ML20138P857
| ML20138P857 | |
| Person / Time | |
|---|---|
| Site: | Browns Ferry  |
| Issue date: | 02/12/1997 |
| From: | TENNESSEE VALLEY AUTHORITY |
| To: | |
| Shared Package | |
| ML082401529 | List: |
| References | |
| NUDOCS 9703050420 | |
| Download: ML20138P857 (72) | |
Text
.. -
j l
1 I
1 3
1 ENCLOSURE 1 3
i TENNESSEE VALLEY AUTHORITY BROWN 8 FERRY NUCLEAR PLANT (BFN) 4 UNITS 1,.2, AND 3 i
RESPONSE TO REQUEST FOR INFORNATION REGARDING ADEQUACY AND AVAILABILITY OF DESIGN BASE 8 INFORMATION 1
l i
2 i
h 1
J d
b l
1 4
i a
l 4
4 9703050420 970212 PDR ADOCK 05000259 P
PDR i
l I
ENCLOSURE 1 i
TENNESSEE VALLEY AUTHORITY BROWN 8 FERRY NUCLEAR PLANT (BFN) i UNITS 1, 2, AND 3 l
RESPONSE TO REQUEST FOR INFORMATION REGARDING ADEQUACY l
AND AVAILABILITY OF DESIGN BASES INFORNATION 1
l TABLE OF CONTENTS
(
Page 1
I. EXECUTIVE
SUMMARY
1 II.
SUMMARY
OF BFN DESIGN BASIS VERIFICATION EFFORTS
.........................................3 A.
Background
.................................3 B.
Design Baseline Verification Program (DBVP).. 3 1.
Determination of Unit 2 Design Basis 4
Requirements.............................
5 2.
Independent Reviews of Unit 2 DBVP....... 8 3.
Determination of Unit 3 Design Basis Requirements.............................
8 4.
Independent Reviews of Unit 3 DBVP.......
8 5.
Comparison of the DBVP to NUMARC Guidance.................................
8 C.
DBVP Implementation..........................
9 D.
Restart Test Program........................
11 E.
System Pre-operability Checklist (SPOC)/
System Plant Acceptance (SPAE) Process......
11
)
F.
Summary.....................................
11 III. Specific NRC Requested Information...............
15 A.
Request (a).................................
15 1.
Design and Configuration Control........ 15 a.
Design Change Control Process.......
16 b.
Fuel / Core Component Change Control.. 17 i
1
)
]
TABLE OF CONTENTS (Continued)
Page i
c.
Temporary Alteration Control........
18 d.
Design Process Perfccmance Monitoring..........................
19
- 2. Activities that Maintain Design Configuration............................
19 j
a.
System Line-up Controls.............
19 b.
Overall Control of the Operation of Plant Equipment..................
20 c.
Control of Equipment During Maintenance and Modifications.......
20 d.
Post-modification / Post-maintenance Testing.............................
21 e.
Control of Replacement Parts During i
Maintenance.........................
21 J
f.
Independent /Second Party Verification........................
22 j
g.
Access to Design and Licensing Basis Information.........................
22 J
3.
10 CFR 50.59 Safety Assessments / Safety i
Evaluations............................. 23 4.
Updated Final Safety Analysis Report (10 CFR 50.71(e))
.......................24
'5. Implementation of Appendix B to 10 CFR Part 50.......................... 25 l
6.
Commitment Management................... 27 B.
Request (b)
................................28 1.
Procedural Controls..................... 28 a.
Design Change Process............... 28 b.
Procedure Generation / Revision Process.............................
28 i
c.
Vendor Manual Control Process.......
29
-.. -. ~. -
J r
l i
4 i
J i
i TABLE OF CONTENTS (Continued)
+
i l
Page 4
2.
Procedure Verifications................. 29 r
i a.-
Procedure Upgrade Programs..........
29 j
i j
b.
Operating Experience (CE) Program... 31 t
l-c.
Generic Regulatory Issues...........
33' i
i
~
d.
Emergency Operating Instructions.... 33 3.
Independent Assessments................. 34 a.
Quality Assurance Assessments.......
34 b.
TVA Vertical Slice Assessments......
35 4
c.
NRC Vertical Slice Assessment.......
37 i.
4.
Summary................................. 37 l
9 i
4 j
C.
Request (c)
................................38 q
1 l
1.
Configuration and Performance Controls.. 38 l
2.
Verification Programs.................... 38 l
a.
Reconciliation of Design Basis and Plant configuration..'................'39 f
b.
Restart Test Prograu................
39 i
SPAE/SPOC...'........................
40 c.
3.
SSC Testing............................. 40 l
a.
Routine Surveillance Testing........
40 j
j b.
ASME Code Required Performance 1
Monitoring..........................
41 (1) Inservice Inspection............ 41 (2) System Pressure Tests........... 41 (3) Inservice Testing............... 42 c.
Containment Testing.................
42 iii
TABLE OF CONTENTS (Continued)
Page 4.
Continuing Review Efforts............... 42 a.
Maintenance Rule Requirements.......
42 b.
System Status Reports...............
42 c.
Operating Experience Program........
43 d.
Generic Regulatory Issues...........
43 5.
Independent Assessments................. 44 a.
Quality Assurance Assessments.......
44 b.
TVA Vertical Slice Assessments......
44 c.
NRC Vertical Slice Assessment.......
45 6.
Summary................................. 45 D.
Request (d).................................
46 1.
TVA Corrective Action Program...........
46' a.
WR/WO Process.......................
47 b.
PER Process.........................
48 c.
Self-Assessments....................
52 d.
Operating Experience Program........
53 e.
Event Reporting Process.............
53 f.
Informal Reporting..................
54 g.
Informal Processes..................
54 E.
Request (e)..................................
S'S
- 1. Summary of TVA Confidence in Design Basis................................... 55 2.
Performance / Implementation Issues....... 56 3.
Measurements of Effectiveness........... 56 a.
TVA EffectivenesE Monitoring........
57 l
l l
IV
(,
l TABLE OF CONTENTS (Continued)
Page i
b.
NRC Reviews.........................
57 (1) Design Baseline Verification Program..........................
57 (2) Procedure Upgrade Program.......
59 (3) Corrective Action Program.......
59 i
(4) Electrical Distribution System Functional Inspection...........
60 (5) Performance Issues..............
60 4.
Additional Relevant Assessments.........
61 a.
Current Licensing Basis.............
61 b.
The UFSAR...........................
61 l
F.
Additional Efforts...........................
65 l
1.
Vertical Slice Assessments..............
65 2.
QA Assessments of Engineering Activities 65 3.
QA Assessment of FSAR Accuracy.......... 66 4.
Engineering Validation of FSAR Accuracy. 66 l
r b
1 k
I i
f l
5 v
l t
l
ENCLOSURE 1 TENNESSEE VALLEY AUTEORITY BROWNS FERRY NUCLEAR PLANT (BFN).
UNITS 1, 2, AND 3 RESPONSE TO REQUEST FOR INFORNATION REGARDING ADEQUACY AND AVAILABILITY OF DESIGN BASES INFORNATION I.
EXECUTIVE SUNNARY This enclosure provides TVA's response to the October 9,
- 1996, 10 CFR 50.54(f) request for information regarding the adequacy, availability, and control of design basis information for BFN.
As described in this enclosure,.TVA has appropriate documentation l
defining the design basis'for BFN.
TVA also has processes and controls designed-to ensure that the design basis, and changes j
made to the design basis,-are appropriately evaluated and j
reflected in procedures, as well as in system, structure and component (SSC) configuration and performance.
TVA has. performed several programs which verified that the design basis has been l
translated into procedures and SSC configuration and performance, and we continue to perform reviews and assessments that challenge this translation.
TVA's efforts in this area are not static, but rather are continually being impreved and enhanced in light of ongoing industry and regulatory developments and TVA's own internal assessments.
When problems or the need for enhancements are identified, they are addressed through TVA's corrective action program.
All of these programs, processes, controls, and reviews, as well as TVA's self-critical approach in this area, provide TVA with assurance that BFN is operated safely and consistent with BFN. design basis requirements.
It was approximately ten years ago that TVA identified a failure at BFN to consistently maintain a documented design basis and to control the plant's configuration in accordance with that basis..
s To address this concern, TVA implemented several improvement for Units 2 and 3.g a Design ~ Basis Verification Program (DBVP) programs, includin The scope of the DBVP included developing design documentation for those systems, or portions thereof, that perform safety-related functions.
This included the safety functions necessary to mitigate postulated Final Safety Analysis Report (FSAR) Chapter 14 accidents, abnormal operational transients, special events (e.g., evacuation of the control room), and external events (e.g., flooding, tornado, and earthquake).
The DBVP also included plant walkdowns and drawing In accordance with TVA's prior commitments, TVA will implement the DBVP on Unit 1 prior to its return to service.
3 I
1 l'
l t
I
\\
t verifications that reconciled plant configuration and design l
basis.
Once design requirements were developed through this program, they were incorporated into design documents, i.e.,
i i
design criteria, calculations, drawings, and the safe shutdown
}
analysis.
These documents are reviewed when design changes are made and are updated as part of the configuration control i
j process.
As part of TVA's efforts to restart' Units 2 and 3 in the early l
1990's, TVA also implemented several programs to upgrade operations, maintenance, and testing procedures.
In addition, t
TVA implemented testing programs that validated the performance of SSCs.
These programs utilized the results of the DBVP to l
ensure design basis requirements were incorporated into the procedures.
Since the implementation of those programs, the integrity of TVA's design basis, as well as the translation of that basis into procedures and SSC configuration and performance, have been examined and tested through several mechanisms.
These mechanisms include TVA review efforts that target specific industry and regulatory issues, TVA self-assessments, and Nuclear Regulatory Commission (NRC) inspections.
TVA recognizes the importance of maintaining plant configuration consistent with the design basis and the need to control changes to the design basis to ensure that design basis assumptions remain valid.
TVA also recognizes the importance of maintaining an accurate Updated Final Safety Analysis Report (UFSAR).
TVA continues to be self-critical in these areas and has identified the need for improvement in UFSAR accuracy.
Accordingly, TVA has initiated actions to review the UFSAR and the processes used to control the UFSAR.
Details of the processes, programs and reviews of design basis information and its translation into procedures, and SSC configuration and performance are provided below.
Also included are TVA's plans for future activities in this area.
i J
1 2
i k
II.
SUMMARY
OF BFN DESIGN BASIS VERIFICATION EFFORTS In the paragraph following NRC information requests (a) through j'
(e) in the October 9, 1996 10 CFR 50.54(f) request, the NRC asked l
for information regarding licensee design review or reconstitution programs.
Provided below is a summary of principal efforts TVA has already undertaken in this area.
This l
summary is referenced and augmented, as applicable, in TVA's j
specific responses to requests (a) through (e).
A.
Background
Browns Ferry Units 1 and 3 were voluntarily shut down by TVA in March 1985 because of specific questions regarding leak rate testing for Unit 1 and instrumentation for Unit 3.
Unit 2 was already in a refueling outage at that time and remained shut i.
down. On September 17, 1985, the NRC requested in a letter to j
TVA's Chairman of the Board, pursuant to 10 CFR 50.54(f), that TVA describe the corrective actions which would be completed provide a schedule for longer term actions.g facilities and prior to restart of any of the TVA operatin j
TVA submitted and subsequently updated the Corporate Nuclear Performance i
Plan (CNPP) and the Browns Ferry Nuclear Performance Plan (BFNPP), which contained TVA's corrective action plans.
The l
CNPP addressed concerns with TVA's corporate management.- The BFNPP addressed Browns Ferry site specific issues, with an emphasis of the actions required to restart Unit 2.
The Unit 3 recovery programs were the subject of subsequent correspondence.
i I
j Unit 2 was restarted in May 1991 and Unit 3 was restarted in l
November 1995.
j B.
Desian Baseline Verification Procram (DBVP) f The BFNPP was originally isgued in August of 1986 and was last 3
i revised in October of 1988.
TVA provided separate submittals j
that contained additional details regarding the proposed corrective action programs.
As part of TVA's response to the q
NRC's letter dated September 17, 1985, TVA began a DBVP in the j
review in March 1988.gitted Revision 4 of the Unit 2 DBVP for NRC j
late 1980's.
TVA sub i
The BFN DBVP was established to resolve i
j several problems related to design control that had occurred at NRC letter from William J. Dircks, Executive Director for operations, f'
to Charles Dean, Chairman - TVA Board of Directors, dated September 17, 1985, j
in regards to a Request for Information, Pursuant to 10 CFR 50.54(f), for TVA's Corrective Actions to Address concerns Identified During the Fifth Systematic Assessment of Licensee Performance Report.
J TVA letter to NRC, dated August 28, 1986, in regards to submittal of j
the Browns Ferry Nuclear Perfog1 nance Plan.
TVA letter to NRC, dated october 24, 1988, Browns Ferry Nuclear i
j Plant (BFN) - Nuclear Performance Plan.
l.
TVA letter to NRC, dated Narch 25, 1988, Design Baseline and j
verification Program (DBVP) - Program Plan Revision 4.
4 3
,,_4
1
)
i-BFN.
These problems were:
I Ineffective control of plant changes caused a loss of L
configuration control, which resulted in engineering design and evaluations being performed using inaccurate' drawings.
l 1
o' The plant's design basis was scattered among many' documents, which were not readily available for use..
Weaknesses in some plant modifications implemented after the l
plant became operational.
The objective of the DBVP was to re-establish the design basis l-and evaluate the plant configuration to ensure:
l i
The plant configuration satisfies the design basis,
{
i The configuration of systems and components within the scope of the DBVP program is supported by engineering analysis and documentation, and The plant configuration is in conformance with TVA's licensing commitments.
The essential elements of the overall program were as follows:
i i
I Research and develop design basis documentation, I
Verify the plant configuration,
{
l j
Reconcile the plant configuration with engineering design documents, including essential calculations and design
- criteria, i
Reconcile the plant configuration with the Browns Ferry FSAR
]
and licensing commitments, l
Perform system evaluations of the verified plant
)
J configuration to identify design discrepancies,
)
Issue configuration control drawings consistent with the plant configuration for systems within the scope of the DBVP, and Implement an improved change control process to ensure the 1-accuracy and completeness of design basis documents (i.e.,
design criteria, calculations, drawings, and the safe
?
l shutdown analysis).
These documents are reviewed uhen design changes are made and are updated accordingly.
4 i
I i
a i
i 1
Design basis documents verified or developed during the DBVP were I
l comprised of the Safe Shutdown Analysis (SSA), system design j
criteria, supporting calculations, and drawings.
i 1
l 1.
Determination of Unit 2 Desian Basis Reauirements TVA i
i established the Unit 2 design basis requirements and reconciled l
the as-designed and as-constructed facility using the following four steps.
Lessons learned from the Unit 2 program were j
incorporated into the Unit 3 program and are discussed later in l
l this section.
4 Step 1 -
Review of Design Basis Documents and Re-establishment of the Design Basis Step 2 -
Defining the As-constructed Configuration of the Systems and Components Within the Unit 2 and Common DBVP Boundary Step 3 -
Reconciliation of the As-constructed Configuration with the Re-established Design 3 asis Step 4 -
Issuance of Required Documentation and Corrective Actions Details of each of these steps are provided below:
Step 1 -
Review of Design Basis Documents and Re-establishment of the Design Basis The design basis input for Unit 2 was established through the creation of a commitments / requirements (C/R) database, design criteria documents, an SSA, a set of essential calculations within the scope of the DBVP, and functional testing requirements.
In general terms, this was accomplished in the following manner:
The licensing commitments and. design requirements necessary to achieve safe shutdown were documented in a C/R database for use in establishing the design criteria documents.
An SSA was performed based on the FSAR Chapter 14 accidents, abnormal operational transients, special events (e.g., evacuation of the control room), and external events (e.g., flooding, tornado, and earthquake).
The list of SSA events is provided in the attached Table at the end of this section.
Systems and portions of systems necessary to support safe shutdown were identified in system requirements calculations (SRCs).
The SRCs were used in establishing the scope of the DBVP and identifying the equipment requiring essential calculations to be performed.
The Design Criteria Documents (DCDs) were developed from a search of the licensing commitments and design requirements database.
The DCDs define the engineering requirements necessary to meet 5
1
h
)
l the plant's design basis.
4 I
Essential calculations are those which address plant systems or j
features whose failure could result in:
loss of reactor coolant i
system integrity, loss of ability to achieve safe shutdown, or a release of radioactive material offsite in excess of the a
i 10 CFR 100 guidelines.
The essential calculations needed to l
verify the adequacy of the design were reviewed to. ensure that they supported the plant's design basis, were' upgraded if necessary, and if calculations did not exist, new calculations were performed.
Testing requirements for the verification of system capability were developed, where necessary, to ensure the system
- configuration satisfied the functional requirements as defined by the design basis.
These test requirements were included in the Restart Testing Program.
Step 2 -
Defining the As-constructed Configuration of the Systems and Components Within the Unit 2 and Common i
i DBVP Boundary The plant configuration was established through walkdowns, which compared the plant configuration with the as-constructed plant drawings, and through verification of electrical diagrams by walkdowns and/or functional testing.
The walkdowns verified the arrangement of components, and type of components.
The walkdown information was documented on drawings to reflect the as-built configuration.
These drawings were reviewed for conformance to the design basis and, following reconciliation of discrepancies, were then issued as configuration control drawings (CCDs).
The functional configuration of the identified electrical systems and electrical aspects of mechanical systems were verified in the i
following manner: 1) Schematic / elementary diagrams were verified by tests and review of existing documents, or 2) Single lines were verified by physical walkdown and functional testing.
After the functional configurations of the electrical diagrams were verified and open items identified by the DBVP were resolved,
)
CCDs were issued to document the as-built plant configuration.
j The results of walkdowns from other programs were also utilized (e.g., environmental qualification, the seismic qualification of large bore piping and pipe supports, field verified cable routing j
data from TVA's cable ampacity and Appendix R program, walkdowns l
and evaluation of Class 1E low voltage power, control and instrumentation cables and safety-related medium voltage cables, and walkdowns of selected Regulatory Guide 1.97 instrumentation).
This information was assessed and used whenever appropriate in determining the functional configuration of the plant.
Results of the restart testing program were used as noted in verification of alectrical diagrams above.
Step 3 -
Reconciliation of the As-constructed configuration i
6
I i
l with the Re-established Design Basis i -
The plant configuration was evaluated against the design basis to verify that the plant was in conformance with safe shutdown requirements.
The. evaluation of each plant system was performed in the following manner and documented in a System Evaluation
}
Report.
f Plant drawings were reviewed to ensure that they accurately depicted the system functions.
Differences between the as-built j
drawings and the as-designed drawings were evaluated and reconciled to generate Configuration Control Drawings.
Acceptable differences were incorporated into the design basis of 1
the plant and discrepancies were punch-listed and tracked until closure.
Corrective action program documents were evaluated to ensure that
{
the corrective actions were in accordance with the plant's design I
basis.
This included closed corrective action documents not supported by an engineering or design change notice.
Corrective action was initiated as necessary.
The work performed by other restart programs (e.g., electrical and seismic issues) was reviewed to determine the portion that i
could be used to satisfy DBVP requirements.
Where appropriate, credit was taken for this work in evaluating the system 5
configuration.
}
Change documentation was reviewed on those systems and portions of systems required for safe shutdown to ensure that the changes a
required to meet the design basis were implemented prior to f
restart.
Changes that were not implemented or partially implemented were evaluated for acceptability based on their status at the time of restart.
Portions of changes not required i
for restart were canceled / voided and closed.
3 Test specifications were prepared for the Restart Test Program to ensure that the testing would verify the required functional requirements of the plant configuration as specified in the design basis documentation.
If testing determined that the functional requirements were not met, a corrective action tracking document was issued and either the design basis was revised or the configuration was modified by the design change control process.
1 Step 4 -
Issuance of Required Documentation and Corrective Actions The outputs of the DBVP consisted of design criteria documents, j
configuration control drawings, essential calculations, system evaluation reports, and documentation required to resolve open items.
The system evaluation report was prepared for each system within the DBVP scope to document the evaluations discussed above.
Open items, including verifying assumptions in essential
)
I 7
_- ~
calculations, reviewing test results, and other pre-restart items, were punch-listed and tracked until closure.
2.
Independent Reviews of Unit 2 DBVP:
In addition, TVA's Engineering Assurance and Quality Assurance Departments performed independent reviews of the DBVP implementation described above on a sampling basis.
The objectives of the reviews were to:
Confirm and validate that engineering activities were conducted in accordance with the approved program plan and procedures.
Confirm technical adequacy of system evaluations and completeness / correctness of supporting documentation.
Verify that corrective actions resulting from these evaluations had been documented and properly implemented.
This review provided added assurance that the engineering activities associated with the program were conducted in a technically adequate manner and in accordance with the written procedures prepared specifically for the DBVP effort.
3.
Determination of Unit 3 Desian Basis Reauirements:
The methodology used to establish the as-built plant configurations for Unit 3 was the same as that used for Unit 2.
However, the Unit 3 DBVP incorporated lessons learned from the Unit 2 program.
Walkdown data for Unit 3 was used to generate verified as-built drawings.
The drawings were evaluated against the design basis
)
and identified discrepancies were resolved.
4.
Independent Reviews of Unit 3 DBVP:
The TVA Quality Assurance organization performed independent reviews of the Unit 3 DBVP.
These independent reviews were performed on a sampling basis and included a series of planned audits, technical assessments, and design reviews of the DBVP process and key deliverables.
The objective of these reviews was the same as those for the independent assessments performed by Engineering Assurance for the Unit 2 DBVP.
These reviews provided added assurance that the Unit 3 DBVP activities were conducted in a technically adequate manner and in accordance with the written procedures prepared for j
the effort.
5.
gpr.3rison of the DBVP to NUMARC Guidance:
TVA developed the BFN DBVP prior to the issuance of NUMARC 90-12, Design Basis Program Guidelines.
However, TVA subsequently compared the NUMARC guidance with the corresponding TVA ; programs (e.g., DBVP and corrective action program) and determined that the TVA programs meet or exceed the recommendations contained in tha NUMARC guidance regarding the scope of design basis documents for safety-related systems, the process for evaluating and reporting i
8 r
discrepancies, design basis document validation, management and control, and the integration of the design basis program with configuration management and design control.
C.
DBVP Implementation The DBVP was implemented on Unit 2 in two phases.
TVA completed Phase I in 1991, before restart of Unit 2.
This phase included the evaluation of those systems and portions of systems required for safe shutdown.
These systems, or portions thereof, were identified by determining the safety functions necessary to mitigate postulated FSI.R Chapter 14 accidents, abnormal operational transients, special events (e.g., evacuation of the control room), and external events (e.g., flooding, tornado, and earthquake).
Specifically, Phase I DBVP included those systems or portions of systems required for reactor pressure vessel integrity, primary or secondary containment integrity, core i
cooling, reactor pressure vessel over-pressure relief, decay heat i
removal (torus cooling), and reactivity control.
TVA completed Phase II in 1993, prior to restart from the next Unit 2 refueling outage.
Phase II extended the DBVP to include the balance of safety-related functions of systems or portions of systems that are utilized in abnormal operational transients and special events not previously covered by Phase I.
Prior to completion of Phase I and restart of B g nit 2, the NRC reviewed the adequacy of the BFN's DBVP program the implementation of Phase I of the Unit 2 program.00"N1 ""
As stated in Inspection Report 89-07, most of the deficiencies noted during the inspection were previously identified by TVA and corrective actions were being tracked.
Therefore, the NRC team concluded that TVA was adequately implementing the DBVP.
TVA Inspection Reports. g g g specific issues raised-in each of the formally responded This culminated in the final NRC NRC letter to TVA, dated December 8, 1988, Volume 3,Section III.2.G (Configuration Nanagement Program - Design Baseline and verification Program) of the Nuclear Performance Plan - Browns Ferry Nuclear Plant.
]
NRC letter to TVA, dated April 14, 1989, Safety Evaluation Report on the Browns Ferry Nuclear Performance Plan - NUREG-1232, Volume 3.
NRC letter to TVA, dated october 24, 1989, Supplement 1 to the Safety Evaluation Report on the Browns Ferry Nuclear Performance Plan - NUREG-1232, Volume 3.
NRC letter to TVA, dated September 8, 1988, Inspection Report Nos. 50-259/88-07, 50-260/88-07 and 50-296/88-07.
NRC letter to TVA, dated June 30, 1989, Inspection Report Nos. 50-259/89-07, 50-260/89-07 and 50-296/89-07.
NRC letter to TVA, dated February 26, 1990, NRC Inspection Report No. 50-260/89-42.
12 TVA letter to NRC, dated November 3, 1988, Response to NRC Inspection Report Nos. 50-259/88-07, 50-260/88-07, and 50-296/88-07.
9
approval of the DBVP program and Phase I of its implementation.15 TVA submitted a summary of the scope, closure of individual program elements, and the pverall completion of Phase II of the Unit 2 DBVP in June 1993.3 TVA evaluated lessons learned from the Unit 2 DBVP and developed a more comprehensive program for Unit 3, which included addressing the demands on common systems due to multi-unit operation and unit tio unit interactions.
The' Unit 3 DBVP i
consolidated the two-phase (pre-and post-restart) approach performed on Unit 2 into a single pre-restart program.
TVA i
I provided the Unit 3 DBVP description, including a discussion of lessons le gned from the Unit 2 DBVP program, for NRC review in June 1991 1
NRC's review of the Unit 3 DBVP program confirmed it was more comprehensiyg than the Unit 2 effort, and was therefore December 1994. A special NRC DBVP inspection was conducted in acceptable.
The inspection concluded that, overall, the DBVP was effective in establishing the design basis for plant safety systems.
The NRC also found that:
1.
Engineering and Design Change Notices effectively addressed plant problems and nuclear safety issues; 2.
Modification packages and equipment installation were well controlled and documented; and l
3.
The process for controlling, reviewing, and changing drawings was good and in accordance with established procedures.
i j
InaccordancewithTVA'spriorcommitments,TVAwillimplegg the DBVP on Unit 1 prior to that unit's return to service l
J TVA letter to NRC, dated April 18, 1989, supplemental Response to NRC Inspection Report Nos. 50-259/88-07, 50-260/88-07, and 50-296/88-07.
TVA letter to NRC, dated August 22, 1989, Response to NRC Inspection Report Nos. 50-259/89-07, 50-260/89-07, and 50-296/89-07.
]
NRC letter to TVA, dated January 23, 1991, NUREG-1232, Volume 3, supplement 2 - Browns Ferry Unit 2 [Section 2.1, Page 2-1].
TVA letter to NRC, dated June 24, 1993, completion of Comunitment for Unit 2 Cycle 6 for Design Baseline Verification Program (DBVP) Phase II.
TVA letter to NRC, dated June 13, 1991, Design Baseline Verification Program (DBVP).
NRC letter to TVA, dated November 21, 1991, Assessment of Browns Ferry Nuclear Plant, Units 1 and 3 Design Baseline Verification Program.
NRC letter to TVA, dated January 17, 1995, NRC Inspection Report Nos. 50-259/94-31, 50-260/94-31, and 50-296/94-31.
TVA letter to NRC, dated July 10, 1991, Regulatory Framework for the Restart of Units 1 and 3.
10 t
__-__._.____m.___.._
J i
i-3 In summary, TVA committed to perform a' design basis verification l
in response to an NRC request for additional information
{
addressed to TVA's Chairman of the Board.
TVA has performed the l
design basis verification for Units 2 and 3.
As part of this effort, TVA also upgraded its design control process to ensure 4
j that changes to the facility are evaluated against, and l'
appropriately reflected in, the design basis documents.
f D.
Restart Test Program s
1 The primary purpose of the Unit 2 Restart Test-
'ran was to was l
to utilize the design basis requirements devt' oy the DBVP to verify that systems and components were papat f meeting their safe shutdown performance requirements.2 The
- st scope l
l consisted of test requirements necessary to v aify system design j
functions utilized in satisfying the safe shutdown analysis and to ensure reliable system operation.
Lessons learned from the Unit 2 Restart Test Program implementation process were j
incorporated in the development of the Unit 3 program.
l i
E.
System Pre-operability checklist (SPOC)/ System Plant Accentance Evaluations iSPAE) Process TVA utilized two programmatic approaches to ensug the complete j
recovery of the safety systems of Units 2 and 3.
The first was used for the engineering validation and the second for the 3
initial checkout and operation of each of the systems.
Prior to j
}
turning a safety system over to Operationa, the SPAE verified that the established design criteria were reflected in the l
physical plant.
It also ensured that the required calculations i
were issued and updated and that primary and critical drawings were revised and updated prior to the system being considered available for service.
Using the SPOC, TVA verified that construction and maintenance work was complete, component testing finished, operating procedures upgraded, field survey and walkdowns concluded, and closure of other issues (i.e.,
programmatic issues, commitments, corrective action documents, and other open items) verified.
F.
Summary The DBVP developed the design basis requirements.
The Restart Test Program verified that safety-related systems and components were capable of meeting the safe shutdown requirements developed TVA letter to NRC, dated April 16, 1996, in regards to Removal of BFN Unit 1 as a Category 3 Plant on the NRC's Problem Plant List.
A concise summary of the Unit 2 DBVP is contained in TVA letter to NRC, dated September 27, 1991, Restart Test Program Description for Units 1 and 3.
3 TVA letter to NRC, dated october 21, 1988, Prerequisites for Reloading Fuel in BFN Unit 2.
11
-..=.
i by the DBVP' The SPAE process ensured the design basis documents incorporated the design basis requirements and the SPOC process ensured that the operating procedures had been updated.
The following responses to the NRC's specific questions also provide the basis for concluding that TVA has adequately maintained control over design basis requirements since that time.
i i
12
TABLE SAFE SIIUTDOWN ANALYSIS EVENTS ENCOMPASSED BY TIIE DESIGN BASELINE VERIFICATION PROGRAM DESCRIPTION TYPE CATEGORY" Generator Trip N
AT Turbine-Generator Trip with Bypass Failure N
AT Pressure Regulator Failure - Closed N
AT Turbine Trip N
AT Isolation of All Main Steam Lines N
AT Closure of One Main Steam Isolation Valve N
AT Loss of Feedwater Heater N
AT shutdown Cooling (RHRS) Malfunction (Temperature N
AT Je:rease)
Inadvertent Pump Start N
AT Control Rod Withdrawal Error N
AT Fuel Assembly Insertion N
AT Control Rod Removal Error N
AT Pressure Regulator Failure - Open N
AT Inadvertent Opening of All Bypass Valves N
AT Inadvertent opening of a safety / Relief Valve N
AT Loss of Feedwater Flow N
AT Loss of offsite AC Power C
AT Recirculation Control Failure - Decrease N
AT Recirculation Pump Trip (One Pump Trip)
N AT Recirculation Pump Trip (Two Pump Trip)
N AT Recirculation Pump Seizure N
A Recirculation Flow Controller Failure Increasing N
AT Flow 13
~
DESCRIPTION TYPE CATEGORY Startup of Idle Reactor Recirculation Pump N
AT Loss of Shutdown Cooling N
AT Feedwater Controller Failure - Maximum Demand N
AT Control Rod Drop Accident N
A Pipe Break Inside Containment - Large Break N
A Intermediate Pipe Break Inside Primary Containment N
A Small Pipe Break Inside Primary Containment N
A Pipe Break Inside Containment and Radiological N
A Effect Fuel Handling Accident C
A Pipe Break Outside Primary Containment N
A Shutdown From outside Control Room C
S Shutdown Without Control Rods N
S overpressure Protection (MSIV Closure - Backup 11 S
Rotated or Mislocated Bundle N
A Flood C
S Low Reservoir Downstream Dam Failure C
S Tornado C
S Earthquake C
S Fire N
S Loss of Fuel Pool Cooling / Makeup N
S N = Zvent is independent, only affects one unit C = Event is common, affecting all units AT = Abnormal Transient, A = Accident, S = Special l
I 14
III.
SPECIFIC NRC REQUESTED INFORMATION A.
Reauest fa)
Description of engineering design and configuration control processes, including those that implement 10 CFR 50.59, 10 CFR 50.71(e), and Appendix B to 10 CFR Part 50.
TVA Response to Reauest ia)
TVA has several interconnecting design and configuration control programs and processes which address 10 CFR 50.59, 10 CFR 50.71(e), and Appendix B to 10 CFR Part 50.
These programs and processed include or are augmented with training, self-checking, and line and independent organization reviews.
The programs at all sites contain, as a minimum, the essential elements described in this response, but there are minor implementation differences between the sites to address specific issues.
1 Additionally, although these programs have evolved with time, the same basic program features have been in use since the DBVP.
Use i
of these programs, coupled with various oversight activities and j
other programmatic controls that are described later in this response, provides TVA confidence that the BFN design basis has l
been properly maintained.
- 1. Desian And Configuration Controit TVA's configuration management program is an integrated process designed to ensure that plant SSCs conform to approved design requirements, l
including design basis, and that the plant's physical and i
functional characteristics are accurately reflected in design basis and other plant documents.
Plant configuration is controlled throughout the life of the plant by the identification and documentation of design requirements and through procedures which ensure that the design is implemented properly.
Three primary processes are used, as applicable, to implement configuration management as applied to changes to SSCs.
These j
processes are:
i The plant modifications and design control process,2yhich is i
e J
the responsibility of the Site Engineering Manager; The nuclear fuel / core component design change control process,which[stheresponsibilityoftheCorporateNuclear Fuels Manager;2 and i
i Nuclear Power Standard 9.3, Plant Modifications and Design Change j
C2ntrol.
Nuclear Power Standard 9.2, Nuclear Fuel / Core component Design j
Change Control.
15
1 l
The ' temporary alterations control program, whicg6 18
- U" responsibility of the Site Engineering Manager Plant modifications are implemented using the design change control process, which, in general, is as follows:
s.
Desian chanae control Process:
A Design Change i
Notice (DCN) package must be developed. This not only includes design changes to safety-related structures, systems, and nonsafety-related SSCs.g also used for design changes to components (SSCs), but DCN packages are required for design changes that involve plant modifications, document-only changes,
)
j generic system / component changes, or other changes to an 3
operating nuclear power plant that also involve a design output document change.
The DCN package provides a basis for the change including references to supporting analyses with new or revised calculations that support the change.
DCN packages are developed i
from a range of inputs including Technical Specifications, design criteria, applicable regulatory requirements, industry and TVA l
codes and standards,, and other similar design considerations in accordance with administrative procedures.
DCN packages include 10 CFR 50.59 reviews as required.
Other key DCN process features include the following:
Implementation of a DCN (e.g., using Work Orders [WOs))
i f
includes installation instructions or references to those
)
instructions.
DCN packages also specify the required post-modification testing necessary to ensure design basis
)
requirements are met.
The preparation and approval of these
)
packages includes appropriate multi-discipline and independent reviews and reviews by affected organizations, as i
required.
For example:
=>
An authorized Nuclear Inspector / Authorized Nuclear Inservice Inspector (ANI/ANII) reviews WOs which contain a
work steps affecting ASME Section XI components and/or systems;
=> -RADCON reviews WOs which involve appropriate work within the Radiologically Controlled Area.
=>
An Independent Qualified Reviewer reviews the WO prior to its issuance for implementation.
The DCN process also includes a Return to Operation Nuclear Power Standard 12.4, Tomporary Alterations control Program.
An exclusion list may be established to identify site features that are not subject to configuration management control. The list can include only SSCs that are not quality related and are not described in the FSAR.
The list must be approved by the Site Vice President or his designee.
16 1
N I
)
evaluation that is required to be completed before the j
turnover of a modified SSC to plant operations.
This process i
ansures that operations, maintenance and testing procedures 4
have been updated, that training required to support proper operability has been completed, and that control room drawings have been revised.
The DCN process includes the updating of the design basis documents that were validated by the DBVP'(i.e., safe shutdown analysis, design criteria, critical. drawings, and supporting calculations), and any required UFSAR changes.
The package is archived for future reference.
TVA has established a controlled data base which contains information relating to the design and operational characteristics ~of as-installed plant components.
Processes are in place which update, maintain, and control key data to track components in the plant by location, unique identifier, description, type, manufacturer, etc.
As plant design changes occur and components are replaced, the design control process requires that the database be' updated to reflect the change.
In addition, efforts are planned at t;ach site'to enhance completeness and correctness of this Key data.
Each of these major points in the DCN process discussed above j
includes coordination between affected organizations, j
documentation of the activities performed, as well as documentation of the overall change being made.
Management involvement is also a part of these activities.
This includes approval'of the request for a change, approval of the engineering work.provided in the DCN package, and approval to implement the change.
The work packages provide detailed instructions with self-checking sign-offs in the installation process.
- Further, the work package also specifies Quality Control hold points for inspection of critical activities before installation can proceed.
TVA assures the DCN process is followed and is effective.
Engineering personnel who independently perform or technically review safety-and quality-related design change activities are required to receive indoctrination and training based on the Institute of Nuclear Power Operations (INPO) Academy 91-017 guidelines.
This training is routinely updated to incorporate lessons learned.
b.
Fuel / Core component chance control TVA controls nuclear fuel / core component design using a similar process.
Generallf:
A Core Component Design Change Request (CCDCR) must be developed for modifications to nuclear fuel assemblies and j
other core components.
This includes 10 CPR 50.59 reviews, as required.
17 l
CCDCRs are reviewed by each affected plant organization.
This review includes the Plant Operations Review Committee (PORC).
Modifications made on-site to core components are completed via the process used for other plant changes as described above.
This includes detailed installation instructions, where applicable, and preparation of WOs.
In addition, the l
l Plant Manager's approval is required before beginning work at the site, j
The CCDCR closure process includes, as applicable, the updating of the design basis documents, maintenance, testing and operating procedures, and the UFSAR.
The CCDCR documentation is archived for future reference.
I c.
Temporary Alteration Control:
Temporary plant alterations is the third process used to implement changes under the configuration management system.
A temporary alteration is normally used to maintain equipment in service using an approved, alternate means until the equipment can be returned to its permanent configuration.
It should be noted that alterations may be made without using the temporary plant alteration process when j
the components or systems are taken out of service (blocked, tagged, or otherwise inhibited or tripped) for troubleshooting, calibration, modification, or maintenance using an approved procedure and the operability of the affected component or system will be verified by testing prior to returning it to' service.
Additionally, temporary plant alterations may be made in accordance with approved plant procedures.
If this is done, and j
the temporary conditions are required to remain in place after closure of the approved procedure, the temporary plant alteration process is required to be followed.
The general process for implementing a temporary alteration is as follows:
A Temporary Alteration Control Form (TACF) is developed.
The TACF describes the alteration (e.g., Wire lifts, Jumpers, Inhibits, and Temporary Connections), its effects or.
equipment and functions, and its location.
Additionally, a
~
Safety Assessment (SA), and as necessary, a Safety Evaluation (SE) is performed as required by TVA's 10 CFR 50.59 program (described below).
TVA requires verification of both the installation and removal of the temporary alteration.
The Plant Manager approves temporary alterations.
Depending on the activity performed, the TACF must be approved by the Operations Shift Manager or Unit Supervisor on the affected unit.
In addition, PORC reviews temporary alterations on quality-related components.
Affected procedures and control room drawings are modified, as required, to reflect temporary alterations.
When a unit startup is in progress, an Operations 18
l i
representative (Senior Reactor Operator (SRO), Shift Manager, or Unit Supervisor) is required to review outstanding TACFs on the unit to determine if the TACF has any restriction with respect to Startup and Run modes of operation.
When a unit is in operation, a monthly review of TACFs is performed to determine continued need and to identify any administrative errors in the TACF records.
The original TACFs, associated 10 CFR 50.59 review, and attached reference drawings for temporary alterations that are installed in the plant are maintained by the Operations 3
Shift Manager.
The closed out TACFs are subsequently archived for future reference.
)
The list of open temporary alterations and the schedule for their resolution is routinely reviewed by senior management.
i d.
Desian Process Performance Monitorina:
Site Engineering routinely monitors indicatars of the health of the design control process.
Monthly and in some cases weekly data is reviewed to track status and cycle time for various engineering deliverables and performance indicators.
Items tracked include DCN closures, drawing updates, open corrective action program documents, and open TACFs.
Managers use this performance monitoring information to focus on and improve process or performance weaknesses.
i 2.-
Activities That Maintain Desian confiaurationt TVA has several layers of administratively controlled programs and practices to ensure that the plant configuration, which is primarily controlled by the three programs / processes described above, is maintained in accordance with the design basis established in the safe shutdown analysis, design criteria, calculations, and critical drawings.
Examples of programs and practices that maintain plant configuration during operations and i
after maintenance or modifications activities are described below.
m.
System Line-up controls:
System line-up is controlled through the use of Equipment Alignment Checklists.
Control is initially established through a thorough documented walkdown and alignment of system components in the proper configuration.
Verifications of this type take place when major evolutions are performed that involve several manipulations to a system's configuration.
The Unit Supervisor /SRO ensures that system line-ups are controlled by directing required changes to the system configuration, ensuring the Configuration Log book is properly maintained, reviewing the Configuration Log book at least once per shift for proper usage, and supervising the overall use of the unit's Configuration Log book to ensure status control is maintained.
The log book is normally used to document component manipulations during maintenance activities and to document special system alignments.
1 19 1
i i
1 1
i i
l Quality Assurance periodically verifies that system l
configurations are controlled in accordance with procedures j
through scheduled audits, assessments, and routine observations.
I l
b.
Overall control of the Operation of Plant Equipments l
During operations, the overall opgtration of the plant is directed j
by the operations shift Manager.-
The Unit Operator, Unit Supervisor, and the operations Shift Manager are informed and j
j aware of significant activities affecting plant equipment.
i However, activities that are unlikely to affect safety, regulatory requirements, or operating capability (e.g., pumping sumps) may be performed without informing the control room.
These activities are coordinated by operations personnel outside i
the control room.
Additionally, some sample and instrument loop 1
i isolation valves are configured by other plant organizations and
)
controlled by appropriate procedures.
Operator tours are i.
conducted by a nonlicensed operator and reviewed by a licensed I
operator supervisor each shift to maintain cognizance of equipment status.
Equipment deficiencies are documented and assessed to determine if compensatory actions arat required by Operations personnel.
These compensatory actions required by Operations personnel are commonly referred to as " operator workarounds."
The Operations Superintendent or his designee i
evaluates the aggregate impact of these identified "workarounds" to ensure that safety and overall operational efficiency is not j
compromised.
Short and long term corrective actions are prioritized, scheduled, and resolution of these workarounds is coordinated with Operations management and supporting i
organizations.
k control of Eauipment Durina Maintenance and c.
i Modifications:
Administrative controls are in place for
{
initiating, planning, performing, completing, and tracking work l
necessary for both the resolution of operator workarounds that do j
n o t i n v o l v e a d e s i g n c h g 'g 3 a n d p e r f o r m i n g p r e v e n t a t i v e a n d corrective maintenance.
These administrative controls require that work requests (WRs).or WOs be prepared and that any necessary short term configuration changes (e.g.,
jumpers, wire lifts, temporary instrument settings, unbolting flanges, temporary connections) and status control changes (e.g.,
repositioning of valves, breakers, or switches) be listed in a configuration log or approved procedures.
Equipment clearances are required before any maintenance is performed on equipment where the unexpected energizing, startup, or release of stored Nuclear Power Standard 12.1, Conduct of operations.
Nuclear Power Standard 6.2, Maintenance Management System.
TVA allows certain minor maintenance activities that are commensurate with craft qualifications and require little coordination to be performed under less restrictive controls then those described in this i
section.
20
l 1
energy could cause injury or equipment damage.31 Within the work t
scheduling process, a Work Week Manager develops a detailed work schedule that integrates the activities for each week.
Licensed Operators, System Engineers and others participate in this schedule development to evaluate the impact on plant operations and ensure proper coordination.
Operations is notified before the start of maintenance or modification activities for evaluation of planned configuration changes and so that control of the status of the equipment can be i
transferred to the maintenance or modifications personnel.
Signatures are required to document that each of the individual configuration and status control changes are made and another signature is required to document when the individual i
configuration and status control changes are returned to their original position.
A complete system status verification may be performed when major evolutions involving several manipulations are performed.
Operations is notified of the completion of the maintenance task or modification activities and status control of the equipment is returned to them.
d.
Post-modification / Post-maintenance Testina:
Post-modification tests, which are specified as part of the i
configuration control process, or post-maintenance tests, which are specified as part of gp'g3 maintenance control processes, are conducted to ensure that:
Equipment performs its intended function following maintenance or modification activities; The original deficiency (if any) has bean corrected; and A new deficiency has not been created by the maintenance or modification activity.
Quality Assurance periodically evaluates the implementation of the post modification / maintenance test (PMT) program through audits and assessments.
These verifications ensure that the plant PMT program includes appropriate plant equipment and verifies equipment will perform its intended function.
Some PMTs are verified through Quality Control inspections, such as piping systems that are verified through hydrostatic testing.
e.
Control of Replacement Parts Durina Maintenance:
Configuration control is maintained during the maintenance process when worn or damaged equipment requires replacement.
When replacement parts are required, the requester must provide Nuclear Power Standard 12.3, Equipment Clearance Procedure.
Nuclear Power Standard 6.1, Conduct of Maintenance.
Nuclear Power Standard 6.2, Maintenance Management System.
21
.. - ~. ~.
1 i
i j
sufficient information to determine the necesg ry technical and quality requirements for the requested items Replacement guality-related materials receive a receipt i
inspection.3 In addition to verifying.that the specified j
technical and quality requirements are met, specific guidance is provided for identification of transport damage, counterfeit and substandard parts.
Requirements for the handling and storage of spare parts, are provided to ensure that these items are handled, l
stored, andshippedinamannertopreventdeteriggion, j
contamination, damage, or loss of identification i
Quality. Assurance performs regularly scheduled audits of the
}
replacement parts programs to verify that these programs are j.
being adequately implemented.
Programs audited include procurement, receipt inspection, storage, handling,' shipping and issue and return.
In addition, audits of suppliers quality i
programs are performed on a three year frequency to ensure that these programs are being adequately implemented.
i f.
Independent /Second Party Verification:
In addition j
to these configuration controls, the Operations Manager is responsible for designating.those systems and/or cogonents 1
requiring independent or second-party verification.
These types of verification requirements are reflected in site operations, maintenance and testing procedures, instructions, and 3
l work documents.
For example, breakers, valves, and other components in designated systems are required to be independently 1
or second-party verified to be in their correct position or condition after they are manipulated for operation, maintenance, modification, or testing activities.
This provides additional assurance that the plant configuration is maintained in i
accordance with the design documents.
g.
Access to Desian and Licensina Basis Informations The Nuclear Quality Assurance Plan (NQAP) requires that for activities affecting quality, measures shall be established to to personnel performing the activity.3pctivity are made available ensure that documents prescribing the The TVA Document Control and Records Management (DCRM) program defines the process for the control of and access to drawings, specifications, design criteria, and other documents related to design basis.
Access to Nuclear Power Standard 10.1, Procurement of Material and services.
Nuclear Power Standard 10.2, Material Peceipt and Inspection.
Nuclear Power Standard 10.3, Handling and Storage of Materials and Spare parts.
Nuclear Power Standard 10.4, Material Issue, control, and Return.
Nuclear Power Standard 12.6, Verification Program.
TVA letter to NRC dated August 31, 1995, TVA Nuclear Quality Assurance (NQA) Plan (TVA-NQA-PLN-89-A) Update.
22
I principal elements of plant licensing basis, such as the FSAR, Technical Specifications, and correspondence submitted to NRC, is also controlled through this program.
1 Design and licensing basis documents are controlled to ensure I
that the latest version is used in performing activities affecting safety.
3.
10 cFR 50.59 Safety Assessments /Bafety Evaluations:
The procedure.g process is controlled by an administrativeThe procedure add 10 CFR 50.
j procedures described in the SAR or tests or experiments not j
described in thagAR to determine if an unreviewed safety i
question exists.
The process includes a SA which consists of a determination of the acceptability of a proposed change from a nuclear safety standpoint, and a screening review to determine if the activity would result in (1) a technical specification change,- (2) a change (other than administrative or editorial) to l
the information presented in the SAR, or (3) if a test or experiment is not described in the SAR.
If the SA indicates that the proposed activity might not be safe, the activity must be i
modified or' canceled.
If the activity is determined to be safe, the process continues to evaluate whether a Technical Specification or SAR change is involved.
If a Technical Specification change is found to be necessary, a license amendment is submitted to the NRC for approval.
If it is determined that a change (other than administrative or editorial) is being made to the information presented in the SAR or a proposed test or experiment is not described in the SAR, a SE addressing the questions in 10 CFR 50.59 is prepared.
If it is 1
determined that the proposed change, test, or experiment involves j
an unreviewed safety question, then the proposed action must be j
revised, canceled, or reviewed by the NRC prior to implementation.
The SA and, if it is required, the SE are prepared as part of the design control or procedure change process prior to the implementation of the change or initiation of testing.
The program requires that only qualified personnel prepare and review SAs and SEs.
Preparers and reviewers must be formally trained before working on SAs and 9Es and they must receive retraining at two-year intervals.
Typically, the initial training for 10 CFR 50.59 involves a two-day classroom instruction with an examination and a practical exercise in which Nuclear Power Standard 12.13, 10 CFR 50.59 Evaluations of changes, Tests and Experiments.
i This includes the latest updated FSAR, FSAR changes not yet incorporated in the controlled FSAR, and any licensing basis commitments not yet incorporated in the controlled FSAR.
For changes to commitments not within the scope of 10 CFR 50.59, TVA has a commitment change process, which is described later in this response.
23
i i
an actual SA or SE is prepared.
Required retraining consists of classroom training on topics related to the SE process.
5 j
Line managers are responsible for assigning trained and qualified preparers and reviewers for SAs/SEs consistent with the complexity and scope of tha proposed activity.
Preparars are required to obtain technical assistance outside their immediate
]~
area of expertise and responsibility, when it.is needed to complete the SA or SE.
Preparars also ensure ~ that the SA and/or SE are consistent with the UFSAR (including the "living FSAR"),
}
NRC operating license amendment Safety Evaluation Reports (SERs) (including supplements), major restart program SERs, and
~
d l
plant Technical Specifications.
PORC reviews SEs as an oversight function of the 10 CFR 50.59 activities.
The Nuclear Safety l
Review Board (NSRB) provides oversight of the SA/SE process and periodically assesses the adequacy of the 10 CFR 50.59 Program.
TVA's 10 CFR 50.59 program has evolved, and will continue to evolve, in consideration of industry and regulatory practices as i
well as to address performance issues identified by TVA.. As an example, a substantial change to the program was made when NSAC 125 was issued.
Other changes were made to provide appropriate
]
program guidance when new issues have arisen such as evaluating analog to digital control system changes or if internal or external assessments indicate that the program should be enhanced.
l 4.
Updated Final Safety Analysis Report F10 CFR 50.71(alls f
i TVA administrative 1y controls the UFSAR, including how this i
document is revigyd and updated, in accordance with l
Changes to the UFSAR are identified during the performance of the SA/SE process (required to corply with 1
10 CFR 50.59), and during the preparation of design changes or procedural revisions.
In addition, not on1v can an individual i
identify the need for a change to the UFSAE, they also have the responsibility to identify any known errors within the UFSAR.
3 I
Changes to the UFSAR aust be made in accordance with the administrative 1y controlled process which is coordinated by the
(
e l
Nuclear Assurance and Licensing (NA&L) Department.
The l
procedural requirements for submitting a change to the U?SAR L
include:
[
t A UFSAR change form must be completed, which includes l
specific references to the pages, figures, tables, that require revision.
1 The preparer must provide annotated pages, figures, tables, i
e j
.or replacement pages that clearly indicate the requested i
change.
l 1
i
)
Nuclear Power Standard 4.2, Management of the Final Safety Analysis l
3 Report (FSAR).
~
24 7
.-m
i i
Identification of the date that the activity addressed by the j'
UFSAR Change Request was implemented (field complete and l
plant approved).
This date is used to ensure that the UFSAR i
is up.to date as.of a maximum of six months prior to the date of filing the amendment in accordance with 30 CFR 50.71 (e) (4),
The preparer must also provide the supporting justification i
e i
for the change.
This normally consists of the SAs and/or SEs j
performed in accordance with 10 CFR 50.59.
However, the justification may also be in the form of an NRC SER that' j
addresses the subject of the change request, such as the SER from an NRC approved' operating license amendment, or i
justification that the UFSAR Change Request is an administrative change.
In accordance with the administrative controls for the UFSAR change process, NA&L logs and tracks UFSAR changes and ensures that the organization assigned primary technical responsibility for the affected UFSAR section evaluates each proposed UFSAR i
change.
Approved changes are periodically incorporated into the Living FSAR, so that there is access to the latest FSAR' material.
The living FSAR is a document that compiles. approved FSAR changes
{
that have not yet been incorporated into a UFSAR amendment package.
t
{.
In order to prepare a UFSAR amendment, NA&L consolidates
[
individual changes that have been implemented prior.to the UFSAR l
amendment cutoff date.
NA&L coordinates a multidiscipline review i
of the UFSAR amendment submittal to NRC with appropriate i
concurrence in accordance with the administrative controls j
established for written communications between TVA and the NRC.#4 once.the UFSAR amendment is approved for submittal to NRC, the controlled copies of the UFSAR are updated in accordance with the 4
administrative controls.
j Assessments of UFSAR accuracy performed in conjunction with TVA's most recent periodic amendments identified a number of discrepancies.
None of these discrepancies has resulted in Unreviewed Safety Questions, or rendered systems inoperable.
Only one minor modification to plant equipment has been identified (a change to a control room annunciator label).
Additional details are provided in TVA's response to NRC request (e).
5.
Yanlementation of honendix B To 10 CFR Part 50 The TVA NQAP describes the Quality Assurance (QA) Program as required in 10 CFR 50.34, " Contents of Applications; Technical Information" and 10 CFR 50.54, Conditions of Licenses."
The QA Program described in the NQAP provides control over activities affecting Nuclear Power Business Practice, BP-213, Managing TVA's Interface with NRC.
25
the quality of identified SSCs to the extent consistent with
{
their importance to safety.
The NQAP is referenced in each TVA j
Nuclear plant's SAR and has been accepted by the NRC as meeting the requirements of 10 CFR 50, Appendix B.
The NQAP places responsibilities on identified sponsors to develop specific elements of the QA Program, addressing requirements of source requirement documents such as NRC Regulatory Guides and ANSI Standards.
This is accomplished through administrative procedures (e.g., TVA Nuclear Standards 1
(STDs), Site Standard Practices (SSPs), Standard Programs and Processes (SPPs]) that are normally sponsored by managers who are responsible for designated functional areas.
STDs and SPPs define overall program requirements.
Each STD/SPP sponsor is responsible for incorporating into STDs/SPPs, QA and other j
regulatory requirements applicable to the functional area.
Site and corporate organizations implement STDs either directly or through lower-level documented procedures or instructions such as SSPs.
SPPs are directly implemented at the sites.
The engineering design and configuration control processes describe.d above also incorporate the relevant requirements of Appendix B to 10 CFR Part 50.
For example, the three processes used to modify the plant's configuration satisfy Criterion III, Design Control, and incorporate requirements necessary to ensure that instruction, procedures and drawings are revised prior to closure in accordance with Criterion V, Instructions, Procedures, and Drawings.
Procurement requirements necessary to ensure adequate quality of the requested items are specified in order to satisfy Criteria IV, Procurement Document Control; VII, Control of Purchased Material, Equipment, and Services; and VIII, Identification and Control of Materials, Parts, and Components.
~
The corporate Quality Assurance organization performs audits to assess the adequacy and effectiveness of the TVA Nuclear QA program.
These audits are performed in accordance with written procedures or checklists by qualified and certified personnel who have no direct responsibility in the areas being audited.
Audits evaluate a number of quality-related attributes, including:
Compliance with Technical Specifications and license conditions.
Performance, training and qualifications of the plant staff.
Effectiveness of actions taken to correct problems with equipment, SSCs or methods of operation that affect nuclear safety.
The performance of activities required to meet the criteria of Appendix B to 10 CFR 50.
The QA organization audits both TVA Nuclear organizations and contractors and suppliers who provide safety-related services or 26
materials.
independent technical reviews are performed by site and Additionally, NA&L to assess activities such as modifications, maintenance, engineering to verify that these activities are performed safely and correctly.
A commitment management and 6.
Commitment Manaaement:
tracking process is in place to provide a formal method for identifying, gacking, and changing commitments not controlled by This process incorporates the Nuclear Ene
" Guidelines for Managing NRC Commitments".gy 10 UR 50.59.
Institute (NEI)
Sources of commitments include Licensee Event Reports, NRCNA&L maintains and NRC SERs.
responsible requirements, system that includes a description of the commitment, Changes in the scope or co organization, and due date.
As necessary, date specified in a commitment must be justified.and the commitment such changes are submitted to NRC by NA&L, tracking system is updated.
NA&L reviews commitment closure documentation to confirm that actions tsken conform to the original intent of the commitment NA&L may elect to and that the original concern is satisfied.
have closure independently verified for any commitment.
Standard Programs and Processes 3.3, NRC commitment Management.
The NEI guidelines were recently included in TVA procedures.
However, TVA participated in the NEI pilot project in 1994 - 1995 and has used l
the guidelines informally since that time.
27
i B.
Reauest (b) 4 Rationale for concluding that design bases requirements are translated into operating, maintenance, and testing procedures.
TVA Response to Roguest (b)
TVA is confident that the BFN design basis requirements are j
translated into operating, maintenance, and testing procedures.
TVA's confidence is based on TVA's design change process, administrative controls for the preparation, review and approval of new and revised procedures, various procedure upgrade and review efforts, and the continuing assessments of procedures.
These efforts and assessments include comparing applicable design basis to procedures to ensure that the plant is operated safely i
and in accordance with design basis requirements.
TVA recognizes that to ensure design basis requirements are accurately translated into procedures, continued vigilance is
}
necessary.
When TVA identifies problems with its procedures, it pursues corrective actions to its procedures and processes, as necessary.
I 1.'
Procedural controls a.
Desian Chance Process:
When a design change is made, TVA's design change process requires that affected procedures be identified and created or revised to reflect the design change.
The design change processes are described above in response to NRC Information Request (a).
These processes provide a line of i
defense in ensuring that the design is correctly reflected in the applicable operations, maintenance, and testing procedures.
~
b.
Procedure Generation / Revision Process:
The administrative control processes established for the development, review, approval, and control of the TVA and BFN procedures are designed to implement upper tier programmatic and nuclear quality assurance plan requirements.
These controls ensure design basis requirements are adequately reviewed for the development of, and incorporation into site technical and administrative procedures.
I Established controls ensure that design basis information is development.gyearched by procedure authors during procedure adequately r Programmatic controls ensure that procedures are reviewed by affected organizations (e.g.,
Engineering, Operations, RadChem), independent qualified reviewers, Quality Assurance (if required), and qualified 10 CFR 50.59 reviewers.
In addition to the procedure development and review cycle, technical procedures receive walkdown reviews and PORC reviews, as appropriate, prior to approval.
4 Site Standard Practice, SSP 2.3, Administration of Site Procedures.'
28 1
The procedures control program also addresses the revision process.
These controls ensure that procedures are maintained current and reflect plant configuration control changes.
Revisions to procedures are processed through the same series of controls as newly developed procedures.-
These administrative 1y controlled checks and balances ensure that j
design basis requirements are correctly translated into j
operations, testing, and maintenance procedures, j
c.
Vendor Manual control Progrant Through the Vendor Manual control Program, TVA incorporates vendor recomagdations
)
into applicable operations and maintenance procedures.
The
)
program establishes and maintains a standardized process which i
documents the receipt, disposition, deviation, revision and utilization of vendor manuals.
The applicable organizations review the information and revise their procedures, as necessary, 4
In this manner, TVA ensures that systems and components are operated, tested, and maintained in accordance with vendor j
recommendations; thereby ensuring the design basis requirements i
.are met.
2.
Procedure verifications:
In addition to the procedural controls discussed above, TVA has performed several programs and procedure reviews that have verified that design basis requirements have been translated into procedures.
A sample _of these programs and reviews is discussed below.
i a.
Procedure Operade Programs:
As previously discussed, TVA performed a DBVP, which established the BFN design basis requirements and reconciled the as-designed and as-constructed 4
facility.
Using the design basis information generated from the DBVP, TVA implemented prognma to upgrade Unit 2 p i
the areas of operations, maintenance, and testing. gcedures in The scope of the Unit 2 restart procedures upgrade programs included standard practices, operating instructions, general operating instructions, abnormal operating instructions surveillance instructions and maintenance instructions.go The review and upgrade of the Unit 2 procedures and instructions resulted in the upgrade of more than 2,500 procedures.
Several key accomplishments of the programs are listed below:
Site Standard Practice SSP-2.10, Vendor Manual control.
TVA letter to NRC, dated october 24, 1988, Browns Ferry Nuclear l
49 Plant (BFN) - Nuclear Performance Plan, Revision 2 - Section 2.4, Procedures Upgrade Program; Section 3.4, operating Procedures Improvement; section 4.1.4, l
Maintenance Procedures and Programs; and Section 5.1, surveillance Procedure Improvement.
TVA letter to NRC, dated April 16, 1991, completion Status of 50 Corrective Actions Identified for Unit 2 Restart in Browns Ferry Nuclear Performance Plan.
29 i
t
A dedicated site procedures group was established to assist the line organizations in developing and revising procedures.
Writer's guides and style guides provided a standardized format.
A review of the Unit 2 and common Surveillance Instructions required for restart was performed to ensure that Technical l
Specification requirements were fully satisfied, techntvally l
correct, workable, and acceptance criteria were clear.
l specified.
l In order to ensure the technical adequacy of procedures at l
BFN, a verification process was implemented and the review / approval process was strengthened.
The verification process combined BFN review requirements and INPO good practice guidelines into one comprehensive checklist.
This l
process also added a validation checklist that was used after l
the procedure was approved.
Validation was performed during the first use of the procedure (which may have been on the simulator), or during a walkdown.
(
An improved procedure control system was developed to require prompt updates to procedures that are incorrect or contain discrepancies.
The use of procedure non-intent changes was greatly restricted.
The Quality Assurance organization performed an independent verification of the completion of the procedures upgrada programs l
and determined that the completed corrective actions were and approved by the NRC Staff.gpde programs were also reviewed adequate.
These procedure upg l
l With respect to Unit 3, the procedure control process developed during the Unit 2 restart effort was determined to be adequate.
Therefore, using the validated Unit 2 procedures as a basis, the Unit 3 procedures were written / upgraded in accordance with the procedure control process.
The Unit 3 procedures then received a verification / validation in accordance with approved plant procedures.
Fo'r example, during the review of the Unit 3 Surveillance l
Instructions, each responsible engineer verified that the Technical Specification (flow rates, calibrations, etc.), Fire Protection Report, and Offsite Dose Calculations Manual i
requirements were accurately reflected in the procedures.
i Surveillance Instructions were also revised to reflect pinnt NRC letter to TVA, dated January 23, 1991, NUREG-1232, volume 3, 51 Supplement 2 - Browns Ferry Unit 2 [Section 4.11).
30 1
l l
configuration changes due to the modification of the Unit 3 systems, including revisions necessary to support dual unit operations.
Item I.C.S.Qs OE Protiram b.
Operatina ihmerience (OE)
Prouram:
TV The progna was established to satisfy NUREG-0737, evaluates experience reports received from NRC, INPO, nuclear vendors and equipment suppliers, architect / engineers and constructors.
The applicability of the item is assessed and l
organizations that could be affected by the experience information are identified.
As applicable, reports are distributed for information or assigned as action items for evaluation to the appropriate TVA plants and organizations.
Due dates for evaluation of OE documents are established commensurate with the probability and potential impact to the plant.
The action items are tracked to completion.
TVA's review of these reports often results in procedure evaluations that utilize industry experiences to ensure design basis information is appropriately reflected in operations, maintenance or testing procedures.
For example:
TVA reviewed an INPO Operations and Maintenance Reminder (O&MR) which noted that several control system problems were attributed to impurities in the governor hydraulic oil.53 In response, procedures were revised to specify oil type, the use of only new oil, cleanliness requirements for oil transfer containers, and the filtering of the new oil as it is added.
TVA reviewed an NRC Inspection Report from another facility and noted that some Rosemount transmitters had temporary instead of the Vendor-recommended permanent plugs. git ports (plastic) shipping caps installed in the spare con TVA conducted a field observation at Browns Ferry, which revealed instancer. of a similar condition (i.e., that temporary shipping caps had not been replaced with permanent plugs, or sealed, as recommended in the Vendor Technical Manual).
However, no deterioration of the shipping plugs was observed during walkdown and intrusion of moisture or foreign material was not ev.' dent.
This condition was documented in accordance with the Corrective Action Program and corrective actions 52 Nuclear Power Standard 4.4, Managing the operating Experience Program.
53 INPo o&MR 418, dated January 4, 1996, Recent Problems with Woodward I
Governor Control Systems for Auxiliary Turbines and Emergency Diesel Generators.
{
54 NRC letter to Northeast Utilities, dated September 20, 1996, Special Inspection of Engineering and Licensing Activities at Millstone Units 2 and 3 (NRC Inspection Report 50-336/96-201; 50-423/96-201).
31 l
=
I were taken that included revising Rosemount Component Calibration Procedures.
I TVA reviewed a General Electric (GE) rapid communication i
l i
letter that reported jet pump restrainer bracket set screw l
gaps being obserygd at a number of other boiling water l
reactors (BWRs).
These gaps reduce the pump lateral support and increase the potential for flow induced vibration.
In response, visual inspection of the jet pump adjusting screws was incorporated into the plants augmented l
examinations procedures.
l TVA reviewed an NRC Information Notice, along with the related vendor service advisory letter, which described recent failures of 4kV circuit breaggra because of hardened grease and failure to latch closed.
As a result, TVA reviewed the related maintenance procedures and revised them to incorporate the vendor recommended lubrication requirements.
TVA reviewed a GE Services Information Letter which notified licensees that another BWR had replaced molded case circuit breakers tgt could not be closed by their associated rotary operators.
In response, TVA incorporated the vendor i
recommendations to verify breaker operation with the rotary i
l operator into the breaker testing and troubleshooting procedure.
TVA reviewed another NRC Information Notice that alerted addressees to an event where mishandling of materials in the spent fue.1 transfer canal caused unexpectedly high gadiation fields in a hallway under the fuel transfer canal.
In response, TVA revised the applicable procedure to include additional access controls for affected areas of the plant during transfer of certain materials in the fuel transfer canal.
55 General Electric Rapid Information Communication Services Information Letter (RICSIL) No. 078, dated June 3, 1996, Jet Pump Restrainer Bracket Set Screw Gaps.
56 NRC letter to All Holders of operating Licenses or Construction Permits for Nuclear Power Reactors, Dated August 2, 1996, Failures of General Electric Magne-Blast Circuit Breakers.
57 General Electric Service Information Letter No. 596, dated February 29, 1996, Molded Case circuit Breaker - Failure to close With Rotary operator.
NRC letter to All Holders of operating Licenses or Construction Permits for Nuclear Power Reactors, dated December 11, 1995, Shielding Deficiency in Spent Fuel Transfer Canal at a Boiling Water Reactor.
32 1
1 1
l l
f-TVA reviewed an INPO Significant Operating Experience Report, which' contained recommendations to define, evaluate, and improve station foreign material exclusion (FME) controls.59 In response, TVA verified that procedures define foreign material, specify levels for FME controls, and require FME controls be included in work instructions.
Through these types of system specific evaluations of procedures, TVA verifies that the plant design basis is correctly reflected t
in operations, maintenance and testing procedures.
c.
Generic Reaulatory Issuest TVA often verifies the i
translation of design basis requirements into operating, l
maintenance, and testing procedures as part of its response to i
regulatory initiatives.
For example, in response to Generic I
l Letter 89-10 and its supplements, TVA implemented an administratively controlled motor operated valve (MOV) program, which is a combination of design basis evaluations, i
proceduralized valve static and dynamic testing, preventative and corrective maintenance, performance trending, and equipment training.
The program and procedures are used to ensure the i
valves included in the program can operate as designed under l-design basis conditions.
This was accomplished by developing l
maintenance procedures to perform differential pressure testing under design basis conditions for those valves that could be l
practically tested.
Maintenance also developed an MOV trending procedure, using state-of-the-art software, that utilizes l
periodic MOV test data.
These efforts ensure that procedures related to those MOVs accurately reflects design requirements.
j d.
Emeraency operatina Instructions:
The BFN Emergency i
I Operating Instructions (EOIs) are significant procedures since they direct operator actions to achieve the safe shutdown of the plant after a broad range of accidents and equipment failures.
The process for the development and revision of the EOIs ensures that. design basis requirements are reflected in the EOIs.
To
(
develop EOIs for BFN, in general terms, TVA translated the* design i
L basis into the EOIs in the following manner:
I TVA substituted BFN plant specific values for the generic
-values contained in the BWROG (BWR Owners Group) Emergency Procedure Guidelines (EPGs) by reviewing the BFN design basis.
TVA performed additional calculations to determine BFN l
l specific curves and limits that are used in the EOIs.
59 INPO letter to TVA, dated June 29, 1995, in regards to INPo Significant operating Experience Report (SoER) 95-1, Reducing Events Resulting From Foreign Material Intrusion.
33 l
=
4 TVA developed from its design basis and physical plant characteristics, technical steps not required by the EPGs, but necessary for BFN to successfully mitigate the event.
TVA researched its design basis requirements and deleted EPG steps that did not apply.
I Verification / validation of the initial EOIs was g rformed in accordance with the EOI administrative controls.
i TVA has a process to control revisions to the EOIs to ensure 1
design basis requirements are maintained.
This process includes checks and balances designed to verify and validate that the change is consistent with design basis requirements.
This process includes a review of the change by the EOI Responsible Procedure Coordinator (RPC) to determine whether verification or validation of an EOI change is required and to obtain concurrence from the Operations Superintendent; and a verification and validation similar to that conducted in the laitial EOI development process.
NRC conducted an emergency operating procedures (EOP) inspection to verify that the BFN EOPs were technically accurate and their controls and instrumentation.gmplished using existing equipment, specified actions could be ac The team found that TVA had satisfactorily implemented the BWROG guidelines and the EOPs provided necessary guidance for the safe shutdown of the plant.
3.
Independent Assessments:
Assessments of TVA's procedures challenge TVA's various procedural control processes and the translation of design basis requirements into procedures.
A j
sample of these assessments is discussed below.
a.
Quality Assurance Assessments: NA&L recently conducted an assessment of the following plant processes to determine if they contained hardware conditions affecting a system described in tg FSAR and if those conditions constituted a design deficiency:'
Operator workarounds, 60 Site Standard Practice, SSP-12.16, Emergency operating Instruction Control.
01 NRC letter to TVA, cated August 25, 1992, NRC Inspection Report No. 50-260/92-27.
62 Nuclear Assurance and Licensing - Hardware Corrective Actions Assessment - NA-BF-96-047, dated october 29, 1996.
34 r
i Iy A
Design Change Notices open for greater than two years, o
?
Wos open for greater than two years, e
Problem Evaluation Reports open.for greater than two years, o
and Closed Incident Investigations for hardware corrective e
actions.
Each process was reviewed to determine if-known hardware issues that impact as designed operation of the plant were promptly corrected.
This included a determination of conflicts in operation as described in the FSAR and changes made to operating procedures or standards that would allow operation in a condition other than as described in the FSAR.
The assessment also considered whether procedures had been changed to correct the deficiencies without correcting the problem and whether systems had been returned to operable service without testing to requirements contained in design documents.
In addition, the assessment evaluated the lengths of time issues have been known without correcting the design problem.
The assessment concluded that most known hardware issues that impact as designed operation of the plant had been identified and corrected.
This included the identification of conflicts with FSAR descriptions of operations and the subsequent changes made to operating procedures, as necessary.
As part of.the assessment of FSAR accuracy, QA found that some nonquality-related procedures do not require 10 CFR 50.59 reviews even thoug,4 nonquality-related systems may be described in the FSAR.
TVA Nuclear-wide corrective actions are being developed to address this finding.
b.
TVA vertical slice Assessments:
TVA recently completed a vertical slice inspections of the BFN Service Water System a g ain Steam and Electro-Hydraulic Control (EHC)
Systems The Service Water System operational Performance Inspection (SWSOPI) of the Emergency Equipment Cooling Water (EECW) and Residual Heat Removal Service Water (RHRSW) 63 Nuclear Assurance and Licensing (NA&L) - Updated Final Safety Analysis - Assessment NA-BF-96-027, dated July 22, 1996.
64 Tracked by CHPER960071.
65 Service Water System operational Performance Inspection, dated June 23, 1995.
00 Report No. TVA810.1, System Vertical Slice Inspection - Main Steam and Electro-Hydraulic Control System for TVA BFN Units 2 and 3, dated August 23, 1996.
35
,~ - -.-
1 i
began in April 1995.
The self-assessment plan was pre-approved l
by the NRC in accordance with Inspection Procedure 40501, 1
Licensee Self-Assessments Related to Area of Emphasis Inspections.
Document reviews, walkdowns, and personnel interviews were used to identify weaknesses or missing information in the design basis, operating, or design output documents.
The inspection was performed in accordance with guidance contained in NRC Temporary Instruction 2515/118, Service Water System Operational Performance Inspection, Revision 1.
l Over a five week period, the team examined plant activities in i
the areas of mechanical and electrical system design, operations, maintenance, surveillance and testing, and quality assurance, including procedures.
The team concluded that the EECW and RHRSW systems were. maintained to perform when required.
Operations, procedures, and training.were consistent with the expectations of Generic Letter 89-13.
The plant operators were found to be l
-knowledgeable in systems operation, and plant material condition was considered good.
The Main Steam and EHC Systems vertical slice review was L
conducted with emphasis on operations and operations procedures, t
testing and testing procedures, maintenance and maintenance procedures, and included system walkdowns.
System operating procedures were reviewed to evaluate usability, clarity and if sufficient guidance is given for operating the system.
The review ensured that satisfactory operations were not a result of i
experienced operators but were based on the operating procedures, j
The system Normal, Abnormal and Emergency Operating Procedures i
and the Alarm Response Procedures associated with the systems I
were also evaluated.
These procedures were reviewed for technical correctness including consistency of setpoint and instrumentation information, consistency with other plant documentation and consistency with the installed plant equipment.
Allowable system alignments were reviewed against allowed design basis configuration (s),
i Testing and testing procedures were reviewed against the systems design and licensing basis.
Test acceptance criteria consistency j
with the design basis was evaluated to ensure system testing j
adequately demonstrated that the system operates as designed.
The review also determined if Surveillance Instructions l
comprehensively addressed required system responses.
l Selected equipment, maintenance and maintenance procedures were reviewed to ensure that equipment was maintained in accordance j
with system and component's design basis.
Procedures were reviewed against vendors' and plant specific maintenance j-requirements, including maintenance intervals.
i In' general,.the team found that the reviewed documentation i
provided a comprehensive design basis for the Main Steam, EHC, I
and supporting systems.
Design documentation and design analyses I
were generally retrievable.
Design basis information was found 36 l'
j i
i 1
in the FSAR, Design Criteria,'and in historical documents.
Surveillance procedures were found to be well written and addressed the proper system configuration. Maintenance procedures were found to be technically adequate and the post-modification test procedures were found to provide the required tests and included appropriate acceptance criteria.
c.
NRC Vertical Slice Assessment NRC conducted an j
Electrical Distribution System Functional Inspection to assess
{
distribution system (EDS).gpd technical support of the electrical the design implementation The inspection included a selective
+
review of-EDS design calculations, relevant procedures, representative records, and installed equipment in the field.
j
'The areas inspected by the team were the 500 kV and 161 kV transmission systems and switchyard; the 500- to 20.7-kV and 20.7-to 4.16kV unit station service transformers; the 161-to 4.16 kV common station service transformers; the 480 VAC system; the 250/125 VDC systems; and the 120 VAC instrument buses.
i Mechanical systems included electrical equipment rooms, HVAC, the emergency diesel generators, and support systems.
The team noted that some procedures relative to the operation and surveillance of the EDS could have resulted in unanalyzed or undesired operating conditions.
A violation was identified in this area.
TVA responded to the violation gpd took corrective actions to address the identified concern.
An inspection was conducted to assess the adequacy of TVA's corrective actions and corrective actionsidengfiedintheresponsetotheviolationwerefoundto be complete i
4.
Summary:
The procedural controls, procedure upgrades, and various procedure reviews described above, provide assurance that design basis requirements are translated into operating, maintenance, and testing procedures.
67 NRC letter to TVA, dated June 18, 1992, Notice of Violation (NRC Inspection Report Nos. 50-259/92-15, 50-260/92-15, and 50-296/92-15).
68 TVA letter to NRC, dated July 20, 1992, NRC Inspection i
Report 50-259, 260, 296/92 Reply to Notice of Violation and Electrical Distribution System Function Inspection Team Findings.
69 NRc letter to TVA, dated May 6, 1993, NRC Inspection Report No. 50-259/93-14, 50-260/93-14, and 50-296/93-14.
37
l i
C.
Regieat (c)
]
Rationale for concluding that structures, systems, and compone ts (SSC) configuration and performance are consistent with the j
design bases.
TVA Response to Reauest (c)
TVA ils confident that BFN SSC configuration and performance'are consistent with the BPN design basis.
TVA's' confidence is based on TVA's configuration control and corrective action processes (as described in response to requests (a) and (d)), programs that i
compared SSC configuration to design requirements and tested SSC i
performance, testing that verifies SSC performance on an ongoing basis, and various reviews and continuing assessments of SSC configuration and performance.
TVA recognizes that it must continue to be self critical in this area to ensure that SSC configuration and performance remain 1
consistent with design basis requirements.
When problems are identified, prompt corrective actions are taken.
i 1.
Confiauration and Performance controls:
As discussed in response to request (a), TVA's configuration management program is an integrated process designed to ensure that SSCs conform to design requirements.
Plant configuration is controlled throughout the life of the plant by the identification and i
documentation of design requirements, and through procedures that j
ensure that design is implemented properly.
TVA has several l
layers of administrative 1y controlled procedures and practices in the areas of:
i Design changes, System line-up, Operation, maintenance, modification and testing of plant equipment, Procedure generation or revision, and
- Vendor manual control.
All of these processes work together to ensure that SSC configuration and performance are maintained consistent with the BFN disign basis.
When problems are identified, they are eval"ated and corrected in accordance with TVA's Corrective Action Program.
2.
verification Programs:
In addition to the various configuration controls discussed above, TVA has implemented several programs that have verified that SSC configuration is consistent with design basis requirements and that SSCs perform 38
I
[
in accordance with design basis requirements.
1 a.
Reconciliation of Desian Basis and Plant confiuuration:
As discussed earlier in this response, TVA i
established the design basis and reconciled the design basis with plant configuration as part of the DBVP.
This process involved verifying plant configuration through walkdowns (i.e., comparing j
plant configuration with the as-constructed plant drawings), and verifying electrical diagrams by walkdowns and functional testing.
Examples of these reviews are provided below, l;
TVA ensured the adequacy of piping system supports and anchor l
i bolts.
Walkdowns were performed to determine the actual field configuration of the Class I piping systems and supports.
Pipe stress analysis and pipe support evaluations j
were based on this data.
As necessary, required modifications were identified and performed.
Por Unit 2, walkdowns and signal tracing were used to evaluate and field verify cable routing data.
The Unit 3 Consolidated Cable Routing System database information was validated for divisional separation to a 95/95 confidence level using two random samples.
The samples were analyzed either by walkdown and/or signal tracing and compared to the relevant design criteria.
Safety-related medium voltage cables were identified, walked down and evaluated against the bend radius criteria.
The as-constructed configuration was then reconciled with the re-established design basis, which included performing any necessary testing.
Through the DBVP program, TVA verified that the plant was configured in accordance with the design basis requirements.
b.
Restart Test Programs For Unit 2, TVA performed a comprehensive Restart Test Program to ensure that SSCs were capable of meeting their safe shutdown performance requirements.
These design requirements were developed through the DBVP.
From these requirements, Baseline Test Requirements Documents (BTRDs) were developed, which establish the testing necessary to demonstrate that SSCs would perform in accordance with these design requirements.
Systems and components were then tested to
'the BTRDs.
For Unit 3, the Restart Test Program incorporated the lessons learned from the Unit 2 program.
The Uni 3 Restart Test Program also utilized a more integrated approach.y0 A comprehensive System Test Specification was prepared for each system.
It not 70 TVA letter to NRC, dated February 2, 1994, Restart Test Program (RTP) Update for Units 1 and 3.
39
only addressed test requirements stemming from the DBVP, but included inputs from the Post-Modification Testing Program, Post-Maintenance Testing Program, and System Engineering reviews.
From these'one-time tests, conducted in the early to middle 1990s, TVA verified that these SSCs would perform in accordance with design basis requirements.
NRC reviewed TVA's Restart Test Program and concluded in NUREG-1232 that the implementation of the Restart Test Program would ensure proper verification of the fugtional integrity of the safety systems at Browns Ferry Unit 2.
Similarly, the NRC staff determined that the Unit 3 Restart Test Program provides adequate assurance that safety systems can fulfill their safe shutdown functional gquirements and support the safe return to operation of Unit 3.
c.
SPAE/SPOC As previously discussed, TVA utilized two programmatic approaches to ensure the complete recovery of the safety systems during the recovery of Units 2 and 3.
Prior to turning a safety system over to Operations, the SPAE verified that the established design criteria were reflected in the physical plant by performing system walkdowns.
i Using the SPOC, TVA also verified that construction and
{
maintenance work was complete, component testing finished, and 1
operating procedures upgraded.
By systematically ensuring that l
identified items were addressed, these two programs provided I
additional assurance that SSCs were properly configured and capable of performing'as designed.
3.
ssC Testina a.
Routine Surveillance Testiner Surveillance testing is an important tool to demonstrate that SSCs will perform in accordance with their design and licensing requirements and commitments (e.g., Technical Specification and the Fire Protection Report).
The Surveillance Program provides the administrative controls for surveillance scheduling, testing results,andtestrecords.greformat,evaluationoftest status, surveillance proce Through these controls, TVA ensures that testing necessary to demonstrate performance of SSC is executed in a rigorous fashion.
Controls include:
}
I NRC letter to TVA, dated April 14, 1989, Safety Evaluation Report on the Browns Ferry Nuclear Performance Plan - NUREG-1232 volume 3, Section 4.6.3.
2 NRC letter to TVA, dated August 30, 1994, Browns Ferry Nuclear Plant I
Units 1 and 3 - Restart Test Program.
3 Site Standard Practice, SSP-8.2, surveillance Test Program.
40
F
)
Plant operational modes for which the surveillance requirements are required to be current to support system / equipment operability are listed.
In the cases where the operational modes are not specifically indicated by the Technical Specifications, the modes which are applicable are determined by the organization responsible-for the surveillance procedure.
Plant operational modes in which the surveillance can be performed (and therefore, by_ inference, the modes it can not be performed in) are listed.
.The frequency or initiating plant condition / event for each surveillance requirement is listed.
The implementing procedure number for each surveillance requirement.
The organization (s) responsible for performing / preparing each surveillance requirement.
b.
ASME Code Resuired Performance Monitoring i
(1)
Inservice Inanection 10 CFR 50.55a(g) and BFN Technical Specifications both require the establishment and
.)
implementation of Inservice Inspection (ISI) requirements (including preservice) in accordance with Section XI of the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code for components (including supports) which are classified as ASME Code class 1, Class 2, and Class 3, or equivalent.
Administrative controls provide instructions XIISIorPreserviceInspectionprograms.gationofASMESection necessary for the preparation and implema Implementation of this inspection program and the performance of the prescribed testing provide added assurance that safety-related components will perform consistent with their design basis requirements.
(2)
System Pressure Tests:
Administrative controls also establish the general requirements, responsibilities, and guidelines for preparation, review, and performance of system pressure tests to meet the requirements of Section'XI of the ASME Boiler and Pressure Vessel Code, as required by Paragraph 50.55a(g) of 10 CFR requirements of Technical Specifications.yo and the SPT Implementation of this testing program provides added assurance that the pressure boundaries for safety-related systems will maintain their
~
74 Site Standard Practice, SSP-6.10, ASME Section XI and Augmented Mondestructive Examinations.
Site Standard Practice, SSP-8.5, ASME Section XI System Pressure Test Program.
41
I integrity.
i (3)
Inservice Testinct 10 CFR 50.55a(f) and Technical Specifications require the establishment and implementation of ASME Section XI Subsections IWP and IWV for j
Inservice Testing (IST) in accordance with Section XI of the ASME j
Boiler.and Pressure Vessel Code to verify operational readiness of pumps and valves whose function is required for safety.
i Administrative controls establish tg implementation' requirements for IST of pumps and valves at BFN.
These controls reflect-the current "living" IST program for BFN, including the applicable SERs and requirements and active changes to the IST program in progress.
Implementation of this testing program provides assurance that safety-related pumps and valves will function during anticipated operating, transient, and accident conditions.
o.
containment Testina:
Administrative controls are established for the primary containment leak rate test program.
This Site Standard Practice provides a list of primary containment boundary components and specifies the associated test requirements for both the integrated containment leak rate testing and penetration testing in ordg to satisfy the requirements of 10 CFR 50, Appendix J.
Implementation of this testing program provides added assurance that primary containment and its penetrations will perform consistent with their design basis. requirements.
4.
continuina Review Efforts a.
Maintenance Rule Requirements:
Administrative controls are established for performance monitging, trending, and reporting in accordance with 10 CFR 50.65.
The program controls the initiation, analysis, retrieval, trending, and reporting of data'related to " Plant Level" and " Function Specific" indicators of system performance in accordance with 10 CFR 50.65. By monitoring system performance and taking corrective actions, as necessary, TVA ensures that SSC safety-related functions will perform consistent with their design basis requirements.
b.
System Status Reports The BFN System Status Report is a managernent reporting tool that is coordinated by each system engineer for each system.
This is a quarterly process that systematically evaluates system performance against established performance goals (e.g., unavailability and reliability).
The i
evaluation provides a description of known problems and various 6
Site Standard Practice, SSP-8.6, ASME Section XI Inservice Testing of Pumps and Valves.
Site Standard Practice, SSP-8.7, Containment Leak Rate Programs.
78 Technical Instruction o-TI-346, Maintenanca Rule Performance Indicator Monitoring, Trending, and Reporting - 10 CFR 50.65.
42
I i.
I quantitative performance indicators, including Wo backlog, to determine whether or not performance goals have been met or if additional resources are necessary to improve performance.
l c.
operatina Ernerience Progrant As previously j
discussed, TVA's Operating Experience Program evaluates i
experience reports received from NRC, architect / engineers and constructors.y,and INPO, nuclear vendor equipment suppliers, TVA's review of these reports often results in evaluations that 1
utilize industry experiences to ensure systems, structures, and i
components are consistent with design basis requirements and will
[
perform as expected.
For example, TVA's Operating Experience Program was used to l-evaluate NRC Information Notice 96-007, which described slow five percent scram insertion times associated with fluoroestastomeric (Viton) diaphragas used in scram solenoid pilot valves at two domestic utilities.
Based in part on the review of this document, TVA replaced scram solenoid pilot valve exhaust diaphragas using Viton with Buna-N diaphragas, i
i 4.
Generic Regulatory Issues TVA often verifies that i
SSC configuration and performance are consistent with the design basis as part of its response to regulatory initiatives.
Several j
examples are provided below:
In response to Bulletin 88-04, the design calculation for the Core Spray system miniflow bypass orifice size was reviewed.
The affected orifices were removed and inspected to verify proper sizing and if not, bored to the proper size.
i In response to Generic Letter 88-14, TVA performed air 1
quality testing on the Drywell Control Air system and safety-related air operated components and accumulators to ensure that they perform'in accordance with their intended function.
I In response to Generic Letter 89-08, TVA implemented a and-dualphasepiping.jgknessmonitoringprogramforsingle long-term pipe wall th j
These instructions require pipe j.
wall thickness measurements each outage at established monitoring locations.
They also provide direction on
(.
trending of data as well as engineering review for any necessary corrective action.
This assures that piping performs in accordance with design basis assumptions.
l In response to Generic Letter 89-10 and its supplements, TVA i
implemented an administratively controlled MOV program, which j
Nuclear Power Standard 4.4, Managing the operating Experience j
Program.
f TVA letter to NRC, dated July 19, 1989, Response to Generic Letter 80 J
89 Erosion / corrosion-Induced Pipe Wall Thinning.
43 i
I
~!
I
~
is a combination of design basis evaluations, proceduralized valve static and dynamic testing, preventative and corrective -
i maintenance, performance trending, and equipment training.
Separate calculations were issued for each MOV in the Generic Letter 89-10 program.
These calculations compared the valve's capability at degraded conditions with the system opening / closing requirements.
As a result, design output documents (drawings) were issued with the required switch (torque and trip) settings for each MOV in the program.
5.
Independent Assessments:
TVA, industry, and NRC assessments of SSCs at BFN provide an additional barometer of whether SSC configuration and performance are consistent with design basis requirements.
I e.
Quality hasurance Assessments:
NA&L recently conducted an assessment to determine if known htrdware issues I
that impacg3 as designed operation of the plant have been promptly corrected.
This included an assessment of whether there were any conflicts between FSAR descriptions of operations and changes l
made to operating procedures that would allow operation in a i
condition other than as described in the FSAR.
The documents l
reviewed included operator workarounds, design changes, WOs, and corrective action documents that were open for longer than two years.
While the overall program for identifying and correcting l
these deficiencies was found to be sound, implementation weaknesses were identified.
The maintenance of the Document control and Change Management database and change packages was l
marginal in the areas reviewed. Corrective actions were initiated to correct these weaknesses.
j b.
TV1 vertical Slice Assessments:
As discussed above, the SWSOPI of the EECW and RHRSW began in April 1995.
The l
self-assessment plan was pre-approved by the NRC in accordance with Inspection Procedure 40501, Licensee Self-Assessments Related to Area of Emphasis Inspections.
The inspection was performed in accordance with guidance contained in NRC Temporary Instruction 2515/118, Service Water System Operational Performance Inspection, Revision 1.
Over a five week period, the team examined plant activities in the areas of mechanical and electrical system design, operations, maintenance, surveillance and testing, and quality assurance.
The team found that the plant design is extensively documented through design criteria documents, systems requirements calculations, and numerous design calculations.
TVA's development of design criteria documents, system requirements calculations, generation of numerous design calculations, and previous walkdowns is consistent with Generic Letter 89-13, Action IV requirements for design basis reviews.
Overall, the team found that the service water system was capable 81 Nuclear Assurance and Licensing - Hardware Corrective Actions Assessment - NA-BF-96-047, dated October 29, 1996.
44 1
j
.\\
i 1
1<
of performing its safety functions on demand.
The Main Steam and EHC Systems vertical slice review was conducted with emphasis placed on Design and Design Basis, Maintenance, and Operations and included design document reviews as well as system walkdowns.
The design and design basis portions of this inspection focused on the analytical basis, t
j design change control, design basis documents, licensing / design l
interface, configuration and documentation control.
In general, the team found that:the reviewed documentation provided a comprehensive-design basis for the Main Steam, EHC, and supporting systems.
Design documentation and design analyses j
were generally retrievable.
Design basis information was found l
in the FSAR, Design Criteria, and in historical documents.
The Engineering / Design area of t's Main Steam and EHC Systems were j
found to be ready to perform their intended safety function, i
l however, there were areas which could be improved to assure the highest level of confidence in the system.
For example, the team i
j found that a replacement of Main Steam Isolation Valve poppet parts was actually a design change since it resulted in gpanges j
to flowrate,. weight, and pressure drop across the valve.
Therefore, a 10 CFR 50.59 review should have been performed.
The required 10 CFR 50.59 review was performed and the required
^
changes to the FSAR and system design criteria are being
}
evaluated.
c.
MRC Vertical Slice Assessment As previously l
mentioned, NRC conducted an Electrical Distribution System technical support of the EDS.gy the design implementation and Functional Inspection to asse The team concluded that offsite power was flexible and reliable and that the onsite EDS was generally in compliance with the Technical Specifications /FSAR/
4 Safety Evaluation Report.. Design documentation including l
calculations and analyses were available and retrievable.
j However, a few calculations contained errors or omissions, but i
these were considered exceptions to an otherwise good quality calculations program.
I 1
6.
Summary:
The processes, programs, reviews, and l
assessments described above, previde assurance that SSC configur ation and performance are consistent with the design i
basis.
1 1
l j
82 Tracked under RFPER960947.
83 NRC letter to TVA, dated June 18, 1992, Notice of Violation (NRC 3
Inspection Report Nos. 50-259/92-15, 50-260/92-15, and 50-296/92-15).
45
{
i
E D.
Request (d)
Processes for identification of problems and implementation of corrective actions, including actions to determine the extent of problems, action to prevent recurrence, and reporting to NRC.
TVA Resoonse to Roguest (d)
There are several ways in which problems are identified.
These include observation by trained personnel, through equipment performance, through assessment and audit activities, and through
" generic" industry information.
Once identified, problems are placed in TVA's corrective action program for evaluation and correction.
This process is described below along with TVA's reporting processes.
The programs at all sites contain, as a minimum, the essential elements described in this response, but there are minor implementation differences between the sites to address specific issues.
It is important to note that training received by personnel involved in configuration management, coupled with their experience, enhances their ability to identify problems.
i Engineering personnel who independently prepare or technically review safety-and quality-related design changes are initially trained and receive periodic refresher courses.
The operations personnel responsible for configuration control include both NRC-
)
licensed and nonlicensed operators who receive extensive training.
Maintenance is required to be performed by individuals l
trained and q"alified for each specific task.
The administrative 1y controlled configuration management process coupled with this training assists the involved personnel in identifying potentially adverse conditions.
i j
In addition to TVA's corrective action program, TVA established an Employee Concerns Program (ECP) to provide an alternative problem reporting mechanism.
The ECP was established to receive, investigate, and respond to concerns raised after February 1, 1986.
The ECP has offices at each operational nuclear plant site 4
and the TVA Nuclear corporate office.
The program name was changed to Concerns Resolution program in 1991.
The program continues to er ourage the prompt and effective resolution of 4
]
concerns throua. the normal line processes while providing an alternate avenue for concerns that cannot be effectively resolved otherwise.
1.
TVA Corrective Action Program:
TVA's Corrective Action Program contains the processes for the documentation of potential problems, and the determination, tracking and implementation of corrective actions, including actions to determine the extent of 1
problems and to prevent recurrence.
The Corrective Action Program consists of different processes 46
which document and correct problems and adverse conditions.
l These processes are designed to address problems and adverse conditions in a manner consistent with the nature of the condition and its importance to plant safety.
The corrective action program processes most applicable to design basis issues are the WR/WO and the Problem Evaluation Report (PER).
The WR/WO l
is used to identify and correct routine hardware problems or failures on equipment, structures, spare components (i.e.,
replace packing, correct seat leakage, replace motor bearings, etc.).
PERs are used to identify and correct nonhardware deficiencies and are also used to address the causes for nonroutine hardware deficiencies.
For example, an unusual component failure that caused damage would result in initiation of both a WR/WO (to fix the specific hardware problem) and a PER (to identify and correct the cause of the hardware problem).
a.
WR/WO Process:
Routine equipment deficiencies are correcteg4 using the WR/WO process which, in general, is as follows:
A WR card is completed by the initiator to describe the deficiency, the equipment involved, and the location of the equipment.
The initiator's supervisor reviews the WR card to determine if a PER is also needed.
If so, a PER is initiated.
The initiator or supervisor then submits the WR card to the Operations Shift Manager (or designee) for operability and reportability evaluations.
The Operations Shift Manager (or designee) performs an operability evaluation as soon as possible.
The evaluation must be performed within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of WR initiation.
This evaluation ensures that Technical Specification Limiting Condition for Operations are reviewed and applied as appropriate.
The Operations Shift Manager also determines if the deficiency is reportable to NRC or other agencies, and initiates any required actions (TVA's reporting process is described further below.).
Finally, the Operations Shift Manager assigns a priority to the WR.
The Work Control Group enters the WR into the tracking system and forwards it to the Planning Group.
The Planning Group plans the work, producing a WO, which is 84 TVA allows certain minor maintenance activities that are commensurate with craft qualifications and require little coordination to be performed under less restrictive controls than those described in this j
section.
47
l l
subsequently used by maintenance / modification craft to i
correct the equipment deficiency.
Work performed is documented on the WO, and the Wo is closed.
Appropriate data from the Wo is entered into an equipment history data base.
The equipment history database is periodically evaluated to identify recurring equipment problems and other negative trends.
PERs are generated, as appropriate, and results are used in the site self-assessment process described below, b.
PER Process:
The PER is an important part of the corrective Action Program because it is the method by which root causes, extent of condition, and recurrence control are determined for significant problems. The PER process is managed by the NA&L.
NAEL maintains a database that tracks each individual PER, the development of corrective actions, the schedule and completion of the corrective actions, and the closure of the PER.
Time limits are maintained for initiation and review of PERs, as well as development of Corrective Action Plans and verification of closures.
NAEL monitors the completion of these activities and if the time limits are not met (or appropriately extended) for Level A and B PERs (PER levels are described below), NA&L escalates the matter to management.
NA&L may escalate late actions on Level C PERs.
In general terms, the PER process includes the following:
A PER can be initiated by an employee for any condition, and immediate action is taken as necessary.
Immediate actions may be necessary to protect plant personnel or plant equipment, or if the condition is potentially reportable or potentially affects operability.
After initiation, the PER undergoes supervisory and/or management review to ensure that any necessary immediate actions are taken and to assign an organization to investigate the PER.
In addition, the supervisory / management reviewers assign one of four levels of significance to the PER based on the following definitions:
=>
Level A - Significant Adverse conditions.
These include:
A major safety-related or QA program gondition that has_
occurred with a frequency as to indicate that past recurrence control has been lacking or ineffective.
Confirmed adverse trends in quality activities identified by trend analysis.
48 4
. _. - -. ~. - -.. - - _-.~
i A programmatic breakdown which negates quality controls j
or places doubt on the integrity of the affected program.
j
\\,
)'
Repetitive or deliberate occurrences of procedural violations that have a direct and detrimental effect on
)
safety or quality.
4 Conditions which impact the plant's ability to mitigate J
j design basis accidents.
]
)-
=>
Level B - Adverse Conditions that do not meet the Level A j
significance criteria but are not routine.
These include:
Quality-related deficiencies which require identification i
of apparent cause and action to correct the condition in accordance with the Nuclear Quality Assurance Plan.
j Human error (inappropriate actions) which could have, under different circumstances, caused a significant plant event or personnel injury.
Responses to regulatory identified issues which did not 3
result from a Level A event, l
i Recurring events not classified as significant which 4
I 4
retain the potential for causing a plant event or i
personnel injury.
s l
Events or conditions which require root cause analysis to support required recurrence control.
These include Licensee Event Reports, NRC violations, and audit findings.
I i
=>
Level C - Routine issues.
These include:
i Conditions which do not meet the criteria in Levels A or l
B but do identify a problem which warrants tracking to j
closure.
4 i
conditions which do not affect operability and are not reportable.
l
=>
Level D - Minor issues.
These include:
s i
Conditions which do not meet the criteria in Levels A, B, 1
or C and immediate actions taken were sufficient to resolve the condition.
l Conditions which do not affect operability, are not i
reportable, and are not potentially generic.
i 49 j
4 l
i.
i l
PER conditions that are determined by the initiator or the l
supervisory / management reviewers to potentially affect Joperability or be potentially reportable to NRC are promptly identified to the Operations Shift Manager for evaluation.
l The Operations shift Manager determines operability of the l
affected system or component based on a review of Technical j
Specification requirements.
This includes evaluation of necessary attendant equipment such as instrumentation,
)
controls, and power supplies.
The ultimate decision on l-operability rests with the duty Operations Shift Manager.
J However, in order to make this operability determination, the Operations Shift Manager may call upon the various engineering resources available on site.
TVA has l
4 administrative controls for the performance of enginegging i.
evaluations in support of operability determinations.
l
~These Technical Operability Evaluations (TOES) are performed I
I by Engineering at the request of the Operations shift Manager in order to obtain formal engineering input for aid in j
determining operability.
TOES may bs initiated to' evaluate a past operability concern for repcrtability purposes, a future
{
operability concern in anticipation of an upc7 ming plant i
evolution, or for other reasont as requested by the Operations Shift Manager.
The reportability 'jrocess is discussed later in this response to request (d).
l l
The organization assigned to investigate the PER condition (the Responsible Organization) determines the cause(s) of the l
condition and formulates corrective actions.
Root cause i
analyses are required for Level A PERs, when requested by the I
management reviewers, and for PERs written to address Licensee Event Reports, Notices of Violations, or Quality
' Assurance Audit Findings.
The root cause analysis method may be specified by the management reviewer (s).
Otherwise, it is selected by the Responsible Organization based on the nature of the condition.
TVA has' guidelines f E6 performing various types of root cause analysis, including:
=>
Task Analysis
=>
Change Analysis
=>
Barrier Analysis
=>
Event and Causal Factor Charting
=>
Advanced Ane.lytical Methods (e.g., Kepner-Tregoe problem solving)
Training on root cause techniques is provided to personnel 85 Browns Ferry Site Standard Practice, S$P 12.57, Engineering Evaluations for operability Determinations.
~
86 TVA Nuclear Business Practice - 236, Event critique and Root cause Analysis.
50
1
["
1 who perform root cause analyses.
l Significant events are investigated by multidisciplinary j
teams to facilitate comprehensive, accurate, and timely root t
cause analysis.
once the root cause(s) is determined, the Responsible Organization defines corrective actions to remove i
the cause and thereby prevent. recurrence of the condition.
1 Corrective actions for PERs for which root causes are not
)
j-required to be determined are based on an apparent cause l
determination where the specific problem is corrected and l
l i
data is collected and used for trend analyses.
For example, i
j a single example of a procedure error that has negligible consequences may not warrant a root cause analysis; the i
corrective action would be to correct the procedure.
l However, a series of procedure errors over a period of time j
discovered through trend analysis may indicate a more significant problem for which a root cause analysis should be done.
4
. Corrective actions, whether from root or apparent cause l
e analyses, are assigned to organizations and tracked to completion.
During the investigation of Level A and B PER conditions, the Responsible Organization determines the extent of the condition.
This determine. tion uses results of the root or apparent cause analysis to identify if other plant programs, processes, or hardware are subject to the same PER condition.
For example, if the PER documents a low flow condition found to be caused by a manufacturing defect in a pump impeller, the extent of condition process would determine where else in i
the plant that impeller type is used.
Appropriate actions would then be taken to address the potentially defective j
parts.
If a Level A or B condition is determined to be potentially applicable to TVA sites other than the site where it was generated, the PER will be transmitted to the other sites for i
review.
If those reviews conclude that the condition also exists at the other sites, a new PER is generated at each affected site and is cross-referenced to the initiating PER.
j If review-by the other sites concludes that the condition does not exist there, a justification for the conclusion is documented.
i I
TVA requires that significant adverse conditions be processed as Level A PERs.
NAEL approves corrective action plans and verifies that corrective actions 'for Level A'PERs have been completed as described in the corrective action plan.
This i
independent verification occurs after the Responsible Organization reports that all actions are complete and before 51
i the PER is closed.
The Responsible Organization is required to resolve any problems identified during this verification.
A subsequent effectiveness review is also performed for Level A PERs.
After corrective actions have been in place long enough to have removed the cause(s) of.the PER condition, the
[
Responsible Organization assesses whether the original corrective actions were effective.
If the corrective action was not effective, a new PER will be generated.
c.
Self-Assessments:
Self-assessments are performed to identify undesirable changes in personnel, equipment, program, l
and process performance over time.
The self-assessment centers around the development of the quarterly Level I Trend Analysis Report.
The process for generation of this report involves i
extensive line organizational input.
The report format is patterned after the management areas in the INPO 90-015,
" Performance Objectives and Criteria for Operating and Near-Term Operating License Plants."
Each management area is assigned a
" window. "
Performance for the quarter is assessed by the responsible line organization.
Information such as PERs, Notices of Violation, Licensee Event Reports, performance indicators, recurring equipment problems, and other pertinent data are used to determine the overall performance for each management area.
The corresponding window is then assigned a color which indicates the performance in that area.
The colors and corresponding performance ratings are as follows:
Color Performance Ratina Interpretation Red Significant Weakness Requires immediate management attention.
Yellow Improvement Needed Requires additional management attention.
White Satisfactory Meets current standards.
Performance Green Significant Strength Performance exceeding standards or expectations The colors assigned to the windows are then reviewed through a series of site trend analysis committee meetings.
Performance assessment is challenged by peer managers in these meetings, ensuring that each organization's management is self-critical cnd i
is assessing performance to the correct standards.
Once complete, the total report is reviewed by a Trend Review Board, chaired by the Site Vice President or Plant Manager.
Each site's report is then transmitted.to corporate headquarters where it is compiled and reviewed by TVA senior management in the Management 52 w-
,-,..e m
. - - ~. -. -. _,
4 Trend oversight Board.
At each stage, management reviews and challenges the performance ratings to ensure that proper
_ performance standards are applied.
When adverse trends are identified by this process, PERs are generated to address these trends.
d.
Operating Experience Procram:
TVA's OE program assures that operating information pertinent to plant safety is,7 reviewed and distributed in a timely manner to plant personnel.
Information reviewed by the OE program includes NRC Information Notices, INPO Significant Operating Experience Reports, INPO Significant Event Reports, 10 CFR 21 reports that originate outside TVA, General Electric Services Information Letters, Westinghouse Technical Bulletins, and TVA's NRC violation notices.
The applicability of the item is assessed and organizations that could be affected by the experience
'i information are identified.
As applicable, reports are distributed for information or assigned as action items for evaluation to the appropriate TVA plants and organizations.
If these organizations determine that an action is required, then a PER is written and the item is resolved within the corrective action program.
The OE information may result in enhancements to programs, processes, hardware, etc., in order to avoid future problems.
Due dates for evaluation of OE documents are established commensurate with the probability and potential impact to the plant.
The action items are tracked until completion.
In addition to the systematic review of industry operating experience described above, TVA participates in various industry groups (e.g., BWR Owner's Group) where common problems and initiatives are discussed and ovaluated.
These groups provide another mechanism for communication of industry operating l
experience.
e.
Event ReDortina Process:
Conditions determined to be potentially reportable are processed in accordance with an requirements in 10 CFR 50.72 and 50.73.gg specific reporting administrative procedure that details t During the initial stages of an event, Operations either ider.tifies or is notified of the potential problem.
When time is available, the assessment of a problem against the reporting criteria routinely involves other organizations such as Licensing, Site Engineering, and other organizations that have responsibility for the system, structure, component, or process affected by the potential problem.
Through this method, personnel technically experienced with this type of plant problem provide input into the reportability decision.
The final reporting decision rests with 87 Nuclear Power Standard 4.4, Managing the operating Experience Prcgren.
88 Nuclear Power Standard 4.5, Regulatory Reporting Requirements.
53 i
the Operations Shift Manager.
The site Licensing organization writes Licensee Event Reports an administrative procedure.,p0.73 using guidelines contained in (LERs) as required by 10 CFR The Licensing organization obtains information required for the LER from the corrective action program.
For example, the event description, root cause, and corrective actions to prevent recurrence are gener'ated by the PER process.
The site Licensing organization also manages the reporting of j
defects in basic components and failures to comply with NRC requirements in accordance with 10 CFR 21.
f.
Informal Renortina:
In addition to the formal reporting mechanisms, the NRC is apprised of developing plant j
issues through other communication channels.
For example, the NRC Resident Inspector attends plant morning meetings where i
developing issues are discussed.
Site Licensing also discusses a variety of issues with the NRC Project Manager (PM) on an as-needed basis.
These discussions often involve the status of ongoing issues or~ planned plant activities.
TVA management also meets periodically with NRC Regional personnel to discuss plant status, problems, and ongoing initiatives.
g.
Informal Processes:
In addition to the formal programs described above, BFN Site Management currently utilizes several informal mechanisms-for tracking the resolution of problems.
At the present time, the daily Plan of the Day meeting format ~is used to track housekeeping issues, Fire Protection impairments, Maintenance Rule "Al" system reviews, radwaste inlaakage, security system compensatory measures, operator workarounds, oil leakage lists, temporary alterations, control room panel deficiencies, disabled alarms, instruments out of service, and leak seal repairs.
Also, the Site Engineering Manager maintains a list of the Top 20 Plant Equipment Actions, which tracks the resolution of long standing equipment problems.
For example, the BFN EHC System is susceptible to scrams from single failures and equipment upgrades are planned.
Items also tracked include upgrades to the Emergency Core Cooling System inverters, replacement of eroded / corroded piping, addressing the Main Steam Safety Relief Valve setpoint drift problem, and upgrading converters and regulators or, the Unit 3 condensate demineralizers.
I 89 Ibid.
54
. ~.
_ - ~ -..
}
4
(
i E.
Request (e)
The overall effectiveness of your current processes and programs in concluding that the configuration of your plant (s) is consistent with the' design bases.
I i
TVA Response to Remuest fe)
TVA is confident that its processes and programs have been effective overall in ensuring that plant configuration and
)
operation are consistent with the design basis.
TVA is also confident that specific design and configuration deficiencies are l
identified and corrected.
The basis for TVA's confidence has been discussed in response to Requests (a) through (d) and l
issummarized below along with TVA's plans for future activities.
Also discussed below are " data points" that have measured the l
effectiveness of these programs and processes.
TVA recognizes the importance of maintaining plant configuration consistent with the design basis and the need to control changes to the design basis to ensure that design basis assumptions remain valid.
TVA also recognizes the importance of maintaining
(
i an accurate UFSAR.
TVA continues to be self-critical in these areas and has identified the need for improvement with respect to design control and UFSAR accuracy.
Corrective actions are being
)
implemented to address these improvements.
i i
Discussed below is a summary of the basis for TVA's confidence in its programs and processes, and sampling the various " data points" that have measured their effectiveness.
Also discussed j
below are areas related to design and licensing basis control that TVA has identified as needing improvement.
4 i
i 1.
8====ry of TVA Confidence in Design Basis:
TVA's confidence that the plant configuration and operation are i
consistent with the design basis and that specific deficiencies j
are identified and corrected is based upon:
The DBVP, which was a comprehensive effort that established i
l the BFN design basis requirements and reconciled the j
as-designed and as-constructed facility.
The DBVP also identified the design basis requirements that were verified by testing; 1
The Restart Test Program, which ensured through testing that system and component performance requirements identified by the DBVP were satisfied; The procedures upgrade program, which ensured that design basis requirements were translated into plant procedures; TVA's current configuration control processes, which are 55 i
J
l i
i 4
designed to ensure changes to the plant configuration are thoroughly evaluated-and reflected in design basis documentation, the UFSAR, and the implementing operations, test, and maintenance procedures; Use of the corrective action program by TVA's trained and qualified management and line organization personnel to i
identify and correct problems, including those problems l
related to the design basis; i
The routine plant and design reviews, and independent and vertical slice assessments, that assess BFN configuration and SSC performance to determine whether they are consistent with the design basis.
When problems are identified, corrective actions are taken; and The use of generic industry and NRC information to review plant design and configuration, as well as plant programs, as applicable.
As discussed in responses to the other information requests, TVA has already implemented several large-scale efforts to address issues related.to design and configuration control for problems identified in the mid-1980s.
TVA has also implemented or initiated a number of other programs, reviews and assessments since that time to ensure that design basis requirements continue to be implemented in procedures and SSC configuration and performance.
2.
Performance / Implementation Issuest Over the past few years, TVA's assessments of design-related activities have identified performance issues for which TVA has taken, or is in the process of taking, corrective actions.
These performance issues have not undermined ~TVA's overall confidence in its design control process.
TVA assessments have also identified the need to improve some licensing basis controls.
The specific issues identified by TVA in this area involve the applicability of 10 CFR 50.59, and the overall accuracy of the UFSAR.
TVA identified weaknesses in its program that allowed changes to be l
made to certain nonquality and nonsafety-related procedures and certain design input and outputs without a SA/SE.
At present, the program is being revised to correct these weaknesses.
No Unreviewed Safety Questions have been identified as a result of these weaknesses.
TVA is also taking corrective actions to address UFSAR accuracy j
as described below.
3.
Measurements of Effectiveness: TVA assesses the effectiveness of its control of design basis requirements and the translation of those requirements.into procedures and SSC configuration and performance through mar.y specific reviews and 56 l
1-assessments.
These reviews and assessments have been discussed I
l in TVA's responses to requests (a) through (d).
In addition to 1
these reviews and assessments, NRC conducts reviews and i.
inspections that also measure the effectiveness of TVA's processes and programs.
While TVA does not rely on NRC programmatic reviews and implementation inspections to determine d
i if the plant configuration and operation are consistent with the j
design basis, these reviews provide an independent assessment of i
TVA's activities and have'provided additional' assurance that TVA's processes and programs are effective in ensuring that plant l
configuration is consistent with the design basis.
A summary of the previously discussed TVA reviews and assessments and examples of the results of NRC Staff programmatic reviews and j
implementation inspections are provided below.
a.
TVA Effectiveness Monitorina TVA reviews and
{
assessments that provide management with information necessary to j
determine the effectiveness of its translation of design basis i
requirements include:
Site Engineering indicators of the health of the design l
control process;-
I
)
System Status Reports; i
i
\\
Operating Experience reviews; j
j i
l Generic Regulatory reviews; e
Routine in-service and surveillance testing; i
Quality Assurance a'ssessments in the areas of hardware j
corrective actions and the FSAR; a
i I
Vertical Slice assessments of the Service Water System and e
l Main Steam and EHC Systems; and i
Trend reviews performed as part of the Corrective Action e
i Program.
b.
MRC Reviews (1)
Desian Baseline Verification Program:
In i
Section 2.1 of Volume 3 of NUREG-1232, the NRC staff documented i-its evaluation of the configuration management program, the DBVP, and the design calculations program for BFN Unit 2, as described j
in the Browns Ferry Nuclear Performance Plan and related j
supporting documents.
The NRC staff concluded that TVA had adequately identified the problems associated with design control 57 3
}
l
t 1
i 4
and design control changes and had instituted an appropriate design-basis and verification program to reestablish the design l
basis and to ensure that the plant configuration conformed with l
its design basis.
The staff also concluded that the DBVP, if properly implemented, would ensure that the functional plant j
configuration is reflected in design documents and drawings, and thus provide confidence that systems required for safe shutdown j
of the plant can perform their safety-related functions.
As documented in NUREG-1232, Volume 3, Supplement 2, NRC 1
conducted a final team inspection-of Phase I of the Unit 2 DBVP.
i The purpose of this team inspection was to review and assess the L
overall adequacy of TVA's implementation of the DBVP at BPN.
By i
the end of this inspection, the NRC team had not discovered any i
significant discrepancies in TVA's implementation of the DBVP l
l requirements.
Most of the discrepancies found by the staff had i
l been previously identified by TVA, and the associated corrective actions were being tracked to completion.
The NRC inspection team therefore concluded that TVA, in general, was adequately implementing the DBVP at BFN for those essential systems required to safely shut down the plant.
The team also concluded that upon
{
TVA's successful completion of the DBVP, BFN Unit 2 would be in j
conformance with its design basis.
l A special, announced inspection was also conducted in the area of DBVP in 1994.
The inspection focused primarily on a mechanical assessment of a vertical slice of the DBVP for Unit 3.
The I
inspectors reviewed the Unit 2 design basis documents for any j
revisions required in order to permit its application to Unit 3, i
and those that were uniquely developed for Unit 3.
The UFSAR was I
reviewed for commitments, requirements and other design l'
information.
Design Criteria Documents, CCDs, and the installed hardware were examined to determine if they correctly reflect translation of the commitments and requirements into final system design.
Selected essential calculations were reviewed to verify l
that the inputs to the calculations were appropriate, and that the results and conclusions supported the capabilities of the design.
A field walk-down was conducted to confirm the l
as-constructed configuration to be in agreement with the CCDs.
j The inspection resulted in the following assessments of the DBVP:
I overall, the DBVP was effective in establishing the design e
basis for plant safety systems towards Unit 3 recovery effort.
I The essential information and design parameters established in f
the Design Criteria, supported by the essential calculations and to be confirmed by the Baseline Test Requirement Document, l
were consistent and in agreement with the requirements of the i
Safe Shutdown Analysis.
{
5 The overall quality of the essential calculations reviewed was e
58
i i
l
. good.
Standard engineering practices were used in the essential calculations.
All calculations were independently I
verified, often by a different method.
Design parameters and configuration differences between i
Units.1 and 2, if any, were identified and appropriately resolved.by licensee engineering analysis.
i Random verification of system components during the l
inspectors' walk-downs confirmed the as-built status of the configuration control flow diagrams.
(
1 The Engineering Change Notices and DCNs effectively addressed plant problems and nuclear safety issues.
The modification i
i packages.and equipment installation were well controlled and documented.. The licensee's process for controlling, reviewing, and changing drawings was good and in accordance with established procedures.
The oversight activities by the licensee have been a valuable process in the implementation of the Unit 3 recovery process.
(2)
Procedure Upgrade Procrans The procedure upgrade program was reviewed and approved by the NRC Staff as documented in NUREG-1232, Volume 3, Supplement 2.
Section 4.11.2.2, Operating Procedures, notes that TVA conducted a thorough review of operating procedures and implemented a program to rewrite and verify.these procedures.
NRC also stated that the samplings of operations procedures examined in NRC inspections to date have shown no major esficiencies.
(3)
Corrective hetion Procrant NRC service water system self-assessment inspection.,gonMed a The two primary objectives of this inspection were to (1) perform an independent overview evaluation of the service water systems and (2) to evaluate the quality and depth of TVA's sielf assessment.
The Inspection Report states that TVA's self-assessment was thorough.
The cover letter for a recent NRC Integrated Inspection Report states that corporate oversight of plant activities and Nuclear AssuranceandLgensingreviewsofthecorrectiveactionprogram were' effective.
The section on Licensee Corrective Action Program notes that:
j 90 NRC letter to TVA, dated December
- 1, 1995, NRC Inspection Report Nos. 50-259/95-62, 50-260/9512, and 50-296/95-62.
]
l NRC letter to TVA, dated September 25, 1996, NRC Integrated j
l Inspection Report 50-259/96-08, 50-260/96-08 and 50-296/96-08.
59 l
l
1 i
k l'
Corrective action plans that proceeded through all reviews, including a final NAEL approval, were comprehensive and f
{
sufficiently addressed the issues.
(
i The inspector noted several examples in which NA&L questioned 2
l corrective action plans and subsequently precipitated revisions in corrective actions.
i-
.The inspector noted that plant personnel had-initiated l
l several PERs, addressed long standing equipment issues.
l l
These PERs indicated good insight in identifying areas for l
j improvement.
3 The inspector concluded that, in general, corrective actions i-j were sufficient to address identified. deficiencies and l
causes.
The inspector also concluded that NAEL reviews of
]
4 the PER process have been effective and, in some cases, i
instrumental in strengthening corrective actions.
l j
Furthermore, the inspector concluded that the Human' j
Performance Quality Improvement Council meeting reflected a i
revitalized effort to improve plant performance issues.
l (4)
Electrical Distribution system Punctional j
Inspection:
NRC conducted an Electrical Distribution System technical support of the EDS.gy the design implementation and Functional Inspection to asse j
j The team concluded that offsite j
j power was flexible and reliable and that the onsite EDS was j
generally in compliance with the Technical Specifications /FSAR/SER Design documentation including calculations and analyses were i
available and retrievable However, a few calculations contained i
errors or omissions, but these were considered exceptions to an j
l otherwise good quality calculations program.
i (5)
Performance Issuest In August 1996, based on an inoperable Reactor Ccre Isolation Cooling (RCIC) sy cited TVA with a technical specification violation.gpen, NRC TVA 1
replaced a. check valve on the RCIC pum; turbine.
In replacing 3
L.
this check valve, Post-modification and ASME Section XI testing were not performed on the system in accordance with procedures.
These violations represented a failure to implement TVA's i
controls regarding design and ASME testing.
To minimize i
recurrence of these implementation problems, TVA trained its l
personnel gpd added further checks and balances in the j
processes.
,Though~important, these implementation problems do i
92 NRC letter to TVA, dated June 18, 1992, Notice of Violation (NRC Inspection Report Nos. 50-259/92-15,.50-260/92-15, and 50-296/92-15).
'3 i
NRC letter to TVA, dated August 1, 1996, Netice of Violation (NRC i
Inspection Report Nos. 50-259, 50-260, and 50-296/96-05).
{
94 TVA letter to NRC, dated August 30, 1996, NRc Inspection 60 7
i k
1 not undermine TVA's overall confidence in its design control and testing processes.
TVA continues to monitor and trend human 3
t performance issues.
4.
Additional Relevant Assessments a,
current Licensina Basis:
As an additional measure of 4
effectiveness, TVA has performed a Current Licensing Basis (CLB) assessment to determine if changes to the plant's Licensing basis are adequatggy ref.1.ected in the plant's resign basis, 1
as applicable.
The CLB assessment was tr ilored to evaluate the cr ntrol commitments that BFN programs in place that identify anu e
4 affect the current licensing basis.
T
used the definition of j
J CLB found in 10 CFR 54.3.
i 4
The assessment generally followed the guidelines of draft NEI 96-05, Guidelines for Assessing Programs for Maintaining the Licensing Basis.
Areas for review included design change notices, changes to the Quality Assurance, Security and Emergency Preparedness programs, outstanding corrective actions, operating procedure or design changes not evaluated under the provisions of 10 CFR 50.59, FSAR change requests, relief requests, operator workarounds, operations standing orders, and nonconforming items.
When the approved version of NEI 96-05 was issued, the draft and final versions were compared.
No new areas requiring review were identified.
TVA expanded the CLB assessment beyond the recommendations of NEI 96-05 and reviewed the following 7
additional areas:
i
- NRC Orders,
- License Conditions,
- Exemptions, j
- Technical Specification amendments,
- Responses to NRC Bulletins,
- Responses to NRC Generic Letters,
- Responses to Enforcement Actions,
- Licensee Event Reports,
- NRC Safety Evaluations, and
- Commitment management process.
The above items were evaluated to the criteria contained in NEI 96-05.
No new deficiencies or Problem Evaluation Reports were identified.
I b.
The UFSAR TVA recognizes the importance of f
maintaining an accurate and updated UFSAR.
TVA has recently t
embarked upon several UFSAR improvement initiatives and has had i
i several meetings with the NRC Staff to keep them appraised of i
Report 50-259, 50-260, 50-296/96 Reply to Notice of Violation (NoV).
95 Assessement NA-BF-96-064.
61 i
\\
i i
r these activities:
i
=
In February 1996, TVA initiated a verification of UFSAR commitments as part of the ongoing Quality Assurance l'
activities.
In March 1996, TVA initiated a specific Quality Assurance j
assessment to evaluate the accuracy of the UFSAR and associated program controls, to validate portions the UFSAR,.
maintain its accuracy.gectiveness of programs used toA concern was identified rega and to determine the e the availability of in-process FSAR changes, which were pending incorporation into the next FSAR amendment.
Corrective actions were taken to ensura this information was made available to preparers of 10 CFR 50.59 reviews in a timely manner and actions to prevent recurrence are in j
progress..
TVA met with the NRC on July 10, 1996'7 and August 22, 1996'8 to review and discuss TVA's initiatives in the UF3AR area and p
the discrepancies identified as of that point in time.
TVA presented the UFSAR Validation Program Plan summag to the NRC at the August 23, 1996, Plant Status Meeting.
After the meeting with the Staff on August 23, 1996, TVA management asked TVA staff to perform an initial, expedited review to ensure that UFSAR discrepancies that could result in Unreviewed Safety Questions, adversely impact system i
operability, or that required modifications to plant i
equipment, if any, were promptly identified, evaluated, and corrected.
The scope and depth of the expedited review was extensive and included:
l
=>
Verification of consistency between the UFSAR and Technical Specification Amendments;
=>
A review of the UFSAR text by operations personnel to assess whether UFSAR descriptions related to operational activities accurately reflected operations procedures and 96 Nuclear Assurance and Licensing (NA&L) - Updated Final Safety Analysis - Assessment NA-BF-96-027, dated July 22, 1996.
NRC letter to TVA, dated July 18, 1996, Summary - July 10, 1996 Meeting with TVA to Brief the Staff on the Final Safety Analysis Report compliance at TVA Nuclear Plants.
98 NRC letter to TVA, undated, Browns Ferry Final Safety Analysis Report Audit Initiatives - Management Meeting Summary.
NRC letter to TVA, dated August 27, 1996, Meeting Sununary - Browns Ferry Plant.
62 J
i i
i l
l practices.
i
=>
A separate discipline-by-discipline review of the UFSAR text by the responsible site organizations, as defined in
{
BFN procedure for UFSAR control (i.e., Engineering l
[ design / systems), Licensing, Training, Quality Assurance, Chemistry);
=>
A review of UFSAR change requests for proper j
incorporation and to~ ensure that affected UFSAR sections were changed; and l
=>
A Quality Assurance evaluation of the reviews.
On October 16, 1996, TVA provided the NRC with a status briefing on the changes to the UFSAR Validation Program that occurred since the Au 1996, meeting as a result of l
the expedited review.ggyt 23, TVA discussed the additional 2
reviews planned and the types of UFSAR discrepancies identified as of that date.
The types of discrepancies ranged from typographical / editorial errors to descriptions of l
obsolete / abandoned equipment and errors in explanations of j
system operations.
The resolution of these discrepancies has not resulted in Unreviewed Safety Questions, or rendered i
plant systems inoperable.
Only one minor modification to
)
plant equipment has been identified (a single instance of a change to a control room annunciator label).
TVA submitted Amendment 13 to the BFN UFSAR on October 22, 1996, which incorporated the resolution of a number of the diggyepancies identified by the reviews discussed above.
TVA is continuing to review the UFSAR, evaluate the remaining discrepancies, and to prepare the required changes to the UFSAR.
Quality Assurance is performing another UFSAR assessment to assess the accuracy of each UFSAR Chapter and/or Section.
Prioritization of the assessment of each UFSAR Chapters / Sections included inputs from the Probabilistic Safety Assessment and the quarterly line organizations' System status reports.
The assessment criteria include the system design basis (including design criteria, calculations and vendor information), Technical Specification requirements, operating, maintenance and testing procedures, FSAR description, and selected field verifications.
100 NRC letter to TVA, dated october 24, 1996, Summary -
october 16, 1996 Meeting with TVA.
101 TVA letter to NRC, dated october 22, 1996, Updated Final Safety Analysis Report (FSAR), Amendment 13.
63
-... _.. ~..
4
\\
Engineering is continuing with its UFSAR validation efforts.
Design change activities also include the review of each UFSAR section affected by the change.
Identified discrepancies are being evaluated and required UFSAR changes
{
I are being prepared.
l I
5 4
0 t
i i
i s
l l
1 4
i 1
a 4
0 64 1
4 l
I i
F.
Additional Efforts l
In the 10 CFR 50.54(f) information request, NRC also asked licensees to describe any additional efforts in this area that the licensee plans to take.
TVA's response to this request is provided below.
i TTA Response to Request:
While TVA is confident that the plant l
configuration and operation is consistent with the design basis, i
the UFSAR contains no significant inaccuracies with respect to the design basis, and that specific deficiencies are identified and corrected, TVA's ongoing and planned activities in these i
specific areas demonstrate that TVA continues to be self-critical in these areas in order to improve and enhance design basis and UFSAR accuracy.
These ongoing activities include vertical slice assessments, QA assessments of-engineering activities and FSAR accuracy, and Engineering validation of FSAR accuracy.
Details j
oof each of these areas are discussed below.
i 1.
vertical slice Assessments:
Since early 1995, TVA has j.
performed two vertical slice assessments to review the Service Water System, and the Main Steam and EHC Systems.
These i
assessments focused on the capability of the systems to perform
)
i their design functions.
These assessments specifically addressed I
i the consistency of installation, operations, maintenance and testing with the design / licensing bacis, Due to the benefits i
identified as a result of the performance of these vertical i
slices, TVA has previously informed the NRC staff of its intent j
to perform additional vertical slice audits.
?
{
TVA is currently utilizing the vertical slice technique as part of the formal audit program at each site. Vertical slice audits i
are performed at TVA's nuclear sites and, if applicable, at the l
corporate office.
The vertical slices are directed et a i
particular system and incorporate the periodic audits required by 1
Other required audits, e.g.,
fire protection, emergency preparedness, security, safeguards, and fitness for duty, will continue to be performed according to j
their required periodicity, either as part of, or separate from, the vertical slice reviews.
Vertical slice audits are comprehensive and will evaluate the i
engineering design and configuration controls related to the j
specific system, compare the as-built plant and as-modified condition of the system, verify system performance, and assess I
whether design basis requirements for that system have been i
translated into associated operating, maintenance, and test procedures.
An exit meeting will be conducted at the site and a 1
final report will be issued discussing the results of the j
vertical slice.
Audit findings will be documented, tracked and corrected in accordance with TVA's corrective action program, j
4 l
2.
01 Assessments of Enaineerina Activities:
The Nuclear 65 i
1
i Assurance organization developed and is impicmenting an engineering oversight plan to evaluate engineering activities affecting quality.
The potential exposure areas.within Engineering being assessed were identified based upon an evaluation of Licensee Event Reports, NRC Inspection Reports, i
Nuclear Assurance and Licensing Oversight reports, and the most recent Systematic Assessment of Licensee Performance.-
These areas include:
l Correct implementation of the design control process, j
Vendor manual control,
)
FSAR Revision and Change Control processes, Configuration control, l
Calculations (i.e., assumptions and documentation, l
l effectiveness of review and approval, consistency with Design Criteria and the FSAR),
Interface and communication with the Maintenance and Operations organizations, Operability evaluations, Design criteria consistency with the FSAR, and Post-modification testing.
l These assessments will include an independent review of Engineering by QA personnel from corporate and other TVA sites as l
well as an independent contractor evaluation of Engineering.
3.
OA Assessment of FSAR Accuracy:
Quality Assurance is also performing a specific UFSAR assessment to assess the accuracy of each UFSAR Chapter and/or Section.
Prioritization of the assessment of each UFSAR Chapters / Sections included inputs from the Probabilistic Risk Assessment and the quarterly line organizations' System status reports.
The assessment criteria includes the system design basis (including design criteria, calculations and vendor information), Technical Specification requirements, operating, maintenance and testing procedures, FSAR description, and selected field verifications, 4.
Enaineerina Validation of FSAR Accuruggi Engineering is continuing with its UFSAR validation efforts.
As part of the change control process, design change activities include the review of each UFSAR section affected by the change.
Identified discrepancies are evaluated and required UFSAR changes prepared.
66
-