equipment operability determination prior to returning the equipment to service, and restores systems and components to their correct operating or standby configurations following testing.
The supervisor responsible for the work reviews the completed PMT to ensure that the results have been properly recorded, and any discrepancies have been resolved. Discrepancies'may be editorial issues that are corrected by a procedure change, or they may require a Problem identification Report (PIR) and evaluation under the CNS Corrective Action Program.
i (a).2.6 Procurement Document Control I
Design control measures include the review for suitability of application of items that are essential to the safety-related function of the system involved. CNS procedures define the applicable requirements and processes for procurement of spare parts, materials, equipment, and services for essential nuclear systems.
These procedures include provisions for assuring that the necessary quality requirements are incorporated directly into the procurement documents for essential spare parts, materials, equipment, and services. These procedures
+
Attrchment to NLS970027 Page 14 of 65 also include provisions for assuring that the necessary records are specified and provided to the District by the supplier to ensure the components, equipment and services meet the requirements for the application.
In those instances where the normal methods of procurement cannot be applied, it may be necessary to purchase " commercial grade" items for use in essential applications. Verification is performed to ensure that the part utilized is functionally acceptable for the essential application. This verification may include dedication upon receipt, analysis, or other definitive methods.
Procurement procedures require an independent Quality Assurance (QA) review of " essential" and " quality commercial grade" purchasing documents; QA review and approval of suppliers; and QA audit of contractor and supplier activities. This includes revisions to procurement documents.
All suppliers of safety-related items or services to CNS are required by the 4
District to implement a Quality Assurance Program which complies with the applicable portions of 10CFR50 Appendix B or perform their activities under the District's Quality Assurance Program. The Quality Assurance Programs submitted by the suppliers are evaluated by District QA to assess whether they meet the criteria ectablished in 10CFR50 Appendix B.
(a).2.7 Reolacement Comoonent Evaluation (RCE) Process Procedure 3.25, " Replacement Component Evaluation," is used to evaluate replacement of component / parts with equivalent spare component / parts. An engineer performs an equivalency evaluation comparing the critical specifications for the original component to the specifications for the replacement. If this evaluation determines that the replacement component /part is equivalent to the original component /part, the replacement can be performed as a maintenance activity, rather than a change in the facility, and does not require a 10CFR50.59 evaluation.
(a).2.8 Drawina Control Process Procedure 3.7, " Drawing Change Notice," provides guidance for the preparation, review, approval, and control of Drawing Change Notices (DCNs).
Two types of DCNs occur; those associated with the modification process and those not associated with the modification process. The modification process procedurally requires that a 10CFR50.59 Safety Review be performed. Any DCNs performed as a result of the modification are enveloped by the modification package's Safety Review. The modification package therefore ensures that the CNS licensing and design bases are maintained. DCNs not
Attechm:nt to NLS970027 Page 15 of 65 associated with a modification package (stand-alone DCNs) are evaluated in accordance with Procedure 3.4.5, " Engineering Evaluations." The Engineering Evaluation determines if the proposed drawing change requires a separate 10CFR50.59 Safety Review. Stand-alone DCNs may be initiated to correct labels, close DCD open items, or update affected drawings that were not identified in the original modification package. Routinely, identified discrepancies between the drawings and the physical plant configuration, licensing documents, and/or design documents are evaluated through the Corrective Action Program described below in the response to item (d).
(a).3 50.71(e) Process. USAR Uodates Prior to the promulgation of 10CFR50.71(e), the FSAR was not normally updated on a routine basis. In January 1983, the first update to the FSAR was submitted to the Commission. At that time, a formal process for USAR updates had not been developed. Changes to the USAR were initiated by various methods, often by means of a memo. However, in 1986, Procedure 0.29, " Administrative Control of License Amendments," was developed to provide direction for the implementation of changes to both the USAR and the Technical Specifications. Under this procedure, a change to the USAR could be requested by anyone working in or for the Nuclear Power Group (NPG) and was submitted to the Licensing Manager for processing.
In late 1995 the need for additional process improvement was identified.
Subsequently, the District developed Procedure 0.29.2, "USAR Change Requests,"
to strengthen the controls on the USAR change process. The most significant aspect of this new procedure was the requirement that a USAR change request be accompanied by a SORC-approved 10CFR50.59 Safety Review when it is submitted to Licensing. Formerly, this expectation was not clearly defined by procedure.
Any individual working in or for the NPG may initiate a USAR change request. In accordance with Procedure 0.29.2, the initiator must identify whether required changes to the facility have already been completed or provide an anticipated completion date. This practice ensures that changes to the USAR are incorporated at the appropriate time. The appropriate Department Manager reviews the change request and ensures a supporting 10CFR50.59 Safety Review is provided. The 10CFR50.59 Safety Review must be approved by SORC before the change request is processed by Licensing.
Similarly, the process for incorporating drawing changes to USAR figures has also been strengthened over the past year. USAR drawing changes could previously be made without a 10CFR50.59 Safety Review. T his practice is no longer allowed.
l l'
Attachmsnt to NLS970027 Page 16 of 65 at the appropriate time. The appropriate Department Manager reviews the change i
request and ensures a supporting 10CFR50.59 Safety Review is provided. The 10CFR50.59 Safety Review must be approved by SORC before the change request is processed by Licensing.
i l
Similarly, the process for incorporating drawing changes to USAR figures has also been strengthened over the past year. USAR drawing changes could previously be j
made without a 10CFR50.59 Safety Review. This practice is no longer allowed.
USAR change requests affecting USAR figures must be accompanied by an appropriate SORC-approved 10CFR50.59 Safety Review.
The District recognizes that its previous controls over the USAR were not sufficiently rigid to prevent USAR inaccuracies. Therefore, the District plans to
. perform a comprehensive USAR update and validation effort.
(a) 4 10CFR50.59 Safety Review The CNS 50.59 evaluation process was recently revised to enhance the process and to address changes in regulatory expectations. This process is controlled by Administrative Procedure 0.8, " Safety Assessments and Unreviewed Safety Question Determinations." Individual change processes such as the modification process, setpoint change processes, or the drawing change process, specify when a 10CFR50.59 Safety Review is required. Safety Review is a new term which describes the three separate evaluations briefly discussed below.
The Safety Analysis describes the proposed change and evaluates the impact on safety. The originator of the change must prepare, or have prepared, a Safety Analysis. It includes nuclear, industrial, radiological, and personnel safety, if the review datermines the activity is not safe, compensatory measures must be taken i
to mele the activity safe or the change will not be implemented. The preparer distributes the Safety Analysis for review. The disciplines required to review the doc ament are selected based on the technical or administrative expertise required to e /aluate the proposed activity. The preparer then completes an Applicability Scresn.
The App!icabEity Screen determines, for example, if the proposed change is a change to the information in the USAR, or a test or experiment not previously l_
described in the USAR. If the answer to any of the screening questions is yes and j
l the preparer is not directed to another change evaluation process (such as a L
revision to the Security Plan or Emergency Plan), the proposed change must be l
evaluated under the scope of 10CFR50.59.
L 1
1
Attachment to I
NLS970027 i
Page 17 of 65 t
l-The Unreviewed Safety Question Evaluation addresses the questions in L
10CFR50.59 on margin, probability, and consequences of an accident. If the evaluation determines that the proposed change is an unreviewed safety question, l
NRC approval is required prior to implementing the change. The Safety Analysis, l
the Applicability Screen, and the Unreviewed Safety Question Evaluation, if l
required, are assessed by an independent safety reviewer for completeness and the accuracy of the conclusions. The complete package is then presented to SORC l
with the proposed change for final review and approval as required by the individual change processes.
l Supervisors are responsible for assigning trained and qualified preparers and l
independent reviewers to perform Safety Reviews. Five lessons are currently j
i required prior to obtaining this certification: Licensing Basis Orientation; Codes, j
Standards, and Classification; Chapter 14 and Appendix G Accidents; Transient and Overpressure Protection; and 10CFR50.59. In addition, trainees must complete a functional qualification guide before they are certified to work l'
independently.
l l
(a).5 Quality Assurance (QA)
Separate lines of responsibility are maintained between those responsible for the operation of Cooper Nuclear Station and those responsible for Quality Assurance oversight. - The QA program documents identified below describe the i
implementation of the requirements of 10CFR50 Appendix B. The design and configuration control processes previously described also incorporate the relevant requirements of 10CFR50 Appendix B.
l Quality Assurance Program for Operations (Policy Document) - This document translates the requirements of Appendix B and describes generally how CNS is to meet those requirements. Within this document is a description of the applicable requirements and commitments associated with design control and configuration management. In addition to describing some fundamental design control l
requirements this document describes the applicable standards and portions of standards that CNS is committed to with respect to design control.
Quality Assurance Plans (QAPs)- The purpose of a QAP is to define the nature and extent of QA for the specified area and to provide criteria to be used in carrying
' out the QA audit and surveillance functions associated with that area. There are five QAPs: QAP 1.0, " Plant Operations"; QAP 2.0, " Maintenance"; QAP 3.0,
" Engineering"; QAP 4.0, " Plant Support"; and QAP 5.0, " Diverse Activities and L
Programs." QAP 3.0 includes a table which shows the criteria of 10CFR50 i
Appendix B and describes the general expectations for those criteria considered
[
applicable to Engineering activities.
f-l l
l
Attachm:nt to NLS970027 Page 18 of 65 Scheduled and unscheduled audits are conducted to assess the effectiveness of the performance of programs and personnel within the scope of the CNS QA Program. District Management may request audits of specific activities of concern to them. Audits are performed in accordance'with written instructions or checklists and conducted by trained personnel not directly responsible for the areas being audited. Upon completion of the audit, a formal report is prepared and transmitted to the organization audited, which includes an evaluation statement regarding the program's effectiveness. All audit findings identified are documented and appropriate follow-up actions are taken to assure that corrective action has been implemented.
(a).6 Engineering Self Assessment in February 1996, CNS performed an Engineering Self Assessment using the guidance in NRC Inspection Procedure 37550. The purpose of this assessment was to evaluate the effectiveness of the Engineering Division to perform routine and emergent activities, including the identification and resolution ol technical issues and problems. The assessment identified several improvements due to the relocation of Engineering to the plant site, allowing more effective interaction and integration with the plant. However, the assessment results also indicated that the Engineering reorganization and the transition toward meeting the new Engineering mission were incomplete and several areas needed further significant improvement.
An integral part of the assessment was a vertical slice assessment of the j
Emergency Diesel Generator and High Pressure Coolant injection (HPCI) systems.
The purpose of the vertical slice assessment was to determine if the design organization had established and communicated system margins, their limits and interrelctions, to the appropriate plant organization. Also, vertical slice assessment was to determine if the plant organization had incorporated this information in procedures and established clear references to the design bases. The results of the vertical slice of HPCI and Emergency Diesel Generator systems indicated that each of these systems can perform its intended function in accordance with the design bases.
Station management initiated action plans to address the Engineering Self Assessment findings and improve performance in these areas. As described previously, the Safety Review process has been enhanced. The design change process was streamlined, and management expectations for Operability Assessments have been promulgated. The remaining corrective actions are being pursued through the Phase 3 Performence improvement Plan and other ongoing i
initiatives.
i l
Att::chment to NLS970027 Page 19 of 65 (b) Rationale for concluding that design bases requirements are translated into operating, maintenance, and testing procedures.
4 Response to item (b)
Overview Station procedures are a part of the District's method for ensuring the safe and reliable operation of the plant and for ensuring that the plant is operated consistent with its design bases and license requirements. These procedures provide administrative controls so that work can be performed consistently and with minimal additional instruction or interpretation. It is expected that procedures will be followed in all facets of our work. Deviation from or omission of procedural steps is not acceptable unless otherwise specifically stated in the procedure. In the event that an unforeseen situation occurs, or the procedure cannot be performc/ as written the user is expected to stop and inform supervision. If a procedure change.s necessary, one will be made in accordance with Procedure 0.4, " Procedure Change Process," before work resumes.
To ensure that the plant design bases are adequately transferred into station procedures when a change to design is made, CNS's design change programs and processes require that affected procedures be revised (or created) to reflect the modified design. Procedure changes must be made in accordance with CNS's procedure change process which includes various checks and balances to ensure that the station design is correctly translated. Once changes are identified, the procedure change process transfers the new or modified design information into station procedures which ultimately ensures safe plant operation. The District's procedure change process is described in more detail in section (b).1.1 below. In addition, other processes, such as Design Calculations, Relief Valve Setpoint Control, Instrument Setpoint and Meter Banding Control, Relay Setpoint Control, and DCD Program, also ensure that station placedures adequately reflect the design by requiring a review of associated procedures to ensure they remain unaffected or are changed as necessary.
Operating, maintenance, and testing procedures were developed for CNS and have evolved with plant modifications, enhancements, and upgrades. The accuracy of the translation of the design bases into procedures has been verified by a number of efforts including the development of the DCDs, the Surveillance Test Validation Program, and others as described in section (b).2 below. The District's design change processes, procedure change process, and the various verification efforts conducted since 1994 provide the District with reasonable assurance that CNS's design bases requirements are translated into operating, maintenance, and testing procedures.
. -. _ _ _ _ _ _ _. _._ _..._ _ ___ _ y I
Attachmsnt to NLS970027 Page 20 of 65 (b).1 Procedural Controls The District's procedure change process is designed to ensure that design bases information is translated and maintained in station procedures when procedures are -
revised or generated. This process is briefly described below.
(b).1.1 Procedure Chance Process Procedure 0.4, " Procedure Change Process," controls the initiation, review, and approval of all operating, maintenance, and testing procedures. This process has matured over time and in 1995 major improvements were made to the program. These improvements consisted of the establishment of procedure j
owners and the development of verification and validation instructions. The establishment of procedure owners was an important improvement because it established accountability for the technical content of procedures and provides for a consistent and thorough review of procedure changes. The verification and validation instructions and their importance are described in more detail below.
Procedure 0.4 provides two principal flow paths for approval; the instant -
l process and the standard process. The instant process is limited in scope to non-intent changes such as obvious errors, thus disallowing changes that would affect the design bases. This process allows for approval by two Senior Reactor Operators (SROs), with post-implementation reviews by the procedure owner, SORC, and the Plant Manager.
The standard process requires SORC approval for all non-editorial changes to procedures that could affect nuclear safety. This process has the procedure i
owner develop the change package and identify all necessary actions required l
prior to implementation. These actions include:
- 1. Identification of procedures requiring concurrent implementation;
- 2. Performance of 10CFR50.59 Safety Review;
~ 3. Performance of 10CFR50.54(q) review;
- 4. Performance of verification and validation (see below);
- 5. Determination of pre-implementation or post-implementation actions, such as, training, computer updates, and component line-up changes;
~ _ =.
Attachment to NLS970027 Page 21 of 65
- 6. Determination of appropriate cross-disciplinary reviews.
l i
The procedure owner ensures all identified actions are completed, any L
comments are resolved, and SORC approvalis obtained prior to implementation of the procedure change.
As stated above, SORC approvalis required for all procedure changes that could affect nuclear safety. Procedure 0.3, " Station Operations Review Committee," describes and governs SORC activities. SORC review / approval typically focuses on:
Safety aspects of the item, change, or modification including the installation, pre-installation, and post-installation, as applicable.
J Technical aspects of the change or itern, as they relate to the potential impact to the safety aspects of installed plant equipment or facilities,
)
operator actions, or systems interactions.
Adequate completion of the item or document (required signatures, forms completed, questions answered, and attachment of pertinent references).
DORC comments / directions may take any of the following forms:
I Discussion of any or all aspects noted above.
Identification of inadequacies in the Safety Review or lack of a proper Safety Review.
Identification of editorial errors or suggested editorial clarification i
changes.
Identification of omissions, errors, or inconsistencies that require revision or correction.
When procedure changes have the potential for affecting the design bases or configuration control, procedure owners implement a design verification and procedure validation in accordance with Procedure 0.4. Design verification is performed by personnel assigned by Design Engineering. The verification checklat ensures that design bases and configuration control documents, such as the USAR, DCDs, calculations, etc., are unaffected by the change. Any deficiencies identified during this verification are resolved prior to procedure l
approval. Procedure validation is performed by personnel assigned by the j
procedure owner. As a minimum, the validation checklist ensures that the
i Attachment to NLS970027 i
Page 22 of 65 procedure conforms to the CNS procedure writers guide, commitments are met, and acceptance criteria are correct. Procedure owners and representatives have been trained on the need to maintain design / configuration control and implementation of the verification and validation of procedure changes when appropriate.
Additionally, periodic procedure reviews are performed in accordance with Procedure 0.4 to check for correct application / incorporation of setpoints, vendor recommendations, Technical Specifications, station modifications, acceptance criteria, component lineups, etc. The specific periodicity for procedure reviews is maintained on a computerized procedure tracking prcgram and is generally once every five years. This process involves comparing the procedure to the applicable documents and, if necessary, conducting physical walkdowns to ensure the procedure is correct. These reviews provide further assurance that the design bases are correctly translated into procedures.
4 (b).2 Procedure Verification Efforts j
1 In addition to the controls the District maintains over procedures, CNS has implemented several programs and performed efforts that have verified that the design bases have been translated into procedures. These programs and efforts are described below.
1 (b).2.1 Desian Criteria Documents As described in more detailin section (c).2.2 below, CNS developed Design l
Criteria Documents (DCD) which compiled design bases information for certain systems. This proceduralized effort consisted of the collection, verification, and validation of design bases information for plant safety systems, selected non-safety systems, and a number of specific topics. As part of the validation process associated with DCD development, the DCD was compared against operating and surveillance procedures. The operating and surveillance procedures for the selected system were reviewed for two purposes. First, the procedures were reviewed and compared to ensure that the plant is operated and tested in accordance with its design bases. The secondary purpose was to ensure that the procedures were consistent with other documents, such as the Technical Specifications, USAR, and drawings. This review consisted of a review of operating and surveillance procedures to verify that specific design criteria was correctly translated into the procedures. This process verified that, for those procedures reviewed, the design had been properly translated into J
operating and surveillance procedures.
... ~. _ _. _ _. _., _. _. _ - _ -
i Attachment to NLS970027 Page 23 of 65 (b).2.2 Surveillance Test Validation Prooram (STVP)
~
l 4-In 1994, the STVP was initiated to verify that surveillance test procedures i-appropriately tested the design functions of systems and contained the proper acceptance criteria, consistent with the design bases. This program was a
}
component of the District's Phase 1 Performance improvement Plan. Initially, the objective was to validate surveillance procedures for Core Standby Cooling Systems (High Pressure Coolant Injection, Core Spray, Residual Heat Removal (RHR), and Automatic Depressurization System); the Reactor Protection System; the Standby Gas Treatment (SBGT) System; the Control Room Heating, Ventilation, and Air Conditioning (HVAC) System; and the Reactor Building HVAC System. However, because this program identified deficiencies, the decision was made to expand the program to all existing surveillance
}
procedures. This review was completed in March 1995.
i j
The STVP consisted of a line-by-line review of the USAR, Technical i
[.
Specifications, IST, ASME code, and NUREG-1482, as applicable. A comparison to surveillance procedures was conducted to ensure all testing requirements were being met. Deficiencies were identified that ranged from minor procedural enhancements to missed testing requirements to USAR errors l
and Technical Specification enhancements. Identified deficiencies were screened for safety significance and the appropriate process (procedure change, licensing change request, etc.) was implemented to correct the deficiency.
4 However, during the course of preparing this response letter it was determined that approximately 90 deficiencies were apparently not brought to documented closure. The itema represented minimal safety significance and did not affect plant operability. Most of the Technical Specification enhancement items will I
l be closed by the conversion to improved. Technical Specifications (NUREG-
{L 1433). CNS took action to resolve these remaining open items through i
procedure changes, drawing changes, USAR changes, etc.
i l
(b).2.3 Loaic Svstem Functional Test Review (LSFT)
The District has confidence that CNS design for logic systems is translated into testing procedures because the District has reviewed these procedures against the design. The District initiated a LSFT review as part of the corrective actions for a Condition Report (CR 94-0245). This review was designed to ensure that 1-logic system relay and switch contacts required to be tested were being appropriately tested. The sc' ope of this review included a comparison of the electrical schematic and logic diagrams to surveillance procedures and Technical Specifications. The review was validated and verified against the USAR, DCDs, i
Technical Specifications, and other documents to ensure it was complete and l
thorough. A' comparison was also made to the Surveillance Test Validation i
i e
m a
..._, s -, -.-
y-.
-c-r
Attachment to NLS970027 1
Page 24 of 65 3c i
Project (discussed above) which validated that the logic system functional test l
j review performed was thorough.
i i
Subsequently, Generic Letter (GL) 96-01, Testing of. Safety-Related Logic i
Circuits, was issued. Since the LSFT project had already been completed, only the modifications performed since the completion of the LSFT-project were 4
evaluated. Out of 145 modification packages screened,19 required detailed reviews. The review concluded that the existing test procedures were p
acceptable and that the modification process is effective in translating design requirements into relay and switch contact testing.
j (b).2.4 Maintenance Procedure Unarade The District's maintenance procedure upgrade effort is yet another check that
]
ensures design is translated into procedures or that the design is not being changed by procedures.
i in 1994 the District began a Maintenance Procedure Upgrade Project. The l
original objective of this project was to enhance and ensure the administrative and technical adequacy of approximately 250 maintenance procedures. This
}
initial scope was based on procedures screened as possibly inadequate. As the l
project developed; however, more than four hundred maintenance procedures i
were reviewed and revised. The project team also reviewed and revised several l
program procedures as well as developed several new program and maintenance procedures. Several examples of these new procedures are:
j.
Trouble Shooting Plant Equipment, Protective Relays Setting and Testing l
Program, Limitorque Maintenance, Relay Testing and Maintenance, Valve Packing Maintenance, Bolting and Torque Program, and Rotating Equipment
[
Alignment.
i l
To perform these procedure upgrades the project team reviewed and compared
' Technical Specifications, the USAR, Vendor Manuals, industry events, the QA.
j i
policy _docum'ent, and the procedure writer's guide to ensure these upgrades j
were accurate. All changes that were more thar: just of an editorial nature were j
walked down to ensure correctness. These procedures were then sent to
, appropriate engineering personnel for their review and approvai ni the changes.
7 These procedures were then reviewed and approved by the procedure change process in place at that time. This project was completed in the Fall of 1995.
The Maintenance Procedure Upgrade Project provides the District with i
j reasonable assurance, for the maintenance procedures reviewed, revised, or j
generated, that station design bases requirements are adequately maintained j
during plant maintenance activities.
.i 3-a 1
4 c
n..-
+
~
cn,
i i
1 b
f Attechment to 1
a NLS970027 i
~
Page 25 of 65 l
(b).2.5 System comoonent Checklist Verification j
r System Component Checklists are an important aspect of maintaining plant configuration control. These procedures control the configuration of all plant l
3 systems (valves, breakers) and are used to verify system configuration on a
{
routine basis, at least once per cycle, and after returning equipment to service 4.
following protective tagging. Based on self assessment findings in 1994, the District conducted several reviews prior to the startup from the 1994/1995
{
outage in order to ensure that system component checklists maintain and l
l reflect CNS's design. These reviews are briefly described below.
t
{
As pilot systems, the District compared and verified configurations for the B j
RHR Loop (Low Pressure Coolant Injection (LPCI) mode only) and the SBGT i
system.' The results of these comparisons would then be used to determine if I
other system reviews would be performed. For the B RHR loop (LPCI mode only) and the SBGT system the District performed a comprehensive review that i
j involved comparing valve, switch, breaker, and damper positions against I
j system component checklists and against design documentation to determine i
whether the system and its associated checklists were consistent with design.
j Several minor discrepancies were found and corrected. Due to the small j
i number (6) and minor nature of the discrepancies, the District concluded further i
system design reviews were not warranted.
1 l
Due to concerns surrounding the translation of design requirements from plant modifications into system component checklists the District also conducted a review of past station design changes against the associated system i
.i component checklists. Approximately 1900 design changes were reviewed I
dating back to the early 1970s. Discrepancies were identified which required procedure changes. The types of discrepancies found included missing l
components, incorrect component positions, and incorrect component descriptions. These discrepancies were addressed by the appropriate change process. Other aspects of this effort are discussed in section (c).1.2.
j Collectively, these reviews provided another means of ensuring the design has been correctly translated into system checklists.
f (b).2.6 Emeraencv Ooeratina Procedures Develooment CNS Emergency Operating Procedures (EOPs) were developed from the generic j
l BWR Owners Group Emergency Procedure Guidelines (EPGs). This development involved comparing CNS's design with the generic EPGs and i
incorporating that design into the EOPs. This development and implementation j
ensured that CNS's design was properly translated into the CNS EPGs. CNS j
EPGs, which form the basis for CNS EOPs, incorporated plant-specific data i
k m
_ _ - _ _ - ~.. - -. -.. - - _
f Attachment to l
NLS970027 Page 26 of 65 derived from various design and licensing related documents (Technical Specifications, USAR, Calculations, etc.) and drawings. This data ranged from equipment configuration unique to CNS, to specific design parameters or limitations. All plant-specific parameters that were transcribed into the EOP development effort were documented and independently verified by the EOP development team for accuracy and applicability. Calculations were performed using Procedure 3.4.7, " Design Calculation," for those plant-specific parameters l
requiring a supporting calculation. In accordance with this procedure, these l
calculations received an independent in-house Design Engineering review, assuring that the calculation reflected the current plant design bases.
l During development, a verification and validation (V&V) was performed to assure the technical accuracy and usability of the CNS EOPs. The verification l
process included a line-by-line review of the CNS EPG, CNS EPG j
Deviations / Justifications Document, and EOPs to ensure that all plant-specific data was accurately translated and consistent with CNS design. It also ensured i
that the CNS EPG and EOP strategies were consistent with the generic guidelines, and that deviations were identified and evaluated appropriately. The L
validation process ensured the EOPs were usable and understandable.
At the final stage of the project, an EOP maintenance process, Procedure 0.22, "EOP Maintenance Program," was developed to ensure EOPs remain consistent with CNS EPGs and BWR EPGs, and with changes to plant design and l
operation. This ongoing process is assisted by searchable databases that can be used to assess the impact to EOPs during Operations review of design modifications.
Additionally, Procedure 3.4, " Station Modifications," har provisions to assure EOPs remain consistent with the plant design bases. The p.ucess requires Design Engineering to review the proposed modification for impact to CNS EOPs by completing a checklist as part of the modification package. This establishes a flag to perform an in-depth review for EOP impact and initiates procedure revisions as necessary.
i
-These processes and administrative controls provide the District with confidence that the CNS design is translated into the EOPs - an important set of procedures for dealing with postulated plant events and accidents.
A NRC inspection (IR 88-200) reviewed the EOP development documents, operator training, the V&V process, conducted walkdowns, and observed table--
top EOP scenarios. The inspectors concluded that the EOPs were technically
(
accurate, their actions could be physically carried out, and that the plant staff
)
l could correctly perform the procedures. The NRC team identified a number of I
Attcchm:nt to NLS970027 Page 27 of 65 weaknesses relating to the development and implementation of the EOPs.
These weaknesses were corrected and satisfactorily reinspected (IR 90-06).
(b).2.7 Inservice Testing Program (IST) i Another effort that verified the translation of design bases into testing procedures was the development of an Inservice Testing Basis Document and completion of Phase 1 Performance improvement Plan, Action item 6.2. These efforts consisted of a complete review of the IST Program and the ASME XI boundaries prior to startup from the 1994 outage in response to testing issues identified by the District and the NRC.
Phase 1 Plan Action Item 6.2 was implemented to improve four key areas in the IST program. One of these key areas was the establishment of a link between the design bases and the IST acceptance criteria and assurance of the adequacy of the IST surveillance test program.
The existing IST program and test procedures were evaluated using a draft IST Basis Document to identify and resolve discrepancies with the design bases, and any inaccuracies in relief requests. This evaluation was accomplished by comparing the IST procedures and relief requests to the draft IST Basis Document and the design bases. The draft IST Basis Document was developed to update the IST Program for the next inspection interval using the guidance in NUREG-1482, " Guidelines for Inservice Testing at Nuclear Power Plants,"
design bases documents, and licensing basis documents. Since the update of the program was not completed at that time, the IST Basis Document was still considered a draft. The discrepancies were evaluated. Where needed, additional testing to resolve discrepancies was performed prior to startup and new relief requests were prepared and submitted to the NRC. Following startup, the remaining IST test procedures were revised, as necessary, to meet the ASME Code and the IST program was revised to correct any errors or omissions.
This effort ensures that the IST program and procedures are consistent with the design bases.
(b).2.8 Motor Ooerated Valve Program (MOV)
The District has developed and implemented a MOV program in response to NRC Bulletin 85-03, GL 89-10, and its supplements. This program reviewed the design bases for selected MOVs and established a testing program to demonstrate that MOV performance meets design bases requirements. It also established controls to maintain MOV configuration and to ensure that future
_ _~ _ _. - _
4 Attachment to NLS970027 l
Page 28 of 65 performance remains in accordance with the design bases. As part of the continuing implementation of this program, procedures have been developed or upgraded to ensure that MOV performance continues to meet design bases requirements.
i Engineering Procedure 3.33, " Motor Operated Valve Program," was developed to provide the programmatic controls necessary to maintain MOVs. Concurrent with the implementation of Engineering Procedure 3.33, was the establishment of a controlled MOV Program configuration database. This database is controlled by Procedure 3.33.1, " Operating the MOV and Configuration Database," and contains both valve and actuator configuration information which can be used, as necessary, when developing or revising MOV related station procedures. Additionally, Procedure 7.0.11, "Limitorque Actuator Configuration Control," and the Limitorque maintenance procedures provide the necessary guidance for maintaining MOV actuator configuration.
In 1996, the NRC concluded in its GL 89-10 closure inspection of the District's MOV program (IR 96-10) that CNS had appropriately implemented GL 89-10 and that the program was strong and had greatly improved from previous inspections. According to the NRC, this was exhibited by excellent assessments of MOV failures, a good trending program, a well specified program for post-modification and post-maintenance testing, and precise and comprehensive engineering efforts to demonstrate the design' bases capability of the program valves.
(b).2.9 Vendor Manual Proaram Preventive maintenance is another aspect of maintaining the design of pis.a equipment. Preventive maintenance is performed in accordance with procedures that are based, in part, on vendor recommendations. The control and processing of vendor information can be found in Engineering Procedure 3.11, " Vendor Manual Control Process." This procedure ensures that up to i'
date vendor manuals are available for reference during procedure development, troubleshooting, and work package development.
A vendor contact / interface program was first established at CNS in 1987 in response to NRC Generic Letters (GL) 83-28 and was later modified to meet GL 90-03 and GL 90-03 Supplement 1. The scope of the CNS periodic vendor contact program covers safety-related components within the Nuclear Steam Supply System (NSSS) and key safaty-related components. In 1994, the j
vendor manual program was extensively revised to bring the program up to current industry standards.
1 l
I
t i.
Attachment to l
NLS970027 Page 29 of 65 j
(b).2.10 Fire Protection Proaram The Fire Protection Upgrade Program is another program that has verified the l
translation of design requirements into procedur"es. The Fire Protection program l-at CNS has evolved over the years as a result of changing regulations, f
regulatory clarifications, industry generic is.caes, and several self assessments.
Evaluations performed in this area incided reviews of station' procedures to ensure that fire protection is adequately addressed. These reviews have resulted in enhancements to CNS procedures as well as the District's Fire 1
l Protection and Appendix R programs.
l i
In addition, certain issues have been raised in these assessments that have l
'recently caused the initiation of a comprehensive Appendix R validation project.
j, This project, as described in section (c).5.1 below, provides the District with further assurance that the CNS Appendix R Fire Protection design bases i::
adequately documented and translated into station procedures.
)
(b).3 Assessments / inspections 4
Assessment / inspection activities at CNS have also verified the translation of design bases requirements into procedures. The more significant assessment / inspection l
activities are described below.
(b).3.1 Self Assessment i
1 (b).3.1.1 Limited Scone USAR Review i.
in early 1996, the District conducted a limited scope USAR review of two i
systems: HPCI and RHR. All applicable USAR sections and associated
. operating proceduras were first identified for the systems in question. Then a line-by-line review / comparison of the USAR and procedures was performed to determine whether HPCI and RHR operating procedures accurately reflected plant design as described in the USAR. When findings or questions were identified additional documents such as Technical Specifications, DCDs, drawings, GE Service Information Letters, INPO Significant Event Reports (SERs), and vendor manuals were reviewed. Issues that were identified as part of this review fell into one of three categories.
Inaccuracies between documents.
Apparent missing, inaccurate, or confusing description (s) in the USAR or procedures.
Implied preventive maintenance not found in station procedures.
1 1
_m._._
..m.
c Attachmsnt to NLS970027 i
Page 30 of 65 The identified issues have been entered into the Corrective Action Program and will be resolved through the planned USAR update and validation.
(b).3.2 NRC Assessment j
(b).3.2.1 Service Water System Ooerational Performance insoection i-In late March and early April of 1994 the NRC conducted a Service Water
[
System Operational Performance inspection (IR 94-04). The inspection consisted of an examination of various documents including service water t
system procedures (maintenance, operating, and testing), USAR, Technical 4
Specifications, service water system DCD, drawings, calculations, and j
representative records. The NRC also conducted interviews and plant 3
walkdowns. Overall, the NRC found that the service water system was capable of performing its intended functions, but the NRC identified l-examples where the design was not accurately reflected in the output documents, and the system was operated inconsistently with the design as i
reflected in the updated USAR and in the service water system design criteria document.
f In general, the NRC concluded that the procedures were adequate to j
perform the required system operations although some weaknesses were identified. Specifically, the NRC found that the windmilling operation of the service water booster pumps was inconsistent with the USAR' description and procedural guidance was lacking in several areas (pump discharge strainers, river temperature, and certain valve operations). The NRC also found that an evaluation performed to support a design bases temperature change was not adequately reflected in the USAR. Additionally, the NRC reviewed approximately 20 service water system surveillance procedures during this inspection and did not identify any discrepancies. In response, the District revised the USAR and service water system DCD to reflect windmilling operations and the new temperature. The District also made several programmatic changes (Operability Evaluations, Procedure Change Process, DCD process) to prevent recurrence of the identified deficiencies.
(b).3.2.2 Restart Readiness insoection in March of 1995 the NRC conducted a Restart Readiness Inspection (IR 95-01). The purpose was to determine whether activities at CNS were conducted safely and in accordance with NRC regulations. Additionally, the inspection was to determine if performance was adequate to support restart of the plant. With respect to procedures, the NRC walked through several procedures and found them adequate. Specifically, the NRC walked down I
l I
Attachment to NLS970027 Page 31 of 65 several systems and compared them to their respective component checklists. While several minor errors were identified (wrong locations, J
missing label plates, and one valve shown twice on a drawing), the NRC did not identify major errors or mis-positioned components. These minor errors have been corrected. Overall, the NRC concluded that improvements to component checklists had been effective.
The NRC also reviewed the adequacy of several operating procedures and found them to be adequate and operationally sound. Specifically, the NRC reviewed and walked through six procedures concerning the startup and shutdown of the plant and one procedure concerning a shutdown from outside the Control Room. The NRC did find one annunciator response procedure that contained steps inconsistent with having an inerted containment. This procedure has been revised. The NRC also reviewed several surveillance procedures and found them to be generally adequate. In other areas, the NRC concluded that the STVP provided increased assurance in the adequacy of surveillance testing and that the IST review was well structured and comprehensive.
(b).4 Generic items The District has reviewed the translation of design requirements into procedures for specific systems and specific issues. Several examples are provided below.
(b).4.1 Station Blackout Rule (SBO)
In 1988,10CFR50.63 was promulgated which required each light-water-cooled nuclear power plant be able to withstand and recover from a SBO of a specified duration. The new rule specified, that for the SBO duration, the plant be capable of maintaining core cooling and appropriate containment integrity. The District evaluated CNS's design against the requirements of the SBO rule using guidance from NUMARC 87-00 and Regulatory Guide 1.155. This evaluation compared the design bases of those systems necessary to mitigate the effects of a SBO (High Pressure Coolant injection, Reactor Core isolation Cooling (RCIC), Safety Relief Valves, etc.) against the SBO rule and NUMARC 87-00 to ensure that safe shutdown could be achieved and maintained. Based on this evaluation, the District identified several procedure changes that were necessary to meet the guidelines of NUMARC 87-00. These procedures have been revised and implemented per the procedure change process as described above.
in 1994, during a review of valve stroke times, CNS determined that RCIC would not meet SBO requirements due to a valve being AC powered
_. ~ -. -.. -.. _.
2 Attachmsnt to NLS970027 Page 32 of 05 I
{
(Licensee Event Report (LER)94-018). The valve was then modified to be DC i
powered. Later in 1995, due to an NRC-identified concern, the SBO calculations and procedures were reviewed for consistency with commitments (LER 95-013). This review resulted in a procedure revision clarifying HPCI operation and development of a procedure concerning NRC correspondence control.
l (b).4.2 Reactor Vessel Water Level Instrumentation in BWRs j
NRC Generic Letter (GL) 92-04, " Resolution of the issues Related to Reactor Vessel Water Level Instrumentation in BWRs," was issued in August of 1992.
[
The GL requested certain actions to address the adequacy of, and the corrective actions for BWR water level instrumentation with respect to the effect of non-condensible gases on system operation.
1
)
To address GL 92-04, the District reviewed and analyzed related designs, operating history, and procedures. These results were then compared to the j'
BWR Owners Group report on reactor vessel water level instrumentation and a GE report on the same issue. Plant walkdowns and enhanced monitoring of j
vessel water level during plant cooldowns was also performed. ' ith respect to N
f procedures, CNS verified that station procedures provide for proper short-and long-term operator actions during licensing basis accidents and transients.
These procedures were also augmented by special guidance and training.
(b).4.3 Debris Plugging of Emergencv Core Cooling Svstem (ECCS) Suction Strainers As a result of suction strainer clogging events at foreign and domestic BWRs, the NRC has issued several Information Notices and Supplements regarding ECCS' suction strainer clogging ultimately resulting in the issuance Bulletin 93-02 and Supplement 1. In rt sponse to the original Bulletin, the District conducted detailed walkdowns of the drywell to identify sources of fibrous material. The District also reviewed doign documentation and drawings to further identify potential sources of fibrous material. The District identified Kaowool and unjacketed fiberglass insulation in the drywell which was not designed to withstand a Loss Of Coolant Accident (LOCA). The majority of this material was removed from the drywell in 1993. Additional material is scheduled to be removed during the 1997 refueling outage. Furthermore, CNS l
procedures used to install and remove temporary a;r filters were reviewed to
]
ensure that the proper controls were in place to remove these filters prior to i
plant startup.
I Bulletin 93-02, Supplement 1, summarized the various NRC notices and I
actions. It also specified additional actions. In response, the District developed 1
Attechm:nt to NLS970027 Page 33 of 65 and provided detailed training to Operations personnel. The focus of this training was recognizing conditions for and indications of ECCS suction strainer i
clogging, executing contingency actions for alternate injection, and providing guidance concerning economizing ECCS use. The District also performed detailed procedure reviews to ensure that they provided the proper guidance and actions to mitigate the effects of suction strainer clogging. These procedures were determined to provide adequate compensatory actions.
In late 1995 the NRC issued Bulletin 95-02, " Unexpected Clogging of RHR Suction Strainers." Part of the District's response to this Bulletin involved i
upgrading CNS's Foreign Material Exclusion (FME) program and procedure.
The District also developed Procedure 0.45.1," Working Over or in Torus,"
which specifically controls FME for the torus.
i l
Attachment to NLS970027 Page 34 of 65 (c) Rationale for concluding that system, structure and component configuration and performance are consistent with the design bases.
Response to item (c)
Overview The District has completed a number of efforts to provide assuranc': that CNS plant structures, systems, and components are configured and perform in accordance with the CNS design bases. These efforts include the drawing verification program and the Design Criteria Document development program which together represent a comprehensive collection, review, and verification of the CNS design bases, and validation of the translation of the design bases into plant configuration, programs, and processes. Recent system evaluations, walkdowns, and surveillance procedure validation efforts provide further assurance that CNS is configured and performs in accordance with its design bases. A number of specific system and program evaluations along with the development of new programs provide assurance in specific focus areas that the plant is configured and capable of performing as assumed in the design bases. Collectively, these efforts and programs provide reasonable assurance that CNS structures, systems, and components are configured and will perform in accordance with its design bases. Other specific efforts are ongoing.
These efforts and programs are discussed in further detail below.
(c).1 Performance lmorovement Plan In 1994 a Diagnostic Self Assessment and NRC Special Evaluation Team identified weaknesses that involved the engineering modification process, configuration management, and the corrective action program. In order to address these weaknesses, CNS took several steps to improve management oversight and configuration control. The management team focused on culture changes to identify and fix problems correctly the first time, and implemented improved standards for problem identification and resolution. The District also embarked on a three phase performance improvement plan. Phase 1, completed in February of 1995, focused on the activities necessary to demonstrate that plant operations were safe and that public health and safety were protected. Phase 2, completed in June of 1995, included a complete reorganization of the Engineering Division and relocation of the corporate Nuclear Engineering Department to the site. Phase 3, the long-term, strategic portion of the Performance improvement Plan is currently in progress.
The Phase 1 Plan contained action plans that addressed: Design Control and Configuration Management; Procedural Control; Engineering Support; Corrective
Attachment to NLS970027 Page 35 of 65 Action Program; independent Oversight and Self Assessment; Work Control; Plant i
Testing; and Operational Experience Review.
1
.The Phase 2 Plan concentrated on reorganizing the Engineering Division, including i:
" relocation of the corporate Nuclear Engineering Department to the site; Conduct of
}
Operations; Surveillance Program; Managing the Plant Configuration; Integrated Planning, Scheduling and Work Control; Corrective Action Program; and Self Assessment.
f The Phase 3 Plan refocuses improvement efforts from shorter-term issues to address the long-term, strategic direction. It establishes an overall framework for i
improving CNS performance, starting with the vision and top level goals, then
!l translating them into strategies with associated implementing programs.
Some of the Phase 1 Action items are described below:
(c).1.1 Svstem Readiness Reviews Prior to restart from the 1994 forced outage, the District performed multi-i disciplined team system reviews and walkdowns to provide an added degree of assurance that CNS was prepared to start and support operations to the 1995 1
l refueling outage without incident. This effort was embodied in Action item 4.8 i
of the Phase 1 Performance Improvement Plan.
Guidelines were developed to perform these system evaluations and walkdowns. These efforts consisted of broad reviews, evaluations and I
walkdown of systems meeting the following criteria:
Safety-related, Probabilistic Risk Assessment (PRA) evaluated systems; Non-safety-related systems ranked high by the CNS PRA:
I Non-safety-related systems, that have exhibited a history of performance problems; or Non-safety-related systems, that were of significant management concern.
The applicable Technical Specifications, USAR sections, GE design specifications, and available DCDs were reviewed to give the review teams a broad knowledge of the system, key functions, operation, components and equipment locations, and to confirm that the system design and operation were l'
Attachment to NLS970027 Page 36 of 65 consistent with the applicable Technical Specifications, USAR sections, and GE
~
design specifications.
in addition, system operation reviews and walkdowns were performed to identify significant conditions or discrepancies which had the potential to impact system operability. Any concerns identified during these system reviews and walkdowns were documented and screened to determine whether resolution was required prior to plant restart. Issues screened for action were resolved prior to restart. Perhaps the most significant result of this effort was that no new significant material condition or operability concerns were identified during the multi-discipline system walkdowns, providing some indication of the effectiveness of the CNS Corrective Action Program in identifying potentially deficient conditions. These system evaluations and walkdowns provided an independent assessment of the status of CNS plant system configuration.
(c).1.2 Plant Confiauration Ver.ification As part of the Phase 1 Performance Improvement Plan, the District performed walkdowns to verify that the physical position of valves, switches, breakers, and dampers of CNS plant systems were consistent with the system I
configuration checklists. Additionally, a review of completed CNS design changes was performed to ensure that valve checklists, power supply and breaker indexes had been updated as necessary, valves were shown on the affected P&lDs, power supplies were shown on the affected one-line diagrams, and the Equipment Data File (EDF) valve descriptions matched the valves installed, size, use, etc. This effort encompassed the review of approximately 1900 design changes dating back to initial operation in 1974.
The results of the design change review were evaluated and identified discrepancies were field-verified. The field verification packages included procedure and/or drawing changes, EDF changes, and labeling changes
~ proposed to resolve the configuration discrepancies. The packages were then field-verified to ensure the identified corrective actions were appropriate.
Following these reviews, the appropriate document changes were initiated.
An outcome of this process was the development and implementation of new Procedure 0.31, " Equipment Status Control," which provides administrative controls for maintaining physical configuration control of plant equipment.
This effort provided assurance that valves, switches, breakers, and dampers were properly positioned and that procedures controlling the positions reflected the proper component configuration. These efforts assist in providing e
4 r
e g
Attachm::nt to NLS970027 Page 37 of 65 reasonabic assurance that valves, switches, breakers, and dampers are configured in accordance with the design bases.
(c).1.3 Surveillance Test Validation Proaram As described previously in section (b).2.2, the District recently completed a Surveillance Test Validation Program. This effort reviewed the CNS Technical Specification and USAR system testing requirements against the corresponding surveillance procedures to validate that applicable plant systems are being appropriately tested to demonstrate their design bases capability.
(c).1.4 Inservice Testina Program i
The District performed c complete review of the IST Program prior to startup from the 1994 outage in response to testing issues identified by the District j
and the NRC. Also included in this effort was a review of the ASME XI class boundaries.
Two project teams were assigned to this effort. As previously described in section (b).2.7, one team evaluated the IST program and test procedures. The i
second team was tasked with evaluating and resolving boundary classification i
discrepancies using the draft boundary basis document and the Equipment Safety Classification procedure. The draft boundary basis document was prepared from system isometric drawings, flow diagrams, and design documents for the update of the next inspection interval. Regulatory Guide 1.26 and Section 3.2.2 of NUREG-0800 were used for guidance.
Seismic walkdowns of installed equipment and commercial grade dedications were performed to support the classification boundaries. The walkdowns verified that the installed equipment was adequately supported for the design bases earthquake. The dedications verified that the critical characteristics of the equipment were adequate to support the safety function. These activities were also completed prior to startup from the 1994 outat,.. Follow-up activities resulted in USAR changes to capture the information developed during the boundary reclassification.
(c).1.5 Logic Svstem Functional Testing (LSFT)
Prior to startup from the 1994 CNS forced outage, the District completed a review of the adequacy of the LSFTs. The LSFT review was performed to ensure that safety-related and other operationally significant contacts in logic systems for important system were adequately tested. This review included the following systems:
- - _ - - - -. ~ - -. -.. _. - - - - - _ - -
_. ~ - -. - - - _ _ _
t i
i Attachment to i-NLS970027 j
t' Page 38 of 65 High Pressure Coolant injection
- Standby Gas Treatment Reactor Core Isolation Cooling Reactor Building HVAC
- Reactor Protection
- Diesel Generator HVAC-
- Control Room' HVAC Reactor Equipment Cooling
[
- - Residual Heat Removal Core Spray Alternate Rod insertion
- Fire Protection i
e
- ' Service Water Low-Low Set Automatic Depressurization
- Diesel Generator Lube Oil Standby Liquid Control Diesel Generator Auto Start
- Diesel Generator Fuel Oil Primary Containment Isolation (Gr 1-7) l Diesel Generator Starting Air Anticipated Transient w/o Scram
}
The elementary logic diagrams for these systems were reviewed against the
}
existing surveillance procedures to determine if contacts which performed a safety-related function or other operationally significant function were tested in existing surveillance procedures. Since testing of a logic system involves, in many cases, multiple surveillance procedures, a review of individual procedures L
was performed to confirm overlap with other procedures for a complete LSFT.
i The surveillance test scope and overlap points were documented by highlighting l
the logic tested by each procedure on a set of CNS electrical schematic i'
drawings. Where testing was not performed, either appropriate procedures j-were revised or special test procedures were written, and the logic systems
{
were tested. Following this effort, surveillance procedures were revised as j
necessary to incorporate testing performed in those special test procedures.
Additionally, as discussed in sections (b).2.2 and (c).1.3, the District performed a Surveillance Test Validation Program which ensured that surveillance testing i
identified in the CNS Technical Specifications and the USAR was adequately implemented in the appropriate surveillance procedures. This effort further 1
verified the LSFT effort performed, and ensured that Technical Specification LSFT requirements were adequately implemented. Completion of these efforts 7
and associated testing confirmed the functionality of important CNS logic systems.
I 1
Subsequent to this effort, in response to NRC Generic Letter 96-01, " Testing of j'
Safety-Related Logic Circuits," the District reviewed the evaluation and testing j1 performed during the 1994 forced outage. This review determined that the i-effort performed during the outage, plus subsequent procedure changes implemented, ensured adequate testing of the Engineered Safety Feature logic
]
systems. Modifications implemented at CNS since the 1994 LSFT review were i-reviewed to ensure that any impact to required LSFT were captured, and had l
been appropriately incorporated into surveillance procedures.
l 4
-r-r
~r r
i i
1 Attachment to j
NLS970027 i
l Page 39 of 65 i
The existing surveillance procedures at CNS are considered adequate in ensuring complete LSFTs as required by the Technical Specifications. They also provide reasonable assurance that the logic circuits oi required safety systems l
will perform their intended design function when cailed upon.
l (c).2 Design Criteria Document Program i
The following discussion provides a description of several of the more significant efforts completed to ensure CNS is configured and performs in accordance with its design bases.
(c).2.1 -
Drawing Verification Proiect (DVP)
L During the late 1980s and early 1990s CNS completed a program of plant i
[
walkdowns. Approximately 240 Control Room drawings, elementary drawings F
and P&lDs, were walked down and verified against the physical plant. Portions j
of approximately 1300 associated electrical and mechanical drawings were also verified. These drawings are used for daily operational activities in support of i
i
[
maintenance and testing, and for reference in off normal events and l,
emergencies. Numerous discrepancies between the physical plant and the drawings were identified. Most of these discrepancies concerned minor drawing inconsistencies such as symbols and nomenclature, or missing labels in l-the plant. These types of discrepancies were corrected via drawing changes, i
labeling changes, or the addition of labels. However, some of the discrepancies i
identified required further evaluation. These types of discrepancies were l
evaluated by Design Engineering, and were closed based on additional t
information in the design records, corrective maintenance, or by revised calculations and analyses.
Although the focus of this project was updating the "as-built" status of the plant drawings, system component checklists and the EDF were also updated, terminal and pull boxes were labeled, and cables and fuses were tagged. Some minor, non-safety significant discrepancies from the original list remain open and are being addressed through the Corrective Action Program. They will be 4 -
resolved in accordance with their assigned priority. Ongoing plant work and
. engineering activities occasionally identify drawing discrepancies which are i
placed into the Corrective Action Program for resolution.
4 (c).2.2 Desian Criteria Document Develooment Proaram
.c-4 As discussed briefly in sections (a).2.1 and (b).2.1, the District initiated a
' Design Criteria Document (DCD) Development Program in 1987. The initial j'
program guidelines were revised significantly to incorporate the guidance in 1 a 1
6
1 Attechment to NLS970027 Page 40 of 65 NUMARC 90-12, " Design Bases Program Guidelines," and the NRC comments provided in a November 9,1990, letter to NUMARC. The CNS guidelines were eventually converted to plant procedures.
Thirty DCDs have been completed for plant safety systems, selected non-safety systems, and selected specific topics. Development of these DCDs represents a comprehensive collection of the CNS design bases information and a verification of the design bases and validation of the design bases information into controlling programs and processes. These efforts provide significant assurance that CNS is configured and performs in accordance with its design bases.
The objectives for developing, verifying, and validating DCDs were to:
Document the design bases and design criteria for each safety system, along with selected supporting information; 4
Perform verification and provide documented evidence that safety systems can perform their required safety functions; Ensure that the physical plant and selected design documents meet the design bases; and Validate that the plant is operated, maintained and tested in accordance with the design bases.
The development of a DCD was accomplished by first assembling all available information and documentation associated with the selected system. This involved an extensive search of film, hard copy and database records.
Examples of information collected include:
Draft 1967 General Design Criteria GE Specifications e
GE System Descriptions B&R Engineering Criteria Document B&R System Descriptions Original Contract Specifications Calculations and drawings GE Nucles.r Safety Criteria for BWRs Cooper Nuclear Safety Operational Analysis
- FSAR Questions and Answers NRC Safety Guides Preoperational and Startup Testing documentation
Attachment to NLS970027 Page 41 of 65 i
Vendor Specifications, drawings, and calculations Applicable Industry Codes and Standards (IEEE, ANSI, etc.)
Other GE NEDO, NEDE, NEDC and NEDM documents Cooper LOCA Analysis and Operating Plant Limits documents Correspondence with AEC, NRC, GE, B&R and others Original Technical Specifications and bases Original NRC Safety Evaluation Report (SER)
Station Modifications NRC Correspondence
- NRC SERs License Amendments and NRC SERs Setpoint Changes Special Test Procedures NRC Information Notices, Bulletins, Circulars, Generic Letters, and responses
- INPO Significant Event Reports, Significant Operating Experience Reports, and responses Calculations and revisions to calculations Analyses, evaluations, and studies since licensing Vendor Service Information Letters Past and pending Engineering Work Requests Licensee Event Reports and NRC Inspection Reports and responses During this effort the District also procured available design bases information from the original Architect / Engineer (B&R) and NSSS supplier (GE). Qualified teams of engineers were assembled to perform this work. In addition, the District supplemented these teams with ex-employees of GE and B&R who contributed first hand CNS design experience.
This information was collated, verified, and independently re-verified to ensure the draft DCDs accurately reflected the CNS design bases. The identified discrepancies or questions concerning the ability of a structure, system, or component to meet its design bases were tracked, categorized and resolved in accordance with the open item process developed for use during the project.
Those items verified to be an inconsistency with or failure to meet the plant design bases were entered into the CNS corrective action program for resolution.
The DCDs developed were then validated against the as-built drawings, supplemented by additional field walkdowns as necessary, and other plant equipment and component information developed to ensure that the DCDs reflected actual plant configuration. Similarly, the DCDs were validated against modifications perhrmed, licensing basis documentation, the USAR, and station
.. - -. ~
l Attachment to NLS970027 r
Page 42 of 65 i
procedures to ensure that these accurately reflected design bases information collected.
The District has developed twenty-two system Design Criteria Documents to date. These include all of the essential (safety-related) systems at Cooper I
Nuclear Station, as well as several risk significant nonessential (non-safety-
)
2 related) systems. The system Design Criteria Documents completed include:
Diesel Generators l
- DC Electric Standby Gas Treatment
)
{
Primary Containment Fire Protection Residual Heat Removal Instrument Air
- Control Rod Drive Standby Liquid Control Neutron Monitoring
[
High Pressure Coolant Injection
- AC Electric Process Radiation Monitoring j
- Nuclear Pressure Relief Control Ro'om Emerg. Filtration l
. Core Spray Reactor Protection Reactor Equipment Cooling i
Reactor Core isolation Cooling Reactor Vessel Nuclear Boiler instrumentation i
The Topical Des!gn Criteria Documents completed to date include:
5 4
Internal Flooding Environmental Qualification l
Secondary Containment Single Failure
- Station Blackout Electrical Separation j
- Electrical Protection b
l Four additional Topical DCDs are under development:
IST Testing Requirements Piping Component Classification Component Cooling l
The District expects to complete these DCDs by the end of 1997.
i The DCD development efforts completed and those currently ongoing represent comprehensive collation and verification of CNS design bases information, and validation of the design information into the CNS plant. These efforts have
)
identified several design bases deficiencies, which the District subsequently corrected. Examples include the identification and correction of a significant
design error in the Service Water System impacting its ability to meet its design bases post-accident cooling water flows (LER 93-01), and the identification and i
correction of a number of containment penetration deficiencies (LER 94-011).
,i 4
. -. - -. _.. -. -. - - - - _ - _ - -. ~. -... -
~ - - -....
1
)
Attachment to l
NLS970027 Page 43 of 65 The DCD development project represents both a broad and detailed effort to ensure that CNS is configured in accordance with its design bases, and to improve availability of design bases information for quality activities. For those DCDs completed,'this effort has provided an independent validation of plant configuration to its applicable design bases. For those DCDs not yet fully completed, this validation will provide that independent validation of plant
' design and configuration as well. These efforts provide an additional level of assurance that CNS is configured and capable of performing in accordance with its design bases.
l (c).3 Other Confiauration Verification Efforts (c).3.1 Pre-conditionina During the 1994-95 outage the District also addressed the potential for pre-
'l conditioning of plant equipment prior to, or during surveillance' testing. This j
issue concerned operating, stroking, or otherwise changing plant or equipment conditions prior to surveillance testing which could mask actual equipment as-found condition. The District reviewed surveillance procedures to identify and l
correct pre-conditioning issues, and integrated surveillance testing and preventive maintenance (PM) to address potential pre-conditioning concerns.
This effort included a review of surveillance, engineering, instrument and l
control, maintenance, and chemistry procedures to identify and correct any potential pre-conditioning concerns. Management expectations and philosophy on the issue were communicated to site personnel and have been incorporated into the site General Orientation Training. These actions provide assurance that plant equipment is tested in the as-found condition, and thus provide additional assurance that equipment testing results demonstrate performance in accordance with the design bases.
(c).3.2 Seismic Qualification Efforts to achieve resolution of Unresolved Safety issue (USI) A-46, Seismic
- Qualification have resulted in the development of a safe shutdown equipment list, walkdown of systems and components identified therein, and evaluation of these components and their configuration to ensure that CNS can achieve safe shutdown following a safe shutdown earthquake.
The purpose of the Seismic Qualification Utility Group (SQUG) effort is to address USI A-46 at CNS using the Generic Implementation Procedure (GIP).
c This methodology, in part, required the District to develop a Safe Shutdown i
l l
=
y e--
r-w,-
w
l l
l I
l Attachment to NLS970027 Page 44 of 65 l
l Equipment List (SSEL) and perform the necessary walkdowns to ensure that the l
equipment meets the applicable GIP criteria.
An independent peer review of the CNS seismic evaluation was performed.
The review consisted of selecting representative items from the seismic SSEL, performing an independent walkdown of those items, and reviewing the seismic review team's evaluation of these items.
These efforts, including the plant configuration walkdowns, have verified the capability of those plant structures, systems, and components necessary to achieve safe shutdown under design bases seismic conditions.
(c).3.3 Environmental Qualification Proaram (EQ)
The CNS EQ program represents another program which was developed to ensure that plant equipment is capable of meeting its design bases requirements. The EQ program provides the basis for ensuring that given the potential harsh environmental conditions following postulated accidents specific plant events, that safety-related equipment is capable of performing its intended function, non-safety-related equipment will not impair safety-related equipment from performing its intended function, and certain post-accident monitoring i
equipment is capable of performing its monitoring function.
Development of the CNS EQ program involved completion of the following primary tasks:
Evaluation of analyzed accidents to identify the systems credited to respond to accomplish the required safety functions; Evaluation and classification of each component in these systems to identify required safety functions at the component level, resulting in the Q-List; Sorting of the Q-List to identify safety related electrical equipment required to perform its function while subjected to a harsh environment, resulting in the Master Equipment List (MEL);
Identification of Regulatory Guide 1.97 post-accident monitoring equipment requiring qualification to harsh environments; l
l Characterization of post-accident environmental conditions for various l
plant areas; i
l
. _ _ _ _ _ - -. ~.
Attachmnnt to NLS970027 Page 45 of 65 1
Evaluation of each safety related and Regulatory Guide 1.97 component identified above for minimum performance requirements; Evaluation of equipment performance under postulated post-accident-i conditions.
Evaluation of each MEL item is documented in an Equipment Qualification Data Package, which provides the basis for qualification of each identified component. These packages are revised as appropriate to incorporate plant changes, industry experience, and CNS operating experience. Non-safety-related components which could impact operation of a safety-related component were qualified or isolated from the associated safety-related equipment to prevent adverse interaction.
Interfaces with the plant preventive maintenance program, procurement program, maintenance program, and modification program were devoloped and incorporated into plant procedures. Procedures were developed to determine I
when new equipment is added to the MEL and to perform the required
[
evaluations.
i This program has undergone two separate validations. The first validation was L
performed shortly after implementation by an independent consultant to assure p
the program was sound and had captured all required equipment. This effort reviewed the development of the MEL. The second validation was performed after the program responsibility was transferred to Design Engineering and assured that plant changes had been appropriately incorporated into the EQ program. This validation focused on the content of the MEL, the plant i
j interfaces, and the procedures to maintain the MEL and the EQ program.
The CNS EQ program as developed and implemented, provides additional j
assurance that CNS equipment and components are capable of performing their i.
design functions, and that plant configuration is maintained to assure the
. validity of these evaluations.
(c).3.4 - Motor Ooerated Valve Program l
As briefly described in section (b).2.8 above, the District recently completed the i
. establishment of a MOV program, initiated in response to NRC Bulletin 85-03 i
and completed in response to NRC GL 89-10, and its supplements. The goal of L
the MOV program was to provide assurance that MOVs with active safety functions were designed, set-up, maintained, and where possible, tested at or l-near design-basis conditions to demonstrate their capability to perform in accordance with their design bases.
4 4
i Attechm:nt to NLS970027 Page 46 of 65 This effort consisted of system-level reviews to establish the design bases i
conditions for the operation of the MOVs, a component level review to determine the MOV torque and thrust requirements, a limiting component analysis to ensure the valve / actuator structural loading would remain within acceptable limits, and an electrical design bases review to establish the bounding electrical conditions for design bases operation. Using diagnostic equipment, MOVs within the program were statically tested and where practicable, tested under dynamic conditions. Programmatic measures have been established to ensure MOV limit and torque switch settings are controlled in accordance with the established design-basis conditions. A program for periodically testing MOVs within the program scope has been established to monitor, on a continual basis, MOV conditions to provide added assurance of continued operability. Procedural controls have been established to ensure ongoing maintenance of MOV switch settings and MOV program engineer i
review of modifications potentially affecting MOV operation. Therefore, the District has a high degree of confidence that the configuration and performance of MOVs included in this program are consistent with their design bases.
1 (c).4 _ Plant Slatus Control Plant physical configura* ion control, or " plant status control," is maintained by a series of programs and processes which collectively provide the administrative means to ensure that CNS is physically maintained in accordance with the design bases. These administrative controls provide for continuous monitoring of critical plant equipment configuration and conditic.'t, and ensure that an adequate contingent of standby systems are available to respond to unplanned events.
"hese programs and processes interface with the design modification, evaluation, and other processes to provide controls for maintaining the physical configuration j
of CNS in accordance with its design bases. Several of these controls are discussed below.
)
(c).4.1 Limiting Conditions for Ooeration (LCO) Tracking
)
The CNS Technical Specifications, Appendix B of the CN': Operating License, provides limitations, restrictions, and performance requirements for critical plant structures, systems and components to ensure the analyzed basis for the operating license remair;s vdid. One means used in the TechnHal Specifications for providing these controls is through institution of LCOs.
These controls proviae a high 'evel of assurance that important CNS structures, systems, and corAconents will be able to respond as assumed in the CNS accident analyses ad other a 1vzed events, and fulfill their intended design functions. Maintaining complmace with the CNS Technical Specification LCOs
Attechm:nt to NLS970027 Page 47 of 65 therefore provide a positive control mechanism for maintaining the physical plant configuration consistent with its design bases.
As part of the Phase 1 Performance Improvement Plan, the District developed an improved system for tracking Technical Specification LCOs. Previously, these LCOs were tracked via use of a status board which identified inoperable equipment, its corresponding LCO, date and time of inoperability and required Technical Specification surveillances. The improved LCO tracking system is a computer database that incorporates the information previously identified with the plant status board, and added spmific details concerning the associated Condition Report (now referred to as " Problem Identification Report") and the work item that controls and corrects the deficiency. This system provides more complete information for the Control Room Shift Supervisor's use in managing CNS plant equipment.
CNS Technical Specification LCOs, which delineate specific license requirements, provide an important means of maintaining plant status control, and accordingly, maintaining CNS physical plant configuration in conformance j
with its design bases. The recent improvements made to the system used to track LCOs provides added assurance that compliance with these license requirements will be sustained.
(c).4.2 Work F@yino. Scheduling and Control Structured administrative processes exist gove'ning work planning, scheduling r
and control. These processes control the preparation, coordination, and authorization of work performed in the plant. Appropriately designed and effectively implemented, these processes provide positive control of the physical plant configuration. During the 1994 CNS outage, the District assembled a Diagnostic Self Assessment Team (DSAT), comprised of independent evaluators to assess a number of plant program, process, and management areas. The DSAT determined that CNS did not have a comprehensive work control system that included work package and work instruction development, parts and logistics planning function, and centralized short and mid-term scheduling and coordination functions.
In response to these findings, the District developed an action plan to address these issues, resulting in modification of the CNS work control system. CNS now has a dedicated work control organization comprised of experienced personnel and corresponding guidance to ensure effective scheduling of work packages. Organizational changes were implew.ented which added a number of positions to the scheduling organization. Procedural guidance was developed to provide instructions for scheduling on-line maintenance activities based on CNS
Attachment to NLS970027 Page 48 of 65 Technical Specification requirements, system availability, and preventative maintenance requirements. Each week, segments of the 12-week rolling schedule are reviewed to identify support needs, such as procedures and material, and monitor progress in obtaining these items.
i CNS has implemented procedural changes which provide the Operations department with authority for establishing priorities for repair of equipment. A Work Control Center has been established to centralize control of all work activities. The Work Control Center performs Senior Reactor Operator (SRO) screening, validation, mode assignment, and priority of all maintenance activity problem identification 7 irts, and implementation of the minor maintenance program.
CNS now schedules established work windows based on system availability and divisional separation. A 12-week rolling schedule has been established to provide better planning and control of work activities.
These improvements have resulted in a more efficient v.ork control process.
Additional benefits of these process improvements include a reduction in Control Room distractions, reduction of maintenance backlog, reduced system outage times, and improved plant configuration control. The reduced system outage times and improved work coordination and review assist in ensuring maintenance of the plant in accordance with the design bases.
(c).4.3 Surveillance Testing As part of the process for ensuring, on an ongoing basis, system and component readiness for responding to postulated events, all plants, including CNS are required to maintain surveillance programs. Surveillance testing g
periodically demonstrates that important plant systems and components are capable of fulfilling their design functions. These tests are an integral element of ensuring continued plant system readiness, and provide a means for continual assessment of plant system and component status.
As discussed in sections (c).1.3 and (c).1.4 above, the District recently completed comprehensive reviews and assessments of the CNS surveillance and IST programs. The STVP effort reviewed the surveillance procedures to certain plant system drawings, the Technical Specifications, and the CNS USAR to ensure that required testing was being performed and that it was being performed in accordance with its design bases. The IST program review provided assurance that plant equipment is tested in accordance with the requirements of the ASME Code. These efforts, and the conduct of the
Attachmsnt to NLS970027 Page 49 of 65 i
periodic tests required by these programs, provides assurance that plant equipment performance is maintained consistent with its design bases.
(c).4.4 Plant Tours Plant con'iguration is surveyed on a periodic basis via operator shift tours to provide an ongoing check of equipment function and status. Comprehensive operator tours are conducted twice each day. During these tours, equipment is i
checked for proper lubrication, temperature, flow, pressure, vibration, and noise level. Switchgear is checkea for tripped breakers, abnormal current, noise, indicating lights, relay targets, and grounds. Areas are checked for abnormal leakage, odors, and adequate ventilation. Ventilation systems are checked for vibration, loose or broken belts, steam leaks and dirty filters. Discrepant conditions or identified problems are brought to the attention of the shift supervisor for assessment and immediate corrective action as necessary.
Although not part of daily plant status control, system engineers periodically perform plant system walkdowns as part of their normal duties. Guidance for these walkdowns is contained in Engineering Department instruction (EDI) 91-03 entitled " System Walkdown Checklist." This instruction provides specific guidance for system engineer use in identifying conditions which could indicate potential system' problems, including those which might impact the system design bases. While EDI 91-03 requires that these system walkdowns be performed once per operating cycle, system engineers typically spend much more time in the field than this minimum expectation.
These walkdowns, as well as the periodic station operator tours provide an ongoing overall assessment of plant configuration and status to ensure that plant systems and equipment are functioning properly or are ready to respond to plant conditions as needed.
(c).4.5 Accident Analvsis and Nuclear Safetv Ooerational Analvsis Uodate As part of the District's fourteenth revision to the CNS USAR, submitted to the NRC by letter dated July 16,1996, the District incorporated changes resulting from comprehensive review and revision of USAR Chapter XIV, " Station Safety Analysis," and USAR Appendix G, " Nuclear Safety Operational Analysis."
j These revisions resulted from review efforts to ensure that these sections accurately reflected plant design and current analyses. Where operator actions j
were credited in the transient and accident analysos, plant procedures were
)
reviewed to ensure that actions were in accordance with the actions assumed in the analyses. No procedural deficiencies were identified. This effort assists j
in ensuring that the plant design and operation are in accordance with that
l Attachment to NLS970027 Page 50 of 65 assumed in the CNS transient and accident analyses, and accurately reflected in the CNS USAR.
(c).5 Additional Ongoing Efforts The following discussion describes additional efforts currently ongoing which provide additional assurance that the plant is configured and/or tested to ensure conformance with the design bases.
4 (c).5.1 Accendix R Program Evaluation As briefly described in section (b).2.10, the District initiated a self-assessment of its Fire Protection Program in 1994, which included a limited review of the CNS Appendix R Safe and Alternate Shutdown Analysis Report (SSAR). Issues raised during that review led the District to conduct a more detailed review of its Appendix R safe shutdown analysis. This effort included a third party review of the analysis. Based on this detailed review, the District concluded that the analysis was technically sound, but portions of the original analysis were in need of enhancements. To address these enhancements, the District expanded its review to validate and update those identified portions of the safe shutdown ant..ysis. The validation was performed in accordance with more rigorous analytical methodologies developed since the original analysis. As a iesult of this effort, the District identified a number of fire induced vulnerabilities that were subsequently resolved.
As a result of these identified vulnerabilities, the District has expanded the scope of its validation effort to rebaseline the entire analysis starting with system and component selection assumptions, methodologies and their technical basis. Once the documented technical bases were determined, the analysis results were provided with a documented compliance summary basis for each fire zone analyzed. The compliance summaries were utilized to develop revisions to post fire safe shutdown procedures. These procedure revisions are currently being validated with respect to manpower, timing, availability of Emergency Lighting and component identification. Once validated, the procedures will be submitted to SORC for approval. These efforts will provide additional assurance that the plant is configured as assumed in the Appendix R analyses and can respond safely to fire initiated events.
(c).5.2 Imolementation of the Imoroved Technical Soecifications (ITS)
In 1995, the District initiated an effort to convert the CNS Technical Specifications into the Improved Technical Specifications (ITS) following the format of Standard Technical Specifications. This effort constitutes the
Attachment to NLS970027 Page 51 of 65 complete revision to the CNS Technical Specifications in accordance with NUREG-1433, Revision 1. The resulting changes will be submitted along with the basis for each change from the existing Technical Specifications. Reviews of the associated system design bases are being performed to ensure that the existing plant design is appropriately translated into the ITS basis. Additionally, required reviews, revisions, and validation of associated plant procedures are being performed to implement the ITE requirements. When completed, this effort will have re-baselined the revised Technical Specification surveillances to ensure that the plant is capable of performing within the design bases. The CNS Improved Technical Specifications are scheduled to be submitted to the NRC in April 1997, and implementation of the ITS is expected by Spring 1998.
(c).5.3 Setooint Control Proaram Uoarade in parallel with the ITS implementation effort, the District is proceeding with a regeneration of the associated allowable values and setpoint control calculations. This effort is regenerating the setpoint calculations using the GE setpoint methodology. This effort will provide additional assurance that these plant system setpoints are established with sufficient margin to ensure that i
plant systems will respond as assumed in the design bases.
(c).5.4 Imolementation of SAFER /GESTR Analvsis The District is also in the process of performing CNS LOCA analysis using a revised accident analysis code, called SAFER /GESTR. The SAFER /GESTR code represents a more realistic modeling of the CNS plant response to design bases accidents. Implementation of this analysis results requires review, evaluation of all input parameters and validation that the input parameters correspond to actual plant response. Completion of this effort will provide further assurance that the p! ant performs in accordance with the design bases. The revised LOCA analysis is scheduled to be submitted in April 1997.
(c).5.5 Unauthorized Modifications in 1995, the District concluded that its past practice of implementir.s minor station modifications under the maintenance program created configuration control inconsistencies (LER 95-018). These modifications received an undocumented evaluation wherein, if they were determined not to change the facility as described in the USAR, they were implemented without going through the formal design control process. At that time Design Control procedures and maintenance procedures did not adequately interface. The maintenance procedures did not provide for a documented 10CFR50.59
" screen" of proposed maintenance work that involved the installation of
i Attachm::nt to NLS970027 Page 52 of 65 components not previously installed. Modifications made in this manner are now considered unauthorized modifications.
The District has subsequently performed plant walkdowns and actively searched for other instances of potential unauthorized modifications. The Maintenance Work Request (MWR) database was searched to identify MWRs not associated with design documents, that installed, modified, added, removed, or deleted something to determine if any station modifications were inappropriately made. A total population of approximately 20,000 MWRs were identified based on the selected search criteria. A 10% sample of these MWRs was selected for further review based on a commitment to the NRC (IR 96-04).
PMs and Minor Maintenance were not included in this sample. PMs were excluded because modifications were very unlikely to occur under the PM program. Minor Maintenance activities were excluded since they were previously reviewed. An initial screening of the sample was conducted by reviewing the work description entries provided in the database. After this initial screen, the actual work control document was retrieved and reviewed if there was not enough information in the database to determine if an unauthorized modification had been made. Finally, a plant walkdown was performed if there was not enough information in the documentation to determine if a potential unauthorized modification had been made.
I Approximately 6% of the MWRs in the sample identified potential unauthorized modifications. The corrective action program was used to document and evaluate these potential unauthorized modifications. None of these modifications were safety significant. In general, these modifications were minor enhancements to non-essential structures, systems, and components to improve plant operation. The remainder of the originallot of 20,000 MWRs is currently planned to be reviewed by the end of 1997. The District acknowledges that it may still find instances of unauthorized modificntions, but, based on the results of the sample performed, these instances are not expected to have a significant safety impact. Any potential unauthorized modifications identified by this review will also be addressed through the corrective action program described in the response to item (d).
Procedure 3.4.5, " Engineering Evaluation," has been established to disposition j
identified " unauthorized modifications." The disposition may result in the removal of the " unauthorized modification" or provide the basis for its acceptance. If required, a 10CFR50.59 Safety Review will be performed. This new procedure also provides controls to update design-related documents consistent with the results of the evaluation, in addition, CNS has taken broader based corrective actions to prevent future implementation of unauthorized modifications. These actions include revising plant procedures, I
i i
~ _ _ _
S Attachment to NLS970027 Page 53 of 65 educating the plant staff, and communicating to station personnel management expectations regarding improved standards of performance.
f
~
Attechment to NLS970027 Page 54 of 65 (d) Processes for identification of problems and implementation of corrective actions, including actions to determine the extent of problems, actions to prevent recurrence, and reporting to NRC.
Response to item (d)
Overview There are several ways that problems are identified including observation by trained personnel, equipment failures, CNS inspection activities, and " generic " industry information. Once identified, problems are placed in the Corrective Action Program for prioritization, evaluation, and correction. This process is described in detail below along with the District's reporting processes.
In the early 1990s, CNS was not totally effective in identifying problems or implementing corrective actions to prevent recurrence. Improvements to the Corrective Action Program were implemented and a considerable effort was made by station management to force a culture shift. Plant management encourages everyone to report any potential problems they may find. Internal assessments indicate that CNS personnel are effectively using the Corrective Action Program to report problems.
However, CNS recognizes that the timeliness and adequacy of corrective actions is still in need of improvement. The preliminary results of a recent NRC Inspection (IR 96-25), also indicate that the Corrective Action Program is effective overall, but that weaknesses remain in the area of corrective actions.
(d).1 Corrective Action Proaram (CAP)
The CAP is used to identify, evaluate, and correct problems at CNS. The current process is controlled by Procedure 0.5, " Problem Identification and Resolution."
The process was designed as a single entry program to resolve various types of problems. Problems can be identified in many ways including audits and inspections, equipment failures, through discrepancies during testing, evaluation of Operating Experience Review (OER) issues, during field observations, or durlig the development of instructions, procedures, drawing changes, or DCDs. Any individual at CNS who identifies a problem or potential problem is responsible for initiating a Problem identification Report (PIR). The originator of the PIR must promptly notify the Shift Supervisor or their Supervisor of any condition requiring immediate action. The PIR is assigned one of four categories of significance l
defined as:
Attachm::nt to NLS970027 Page 55 of 66 SCAQ (Significant Condition Adverse to Quality) - a condition which does_QL could directly affect nuclear or personnel safety or plant availability. This type i
of problem requires prompt action, evaluation, or management attention.
CAO (Condition Adverse to Quality) - conditions which indicate less than adequate performance of equipment, people, programs, or procedures. The evaluations required could include root cause, apparent cause, or none (correct deficiency only). These are items that, if left uncorrected, could lead to SCAQs.
l Departmental Dispositions - activities that are betterment items which require tracking to ensure positive closure. These conditions, when considered individually, do act represent a CAQ but, if left uncorrected, could lead to a CAQ. Evaluations, tracking, or resolution of Departmental Dispositions do not require an apparent or root cause.
Trends - conditions requiring no further evaluation or corrective action beyond that already initiated.
The Supervisor of the PIR originator reviews the PIR for immediate personnel or equipment safety concerns not already addressed, completeness, and actions necessary for the preservation of evidence which may be needed for a root cause analysis. The supervisor also recommends interim actions to minimize recurrence until permanent corrective actions are identified and implemented, recommends an appropriate category and disposition of the identified problem (e.g., Work Item only, Condition Report, Engineering Project Request, etc.), and promptly notifies the Shift Supervisor of any condition requiring immediate action. Guidance is provided in Procedure 0.5 for categorization of the PIR.
The Shift Supervisor then reviews PIRs marked as requiring a Condition Report (CAO or SCAQ) for immediate personnel or equipment safety concerns not already addressed and promptly notifies the appropriate CNS Manager of any condition requiring immediate management action. The Shift Supervisor also identifies equipment having Technical Specification requirements and any Technical Specification Limiting Conditions for Operation (LCO) entered, determines the operability of affected systems, structures, or components, and identifies any immediate reportability requirements (10CFR50.72).
Operability Assessments (OA) are performed as part of the PIR review process using the instructions provided in Procedure 0.5. The Shift Supervisor evaluates the effect of the condition stated in the PIR on the SSC to assess the impact on its operability and to determine what immediate actions need to be taken if the SSC is inoperable or degraded. These actions include applicable Technical Specification
Attachment to NLS970027 Page 56 of 65 LCO Action Statements. If additional assistance is needed, he can obtain help from the STE or the Engineering Division. The basis for the OA is documented and attached to the PIR. Repairs or compensatory measures may be required to restore operability. Repairs would be accomplished through the MWR process.
Compensatory measures could include procedure changes, modifications, etc. If repairs or compensatory measures cannot be implemented in a timely fashion, a justification for continued operation may be prepared by Licensing and submitted to the NRC.
The Corrective Action Program Group (CAP Group) processes PIRs and evaluates and assesses PIRs each workday to validate the recommended category and disposition of the originator's supervisor. The CAP Group also ensures that PIRs categorized as " Departmental Disposition" do no1 represent a SCAQ or CAQ. The PIRs are then presented to the Condition Review Group (CRG). The CRG is a management review group comprised of front line managers that perform the fol lowing key functions:
Maintain an overview of operationallimitations to ensure safety is not being compromised and ensure economically significant issues are being pursued.
Categorize PIRs, assign the Responsible Manager, and assign priorities for SCAO and CAO Condition Report evaluations.
Designate other actions for Condition Reports as necessary.
Review PIRs marked as Departmental Disposition.
After presentation to the CRG, the CAP Group obtains Licensing's review fr. any reportability issues not already reported by the Shift Supervisor. Tha Licensing Department provides a comprehensive review of PIRs for reportability (10CFR50.73) and makes final decisions on reportability issues. They submit any l
justifications for continued operation to the NRC. The CAP Group then distributes j
the PIR to the responsible manager, assigns the trend code (s), and inputs the PIR information into the CAP database.
The responsible manager reviews assigned PIRs and assigns a Leader (for SCAQ j
Condition Reports) or Owner (for CAQ Condition Reports) for the evaluation and disposition. He also identifies any operational restraints not apparent during the CRG review and notifies the Shift Supervisor immediately whenever the investigation of the condition indicates that a system, structure, or component, declared operable may be inoperable. The manager approves the completion of corrective actions, ensures the timeliness of the actions to address or correct the condition, or, if appropriate, initiates interim actions to resolve or mitigate the
Attachment to NLS970027 Page 57 of 65 condition. The manager also monitors open actions associated with the initial disposition or corrective action plan to meet scheduled completion dates.
The assigned owner or team leader has the principal responsibility for evaluation and resolution of the problems identified. The owner or team investigates the condition, performs the required evaluation, develops the corrective action plan, takes other actions as assigned by the CRG to disposition the SCAO or CAO Condition Report, and assesses the effectiveness of the corrective action plan.
Root Cause Analysis provides the formal framework for evaluating SCAQs to determine their cause and to determine effective corrective actions to prevent recurrence. In the context of the CAP program a " problem, condition, or event" is defined as an equipment deficiency, a human error or a work process related j
administrative deficiency (which could be indicated by a negative trend). In most cases, a team approach is preferred for performing a root cause analysis. One of the team members must be certified to the Root Cause investigation Training program. In addition a CAP Evaluator is assigned to the team as a " mentor" to provide a guidance. The process requires an evaluation of the extent of the problem, and a determination of the generic implications (transportability). The evaluation is accomplished by reviewing available information on similar problems at CNS and throughout the industry to determine if the problem applies to other equipment or processes.
The training for a root cause investigator requires completion of two training plans:
Kepner/Tregoe Analytical Troubleshooting, which is a course on problem solving; and Root Cause Investigator, which is an in-house course developed from commonly used investigation techniques including Event and Causal Factor Charting, Common Cause Analysis, Organization Program Interface Charting, and Barrier Analysis. CAP mentors are also certified root cause investigators.
Upon completion of the SCAQ root cause investigation a report is prepared and presented to the Corrective Action Review Board (CARB). The report summarizes how the investigation was performed, the techniques and tools used, the results found, and the conclusions drawn to reach the root cause. The recommended corrective actions are also presented and explained with regard to the resolution of the root cause. The CARB typically consists of a Senior Manager (Chairman), CAP Group personnel, the Responsible Manager, and a QA representative. The CARB review provides reasonable assurance that the correct root cause has been identified and that appropriate corrective actions have been assigned to prevent recurrence of the condition.
As part of the Phase 3 Performance Improvement Plan various trend reports were developed to provide a tool to monitor the CAP program. In addition to monthly
Attachment to NLS970027 Page 58 of 65 j
reports on the generation, evaluation, closure, and distribution of PIRs with respect j
to totals for each department, the CAP Group inputs discovery method codes, q
program / function codes, system and component identifiers, and root cause codes, i
These codes enable the CAP Group to generate trend reports that focus on human performance related problems and identify recurrent problems within departments.
These types of trend reports are routinely provided to management. As an i
example of the trend information provided, the CAP Group identified a declining trend in procedure adherence. Management took action and conducted site wide training sessions to focus attention on this issue.
i (d).2 Reportability Determinations
.j The Shift Supervisor is trained to make reportability determinations when evaluating PIRs. The training covers the requirements of the applicable regulations and the implementing procedures as well as management expectations, and the J
guidance in NRC Inspection Manual, Part 9900, and NUREG-1022. In addition, the
. Shift Supervisor may contact Licensing or senior management for advice, if needed. When it has been determined that a report to NRC is required, the Shift Supervisor or Control Room Supervisor immediately contacts the Shift Communicator to make the report or assigns an alternate if the Shift Communicator is unavailable.
The Shift Supervisor ensures the information for the report is accurate. The Shift Supervisor may utilize the STE, Control Room Supervisor, Licensing, and/or CAP personnel to review the information to be reported for accuracy and appropriate detail. Then the Shift Supervisor ensures the. aal report is made to the NRC in the required time. As much factual information as possible is provided to aid the NRC in understanding the situation. If the NRC requests information for which accurate data is not yet available, then the requested information will be provided in follow-up communications. Follow-up reports are made as needed to keep the NRC informed of further degradation in the level of safety of the plant or other worsening conditions.
A copy of the information used for the oral report and any supporting information is forwarded to Licensing. If an oral report is not required, a copy of the PIR is sent to Licensing for preparation of the written LER.
In addition, Licensing reviews the PIRs sent to the CRG for reportability. Licensing is responsible for preparing the LER and submitting it to the NRC in accordance with the regulations. Input for the report is obtained from the PIR owner and others involved in the event as necessary. The PlR process is also used to track the submittal of the LER.
i e
w.
~
t
Attachment to NLS970027 Page 59 of 65 (d).3 Part 21 Notifications Any individual may identify a potential 10CFR21 reportable issue through the Corrective Action Program described in section (d).1 above. The PIR should identify the possibility of this condition being reportable per 10CFR21. Per Procedure 0.11, "10CFR Part 21 Evaluations," the date of the PIR is considered the date of discovery. An action item is assigned in the tracking system to have an evaluation performed within 60 days. Evaluations of potential defects in basic components must consider failure of functionally redundant basic components in determining whether a loss of safety function could occur. A condition, circumstance, or deviation which could cause a failure of the functionally redundant component must be considered in evaluating potentiallosses of safety function or major reduction in the degree of protection provided the public health and safety. Deviations in basic components which are delivered and accepted by CNS, but are not installed in the plant, must still be evaluated and reported under 10CFR21.
Part 21 evaluators are assigned by station management to perform evaluations.
The evaluation package, including aporopriate documentation and any completed attachments, is delivered to Licensit for an independent review. This review ensures that the evaluation and attachments support the conclusions of reportability, if reportability cannot be ascertained, the concern is escalated to the Vice President - Nuclear Energy who then decides.
If the concern is determined to be reportable, Licensing presents the evaluation to SORC for review. If SORC concurs that the item is reportable, the item is then presented to the Vice President - Nuclear Energy and reported to the NRC in accordance with regulatory requirements.
(d).4 Operating Exoerience Review (OER) Program The OER program ensures that pertinent issues, concerns, and lessons learned from industry experience are disseminated to CNS personnel and are incorporated in processes, procedures, programs, and training courses as appropriate.
The OER program is implemented by a dedicated OER Group who report to the Events Analysis Manager. Incoming Operatir.g Experience (OE) documents are screened for both event-based and progrmnmatic concerns. OE documents formerly issued by INPO and the NRC make up the majority of documents reviewed. Also reviewed, however, are OE documents generated by other utilities, daily 10CFR50.72 reporte, and NRC notifications. When an OE document is received by the OER Group, it is screened for issues that may be of immediate interest to departments or for conditions that require immediate action.
Attachment to NLS970027 Page 60 of 65 Existing degraded or non-conforming conditions adverse to safety identified or confirmed during operating experience document evaluations or conditions requiring immediate action have a PIR generated and action initiated per CNS Procedure 0.5. Conditions that are of immediate interest to a specific group or department are routed to the cognizant manager (s), supervisor (s), and/or staff.
Department Managers and Supervisors, with the assistance of the Nuclear Training Department, ensure pertinent information associated with industry experience is made available to all working levels of their departments.
The OER program was upgraded in 1994 in response to both internal and NRC concerns (CAL 4 94-08) regarding the effectiveness and thoroughness of the District's review of industry events and incorporation of lessons learned. Action taken to address these concerns included an initial screening of approximately 5,000 historical OE documente,, including revisions and supplements to determine their applicability and safety significance. These documents included:
NRC Bulletins, Generic Letters, Information Notices, Circulars, and 10CFR Part 21 notifications.
INPO documents: Significant Operating Experience Reports, Significant Event Reports, Significant Event Notifications, and Operating & Maintenance Reminders.
Vendor documents: GE-Service information Letters, GE-Rapid information Communications Services Information Letters, GE-Service Advisory, Westinghouse-Availability Improvement Bulletins, Westinghouse-Operations and Maintenance Memos, and Westinghouse-Customer Advisory Letters.
Other industry information notices.
Of the 5,000 documents screened, approximately 2,000 were determined to require further evaluation. The closure documentation for these 2,000 documents was then reviewed for adequacy. The majority of these were considered acceptable. In those cases where the closure documentation was not considered adequate, the document was reassessed by the responsible group and, if necessary, appropriate updated responses were developed and approved. Some of these reviews were caused by the inability to retrieve documented responses from the files. The reassessments resulted in 33 actions to address potentially safety significant OE document concerns. This review addressed all known historical OE documents. The NRC reviewed these program improvements (IR 96-05), and noted that the existing OER program appeared to be adequate.
2 Attachment to NLS970027 Page 61 of 65 The identification of potentially safety significant concerns at CNS prompts a I
review of operating experience for both root cause analysis and corrective action purposes. As appropriate, these OE documents and the associated responses are reviewed again in an effort to ensure that technical issues and lessons learned at other nuclear installations are properly addressed at CNS.
(d).5 Informal Renorts
'n addition to the formal reporting mechanisms described above, the NRC is made aware _ of developing issues through other communication channels. For example, the NRC Resident inspector frequently attends the plant morning meetings and can i
learn first hand about developing issues. It is also the expectation of plant-management that the NRC Resident be informed of developing issues as soon as possible, and that updates be provided whenever new information becomes available. In addition, the Licensing Manager discusses a variety of issues with the NRC Project Manager on a regular basis. This discussion provides an opportunity to update the Project Manager on the status of various issues, and identify other issues that are being evaluated. Furthermore, Plant Management discusses plant status and other issues with NRR and Region IV management as needed.
Attachment to NLS970027 Page 62 of 65 (e) The overall effectiveness of your current processes and programs in concluding that the configuration of your plant (s) is consistent with the design bases.
Response to item (e)
The District has made substantial progress over the past few years in addressing prior weaknesses in its design documentation, its design and configuration control, and its corrective action processes. CNS's design documentation, design control processes, and configuration control processes, as with other older vintage plants, have evolved over its 23 years of operation to reflect changing management, industry, and regulatory expectations.
The District is confident that its current engineering design and configuration control processes, as described in the response to item (a) above, provide effective controls for maintaining the configuration of the plant consistent with the design bases. Most of these processes have been evaluated and revised since the 1994 outage to address identified weaknesses. Additional enhancements to some of these processes are being considered as part of our ongoing Phase 3 Performance Improvement Plan.
The accuracy of the translation of the design bases into procedures has been verified by a number of efforts including the dev'elopment of Design Criteria Documents, the Drawing Verification Program, the Surveillance Test Validation Program, the Logic System Functional Testing Program, Limited Scope USAR Verification, and others.
The District's design change processes, procedure change process, and the various verification efforts conducted over the years provide the District with reasonable assurance that CNS's design bases requirements have been translated into operating, maintenance, and testing procedures.
Described below is a summary of the District's bases for concluding that the plant configuration is maintained in accordance with the design bases:
The Drawing Verification Program updated Control Room drawings to "as-built."
The Design Criteria Document Program gathers the design bases information for essential systems in one place and campares the DCD to other plant documents to ensure that the design bases information had been translated into plant operation.
Attachment to NLS970027 Page 63 of 65 Performance Improvement Plans Surveillance Test Validation Project verified that surveillance test procedures appropriately tested the design functions of systems and contained the proper acceptance criteria, consistent with the design bases.
System Checklist Verification ensured that system configuration checklists maintained and reflected CNS's design.
Restart Readiness Reviews provided a horizontal slice through key plant programs on a system basis to ensure those programs were successfully identifying and dispositioning plant issues.
Logic System Functional Testing ensured that logic system relay and switch contacts were being fully tested.
Inservice Testing Program Upgrade reestablished the Safety Related Pressure Boundaries consistent with the design bases, established a link between the design bases and the IST acceptance criteria, provided assurance of the adequacy of the IST surveillance test program, and updated the USAR.
Limited Scope USAR Verification performed a line-by-line review / comparison of the USAR and procedures to determine whether HPCI and RHR operating procedures accurately reflected the plant design as described in the USAR.
Maintenance Procedure Review enhanced the administrative and technical adequacy of mechanical and electrical maintenance procedures.
Environmental Qualification Program performed evaluations or tests to determine if equipment was able to meet the minimum performance characteristics in the specified environment.
The Ongoing Fire Protection Program Upgrade is reviewing, analyzing, comparing, and revising or developing the appropriate documents as related to Appendix R requirements.
The implementation of ITS will re-baseline the revised Technical Specification surveillances to ensure that the plant is capable of performing within the design bases.
Vendor Manual Program Upgrade provides personnel with current and technically accurate documents and information.
1 1
Attachment to NLS970027 Page 64 of 65 Emergency Operating Procedure Development compared CNS's design with the generic EPGs and incorporated that design into the plant specific EOPs.
MOV Program developed procedures to insure that MOV switch settings were appropriately controlled and maintained to provide a high degree of assurance that the affected valves would be capable of performing their design bases functions when called upon.
The OER program ensures that CNS and industry operating experience is reviewed i
and evaluated for effects on plant operations and the design bases.
The USl A-46 evaluation for CNS provides additional assurance of the capability to safely shutdown following a design basis seismic event.
Engineering Self Assessment performed both horizontal reviews of Engineering support and program functions, and vertical-slice reviews of two systems.
QA Audits assess the effectiveness and performance of programs and personnel within the scope of the CNS QA Program.
The District's efforts in developing the DCDs, performing drawing and procedure verifications, and implementing the Phase 1 and 2 Plans as described in the responses to items (b) and (c) above, provide reasonabh assurance that there are no significant safety issues at CNS created by the weaknesses in prior design-related control processes at CNS. Furthermore, internal and external assessments since the completion of the Phase 1 and 2 plans indicate improved performance, especially in the District's ability to self-identify problems. As described in the response to item (d), if a safety issue or discrepancy in the plant conf lguration is identified, regardless of its safety significance, the CNS program for problem identification provides the controls necessary to assure that corrective measures are taken. The District acknowledges that in recent years a number of deficiencies have been identified in design related processes and programs. However, as described in this letter, a number of design verification efforts, program upgrades, and process improvements have been completed. On this basis, the District is confident that its current processes and programs are effective and that there has been sufficient verification of past and present programs and processes to conclude that the configuration of the plant is consistent with the design bases.
The District recognizes that there may be minor inconsistencies and ambiguities in old design documents and the USAR, and that to achieve superior performance, CNS must continue to examine its practices in a self-critical fashion and make improvements where needed. The preliminary results of the recent NRC SSFI identified some additional examples of USAR inconsistencies and ambiguities.
.~_. _.-- -.--.. -.. -..-, --.
Attachment to NLS970027 Page 65 of 65 Although the identified issues are considered of minor safety significance and did not affect plant operability, the District will perform a comprehensive USAR update and validation. Together with the ongoing Phase 3 Performance improvement Plan, implementation of the Business Plan, and the USAR update effort will further enhance the District's configuration management efforts and will help CNS achieve its goal of top quartile performance.
l ATTACHMENT 3 LIST OF NRC COMMITMENTS l
Correspondence No: NLS970027 The following table identifies those actions committed to by the District in this document.
Any other actions discussed in the submittal represent intended or planned actions by the District.
They are described to the NRC for the NRC's information and are not regulatory commitments.
Please notify tne Licensing Manager at Cooper Nuclear Station of any questions regarding this document or any associated regulatory commitments.
COMMITTED DATE COMMITMENT OR OUTAGE The District will provide a detailed description of the March 31, 1997 scope of the USAR Project The District will perform a comprehensive USAR update and N/A validation l
l l
PROCEDURE NUMBER 0.42 l
REVISION NUMBER 3 l
PAGE 6 OF 9
__]