ML20216G034

From kanterella
Jump to navigation Jump to search
Summary of 990825 Meeting with NEI Re Continuation of Exchange of Info & Views in Further Developing Concepts Sent to Commission for Improving Process for Overseeing Safety Performance of Nuclear Power Reactors
ML20216G034
Person / Time
Issue date: 09/21/1999
From: Spector A
NRC (Affiliation Not Assigned)
To: Madison A
NRC (Affiliation Not Assigned)
References
NUDOCS 9909270224
Download: ML20216G034 (114)
v • d • e


Text

September 210 1999 MEMORANDUM TO: Alan Madison Inspection Program Branch Division of Inspection Program Management Office of Nuclear Reactor Regulation FROM: August Spector Inspection Program Branch Division of Inspection Program Management Office of Nuclear Reactor Regulation

SUBJECT:

REVISED REACTOR OVERSIGHT PROCESS:

SUMMARY

OF THE AUGUST 25,1999 MEETING WITH THE NUCLEAR POWER INSTITUTE TO DISCUSS THE CONTINUED DEVELOPMENT OF PERFORMANCE ASSESSMENT PROCESS AND INSPECTION PROGRAM IMPROVEMENTS On August 25,1999, a public meeting was held between the NRC and the NEl to continue exchanging ir. formation and views in further developing the concepts sent to the  ;

i Commission for improving the process for overseeing the safety performance of nuclear power reactors. The meeting agenda, a list of those who attended the meeting, a copy of written ,

information exchanged at the meeting, and summary minutes are attached.

l Attachments: As stated l

. f}[j((kh fy

Contact:

August Spector 301-415-2140 kghg i

I Distribution:

Central Files PUBLIC hp Al

,a y gn2 llPB R/F MThadani/NRR 770114 pp#.3 DOCUMENT NAME: A:\meetingsumm0825.wpd To receive a copy of this document. iWte in the box: "C" = Copy without enclosures "E" = Copy with enclosures "N" = No copy OFFICE IIPB:DIPM V/ IIPB:DIPM s-NAME AKSpector -'7 AMadison/M DATE 9/ 2 [ /99 9/ p/ /99 O OFFICIAL RECORD COPY q g [ fL 9909270224 990921 eon asvoe saammac X o 4 q. - b hgI [>ryp-PDR J

Public Meeting Minutes l Date: September 25,1999 l

Time: 8:00 a.m. to 3:30 p.m.

Topic: NRC/NEl MEETING TO DISCUSS THE CONTINUED DEVELOPMENT OF PERFORMANCE ASSESSMENT PROCESS AND INSPECTION PROGRAM IMPROVEMENTS Attendees: See Attached Listing l

l Items Distributed: See attachments Overview:

NRC, NEl and the public discussed and reviewed NRC's development of the performance assessment process and inspection program improvements. Participants shared progress by the NRC's Transition Task Force (TTF) on the new Regulatory Oversight initiative and gained input from NEl and the public.

Issues Discussed Significance Determination Process NRC distributed draft manual chapter on Significance Deterr.iination Process (see attachment)

Performance Indicator Guideline Manual Group reviewed performance reporting guideline shown in NEl 99-02 [ Draft Rev. B] items and agreed to make corrections as shown in the attachment. In addition, proposed revision to the manual (addenda) was given to the NRC for reviev (see attachment on disk).

1 Enforcement Guidance for Performance Indicator (PI) Reporting The participants discussed enforcement issues associated with inaccurate / incorrect reporting of Pis. NRC stated that if a PI error had caused a color change or NRC had taken regulatory actions based on incorrect information, it will be treated as violations of 10 CFR 50.9. 10 CFR 50.9 requires that information provided to the Commission by a licensee shall be complete and accurate in all material aspects. The NEl requested a definition of the term " material." The NRC 1 stated that the Office of General Counsel is responsible for defining or clarifying this informa~ tion.

The participants stated that credits should be given to the self-identification of issues. NRC stated that during the pilot and the first full year of implementation, the findings will not be cited j unless it is willful mis-representation.,

Supplemental Inspection Program NRC distributed draft Supplemental Inspection Procedure for repetitive degraded comerstones, l multiple degraded comerstones, multiple yellow inputs, or one red input .

c I

The NRC agreed that at the next meeting (September 8,1999) comments will be discussed.

l Suggestions made to add to each manual a " philosophy" statement so that the reader will understand the context in which inspections and findings are to be made. (See attachment)

Corrective Action Guidance Document l

The NEl stated that they are developing a corrective action guidance document with the help of INPO to provide further guidance to the industry. A final draft is expected to be completed by NovemW 30,1999. They stated that this document will be submitted for NRC review.

Management Directive 8.3 NRC presented brief discussion of progress in the development of NRC Incident investigation management directive, MD 8.3.

Future activities brainstorm session Group discussed following topics:

What is needed for full implementation Major steps to achieve full implementation Measures of success l Next meetina:

Agreed to hold next public meeting on September 8,1999 from 8:00 a.m. to 3:30 p.m.

Meeting adjoumed at 3:30 p.m.

I l

J

AGENDA FOR AUGUST 25,1999, NRC/NEl MEETING TO DISCUSS THE CONTINUED DEVELOPMENT OF RISK-INFORMED PERFORMANCE ASSESSMENT PROCESS AND INSPECTION PROGRAM IMPROVEMENTS

. Introduction

. Purpose of Meeting

. Review / Discuss the Risk-Informed Inspection Program and Assessment Process j Planning for Future interaction '

List of Attachments l Significance Determination Process NEl 99-02 [ Draft Rev. B) Addendum - on computer disk Draft Supplemental Inspection Procedure ATTENDEES Public Meeting August 25,1999 i Nuclear Enerav Institute (NEI) l John Butler Robert Evans Stephen Floyd Tom Houghton Nuclear Reaulatory Commission (NRC)

Bill Borchardt, OE ,

l Bill Dean, NRR Frank Gillespie, NRR Kathy Gibson, NRR l Alan Madison, NRR Roy Mathew, NRR Donald Norkin, NRR August Spector, NRR Serita Sanders, NRR OTHERS Kevin Borton, PECO Wally Beck, COMED Richard L. Jawovski, Omaha Public Power District Robert Gradle, BGE Dennis Hassler, PSEG Nuclear Jack Leveille, NSP Randy Mika, COMED David Robinson, Nebraska Public Power District

]

]

'~

3 l

l NRC INSPECTION MANUAL PIPB 1

Manual Chaoter 06XX SIGNIFICANCE DETERMINATION PROCESS 06XX-01 PURPOSE of an inspection To provide program guidance finding. for the The inspection significance finding significancedetermination (Risk Characterization) determination processes describe procedJre and its appendixes evaluate the significance of individualinspection findings so that the overall licensee performance assessment process can compare and evaluate them on a '

information. Licensee identified significance issues, scalebysimilar when reviewed to the plant NRC inspectors, performance are also candidates indicator (PI)for this process.

06XX 02 OBJECTIVE 02.01 To characterize the risk significance or importance of an inspection finding consistent with the regulatory response thresholds used for performance indicators (Pls) in the NRC licensee performance assessment process.

i 02.02 To provide a risk informed framework for discussing and communicating the potential significance of inspection findings.

02.03 To provide a basis for assessment or enforcement actions associated with an inspection finding.

02.04 To specify the minimum amount of documentation needed to allow reconstruction of the basis for any decisions associated with the risk significance ranking of an inspection finoing.

06XX 03 DEFINITIONS ,

h A_poarent Risk Sionificant issue. An issues that has been processed through the SDP and its risk l estimation is greater than that associated with a Green finding.

l Findino. As used in this chapter, an observation that has been placed in context and assessed for j significance, i i

Observation. A fact; any detail noted during an inspection.

Sianificance Determination. The process for applying a risk characterization to an individualissue .

for the purpose of providing an inpy.1 to the NRC's Reactor Oversight Plant Assessment and l Enforcement Processes. )

i 06XX-04 RESPONSIBILITIES AND AUTHORITIES l

All NRC inspectors are required to assess the significance of inspection findings in accordance with  !

the guidance provided in this inspect;on Manual chapter. General and specific responsibilities are listed below, i

Issue Date: 08/10/99 Revision 1 DRAFT 06XX ,

J

04.01 Director. Office of Nuclear Reactor Reaulation.

a. Provide overall program direction for the reactor inspection program.
b. Develop and direct the implementation of policies, programs, and procedures for regional application of the Significance Determination Process in the evaluation of findings and issues associated with the Reactor Oversight Program.
c. Assess the effectiveness, uniformity, and completeness of regionalimplementation of the SDP.

04.02 Associate Director for Insoection and Proarams.

Direct the development of the SDP within NRR 04.03 Director. Division of Insoection Proaram Manaaement I a. Jointly, with the Director, Division of Systems Safety and Analysis, develop and refine the i SDP through periodic revisions based on new risk insights and feedback from users,

b. Provide oversight and representativer, as necessary to support the Significance Determination Process Oversight Panelin order to ensure consistent application of the process.

1 04.04 Director. Division of Systems Safety and Analvsis.

I a. Jointly, with the Director, Division of Inspection Program Management, develop and refine I the SDP through periodic revisions based on new risk insights and feedback from users.

I I

I b. Provide oversight and representatives as necessary to support the Significance i Determination Process Oversight Panelin order to ensure consistent application of the

! process.

04.05 Director. Office of Enforcement

a. Ensure consistent application of the enforcement process to violations of NRC regulations with the appropriate focus on the significance of the issue,
b. Provide representatives as necessary to support the Significance Determination Process Oversight Panelin order to ensure consistent application of the process.

04.06 Director. Office of Research

a. Provide support in the development and refinement of the SDPs, which use risk insights from research activities.
b. Provide representatives as necessary to support the Significance Determination Process l Oversight Panelin order to ensure consistent application of the process. i 04.07 Reaional Administrator l
a. Provide program direction for management and implementation of the SDP to activities performed by the Regional Office.
b. Provide representatives as necessary to support the Significance Determination Process Oversight Panelin order to ensure consistent application of the process,
c. Within the guidance of the Reactor Oversight Program, apply inspection resources, as necessary, to determine the significance of specific issues identified.

06XX-05 BASIC REQUIREMENTS l 06XX DRAFT Revision 1 Issue Date: 08/10/99 j

INSPECTION FINDING SIGNIFICANCE DETERMINATION PROCESS (SDP)

Introduction SECY-99 007, dated January 8,1999, described the need for a method of assigning a risk characterization to inspection findings. This risk characterization is necessa so that inspection findings can be aligned with risk informed plant performance indicators (P during the plant performance assessment process. Figure 1 describes the process flow o ical inspection f

i findings or issues. Figure 1 also outlines the different paths an issue could t e with the final i 2g12g1 of each process being an [ngq to 'the assessment and/or the enforcement process.

Enforcement associated with violations o' regulatory requirements will be processed in accordance with NUREG-1600, Rev 1, General Statement of Pohey and Procedures for NRC Enforcement Actions and any applicable Enforcement Guidance Memorandums (EMGs). Minor violations, as I do not need to be reviewed using this process. However,if I l defined by the minor violations enforcement were evaluated us policy,ing this process they would be screened I as gree during the phase 1 review. I Appendix 1 of this attachment describes the significance determination of Inspection findings, which I j have a potential impact on power operations, thereby affecting the initiating event, mitigating I systems, or barrier cornerstones associated with the reactor safety strategic performance area, i lt is expected that this process will address most of the risk significant issues that would be experienced at a facility. Issues associated with, emergency preparedness, radiation safety, safeguards, fire protection and shutdown risk also necds a SDP as well. Appendix 2 of this 3 attachment t safeguards.provided the SDP processes for emergency preparedness, radiation 1 safety, additional staff development and review. Appendix 4 addresses the significance of degraded fire i barrier and suppression systems. Appendix 5 describes the SDP and Enforcement Review Panel I concept and provides a sample worksheet for issues to be brought before the panel. I I

l l

l

)

Issue Date: 08/10/99 -3 Revision 1 DRAFT 06XX L.

s 1.b i'i!

< w I Ak Jk 4k

$ $ '8 ;B 1

g!.I $sig . S 3: 3 E I.i t

  • g}] B ijjj d 1112

< s ISO s!g E= S E!!!

aa"  !?  ?

.e JL

,E - ,

.:~4 as =5 54 aus p<$s s[

is I $' II n I E i

=

!si

!= I a

n

!s i

&y g v

9 ,

E JL

  • ! llI!

=fa =ll 1 e s -

iflI jue 1] .<

- *.* E 5 *

-+ =elfje s o jo -

gI

!i + 3.1:i 2

1[.tg w tite is[ibsis n i

.s

.y

< egv 835m

  • g E

o

( ...

sO N

8

'.' i Appendix 1 Significance Determination of Reactor inspection Findings for At Power Situations 1 Entry Conditions The process in this Appendix is designed to assess only those inspection findings associated with I at power operations within the cornerstones of initiating events, mitioation systems, and barrier integrity under the reactor safety strategic performance area. Compliance with Technical Specifications (TS) and design basis assumpt,ons i continue to provide defense in-depth and safety margins. This process was developed to provide a determination of relative risk significance for I conditions that may affect these assumptions. An actualinitiating event will either be captured by i or, if it is complicated by equipment malfunction or a performance operator indicator error, should (e.g.,

be assess.! a reactor f by NRC r tr'p)isk analysts outside of the process I describ Objectives 1.To characterize the risk significance of an inspection finding consistent with the regulatory response thresholds used for performance indicators (Pls) in the NRC licensee performance assessment process and for entry into the enforcement process.

2.To provide a risk-informed framework for discussing and communicating the potential significance of inspection findings.

Definino Characteristic The most important intended characteristic of this process is that it provide a means for inspectors I and their management to elevate potentiall I licensee correction and/or agency action,y risk significant and screen issues those findings thatearly haveinminimal the process risk for I

timely significance into the licensee's corrective action program. The process presumes the user has a i basic understanding of risk analysis methods.

Introduction The proposed overal! licensee assessment process (as defined outside of this document) eva!uates licensee performance using a combination of Performance Indicators Thresholds have been established for the Pls, which,if exceeded, mptmay pro (Pis) additional and inspections actions to focus licensee and NRC attention on areas in which there is a potential decline in licensee l performance. The inspection finding risk characterization process described in this appendix and )

illustrated in Figure 1 evaluates the significance of individualinspection findings so that the overall licensee performance assessment process can compare and evaluate them on a significance scale similar to the Pi information. Licensee-identified issues, when reviewed by NRC inspectors, are also candidates for this process.

Issue Date: 08/10/99 Al-1 Revision 1 DRAFT 06XX

_ _ 1 er

_ _ u g

_ _ i

_ _ n F

_ _ i o t

_ t

_ a n t

r e

_ I _

e _2re en e

_ s _ aet s ac h

P a _

_ha

_Ph

_ C r

g ny i it 3mW si af e h R P ks sa

_ ni l i(

R _

k s iab R m ap )3 i

E I

R ea R

Rc2p h

_ ene i t

SR _

hot t

iS w _

SA

_ _ yta( 9 f

it ig e .

9 -

EB t

C &

nt deM i

i dM i

a c

oc)

/

1

/

0

_ sS4 O _

s g2 Anp 8

0 R SR _ _

ks M e i

PME e

R th S(t i .

t o a NT EW _

e nd t

t s D OS O _ _

i mo

. s y e u

TY P I

_ s r o

rM e

l a S s n d _ in f io e t S

AST_ e e _ gio dk _ r m D A I i

es ai .

f _ intp) ni _ nT k NG A I

it n

e dn1 inru1 eR en ee cr S us )1 i

s Rts MNS I d

i g

Fsp d se r

c o)

St 2

_ fo oel >

Cu Rse l

2-RT E m eatS sa1 c _

dx a pb .

t NR EA N d n

ind(

f ne ip nn p e o E.T

- de n

ai n l

A TG EI TO i

F ic

_ f ead D eM otae da rkt e

cla(

ni S

hs&

h v et 2 e eef eR ot k n2 DITS f i

c

_ t cual r Cen

_ ie Lvp eEt e l

b a

. s n

EMR e _ a e t

p pm do _ Tt i c

r eP _ n S gd i

,E S _

mo t a _ ig(

nn ne L C TN _

I F t S

nti ea ir sC U e

) e g

N NR _

_ _ t i ei t et a 2

le

. a g

A EO _

Dn I nrEb ci ap a E n

C VC ico#T I

> rD&

FE _

_ f i p" 4 I

n gA p" 2 NG _

i S gU ep GN I I k i isyl n t S

ST _ _

)

sn g Rp ep

(

A _

_ ( i t a A T _ _ lod ri) n m2 I _ _

aF1 it N

I n y2 e

cbp E s

_ _ Sde t

_ _ eteS  ;

inc(

f a ep 1

_ _ Dm I n io

_ _ is

_ _ v

_ _ e

_ > R

_ _ T F

A R

D X

X 6

0

l Inspection findin '

barrier integrity)gs related will be to reictor cssissed sIfety cornerston;s (initiating events, mitigIting systems, atn differentl occupational exposure, public exposure, y thin and the remaining physical secunty). areasFor the(emergency planning, reactor safety cornerstones, excluding the EP area, each finding is evaluated using a risk-informed framework i that relates the finding to specific structures, systems, or components (SSCs), identifies the core damage scenarios to which the failure of the SSCs contribute, estimates how likely the initiating event for such scenarios might be, and finally determines what capability would remain to prevent core damage if the initiating events for the identified scenarios actually occurred. ,

1 Bases "

The approach described in this Appendix was developed using input derived from other agency documents, including the following:

  • The accident sequence precursor (ASP) screening rules as outlined in NUREG/CR-4674,

" Precursors to Potential Severe Core Damage Accidents."

In addition, Table 2 is based on generic equipment unavailability values that are generally I i consistent with values obtained from more detailed PRA models. I l Process Discussion The inspedion finding assessment process is a graduated approach that uses a three phase process to differentiate inspection findings on the basis of their actual or potential risk significance.

Findings that pass through a screening phase will proceed to be evaluated by the next phase.

Phase 1 - Definition and initial Screening of Findings: Precise characterization of the finding and an initial screening-out of low significance findings Phase 2 - Risk Significance Approximation and Basis: Initial approximation of the risk significance of the finding and development of the basis for this determination for those findings that pass through the Phase 1 screening Phase 3 - Risk Significance Finalization and Justification: As needed refinement of the risk significance of Phase 2 findings by an NRC risk analyst Phases 1 and 2 are intended to be accomplished primarily by field inspectors and their first line managers. Until a user becomes practiced in its use, it is expected that an NRC risk analyst may be needed to assist with some of the assumptions used for the Phase 2 assessment. However, af ter inspection personnel become more familiar with the process, involvement of a risk analyst is expected to become more limited. The Phase 3 review is only intended to confirm or modify the l results of significant (" white" or above) or controversial findings from the Phase 2 assessment. I Phase 3 analysis methods will utilize current PRA techniques and rely on the expertise of l knowledgeable risk analysts.

Phase 1 and Phase 2 worksheets, intended for inspector use to aid in their use of the SDP are I developed for each reactor plant. These work sheets will contain plant design specific information I to assist in the use of Table 2 of this appendix. These work-sheets should be used by the I inspectors, although it is expected that some simple screening may be done mentally. However, I for any issue where a Phase 2 analysis is conducted, the information necessary to reconstruct the l Phase 2 analysis must be documented in the inspection report so as to provide a clear basis for I the significance determination of the issue. I Step 1 - Definition and initial Screening of Findings Step 1.1 - Definition of the inspection Finding and Assumed Impact l It is crucial that inspection findings be well defined in order to consistently execute the logic required by this process. The process can be entered with inspection findings associated with I pertormance problems that involve one or more degraded conditions concurrently influencing any I mitigation equipment and/or initiating event frequency. The definition of the finding should be i i

Issue Date: 08/10/99 Al-3 Revision 1 DRAFT 06XX l

l

' bistd on the known existing facts and should NOT include hypothetical fitiluras such s.s the one i single failure cssumed for licensing basis design requirements.

I I When determining the risk associated solely with the licensee performance problem, it is not I necessary to include equipment that is out of service for routine maintenance or testing. The I impact of the likelihood of this equipment not being available for. mitigation purposes is generally 1 included in the licensee's baseline PRA equipment unavailability values. However, for the purpose l' of initial NRC response to events and degraded conditions, the SDP analysis should assume the i entire plant configuration, including out of service equipment for routine maintenance or testing .

.I This approach allows the NRC to validate that the other out-of service equipment was not a result I- of performance problems.

The statement of the finding should clearly identify the equipment potentially or actually impacted, as this will be used in the nsk characterization process. In some cases, the impact of the finding can be stated unambiguously in terms of the status of a piece of equipment, for example, whether it is operable or not, or whether it is available to perform its function or not. In other cases, the finding may specify conditions under which a piece of equipment becomes unavailable. In still other cases, those involving degraded conditions for example, the impact is not determined, and assumptions will have to be made for the purposes of assessing the risk significance.

Any explicitly stated assumptions regarding the effect of the finding on the safety functions should '

because the finalresultwill initially always be be conservative viewed (i.e.,

from the context force of those a potentially assumptions. higher Subsequent risk significance)information the licensee or other sources is expected, in many cases, to reduce the significance of the finding,

' with an appropriate explicit and defensible rationale. Findings must also be well defined because I the assumptions can be modified to examine their influence on the results and thereby gain I sensitivity insights. The general rule is that the definition of the finding must address its safety function impact and any assumptions regarding other plant conditions. Examples include the following:

s: a motor operated valve 1.The followirn pressurized situations 4 vater represent reactor (PWR two different finding (AFW) system auxiliary feedwater is found with(M hardened gearbox grease (i.e.,is degraded ; and an MOV in the AFW system is found with a broken wire that renders it non functional. the purposes of assessing the risk significance, the impact of both could be characterized conservatively as "MOV does not perform its safety function of opening to provide flow to the steam generators." In the first case, it is necessary to assume that the hardened grease.makes the valve unavailable, while in the second it is not.

2."AEquipment finding/ System involving / Component X would not perform its safety function of .... unde

... " For example, a remote shutdown panel that might be rendered inhabitable during a cable spreading room fire that causes a loss of offsite power due to inadequate heating, venti lation, and air conditionin conservatively as " an(HVAC) t cooldown notdispersion of the possible from resulting control room smoke, or remotewould be characterized shutdown panel during a loss of off te power from resulting smoke and loss (LOOP) of power caused to remote by cable shutdown panelspreading HVAC." room fire due to inhabitab Step 1.2 -Initial Screening of the inspection Finding For the sake of efficiency the initial screening is intended to screen out those findings that have minimal impact on risk ,early in this rocess. The screening guideline:, are linked to the cornerstones as follows: If there is neg gible impact on meeting the reactor Tafety comerstone I objectives, the finding can be identified a having minimalimpact on risk and should be considered  !

I as a green finding to be corrected under the licensee's corrective action procens.

The decision logic is described as follows:

If the finding'and its associated assumptions, as defined in Step 1.1, could simultaneously adversely affect two or more reactor safety cornerstones, then the user should proceed directly to I the Phase 2 analysis. Alternatively, the finding can be screened as green immediately (characterized as having little risk impact and exit this process) if it can be shown to NOT affect any reactor safety cornerstone. Finally, if the finding and its associated assumptions affect only

-l ; ONE reactor safety cornerstone, it may still be screened as green as follows:

06XX DRAFT Revision 1 Al-4 issue Date: 08/10/99

.lf only the mitigation systrms com:rstona is affected, thin the finding and its associated cssumptions would be considered green and a Phase 2 analysis would not be necessary if Eny of the following were true; the finding represents a design or qualification issue, but the licensee has declared the affected equipment or system operable under NRC Generic' Letter 91-18 guidance (and inspectors are not challenging the licensee's determination), OR the finding does -

NOT represent function of a single trainaofloss a multiof safety train system function of the for LESS THAN a system, ORtimo allowed outage the(AOfinding

/ repr prescribed by the limiting condition for operation OR the finding has not resulted in the failure of(LCO) for Technical Specification equipment, a non-Tech Spec controlled risk-significant  !

system, structure or component under the maintenanca rule (10 CFR 50.65) for greater than 24 I hours. ,

l ,

11 only the initiating event cornerstone is affected and the finding and associated assumptions have no other impact than increasing the likelihood of an uncomplicated reactor trip, the finding would be considered a green finding. I If only the fuel barrier is affected, the issue will be screened out since a Pl exists for this barrier.

I If any reactor coolant system affected, the issue will be assess ed in (RCS) Phase 2. barrier function to mitigate an accident seque If the containment barrieris affected, the concem is referred to a risk analyst until more guidance can be provided. However, if the concern is associated with containment cooling function {

needed to preserve the NPSH capability of the ECCS equipment during the recirculation phase, { l its impact should also be evaluated as part of mitigation system cornerstone above. 1 Any inspection finding that is NOT screened as green by the above mentioned decision logic I k

'should be assessed using the Phase 2 process described herein.

1 The SDP can he! to better understand the sentitivity of various assumptions regarding plant i I capability to the ckange in plant risk. For example if an inspection finding screens l asI Phase 1, it may oe useful to use the SDP phase 2 process to examine the effect of other plant I }

equipment being unavailable or degraded simultaneously with that of the finding, if the outcome i  !

of the SDP can be significantly influenced by the unavailability of other equipment (e.g. if a  !

"warranted combined" finding to verify could be the assumption thatcharacterized as avai this equipment was white or greater)lable., then inspection I l

e l

Phase 2 - Risk Significance Approximation and Basis Step 2.1 - Define or Select the Applicable Scenarios i Once an inspection finding passes into Phase 2, it is evaluated in a more detailed manner. The first step in Phase 2 is to ask the question "Under what core damage accident scenarios would the finding, as defined in Step 1.1, increase riskT That is, the inspector must determine which core I damage scenarios are adversely impacted by the finding.

Determining which scenarios make an inspection finding risk important may not always be intuitive.

Therefore, high level (f unctional) plant specific scenanos taken from PRAs have been provided as I a set of Phase 2 worksheets for each plant design. Additionally, documents such as current plant- l specific PRA insights, safety analysis reports, Tech Spec bases, and emergency operating procedures should be reviewed as needed to ensure that all applicable events and circumstances I are considered. Identifying the scenarios begins with identifying the equipment and the assumed or actualimpact of the finding, and takes into consideration the role the equipment plays in either the continued operation of the plant or the response to an initiating event. This step leads to an

!dentification of the role of the finding in either contributing. to an initiating event or affecting a mitigating system, or both. For the mitigating systems, the impact may be one of two kinds: the finding results in the equipment functior, being compromised or the finding relates to the identification of a condition under which the function would become compromised.

In the first of these two cases, the function can be assumed to be lost, and the scenario of interest is the initiating event for which the equipment is required and the remaining equipment that by design can provide the same function as that which has been lost. For the second case, the scenario definition must also include the condition under which the function would become compromised. For example, if the finding is that while performing the switchover to recirculation in a PWR, the safety injection (SI) pumps could be irreparably damaged due to cavitation, the Issue Date: 08A0/99 Al-5 Revision 1 DRAFT 06XX

sesn:rio d;finition includes ths loss of coolant tecidInt charging system (if it is a viable alternative meansviding of pro (LOCA) sump initiatingand recirculation), event, the failure of the also the human error (which represents the condition under which the pumps would fail). If the finding were that the SI pumps could never be aligned properly for some reason (this extreme case is an example to demonstrate a charging system failures. point only), the scenario definition would involve only the LOCA and t During this phase of the process, inspectors may determine that several different scenarios are affected by a particular inspection finding. This determination can occur in one of two ways:

First, the finding may be related to an increase in the likelihood of an initiating event, which may require consideration of several scenarios resulting from this initiating event.

Second, a finding may be related to a system required to respond to several initiating events.

For example, the discovery of a degraded instrument air system could affect plant response to both a loss of offsite power and a LOCA. Each of these two initiating events must be considered separately l' The scenarios resulting in the hi hest significance will be used to establish the initial relative risk-

' significance of the finding. If a ase 2 assessment of multiple applicable scenarios results in all

" green" significance, the user should seek assistance of a risk analyst, since the Phase 2 process

'cannot effectively sum" the significance of multiple low-significance scenarios.

In identifying possible core damage accident scenarios, consideration must also be given to the role of support systems as well as the primary system. For example,if a particular initiating event can be mitigated by more than one system providing the same safety function, but all such systems are dependent on a single train of a support system the limiting scenario mayinvolve the failure oflethe sing train (e.g.,

of the service support system water ratheror emergency than the ac pow 1 individual primary system trains. Therefore, for findings involving support system functional 1 degradation, each scenario given on the Phase 2 worksheet must be examined for the impact of I this degradation on the primary system functions and the user may need to create a new scenario I by collapsing multiple primary system functions into a single associated support system failure.

- Step 2.2 - Estimation of the Likelihood of Scenario !nitiating Events and Conditions In Ste 2.1, sets of core damage accident scenarios were determined that could be made more likely the identified inspection finding degraded condition identif tion of one or more initiating even(ts, each followed by). This step various sequences should of equipment result in the i failures or operator errors. To determine the most significant scenarios, perform the following analysis for gagh set of scenarios with a common initiating event.

If the finding does not relate to an increased likelihood of an initiating event, the initiating events for which the affected SSC(s) are required are allocated to a frequency range in accordance with guidance provided in the left hand column of Table 1 herein. Table 1 is entered from the left l column, using the initiating event frequency, and from the bottom, using the estimated time that i the degraded condition existed, to arrive at a likelihood rating (A - H) for the combination of the initiating event and the duration of the degraded condition.

If the finding relates to an increased likelihood of a specific initiating event, the likelihood of that initiating event is increased according to the significance of the degradation. For example, if the inspection finding is that loose parts are found inside a steam generator, then the frequency of a SGTR for that steam category,generator and Table 1tube rupture (d acco)rdingly. plant may increase to the next higher freque is entere

.When the scenario includes the identification of a condition under which a function, a system, or  !

a train becomes unavailable, then this fact must be factored into the assessment. It is not  !

appropriate to assume that the affected function, system, or train is unavailable. At this point, it is necessary that a risk analyst assess the probability of the condition and adjust the likelihood of the initiating event (or events) by the appropriate amount. For examp,le:

- A finding is that if a control valve in the instrument air system fails it could lead to overpressure of a low pressure part of the system, thereby leading to the failure of the equipment controlled by the air system. The probability of interest is that of the failure of the valve during the mission time, which depends on the impact of the failure. For example,if the valve failure would lead to a reactor trip in addition to failing some mitigating equipment, the mission time is 1 year, and the 06XX DRAFT Revision 1 Al-6 lasue Date: 08/10/99

1 initiatin cvint fr;qu:ncywould be the prob;bility of failura of the v lve in on3 year. If the impact is simp on tho mitigating systems for o LOCA, the mission time is that time r: quired to place the pla in a safe, stable state. In this case, the LOCA frequency would be adjusted by the probability that the valve failure would occur during the mission time. l Finally, the definition of the finding and the selection of core damage accident scenarios should be l strictly based on the known existing facts and should NOT include hypothetical f ailures, such as i the one single failure assumed for licensing basis design requirements. However, the selection l l of scenarios need NOT be restricted only to those described in the SDP worksheets and tables. I :

The SDP provides a simplified risk framework to examine all possible scenarios based on plant- I specific design, inspectors should recognize that reasonable probabilities must be assigned to I each failure event in any scenario they may postulate. I I

l l

1 1

i 1

l 1

1 l

I I

(

)

1 il t

Issue Date: 08/10/99 Al-7 Revision 1 DRAFT 06XX t-

Table 1 - EstimatId Liksilhord Rating f:r Initiating Ev:nt Occurrinco During Decrad:d Psriod (takin from NUREG/CR 5499)

Row Approx. Freq. Example Event Type Estimated Likelihood Rating

>1 per 1 - 10 yr Reactor Trip A B C l Loss of Power Conv. Sys. l (loss of condensor, l closure of MSIVs, loss of feedwater) 1 per 10 - 102 yr Loss of Offsite Power B C D Small LOCA (BWR) ll MSL(Stuck open SRV only)

B (outside entmt) 1 per 108 - 108 yr SGTR C D E Stuck open PORV (PWR)

Small LOCA (PWR) lli (RCP seat failures and stuck open SVs only)

MFLB MSLB (inside PWR entmt) 1 per 10 - 10' yr Small LOCA (pipe breaks D E F IV ATWS PWR (elect only) )

1 per 104 - 105 yr Med LOCA E F G V Large LOCA ATWS BWR (BWR)

<1 per 105 yr Large LOCA PWR F G H VI ATWS PWR((mech)only) ,

ISLOCA Vessel Rupture

> 30 days 30 3 days <3 days Exposure Time for Degraded Condition Table 1 - Estimated Likelihood for initiating Event Occurrence During Degraded Period Use of Table 1 should result in one or more initiating events of interest with an associated likelihood  :

rating ("A" through "H") for each.

l Step 2.3 - Estimation of remaining mitigation capability The scenarios of Interest have now been identified, and Table 1 has been used to estimate associated initiating event frequencies and to combine them with degraded condition exposure time l to arrive at an estimate of the likelihood of the initiating events. Following an initiating event, core damage will result from a series of system, component, or operator failures. In this step, the user will approximate the probability of faiIing to mitigate the core damage scenarios associated with the ,

condition identified by the finding. Findings defined in Phase 1 will generally identify the p I for degrading a particular function. Therefore, the probability of preventing the scenan,otential os that I include this degraded function will depend on the extent of remaining mitigation capability for providing the function.

I To count remaining mitigation capability in a probabilistically consistent manner, systems are considered to be either single train or redundant. A redundant system is a system that has more than one identical train, where the loss of one train does not lead to a loss of function. However, I all trains of a redundant system are subject to a possible common cause failure. Successful 06XX DRAFT Revision 1 Al-8 issue Date: 08/10/99

r;.. - -

mitig: tion may be provided by cich trcin of divzrse singl2-train systems.( , high-pressure i

. I action in a boiling water reactor (BWR) for a loss of feedwater transient m e provided b

.h h. pressure coolant injection (HPCI) and reactor core isolation coolant ( IC systems,ytheboth si gle train systems), or by diverse redundant systems (e.g., low pressure in)jection may be provided by the low-pressure core spray (LPCS systems), or by mixtures of single tra,m and red) and the LPCI cases systems thereinmay a BWR-4, be time both multi tr undant systems. In some to recover the function or train that has been lost, which can be credited as a success path under certain conditions.

! In counting the number of remainin de i

2, Risk gradation Significance assumed by Estimation Matrix," the the user findi_ng, must for each g available select the most a affected scenario.ppropriate success Each columncolumn in Table paths for of2Table l represents about one order of magnitude difference from adjacent columns in the failure probability ,

l of remaining miti ation capability, and the descriptions in the column headings are intended as non- 1 inclusive exam es cl mitigation methods that can typically be assumed. Refer to the site or I j design specific nformation that has been provided in the Phase 2 worksheets for basic information I i on the number of trains and redundant systems. Table 3 of this procedure also provides guidance i J

! on how to apply mitigatio.n credit. in addition, the following rules and guidelines apply: I

  • Only equipment that the licensee has sco ed into the maintenance rule (10 CFR 50.65) may be credited for remaining mitigation capabil . This provides a minimum level of assurance that credited equipment meets pre establishe reliability goals or performance criteria.
  • The potential for common cause failure of the remaining mitigation capability is accounted for I in the column definitions of Table 2. Therefore, any actual evidence of a common-cause failure must be included in the definition of the inspection finding.

l

  • Credit for recovery may be taken if there is a possibility of restoration of the SSC or a function
that has been assumed to be lost due to the condition identified by the finding. Recovery actions should be credited only if there is sufficient time available, environmental conditions allow access, they are covered by operator training and written procedures, and necessary equipment

~ is available or appropriately staged and ready. For recovery actions that are relatively complex, and/or require actions outside the control room, it is particularly important that the actions required are feasible within the time available to prevent core damage. If there is no remaining mitigation capability other than restoring the f ailed equipment, and the above conditions are met, I then use of the " recovery of failed train" column on the Phase 2 worksheet will credit this I recover failure,such

y. For as example, consider a failed automatic anfeature.

start inspection finding If status involving indication existsaand potentially recoverable system simple operator action would be able to start the equipment within sufficient time to provide the system function, then credit can be given to recovery. If other equipment is also available as remaining I mitigation capability, then operator actions may be assumed for that equipment. I  ;

  • Caution has to be exercised when taking credit for systems that are dependent on manual actuation (such as standby liquid control (SLC)in BWRs). If the time to initiate the system is short and performed under stressful conditions, then credit is allowed per Table 3 for " operator I action under high stress". When there is ample time, as in the initiation of suppression pool cooling in BWRs, the human error probability is low enough that credit per Table 3 for " operator I action is appropriate. I When all scenarios have been identified and the associated initiating event likelihoods and l I

remaining mitigation capability estimated, the Table 2 matrix described in the next section can be used to estimate the potential significance of the degraded condition, within the context of.all

, assumptions made to this point.

Step 2.4 - Estimating the Risk Significance of Inspection Findings l The last step of the Phase 2 assessment process is to estimate the relative risk significance of the i finding. The risk is estimated by employing an evaluation matrix Table 2 herein , which utilizes the information gained from Steps 2.1 through 2.3. This matrix co(mbines the sce)nario likeliho derived in Step 2.2 with the remaining mitigation capability determined in Step 2.3 and establishes an estimated risk significance for the particular finding. One of only four possible results can be obtained: Green, White, Yellow, or Red. These results are comparable to those used for Pls. The user must complete this assessment process for,ttagt1 scenario affected by the inspection finding before determining the scenario of highest significance.

' Issue Date: 08/10/99 A19 Revision 1 DRAFT 06XX

j lJ j{ j tl l 1l,J e d w e n n n e d e

d d lo it e e 0 o n R R R e

R e

le h e r e r

Y W G G d

e nss ~

l ia ir t

oe f

f cs a

t e n n n on R r h d d d w o t e e e e

i 1 ya r r O oig e e ih e e e et tha R R R lle r r r v rr ee Y W G G G o

c pd e Onu R

)

s e

l p n ns +d )

o osl e 9 m i iei a 9 a

t c t ctrf / 9 x n a asf o ,n w e n n n n 0 9 E ia R r R rhgyae d e

d o it e e e e 1 /

2 t r

O to O oait r R R e l le h e r e r e r e r

/

S 0

h 1 a rhet r

Y W G G G G 1

/

i t r ep er v pe o v

e r

8 0

w O Odc (

( ner x

e g u t n

i r a i

t d t

a D a le

+d nle M e R i a n oia u y +ff ia tf i

n s t

i non R t rme R aoin cf d w o it e n e

n e

n e

n e

n e i o i s

l 3 ia i i rya e e rr r ya O t

i ltt u ys O or r R B

e h e r r e r e r e a b t et t Y W G G r

a 1 v ms ta e rv G G G m p o 1 eo i 0 a c pc t s 1 e Ore -

C r E l n e A o md c i

t s ele n a

g n ti sa a

i ia yf i c

r sf f t t o w e n n n n n n i i

M 4 e s R n n yi R

o t i e e

e e

e e

e e

e e n g

r O iara ret r e h r r r r e e g e t

- v Y W G G G G r i n iv i lt o G'. G S i

n d u ec k i 2 mr s a 1 + i R

m -

e '

2 R in e+oi f

n e

+ra m s ya e n n n n n n l

b ne t r r e e n ittsROe sret e e e e e a it 5 ial ruy ivivd n h e r e r e r

e r e r

e e T t daoe W G G G G G r r 1 ms 2 earf trci l G G 1

n n f e

s rs ias t

r m

+ r i

a+on yari n n n n n n n n en R -

nti mr e e e e e e e 6 vi ia drt O ius lt my O eR t

ial r

t e et utsoe vd e r

G e

r G

e r

G e

r G

e r

G e

r e r

e e

r 1

n 3 s t

m yci l G G G o 2

1 1

sea rf i

s i

v e

R g od T ntn o F A

i aei h t

ivl A B C D E F G H R iEe t

D I

n k i X

L X 6

0

!ll l

Type of Remaining Cenability Remaining Capability Rating l Operator Action Under High Stress 1 l l

Definition: Operator action assumed to have about a 1E-1 I probability of failing when credited as " remaining mitigation I capability".

I Recovery of Failed Train 1 1 I

Definition: Operator action to recover failed equipment that is I capable of being recovered after an initiating event occurs that I requires the equipment (e.g., equipment was unavailable due I to a switch misalignment). Action may take place eitherin the I control room or outside the control room and is assumed to I have about a 1E-1 probability of failing when credited as i

" remaining mitigation capability". I Operator Action 2 l l

Definition: Operator action that can occur with sufficient time to I have about a 1E 2 probability of failing when credited as l

  • remaining mitigation capability". .

I 1 Train (diverse as compared to other trains) 2 l l

Definition: A collection of associated equipment (e.g., I valves, breakers, etc.) that together can provide 100% of apumps, I specified safety function and for which the probability of being i unavailable due to failure, test, or maintenance is assumed to I be about 1E 2 when credited as " remaining mitigation I capability". Two or more trains are diverse if they are not I considered to be susceptible to common cause failure modes. I 1 Multi Train System 3 I I

Definition: A system comprised of two or more trains (as I cause failure m) odes. Such a system is assumed to havedefined above that areI consid I about a 1E-3 probability of being unavailable, regardless of I how many trains compnse the s l

" remaining mitigation capability"ystem, when credited as I

2 (diverse) Trains (adding example] 4 (= 2 + 2) l I

(2 diverse trains are assumed to have a combined 1E-4 -

1 probability of being unavailable) I 1 Train + Recovery of Failed Train [ adding example] 3 (=2 + 1) l I

(1 train plus recovery of failed train is assumed to have a l combined 1E 3 probability of being unavailable or failed) i I

Table 3 - Remaining Capability Rating Values I Issue Date: 08/10/99 A1 11 Revision 1 DRAFT 06XX

~

St:p 2.5 - Documenting tha R:sults The results of the Phase 2 risk estimation will be communicated to the licensee through the inspection report process. It is expected that risk-significant or controversial findings will require obtaining licensee risk perspectives and will most likely prompt a Phase 3 review. If the inspectors, and appropriate regional and Headquarters staff (when necessary agree with the results of the Phase 2 assessment, the final results will be documented in an inspe),cton report and no further revie needed. The extent of documentation should include allinformation needed to reconstruct the Phase 2 analysis. Although licensee perspectives will be considered, the NRC staff wiH retain the final responsibility for determining the risk significance of a finding and will provide its jusdfication in an inspection report or other appropriate document. When licensee assumptions or perspectives differ from those of the staff, the staff should explicitly justify the basis for its determination.

Phase 3 - Risk Significance Finalization and Justification If determined necessary, this phase is intended to refine or modify the earlier screaning results from Phases 1 and 2. Phase 3 analysis will utilize current PRA techniques and rely on the expertise of knowledgeable risk analysts. The Phase 3 assessment is not described herein.

l 1

1 06XX DRAFT Revision 1 Al-12 issue Date: 08/10/99

I Appendix 2 Significance Determination of Inspection Findings in the Emergency Preparedness, Radiation Safety, and Safeguards Area This appendix and its attachments represent the concepts for evaluating inspection findings in the emergency preparedness, radiation safety, and safeguards areas. Thresholds were selected on a significance scale similar to those established for the plant performance indicators that industry plans to submit. )

j l

I Issue Date: 08/10/99 A2-1 Revision 1 DRAFT 06XX

I.

Attachment 1 EMERGENCY PREPAREDNESS SIGNIFICANCE DETERMINATION PROCESS able of implementing adequate The objective protective measuresof this comerstone to protect public health andissafety to ensure that the licensee is cab.

in the even of a rad Licensee performance in the cornerstone is assessed by considering both the relationship of performance indicators {PI's) with regard to thresholds and inspection findings. The Significance i

to be combined with Pl(results. Determination Process SDP) dispositions individualinspection finding The SDP consists of flow chart logic to disposition inspection findings into one of the following categories: " licensee response band,"" increased reg"ulatory response band,"" required regulatory response band," or " unacceptable performance band.

During the development of Emerg,ency Preparedness (EP) PI's, the most risk significant areas were identified as distinct from other important program elements. These development efforts were from members of the public. The SDP performed by a group methodology recognizes of EP failures subject in the identifiedmatter risk signiexperts with input,ficant areas as mor findings in other program areas.

Emergency Preparedness regulations codify a set of emergency planning standards in 10 CFR 50.47(b) and Appendix E to Part 50. The more risk significant areas of EP align with a subset of the planning standards and requirements. The SDP logic uses failure to meet or implement planning standards and other regulatory requirements as criteria for decisions. Failure to meet or implement the more risk significant planning standards results in greater significance (e.g., a white finding as opposed to a green finding.)

The logic of the SDP intentionally parallels NUREG 1600, " General Statement of Policy and Procedures for NRC Enforcement Actions." The GREEN, WHITE, YELLOW and RED results generally align with current Severity Levels IV,111, il and I respectively. However, there are some differences that were generated as a result of subject matter expert efforts to identify the most risk significant areas of EP. The SDP does not sum unrelated findings to escalate the resultant response band disposition. However, a program failure may be indicated by contemporaneous failure to meet multiple planning standards. The SDP logic recognizes this unlikely, but significant, deterioration of an EP program and responds with findings of increased significance, including the potential for a set of concurrent findings being assessed as " unacceptable performance."

A finding that is assessed as a GREEN indication does not mean that the performance associated with the finding is good or even acceptable. It may represent non conformance or a violation.

However, the safety significance of the finding is not great enough to warrant further NRC intervention. It is considered to be within the " licensee response band. Licensees are still required to return to compliance with the regulation and their commitments. However, the licensees are given the latitude to self correct these findings.

l 06XX DRAFT Revision 1 A2-2 issue Date: 08/10/99

Guidance

1. Exercise performance is measured by the Drill / Exercise Performance and ERO DrillParticipation performance indicators. Exercise weakness and deficiencies are expected to be identified and resolved by the licensee in accordance with 10 CFR 50.47 The inspection program is designed to verify that this expectation is met. However, poor (b)14. performance itse l
2. A Finding is an observation of an emergency preparedness program element that has been placed in context and assessed for s#gnificance.
3. Failure to implement a planning standard means that it was not implemented during an emergency event, but that the program itself continues to meet the planning standard e. g., a personal error j during an event.
4. Failure to meet a planning standard means that the program in not in compliance with the planning standards of 50.47(b)f Plan. The measure o program compliance are the criteria of NUREG 0654, as articulate approved Emergency Plan.
5. A regulatory requirement is any requirement of 10 CFR or the Emergency Plan. i
6. A violation of requirements may also involve a failure of the PIDR. This should be analyzed through the significance determination process for.both the violation and the PIDR failure. The more significant determination should be the overall determination.
7. Failures of the PIDR program that result in green, white or yellow findings should also be provided to the inspection team responsible for the conduct of Inspection Procedure No. 71152 /dentification and Resolution of Problems.

4 I

Issue Date: 08/10/99 A2 3 Revision 1 DRAFT 06XX i

4 NRO Sbnificarce Deterrrination Process for Emergency Preparedness inspecten Fhdngs . Sheet i draft 3 April 19,1999 Sinding identified I 1 r Monndoner YES

,gi*f& > ToViolaton SMd2 9

NO 1

9 r

$5,# # ToPIDR Prodem Shed 4 NO ir 1

cI*,C.E l

RSPS = The Risk Shnificant Planning Standards: so.47 (b) 5,4, 9 & 1o and Apperdk E sectbn N B, C, D(1) & D(3)

PS = The Pla nnirg Standards of 50.47 (b) and the requirements d Appendk E POR = Problemidentifcati:n and Resolutien Sysum T'mely Resolutbn d failure to meet = RSPS,so Day; PS, t20 Day; other Regutstory Requirement,240 Day Trnely Resolutbn d fallute to implement- RSPS, immediate (14 Dey); PS, so Day; cther Regulatery Requirement, t20 Day 06XX DRAFT Revision 1 A2-4 issue Date: 08/10/99

. - 1 NRC Significanoe Det:rminction Process for Ernsrgency Preparedness inspection Findings She;t 2 draft 3 Apru 19,1999 Violation identified

)j 1 P Failure to NO implement or meet PS7 3 GREEN YES 1 P Failure to YES

'g*$'**$,P8 To PS Implementation Problem n)

Sheet 3 NO lI Failure to NO 5 or more NO (P ure) 'h 7 WHM YES YES 1 P 1 P 3 or more No failures to meet '

" YELLOW RSPS7 YES 1 r RED issue Date: 08/10/99 A2-5 Revision 1 DRAFT 06XX

( . ,

e NRC Sigorncance Determination Process for Emergency Preparedness inspection Findings sheet 3 draft 3 April 19,1999 l

l PS Implementation Problem (Actual Event) l 1 V NOUE YES ,

? - GREEN j I

1 NO 1 F ALERT YES Failure to YES ' i

?

Impement " WHITE l RSPS?

NO I *  ; GREEN 1 r SAE YES Fanure to YES

? nt  ? YELLOW j ImRPhe 1

NO l  ? WHITE NO 1 V l

l GEN YES , Failure to YES l EMERG - t  ; RED

  • PhY?

R l

( NO l  ? YELLOW 1

l l

06XX DRAFT Revision 1 A2-6 issue Date: 08/10/99 I

l

NRC Significate Determination Process ior Emergency Preparedness inspection Findings . Sheet 4 draft 3 April 19,1999 PIDR Problem

- 1P )

i j

1 P!DR FAILURE YES l DrWExercise To PIDR DrilVExercise r Evaueton

? Sheet 5 Inspection NO Oesewtion J L NO 1I o

Fa lure Failure to to resolve Feiture to or tosoive NO 13 PS NO ID other Prob,emt regulatoy ea (meet or req #remem og impwwnt) problem

?

YES YES YES q r 1r GREEN YES PS7 WHITE NO 1 r Other YES reputatoT reau,rememe GREEN NO a r inspecion Oceervation l

Issue Date: 08/10/99 A2-7 Revision 1 DRAFT 06XX

NRC Significance Determination Process for Emergency Preparedness inspection Findings Sheet 5 draft 3 April 19,1999 PIDR Drill / Exercise Evaluation Problem 1 P

'oYs" Implementabon YES f$"dSp's YES gat .

YES E10W s, "mplementation to ID Problem Problem  ?

7  ?

NO r NO 1 P Repeat YES Failfe l

? WHITE 7

NO NO 1 P GREEN lf i

Failure to e-~.e

'?es?s,,n

%,e,nenteg O e~.i.on prootem

?

YES 1 r GREEN 06XX DRAFT Revision 1 A2-8 Issue Date: 08/10/99

Attachment 2 OCCUPATIONAL RADIATION SAFETY SIGNIFICANCE DETERMINATION PROCESS The objective of this corner stone is to ensure worker health and safety from exposure to radiation from licensed or un licensed radioactive materials during routine operations of civilian nuclear reactors. The health and safety of workers is assured by maintaining their doses within the limits in 10CFR20 and ALARA.

Licensee performance in the cornerstone is assessed by considering the Pl indication in combination with inspection findings. A baseline inspection is maintained to verify the accuracy and completeness of the Pi data (i.e., work control in radiologically significant areas), supplement the PI data in areas where the Pl alone is not sufficient to measure performance inspection findings of performance fo(i.e.,

r areas not problem identification covered by and resolution),

the Pi (i.e., ALARA planning andand complement controls, radiation the Pls monitoring instrumentation, and personnel dosimetry).

The Sigr ticance Determination Process (SDP) is the mechanism in which the significance of individual events (follow up of an operational occurrence, substantiated allegation, or other inspection finding) can be normalized and combined with the PI results to arrive at an overall cornerstone perforrnance assessment. Logic flow charts are provided to outline the process. A finding that gets through the process without tripping a decision J

" gate" ends up as a GREEN indication. This does not meanance th perform (flow chart)is indiv) thatenthe or even acceptable, it still may be a non-conformance or a violation. It does mean that the safety sign,ficance i of the event is not large enough to warrant further NRC intervention. Licensees are still required to come into i compliance with the regulation and their commitments. However, the licensees are given the latitude to self j correct these non-conformances. -

The decision gates in the SDP intentionally parallel the Enforcement Policy Supplement examples to facilitate use of the SDP in evaluating the significance of inspection findings that are also subject to the enforcement process.

Although not a fast rule, the GREEN, WHITE, YELLOW and RED results generally align with current Severity definitions )to allow the SDP to be used to determine those single events that, although (and will be counted as a PI), they require separate reporting by Part 20 and may be a significant enough risk to worker health and safety to deserve their own " colored" assessment input.

ALARA Findinas Section 1101.(b) of 10 CFR Part 20 states that licensees shall use, to the extent practical, procedures and engineering controls based upon sound radiation protection principles to achieve occupational doses that are as low as is reasonably achievable (ALARA).

An ALARA finding is a finding whereby the licensee has failed to properly implement procedures and engineering controls based on sound radiation protection principles to ensure that doses associated with plant operations and maintenance are maintained ALARA.

Section 1101 of 10 CFR Part 20 requires that each licensee develop, document, and implement a radiation protection program that includes provisions for keeping occupational radiation doses ALARA. As contained in the Statements of Consideration in the May 21,1991 Federal Register concerning the revision to 10 CFR Part 20, the Commission continues to emphasize the importance of the ALARA concept to an adequate radiation protection pro 0 ram. A licensee's compliance with this requirement will be judged on whether the licensee has incorporated measures to track and, if necessary, to reduce exposures and not whether exposures and doses represent an absolute minimum or whether the licensee has used all possible methods to reduce exposures.

The metric chosen for the ALARA portion of the SDP for evaluating the significance of an ALARA finding is a plant's three year average collective dose consideration of doses to individuals and individual dose limits are treated in the Exposure Control portions of(the SDP). Plants with effective ALARA programs overall collective doses than those which have poor or inadequate ALARA programs. On average the industries current ALARA performance is considered very good. Total collective dose appears to be reaching an equilibrium minimum value in the last few years. Therefore, current the median value of the three year everage (MTYA) collective dose and the third quartile values are established as a decision gate standards. Due to the different challenges for BWRs and PWRs, different MTYA and third quartile values are established for these reactor types.

Issue Date: 08/10/99 A2 9 Revision 1 DRAFT 06XX

Another metric which is used to evaluated ALARA findings is the accuracy of a licensee's dose goals established for work packages. A Job dose which excends the dose goal by 50% or more is indicative of poor pre job planning and one proceeds to the next gate. If the actualjob dose falfs within the pre-job dose estimate or exceeds it by less than 50%, then the finding is GREEN The next two gates evaluate the significance of the ALARA finding once the magnitude of the actualjob dose has exceeded the job dose estimate by 50% or more. Once the magnitude of an actualjob dose reaches 20% of the MTYA for the appropriate reactor type, then the significance of the ALARA finding goes from G-REEN to WHITE.

The occurrence of three or more job doses which are greater than 4% but less than 20% of MTYA (in a one cal:nder year period) will also give a WHITE finding.

The final gates in the ALARA flowchart use a plant's source term as a metric and evaluate whether the finding is a source control finding or not. If a plant is a known high sou.ce term plant, then the licensee should be sensitive to this issue. The licensee should place increased emphasis on ensuring that radiation fields in the work area are minimized. If a plant is a high source term high job dose resulted from inadequate pre plant and finding is determined to be a source term finding (i.e., the finding will be classified as being YELLOW. job planning to reduce the radiation fields in the work area), then the If the finding is not determined to be a source term finding, then the finding will be classified as being WHITE.

Similarly, if the plant is not a high source term plant, then more emphasis should be placed on work controls such as properjob planning, use of mockups, use of skilled workers, integration and coordination of jobs to minimized unnecessary setup and tear down of scaffolding and temporary shielding, etc. If a finding is identified (for a plant which is not a high source term plant)in which the high. job dose was a result of lack of attention to work controls (i.e., it is not a source control problem determined to be a source term finding),then the finding will be classified as being WHITE.then th Exoosure Control Findinas 1 Unintended Exposure is a failure of one or more radiation safety barriers that results in a significant unintended or unplanned dose. Raciation safety barriers include adequate radiation monitoring, physical controls, hazards analysis and surveys, instructions to workers controls. Since most of these are either requ(including RWPs, postings, Part 19 training, etc) a procedures, the failure to implement one or more of these is generally a violation. To be significant, the of the stochastic,10% of the non) stochastic,20% of the limits to minors and fetus, and 100% o limit from a Discrete Radioactive Particle).

Exposure in excess of 10 CFR 20 limits is a YELLOW indication. This is an area where SDP deviates from the Enforcement Policy (SL lil " equate" to WHITE findings). Based on the ICRP 66 total probability coefficient of 4E-4

/ rem, a 5 rem dose equates to a 2E 3 risk of death from cancer. Since preventing this risk is the objective of the Radiation Safety cornerstone, we have elevated its significants from that in the Enforcement Policy. The threshold for a RED finding is consistent with the SL I significance in the Enforcement Policy.

Breakdowns in the Radiation Protection Program, or unintended exposures, that do not exceed a dose limit can still be considered significant if they constitute a "SubstantialPotential for Overexposure." A substantial potential, consistent with the current Enforcement Manual (NUREG/BR 0195, subsection 8.4.1,is an occurrence in which a minor alteration of the circumstances would have resulted in a violation of Part 20 lim)its the altered circumstances did not occur. In the SDP the finding can also be a YELLOW or RED depending on the dose rates (risk of a serious outcome) associated with the failure. In a Very High Radiation Area of 500 rads /hr, it can take as little as 3 minutes for a worker to receive 25 rem. Note however that the Enforcement Process (and possible civil penalty will not engage unless the event had an " actual consequence"(in this case an actual overexposure . The Asse)ssment Process rather than the Enforcement Process will dete licentee and NRC actio)n for events that do not result in " actual consequences."

The last decision gate in the SDP is intended to sort out significant issues and findings related to plant equipment and facilities. The Assessment Program is a risk informed process, and radiation dose is the measure of health risk associated with licensee activities. Therefore, this gate focuses on those issues that could or does compromise the licensees ability to assess dose. Since this gate culls out WHITE findings (comparable to SL 111, it is intended that only significant, programmatic, failures of radiation monitoring and personnel dosimetry gate. i trip th)s Examples of findings intended to be addressed by this gate include; 1) the licensee's failure to use a NVLAP certified dosimeter processor,2) a generic and uncorrected failure of the DADS to respond to, or record, l are used as a basis)for establishing protective controls. An individual failure to survey 06XX DRAFT Revision 1 A2-10 issue Date: 08/10/99

consider:d cs o failura of a radiation safity barriIr cnd cvalu:ted for its potInti;l for unintindId dose or substantti potential far overexposure cs discuss:d cbov2.

1 i

i Issue Date: 08/10/99 A2-11 Revision 1 DRAFT 06XX

- ~

~

t i f

a r l N

D E E

R G

l O

N Y l T r E

M 9

9 E S 1

M

/

0 1

F E Y l

/

8 A  :

0 e

S O N

t D

a _

N e u

O I . h, r l i

s s

T 1 r m r 1

A R R H 00 r D E

A S E > S S R I

D  :

Y nN' Y E >

V5 N' E 1 , l 2 1

2 g A A O N

R l E

,C ,

W O

L O N M L L

A I M

l E

Y N i O

I T

u

~

g O N

1 A

i P

U C

1""

S E

r 1

7 '

S E

r 1

d/

a L

D t

n e

s' o

u S

E r

1 l

D E

R Y Y S Y l C  :

O M 1 n

io

.d

. ie A i

s v

f i R A

r e t

R

- n T L

e A S T d E F I

Y A

R D

X X

6 0

r illl

OCCUPATIONAL RADIATION SAFETY Draft AMRA finding i

I 1r b 3 yr.

Cd et e Olse

  • Joe No 2,, GREEN l mico gst ascn.ged ova,rres I

vu j y, 1r l l GREEN l Y :l GREEN l vn ir NI arcn. or *x

/',,, GREEN l >

l i

l Yn ir ves l

Ron No R 'V No Y7' nes" increYeo'*m n"e WHITE l ou 2 v.. = 4 i

1r l

ts Pia No

  • Thae No ngtroi sovrceie YEROWl Piant 9

N' 1, ve.

Ths No source conu -

WHITE }

N"f *X is defined as the rnedian value of the 3 year average collective dose for PWRs and BWRs for vu the years 199s 1997. Separate

" values of X exist for PWRs and for BWRs.

lYEaOWl Issue Date: 08/10/99 A2-13 Revision 1 DRAFT 06XX

PUBLIC RADIATION SAFETY SIGNIFICANCE DETERMINATION PROCESS Radioactive Effluent Release Program l This branch of the logic diagram focuses on the licensee's radioactive effluent release program.

It assesses the licensees ability to maintain radioactive effluents ALARA. These are the design dose objectives contained in Appendix l to 10 CFR Part 50. Radiation dose to a member of the public is the success enterion.

The regulatory basis for requiring radiological effluent monitoring programs is given in General Design Criterion 60," Control of releases of radioactive materials to the environment," of Appendix A," General Design Criteria for i Nuclear Power Plants,"to 10 CFR Part 50," Licensing of Production and Utilization Facilities." Criterion 60 requires a licensee to provide for a means to control the release of radioactive materials in gaseous and liquid effluents i during normal reactor operation, including anticipated operational occurrences. An additional requirement is in Section IV.B.1 of Appendix I to 10 CFR Part 50. This section requires a licensee to provide data on the quantities of radioactive material released in liquid and gaseous effluents to assure that such releasea are within the ALARA design objectives. This data, pursuant to 10 CFR 50.36a, is reported to the NRC annually.

SDP determination process: Is there an event or occurrence in the licensee's radiological effluent monitoring pro 0 ram that is contrary to NRC regulations or the licensee's Technical Specifications (TS), Offsite Dose Calculation Manual (ODCM), or procedures? If yes, the question is what is the dose impact (as calculated by the licensee) of the event? If there was no radiological release associated with the event (no dose impact to a member of the public) then there is m -imal " risk" and the SDP classifies it as GREEN. The licensee is responsible to resolve the finding. The NRC will periodically inspect the effectiveness of the licensee's corrective action program, if the event resulted in an effluent release of radioactive material that, based on the methodology in the licensee's ODCM, exceeded the dose values in Appendix i to 10 CFR Part 50 but is less than 0.1 rem, the SDP classifies the event as WHITE. In this case, the NRC will maintain some detail of oversight on the licensee's corrective actions. NOTE: The licensee has a Performance Indicator (PI) in this area that uses dose values equal to the quarterly dose values given in the TS or the ODCM. This SDP is not to be used to " double count" the Pl. If a situation results in which the dose exceeds Appendix l values because of multiple effluent releases which exceeded the PI threshold it should not automatically be assessed as a degraded cornerstone. The SDP is to be used to assess the significance of a finding on an action or event by the licensee which was contrary to NRC regulations, the licensee's TS, ODCM, or procedures.

If the event resulted in effluent release of radioactive material that, based on the methodology in the licensee's ODCM, exceeded the annual public dose limit in 10 CFR Part 20 of 0.1 rem but is less than 0.5 rem, the SDP cl2ssifies the event as YELLOW. .The NRC would be significant NRC oversight of the licensee's corrective actions.

If the event resulted in eff!aent release of radioactive material that, based on the methodology in the licensee's ODCM, exceeded 0.5 rem, the SDP classifies the. event as RED. The NRC has lost confidence in the licensee's cbility to control radioactive effluents. Significant NRC interaction with the licensee will result.

Example:

The licensee had an inoperable radiation monitor on the radioactive liquid effluent discharge line. Because the monitor was inoperable, the licensee was required to perform grab sample monitoring of the liquid discharge. The licensee failed to perform the sampling to verify that the liquid effluent was within the activity pr,ojected based on prior analysis of the hold-up tank. This is the finding. Looking at the SDP flowchart, the key decision to determine the significance of the finding is dose. Was the calculated dose from the release above orbelow the values in the i decision diamonds? The dose determines the significance color.

Radioactive Environmental Monitoring Program This branch of the logic diagram focuses on the licensee's ability to operate an effective radioactive environmental monitoring program.

The regulatory basis for requiring radiological environmental monitoring programs is given in General Design Critenon 64, " Monitoring Radioactivity Releases," of Appendix A, " General Design Cnteria for Nuclear Power Plants,"to 10 CFR Part 50," Licensing of Production and Utilization Facilities." Criterion 64 requires a licensee to 06XX DRAFT Revision 1 A2-14 issue D' ate: 08/10/99

provide for a means for monitoring the plant environs for radioactivity that may be released during normal operations, including enticipated operational occurrences, and from postulated eccidents. An additional requirement is in Section IV.B.3 of Appendix l to 10 CFR Part 50. This section requires that the monitoring program identify changes in the use of unrestricted areas (e.g., for agricultural purposes) to permit modifications in the monitoring program for evaluating doses to individuals from pn.ncipal pathways of exposure, ,

Radiological environmental monitoring is important both for normal operations, as well as in the event of an accident. During normal operations, environmental monitoring verifies the effectiveness of the plant systems used for controlling the release of radioactive effluents. It also is used to check that the levels of radioactive material in the environment do not exceed the projected values used to license the plant. For an accident, the program provides an additional means to estimate the dose to members of the public.

SDP determination process: Is there an event or occurrence in the licensee's radiological environmental monitoring program that is contrary to NRC regulations or the licensee's Technical Specifications (TS), Offsite Dose Calculation Manual (ODCM), or procedures? If yes, the question is; did it degrade the licensee's ability to assess the impact of its radiological effluents on the environment?

To answer the question with a yes means that the licensee's overall program is degraded. It does not mean that a few environmental samples over the course of a year were not taken, or improperly analyzed. A failure in one or two parts of the licensee's program is not sufficient to reach a " White" significance determination. A f ailure to evaluate a required pathway (i.e., no valid data to support an impact conclusion for that pathway) would result in a YES answer to the decision diamond. This is a high threshold to reach. Historically, inspection findings have documented that samples are missed, or a land use census was not performed, or the air samplers were broken for extended periods of time or they were not in the correct location. Overall, these findings have resulted in lost data, but not a complete failure to be able to assess the impact on the environment from that pathway. The j significance determination of such event would be Green.

I Example:

I The inspector observed the collection of air filters from an indicator air sampling station. The inspector discovered that over the previous 12 month period, one of the air sampler was found to be inoperable on 32 separate occasions. This meant that up to 32 weeks of air sample data was missing and/or suspect. Because the monitor was inoperable, the licensee is required to prepare and submit to the Commission, in the annual Radiological Environmental Operating Report, a description of the reasons for not conducting the program as required and the plans for preventing a recurrence. The licensee failed to prepare and submit the required report. This is the finding. Looking at the SDP flowchart, the key decision to determine the significance of the finding is whether or not the licensee was still able to assess the impact on the environment from radioactive gaseous effluents. In this case the licensee was able to correlate the valid air sample data with known gaseous effluent discharges. Also, the licensee had valid air sample data from the sectors on either side of the faulty air sampler. Therefore, the licensee had some valid data to use to assess the impact on the environment. Thus, for this case the significance determination is Green.

Example:

The inspector reviewed changes to the radiological environmental monitoring program put in place during the last year. The licensee, based on a review of historical data which showed that no radioactive material of plant origin was detected in any of the fish samples collected in the past 5 five years, eliminated the collection of fish in the river where the discharge canal empties. The inspector identified this as an improper change to the environmental monitorino program because the change reduced the pathway monitoring to below the minimum level acceptable to the NRC. Guidance for the environmental monitoring pr> gram is given in the Radiological Assessment Branch Technical Position on Environmental Monitoring, Revis,on i 1, November 1979. Regulatory Guide 4.1 provides a complete discussion of the program and changes to the program over time. The guidance in Regulatory Guide 4.1 allows the licensee to modify the program after 3 years of operational monitoring history if it can be demonstrated from the levels in environmental media or calculations (using measured effluents and appropriate dispersion and bioaccumulation factors) that the doses and concentrations associated with a particular pathway are sufficiently small, the number of media sampled in the pathway and the frequency of sampling may be reduced. For this case, the licensee reduced the number of samples and the frequency to zero. Thus, the pathway was not monitored. This action comprornised tia licensee's ability to assess environmentalimpact. The significance determination for this case is White.

Radioactive Material Control Program l

Issue Date: 08/10/99 A2-15 Revision 1 DRAFT 06XX

1 This branch of the logic diagram focuses on the licenste's radioactive material control program. It assesses the licensee's ability to prevent the inadvertsnt release of licensed radioactivs material to an unrestrictsd area.10 CFR Part 20 contains the requirements for the control and disposal of licensed radioactive material. At a licensee's facility, any equipment or material that came into contact with licensed radioactive material or that had the potential to be contaminated with radioactive material of plant origin and are to be removed from the facility must be surveyed for the presence of licensed radioactive material. This is because NRC regulations, with one l exception in 10 CFR 20.2005, provide no minimum level of licensed radioactive material that can be disposed of l In a manner other than as radioactive waste or transferred to a licensed recipient. I SDP determination process: Is there an event or occurrence in the licensee's radiological material control program that is contrary to NRC regulations? If yes, the question is what is the dose impact (as calculated by the licensee of the event? If the dose impact was not more than 0.005 mrem and there were not more than 5 of these events in) the inspection period, then the SDP classification is Green. If the dose impact was 1 mrem or there were more than 5 events that were not above 0.005 mrem in the inspection penod (may signify a i rogrammatic breakdown , then the SDP classification is White. If the dose impact is greater than 0.1 mrem l xceeds 10 CFR Part 20 ublic dose limit), the SDP classification is Yellow. If the dose impact was greater than i

.5 rem, the SDP classifi tion is Red.-

Historically, these events have had calculated doses well below 0.001 mrem, thus, in most cases a Green significance determination is likely. However, if there were more than 5 events in the assessment period where l licensed radioactive material was released, this may indicate a breakdown of the program.

Example:

The inspector reviewed survey records of material released from the restricted area of the plant. The records indicated that materials with no detectable licensed radioactive material were released for unrestricted use. During the inspection the licensee receives a call from another nuclear power plant that had received painting equipment that was " free released" from the licensee. The radiation survey performed at that plant of the incoming painting l equipment documented the presence of licensed radioactive material. The painting equipment was shipped I directly from one plant to the other. The plant that received the contaminated painting equipment planned to return it to the first licensee (as a radioactive material shipment). The finding is that the licensee did not perform an adequate survey to prevent the inadvertent release of licensed radioactive materialinto an unrestricted area.

To determine the significance requires a determination of the dose consequence to an individual from handling or being near the contaminated equipment. The licensee is responsible to evaluate the potential radiological <

hazard from the equipment. The significance determination will be based on the calculated dose for the event.

1 06XX DRAFT Revision 1 A2-16 issue Date: 08/10/99

l l N

t E E f E H a

r l R

G l

W D .

O _

N _

u[

S e s

E s a

%Y hT Y

T E C X F l N

l E

l W 6 X

A O E

E R

T I

H O

L L

0 T

S N G l

W l

E Y

F A

R

: D N O O 1 O

I N

N i

n o

s T e S

E S

E S

E l i v

A I

s e

e t.

A p

p Y

1 m

e r

Y 5

m e

Y D

E R

e D n > o 0

R 7

A l 1 2

A R

C I

l O S N s L E E

N t

n e

E Y

B R G

E 5

v N

U l >

P O e

N l

l E W T

I O H L L

O W E

N l pY,
0 O

N I

9 S n S S S 9 E o O E E l /

9 m E 0 a Y N Y m m

  • g, e e Y Y t

e D 1

  • o r r r /
  • M" p s

n ar ,

1 o

5 o

l E

R 8

0 T

I t e

a D

e u

s I

s L.

7 , ~;

=~ l ,

s

=

'I i[,',0 '

I ll ,t ,

'l l il.:

, , , 11 $

, ;. . .a -

l 1

'i 3

? N O

u> l I

e , , . e

({ji ' ill ' i I(j 1 J J s e n

'i d'i '

31; ' I!:' ' = ;

i 111'> ,

e ', > l'i ' ,.i '>

(in ' . . _

Il s

,f

, 1 i i

g p

g 1 . , ,

! ' el

' j'

.1

{O l $ y s

@r l

l o' n ',

g 4 Radiation Limits Finding Thans rtation Pads 1 YES R i on NO y

Exceeded?

YES External NO Surface Radiation Levels

> Contamination Levels?

I I YES I f YES dm > dm *

)g YES g YES Elm * #

Em YES y YES n s Nted Area " >

ORed ntaminst Yellow YES Red Issue Date: 08/10/99 A2-19 Revision 1 DRAFT 06XX

Package Breach Breach of y NO Package During Transit V YES i

NO > pe 11 1

l Any Loss of

, NO Any Loss of YES YES> Package NO > Yallow Green ,

Package Contents Contents )y Cause 3(YES ublic TEDE

, NO >25 mrem or White '

Occupation TED Red

>5 rem YES

>100 mrom NO or >( Yellow

>25 rem ,

YES r

Red 06XX DRAFT Revision 1 A2-20 issue Date: 08/10/99

. 1 I

Certificate of Low Level Compliance Burial Ground Low Level m COC NO - Burial Ground NO m

^

Finding "

(LLBG) Access Problem II YES II YES Design YES LLBG NO Part 61 NO Documentation Green Access Waste Under- Green De6ciency Denise Classification NO 1I l' Yellow White Cask YES Licensee banned by Low 4.evel Burial Design Green ground authority for extended time period Denciency (e.g., repeated nonarnpliances) 1rNO Minor YES Contents Green Deficiency 1rNO I NO Con,ents wn.

Deficiency 1 RYES Yellow Issue Date: 08/10/99 A2-21 Revision 1 DRAFT 06XX

1 Notification & Emergency Information i

Failure to Make m Notifications NO m

^

or Provide " O*U Eaik rci YES NO NO No NO N1 N2 N3 N4 Green YES YES y YES p YES White White White White N1 - Failure to comply with 10 CFR 71.97. Made a shipment w/o notifying state govemor prior to shipment entering state N2. Fallure to provide emergency response info required by 49CFR172.602 N3- Failure to respond during actual request IAW 49 CFR 172.604 N4. Failure to make notifiestion of limits exeoded as required by 10CFR20.1906 06XX DRAFT Revision 1 A2-22 Issue Date: 08/10/99

Attichment 3 Physical Protection Significant Determination Process The safeguards risk assessment process recognizes that nonconformance issues have varying degrees of safety significance and in considering the safety significance of a nonconformance issue, it is appropnate to consider the technical significance (i.e., actual and potential consequences).

! Once a nonconformance issue has been identified, the risk of radiological sabotage has to be determined.

The issue is evaluated to establish whether there is no/ low risk or more than low risk of r:diological sabotage.

~

If there is no/ low risk, the issue is within the (licensee response band) and will be resolved via the lictnsee's corrective action program.

8. Examples of events within the (licensee response band):

e, A failure to make, maintain, or provide log entries in accordance with 10 CFR 73.71 (c) and (d)

9. A failure to conduct a proper search at the access point
10. A failure to control access such that an opportunity exists that could allow unauthorized and undetected access into the protected area but which was neither easily nor likely to be exploitable. I
11. A failure to report acts of licensed operators or supervisors pursuant to 10 CFR 26.73.
12. A failure to perform an appropriate evaluation or background investigation so that information relevant to '

the access determination was not obtained or considered and, as a result, a person was granted access by the licensee who would probably not have been granted access if the required investigation or i evaluation had been performed.

l

13. Isolated nonconformance with procedure requirements that are not indicative of a significant performance trend.
14. Protected / vital area barrier, alarm detection, and assessment nonconformance issues that do not impact an actual equipment performance (e.g., recording of test results, documentation for test sources, work request documentation).

In the above examples, none of the events were aggravated by other factors i.e., the events were not in conjunction with other safeguards failures; all were identified prior to any unauthon(zed entry into Repetitive events may be increased to a higher re,sponse band if the events can be considered a repetitive issue within the past 12 months.

The following nonconformance issues have been influenced by aggravating f actors. These issues were discussed by headquarters and/ regional safeguards staff in order to validate the safeguards risk assessment process.

1. A failure to protect safeguards information while information is outside the protected area and accessible to those not authorized access to the site.

The Physical Security Plan contains details of the protection afforded the site. An unauthorized individual with  ;

malevolent intent could possibly exploit the safeguards systems and gain entry into a Therefore, there is some risk involved with this event. Since the plan was unaftended, protected o] '

There were no other aggravated factors involved, that is, the plan was recovered, all secunty systems remained operable, and there was no unauthorized entry into the site. Since this was a single event involving safeguards information for the last 12 months, the issue is within the (licensee response band).

11. The, entry into a vital area from outside the protected area by an unauthorized individual who damages safety equipment.

An unauthorized individualinside a vital area has exploited the protected area physical security systems and presents a risk to safety. The event has been aggravated by the failure of vital area barriers and intrusion Issue Date: 08/10/99 A2-23 Revision 1 DRAFT 06XX

i detection system. Other safeguards mitigating factors were " ineffective," that is, contingency response force failed to preclude unauthorized entry. Operational solutions were not successful and the calculated radiation dose exceeded the Commission guidelines established in 10 CFR 100. This event would be Category" Red."

However, if operation solutions were successful, this would fall within a (required regulatory response band).

l lll. A failure of protected area search e,quipment, that is, metal / explosive detector /x-ray unit that results in the l

introduction to the protected area of firearms, explosives, or incendiary devices that could assist in radiological sabotage.

There is some risk associated with the event. If the contraband is available to unauthorized individuals with I malevolent intent, it becomes easily exploitable. However,if the event is not aggravated by other factors, that is, it was detected and recovered before entry into a vital area, the risk of the event's contribution to radiological sabotage is low and could be dispositioned with the (licensee response band) if this was a single

! event involving unauthorized materials within the last 12 months.

D;finitions:

Lsw Risk: A nonconformance activity has occurred that the licensee has determined presents no or low risk to the plant safety systems necessary to protect the public health and safety.

Prsdictable: Based on the manner in which a program was being implemented. It was predictable that a violation would occur or that equipment,i.e., metal detectors, intrusion detection zones could be circumvented or defeated without generating an alarm based on special knowledge obtained beforehand.

Exploitable: If individuals are aware of eq properly compensated for then those deficienc,uipment or system ies are exploitable. deficiencies They can be used toandthethose deficiencies greatest possible are n advantage by an individual (s) against the security organization.

Aggravating Factor: Any other factors that make the consequences of the event greater. Such as discovered degraded protected and vital area barriers during an alarm assessment or a licensee drug screening facility not tolfowing good practices to ensure false specimens could not be substituted.

Operational Solutions: Intervention by control room personnel that would result in the safe shut down of the ,

plant even if the contingency occurred and/or an adversary was able to render a piece of vital equipment '

inoperable or equipment configuration prevented an adversary from being successfut in their attempt to endanger the public's health and safety..

l i

06XX DRAFT Revision 1 A2-24 issue Date: 08/10/99

s 9

9 W O

s e

c o/

s

%1, 9 6

1 L

L E

Y D

E I

I i

t t n c e s a

m la li P"%

s s*

se **

s*

M S

E Y

? .

O N

A%^

me s

e , 1 O

v .

e d t

f a

r b e?

Fe len su l W

O L

r lo oss nf L snt E

- dc

" uce Y t

r afe o

. gE wfae uf n "Wi lo c SuS S E

Y S X X

6 0 0 W E S O IT T

E S l5 L L

lg H F

A Y E S R E Y E W D Y Y 1

n N o s E i

? E s mts n

? t

?

s s

  • r o o n"t e

v s s

o R G

i v

t c

a E&l ar E*arn R e

F O 3 2 e 3*l 2 O u >1 - 2

- 1 N

5 2-2

> A E

S T E S l5 I H

Y E W E Y lI U

S IS r N o s E E e t n  ?

s E

C lb e ts o R

a v G N am ENl t

c '

A et o o 2 2 O M P r

n '>

1 N I R

O F

N O k 7 C is R

N e O m N o F S O

N N 9 O  ? E 9 I

e E /

T g H 0 A t a ' G 1 C

I b o ' /

8 F a k 0 I

S is T R  :

N w e E L o t a

D I D C e u

s s

I

r.-,

Appendix 3 Shutdown Activities Inspection Findings Significance Determination Process To be Provided at a Later Time l

l 1

Issue Date: 08/10/99 A3-1 Revision 1 DRAFT 06XX

APPENDIX 4 I I

Determining Potential Risk Significance i of l Fire Protection and Post fire Safe Shutdown inspection Findings l I

I 1.0 introduction i I

The fire protection defense-in-depth (DID) elements are i I

(1) Prevent fires from starting. 1 I

(2) Rapidly detect and suppress those fires that do occur i I

(3) Protect structures, systems, and components important to safety so that a fire that is not I gro tgxtinguish by fire suppression activities will not prevent the safe shutdown of I

A fire protection program finding can generall be classified as a weakness associated with I meetin the objectives of one of the prece DID elements. As a result, the Fire Protection i I

was de eloped to evaluate the potential fire risk sign)ificance of any fire protection l weaknesses that are importhnt to post fire safe shutdown. I I

Phase 1 of the FPRSSM is a screening method that is used by the resident or regional I inspector to screen out fire protection findings (e.g., impairments to any fire protection feature) I that are primaril unrelated to fire protection systems and features used to protect safe I shutdown (SSD c pability. Phase 1 is used as an oversight process to monitor operational I conditions affe in fire protection systems and features. This monitoring process identifies I conditions that co d have a potentialimpact on the capability to maintain one SSD success I patha free of fire damage. I I

Findings that do not screen out as result of the Phase 1 screening should be suojected to the I more detailed Phase 2 analysis. The Phase 2 analysis evaluates the synergistic impact that I these findings may have on risk by treating them collectively for a fire area. Because of the I integrated approach taken by the Phase 2 analysis this analysis is generally performed, with I technical support from NRC fire protection enginee,rs and risR analysts, to better understand I the potential fire risk significance posed by the identified DID Phase 1 findings. For those l cases where Phase 2 method determines that the inspection findings have potential risk I significance, Phase 3, which is a more refined analysis, can be performed. I I

2.0 Purpose i I

The purpose of this two-phase screening methodology is to (,1) focus resources on monitoring I the performance and effectiveness of those fire protection mitigation features that are I

' Fire protection features sufficient to protect against the fire hazards in the area, zone, or room under consideration must be capable of assuring that necessary st. qtures, systems, and components needed for achieving and maintaining safe shutdown are free of fire damage (see Section III.G.2a, b, and c of Appendix R to 10 CFR Part 50); that is, the structure, system, or component under consideration is capable of performing its intended function during and after the postulated fire, as needed.

8 An SSD success path must be capable of maintaining the reactor coolant process variables within those predicted for a loss of AC power , and the fission product boundary integrity must not be affected (i.e., there must be no fuel cladding damage, rupture of any primary coolant boundary, or rupture of the containment boundary).

Issue Date: 08/10/99 A4-1 Revision 1 DRAFT 06XX i

cstiblish a threshold method ll' ,(Phase important 1 methodto isprot 2cting described post fira in Section 4.0)safe shutdown that will assist capIbility; (2)in recognizing whic

1 protection mit ation findings may have the potential to affect post-fire safe shutdown Ll capability; an 3) determine the potential fire risk significance of observed findin s associated

.I with fire prote ion mitigation features and systems used to protect SSD capabili y.

l performing screening assessment (Phase 2 method is described in Section 5.0) the as-I found condition (s). The Phase 2 screening analysis portion evaluates the "as found" conditions I associated with each fire protection mitigating element of the fire protection DID philoso by 1 :(e.g., detection, suppression, and passive protection separating post fire SSD functions within i each of the DID elements. The potential fire risk significance of the as-found condition is i determined by performing an integrated assessment of the fire protection mitigation fi ings I and the potential impact they may have on SSD capability.

I

1. The Phase 2 methodology can also be used by an NRR fire rotection reviewer or a agional ificance of:

II inspector as an design condition thataid for determining deviates from the intent ofthe potential risk / safety icensing/desig(n) the facilitie bas l Generic Letter 8610 or 10 CFR 50.59 engineering evaluation documenting aa change in(2) a

.I licensee's fire protection program.

I l For the purpose of this guidance, weaknesses or findings will be defined as conclusions or l factual observations of those "in plant" conditions that do not meet regulatory requirements, do I not conform to the facilities operating license fire protection condition, or are considered to I have risk im I weakness. plications due to an inherent fire protection / post fire safe shutdown system design I

i 3.0 Scope l

I The scope of Phase 1 is to present a process that can help inspectors determine whether a l 1 particular fire protection finding is important to the protection of the safe shutdown capability I and has the potential of being risk significant.

I I , Fire protection DID findings that have been determined to imply potential risk by the Phase 1 I screening method are subjected to a Phase 2 review. The scope of Phase 2 is to present a i process for regional and headquarters fire protection engineers and risk analysts to further I evaluate how a particular fire protection DID finding or set of findings affects SSD ca I ~ln order to evaluate the potential risk significance, Phase 2 integrates the "as found"pability.

I degradations or findings and evaluates their potential affects on fire mitigation effectiveness I and SSD capability. Phase 2 is focused on the following specific areas of fire mitigation: '

I I

  • fire detection / automatic suppression system effectiveness i a manual suppression effectiveness I

l 4.0 Fire Protection Risk Significance Screening Methodology-Phase 1 I

I Not all plant fire protection systems and features are considered to be important to the I protection of post fire SSD capability. The results of the fire IPEEE (individual plant evaluation I of extemalevents can i . contributors to fire) risk.The provide top 10aareas relative ranking identified byof theIPEEE/PRA this plant areas that are therisk (probabilistic major I assessment) ranking are generally important to post fire SSD. These plant areas also present  ;

l- the greatest challenges with respect to separation of redundant trains of post-fire SSD I capability, protection of this capability, and the ability to perform the operator actions I necessary to achieve and maintain post fire SSD conditions. i I.

I Phase 1 method consists of two steps. Step 1 is a screening evaluation of a fire protection I finding or a set of findings and is intended to screen out findings that do not impact the 06XX DRAFT Revision 1 A4-2 issue Date: 08/10/99

= i effectiveness of a fira prot:ction DID sl:mont. For those findings that impact the effectiveness I l I

1 of the one SSD or more provided capability of the DID for theelements} ire area, zone, or room of concern and then I

pres insights with respect to the potential importance that these fire protection findings have on i 2' maintaining one success path of SSD capability free from fire damage l I

The steps that follow describe the general process for implementing Phase 1. I I

Sten 1: Screenino of Fire Protection Findinas l l

The Step 1 screening process is described by Figure 4-1. This process identifies those fire I protection findings that impact the mitigation effectiveness of one fire protection DID element. I Findings that impact the effectivgness of one or more of the fire protection DID elements I potentially have risk implications . Once identified, findings affecting one or more of the DID l

. elements require further screening in order to determine it they are potentially important to I maintaining one success path of SSD capability free of fire damage. This screening is l podormed by Step 2 below. 1 I

Making Judgments regarding how effective a fire brigade can be in extinguishing a challen ing i plant fire requires an evaluator to have a comprehensive understanding of manual fire fi i techniques and operations. It is not the intent of Step 1 to expect resident inspectors to ave I the expertise to evaluate fire brigade effectiveness and performance. In most cases, fire I brigade performance can be important to mitigating a fire and reducing its potential risk and I should be considered when performing a Phase 2 evaluation. Reliance on fire brigade I performance and its effectiveness as a sole means of maintaining one success path of SSD I capability free of fire damage is not viewed as an acceptable practice. In those cases in which I I

' fire, one success pa(th of SSD capab)ility is generally maintained freei of fire d passive fire barrier having a fire resistive rating of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. In Step 2, where fire barners or fire i barriers in combination with an automatic fire suppression system are used as the primary I protection scheme for maintaining an SSD success path free of fire damage, manual fire - l tighting performance or effectiveness is not considered the dominant protective element of the I primary protection scheme. For those protection schemes that use passive fire barriers as I

' primary protection, findings related to only manual firefighting or fire brigade effectiveness l typically do not warrant the performance of a Phase 2 evaluation. I l

i j

3

- Allowed outage times with the use of compensatory measures do not provide an equivalent level of fire safety to that of a fully operable fire protection system or feature. Long-term use (more than 30 days) of compensatory measures for degraded or inoperable fire protection features used to protect the safe shutdown

. capability is an indication of inappropriate attention and resources being given to managing fire risk vu.norabilities.

. Issue Datei 08/10/99 A4-3 Revision 1 DRAFT 06XX

. ., ]

l \

Flaure 4-fr Screenina Process Phase 1 (Sten 1) for a given fire stes, sone, or roarn under considerstlen I' Yes Degradation or impairment of .l f

l~ DID element was less than the j Ceaq stated l impeltment or degradation of allowed outage time without the

.l N F'"

findmgs N hre protection feature or Dio 4 appropriate compensatory {

i g

[ h No, screen out or l Degradation or impairrnent of Affects one of the tolowing l DID element salsted forless g fire mitiganon DID elements N 'h*" 30 d'Y' "h 'h*

D l

I

1. Detection and manual suppression capability
  • 2 $* ,

l l 2. Automatic suppression y No, screen out l capatulity V I

3. Fire barriers Yes, smen out I ,m Yes, )

I Go to Step 2 of Phase 1 l

)

I l' Stoo 2: SafetvImoortance Determination i

I When findings affect one or more of the fire protection DID elements in a given fire area, zone, )

I I or thisroom screenin of step concern,it is necessary,f and determine i the findings are potentially risk significance, the p i SSD capabili for the fire area, zone, or room of concern and the fire protection schemes I used to maint n one SSD success path free of fire damage will have to be determined. For i those findings that do not screen out*, a Phase 2 evaluation will be performed, l.

I The SSD determination can be made by reviewing the plant's Fire Safe Shutdown Analysis I

I mainta)in post fire SSD for each fire area, zone, or room of concern can be determined. In(F I addition, the FSSA willidentify fire protection schemes used to protect the analyzed SSD I success path. Depending on the degree of physical and electrical separation provided for the I various SSD success paths, different fire protection schemes are used to ensure that one SSD l - success path is free of fire damage. Figures 4 2 through 4 5 below, presents additional I screening guidance for determining if the fire protection DID findings are potentially significant.

I If a question is not asked about a DID pr.inciple along a specific screening path, the I assumption is that the degradations associated with the DID elements not being questioned I are low, I

l L

  • Findings that do screen out should not be disregarded, they should be referred to the licensee and placed l

In the licensee corrective action program.

06XX DRAFT Revision 1 A4-4 issue Date: 08/10/99

, *a l

SSD syst:m with redund:ncy (:.g., til high pre:sur) re:ctzt invent:ry c ntrol functI:ns)la I:c:t:d or room orconcern. The remaining recovery capabilityis none. No additional in the stes, recovery tone capabl llty exists for performing the essential SSO functions external to the stes, zone, room of concern.

FIRE AREA BQUNDARY l

3'*.*n' M*"*' '"*** l l

SSD TRAIN A FUNCTION l

l SSD TRAIN B FUNCTION l

l l

No remaining recovery capabihty exists for performing essential sso l functions extemal to tno area. zone or room of concem. I Rgure 4 2 l l

For the SSD interaction as noted in Figure 4 2 above, the following three basic fire protection i schemes are used outside of primary containment to protect and maintain one train of SSD i I

capability free from fire damage: 1 I

Scheme f Provide a 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> fire barrier separation that either encloses one SSD train or i provides wall-to wall and floor to floor separation between the redundant trains; I ,

or l l 1

Scheme 2 Provide a 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> fire barrier enclosing er.c of the SSD trains. The area must be I protected by automatic fire detection and suppression systems; or i I

Scheme 3 Provide more than 20 feet of horizontal separation between the redundant SSD I trains. The spatial separation between the redundant SSD trains must be free I of intervening combustibles. The area must be protected by automatic fire I detection and suppression systems. I I

Determine which protection scheme is used. l l

Issue Date: 08/10/99 A4-5 Revision 1 DRAFT 06XX

I l

l I. Screenina Criterls for Floure 4-2 l

Yes l la Protection i s 3-hour fire barrier Separating .

Scheme 1 used?

4 redundant SSD functions affected

.4 y,,,

l by finding?

l pedorm Phase 2 1

I

)f No, screen out l

l l Yes No l

I le Protection is 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> fire ba. der that is the automatic fire l l Scheme 2 used? separates / encloses one SSD 4 suppression system A Yes, I function affected by finding? affected by the finding? Perform l Phase 2 1

3r Yes, l, perform Phese 2 No, screen out i

I l

l l

l l

l l

l Screenino Criterin for Floure 4 2 I

l Yes No l

l Are combustibles is the automatic fire 1

is Protection + located in the suppression system l Scheme 3 used?

combustible-free -Y affected by the finding?

I zone? Yes, l l perform l l No Phase 2

(

l vyes, Is detection or fire brigade w

l /

l perform Phase 2 effectiveness affected by g finding?

I I V l No, screen out i

I-1 I

06XX DRAFT Revision 1 A4-6 issue Date: 08/10/99 e

e .

l l

SSD syst:m with redund:ncy Is lic:t:d in thJ at:n, zone, Cr room of c:nc:rn. R:m:Ining mitigation capabillt is recovery of one fire-stfected SSD train (e.g., alternst;ve shutdown method for the controltoo .

FIRE AREA BOUNDARY l l

SSO TRAIN A l

l l SSD TRAIN B l

Fire stes, zone, or room of concern I

RECOVERY OF ONE SSO Recovery actions taken TRAIN outside the fire area of concem Figure 4 3 I

For the post fire SSD interaction noted in Figure 4-3 above, one basic type of fire protection I scheme is generally used. l I

Scheme This scheme minimizes fire damage to the preferred SSD trains by providing i automatic detection and fixed suppression in the fire area, zone, or room of I concern (the control room is an exception, no fixed fire suppression is l provided). In addition, this scheme provides an alternative shutdown system I that is electrically and physically independent of the fire area, zone, or room of I concern, 1 I

s Issue Date: 08/10/99 A4-7 Revision 1 DRAFT 06XX i l

. o 1

I ScreenIna Criterls for Floure 4 3 I

l No No i

I is fixed fire suppression Does fire barrier forming the

! f ndin ? h reco areas Are any + rigade ffectv ness affected by the

+ No.

of these fire barriers affected screen by the finding? finding?

out i Yea, Y v l

g perform Phase 2 Yes, y Yes, perform Phase 2 l

l perform Phase 2 I

I I

I l

SSD system with redundancy located in the ares, tone, or room of concern. Remaining mitigation capability is a recovery system with redundancy that is physically independent of the fire area, zone, or room of concern and is manually actuated under time constraints. l j

l FIRE AREA BOUNDARY l

l l SSO TRAIN A FUNCTION I

l l SSD TRAIN B FUNCTION l l

Fire area, zone or room of concern l

Recovery system wit,,

redundancy thatis physically independent of the fire area, zone, or room of concem andis manually actuated undertime constraints Figure 4-4 l

l 1 For the post-fire SSD interaction noted in Figure 4-4 above, three basic types of fire protection  ;

I schemes are used to protect one train of SSD from fire damage within the area of concern.

l These fire protection schemes are the same as those described for Figure 4 2. Determine I l which protection scheme is used. '

I i

l l

1 06XX DRAFT Hevision 1 A4-8 Issue Date: 08/10/99  ;

1 i

i

r , ,

I l Screenina Criteria for Floure 4-4 I  ;

I )

Yes 1

is Protection . Is 3-hour fire barrier i Scheme 1 used? + separating redundant SSD A No, screen out I functions affected by I finding? I

~

I i l

Yes l V l i

is recovery system physically independent l

l (separated by a 3-hour fire barrier) of the yo, fire area, zone, or room of concem and l

+ perform Phase 2 l capable of being manually actuated under l

the time constraints?

l 1

V l Yes, l

screen out l ,

I 1 l

I I

l I I I  !

I I l

l .

1 (

l l

l l

l Issue Date: 08/10/99 A4-9 Revision 1 DRAFT 06XX

0, l l

i I

l Screenino Criteria for Floure 4-4 Yes l No is 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> fire barrier that is the automatic fire No, is Protection Scheme 2 used?

-) separates / encloses one SSD function affected by 4 suppression system 4 screen out affected by the g

the finding? finding?

I Yes l Yes I II 3f I

I 7

is recovery system physically independent I

(separated by a 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> fire barrier) of the fire area, zone, or room of concem and capable of being i

I I

l V

Yes, I

screen out No, I

perform Phase 2 I

I 1

l i l

l Screenino Criterla for Floure 4 4 l l l

l Yes No I g i l la Protection 4 Are combustibles is the automatic fire i Scheme 3 used? located in the 4 suppression system affected l l combustible free by the finding?

l j

zone?

I I

l Yes No l Yes l

l Is detection or fire brigade l -

Yo effectiveness affected by the l If finding?

I l le recovery system physically independent y

I (separated by a 3-hour fire barrier) of the fire area, l zone, or room of concem and capable of being No,

, I manually actuated under the time constraints? screen out 1 I f I l V l No, Yes, l perform Phase 2 screen cat .

06XX DRAFT Revision 1 A4-10 issue Date: 08/10/99 l

l

e ., ,,

I I

SSO system with redundancy Is located in the area, zone, or room of concern. l Remaining mitigation capabilityis a system with redundancy that is l unstfected by the fire and immediately available (automatic inillation or no l time constraints). I FIRE AREA noUNDARY I I

SSO TRAIN A FUNCTION l

l SSO TRAIN B FUNCTION -

l l 1 Fire aren, zone, or room of concern l I Recovery system with redund J m ao a l ab s ( ac irubation or no time constraints).

Figure 4 5 l

For the post fire SSD interaction noted in Figure 4-5 above, three basic types of fire protection I schemes are used to protect one train of SSD from fire damage within the area of concern. I These fire protection schemes are the same as those described for Figure 4 2. Determine I which protection scheme is used. I I

[

Issue Date: 08/10/99 A4-11 Revision 1 DRAFT 06XX

i l

1 l l l 1

I l

l l Screenina Criteria for Floure 4-5 I

I Yes I

No, is Protection is 3-hour fire barrier screen out I

Scheme 1 4 separating redundant '

I SSD functions affected by used?

l the finding?

I I

VYes l 1s recovery system physically independent (separated I by a 3-hour fire barrier) of the fire area, zone, or room l of concern and capable of being automatically initiated Y NO, l 1 or manually actuated under no time constraints? Perform Phase 2 l

l l V l Yes, l screen out i

I g Yes No l

l Is Protection is 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> fire barrier that a tr.e automatic fire "'**'**"

Scheme 2 4 l

I used?.

separates / encloses one SSD function affected by

-)- suppression system affected by the 4

I the finding? finding?

I l

Yes l Yes I Y Y l

l is recovery system physically independent (separated I by a 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> fire barrier) of the fire area, zone, or room ,

I of concem and capable of being automatically initiated l l or manually actuated under no time constraints?

l l ~

J l

I Yes, V No, I screen out perform Phase 2 I

l I

I i l 06XX DRAFT Revision 1 A4-12 Issue Date: 08/10/99

l i

l I Screenina Crlierta for Floure 4-5 I

\

l Yee No l I t is Protection Are combustibles Is the automatic fire Schema 3 4 located in the 4 suppression system affected by used? combustible free the finding? I zone? I I

I No Ye Y l l

l Yes is detection or fire brigade g effectiveness affected by the  ;

finding?

g j Yes y l Y l

{

is recovery system physically independent (separated No, by a 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> fire barrier) of the fire area, zone, or room screen out of concern and capable of being automaticallyinitiated l or manually actuated under no time constraints? I I

I i

I )

V l No, Yes, screen out j perform Phase 2 j

[

i  !

I j l >

l l .

l 1

Issue Date: 08/10/99 A4-13 Revision 1 DRAFT 06XX l

]

.., m.

l 5.0 Fire Protection Risk Significance Screening Methodology-Phase 2 I

l The FPRSSM ~is an integrated process that can be used to assess the relative risk significance I of identified weaknesses in the fire protection DID elements in a given fire area, zone, or room l' under consideration. The following st ps describe the general process that should be followed I when implementing this methodology se Figure 5-1," Fire Protection Risk Significance l Screening Methodology-Process agram"). In the case that the Phase 2 method I determines that the assessed findings have potential risk significance, Phase 3, which is a i more refined analysis, can be performed.

I I Sten 1: Groucina of Fire Protection and Post fire Safe Shutdown Findinas l

I The specific fire protection inspection findings affecting the fire protection mitigation DID .

I features are grouped according to each specific fire area, zone, or room which they impact.

l Then an area specific fire damage scenano is defined and its effects are postulated. Step 2 l provides guidance for defining fire scenarios. Step 1 and Step 2 should be performed during I

i the related fire hazards in the area of c(oncern).an inspection in an integrated manner)!

l

.I Sten 2: Define the Fire Scenario i

I in order to properly support the FPRSSM risk estimates, the inspector or the reviewer will need l' to develop a postulated fire damage scenario that describes the fire and its potential for i

I propagation (FPFI), Appendix(see Inspection H for Procedure further guidance) w (IP)ithin the fire area, zone, or room underXXX, I consideration. Under this postulated scenario, the inspector or reviewer must make i deterministi ualitative judgments regarding the effectiveness of various degraded fire

1. protection mi ation features or systems and their ability to protect a post fire safe shutdown I path and main in it free from fire damage. Postulated fires involving fuel sources in an area l under consideration are deemed meaningfulif they are capable of developing a plume and/or I a hot gas layer that has the potential to directly affect components of equipment that are I important to safety. If the postulated fires in the area of concern are not deemed meaningful, I the fire protection DID findings may not contribute to the change in risk; however, they should I be considered as important. ,

I  !

l Sten 3: Qualitative Evaluation of Findinas 1 i i Once the various inspection DID findings and a meaningful fire scenario have been l

l. established for the fire area, zone or room of concern, the individual findings must be l

l evaluated with respect to their ability to satisfy the performance objective established by the I applicable DiD element. Upon determining which DID elements have been affected by the  ;

I specific fire protection finding, a qualitative evaluation of each finding and its effects on ,

I accomplishing the DID objective is performed. It should be noted that many inspection i I findings can contribute to a degradation in a DID element. For example, poor training, poor ,

I fire bngade/ operational drill performance, improperly installed detection, and inadequate hose I coverage of a fire area can all contribute to the degradation rating assigned to manual l I suppression. Therefore, in order to perform this step, the existing plant conditions as noted by I the inspection finding are evaluated against the deterministic / qualitative evaluation guidance I and degradations categorization critana established in IP XXX, Appendix H. ,

I '

l The output from this deterministic / qualitative evaluation, results in a degradation rating (DR)

I 1 - (e.g., High, Medium, or Low) being assigned to each DID element.

1 06XX DRAFT Revision 1 A4-14 issue Date: 08/10/99 rs.

Sten 4: Asslanment of Quantitative Values i I

From Step 3," Qualitative Evaluation of the Findings," a DR is assigned to each DID element. I Once the DRs for a DID element have been determined, they are quantified by assigning a i value from Table 5.1. I I

I l

Table 5.1 Quantification of Degradation Ratings (DR) of the Individual DID l Elements' I o$rWoon s5r[er"' '* s*5r$" Lu" >

inside controi p

sid_e High 0 0 0 -0.25 -0.5 l Medium -1 -0.5 -0.75 -0.5 -1 l Low -2 (door) -1 -1.25 -1 -1.5 l l

Dependencies exist between certain DID elements. ' hose dependencies and their values are i expressed in Table 5.2 below. I I i Table 5.2 Quantification of Dependencies Between DID Elements l Automatic Fire Suppression ManualFire Fighting Adjustment Due to Ettectiveness Degradation Ettectiveness Degradation Dependency Medium High +0.75 l Low High +0.5 l l

These dependencies are based on the fact that automatic suppression merely controls the fire, I and the fire brigade is needed to completely extinguish the fire. The resulting adjustment has I the effect of providing partial credit for automatic suppression when it has a low degradation I and is paired with a high degradation of manual fire fighting capability. No credit is provided I for automatic suppression when it has a medium degradation and is paired with a high I degradation of manual fire fighting capability.

Table 5.3 Quantification of Common Cause Contribution Between Sprinkler i Systems and Manual Fire Fighting Hose Stations I Automatic Fire suppression ManualFire Fighting Adjustment Due to Common

. Ettectiveness Degradation Ettectiveness Degradation Cause Low Low +0.25 l l

The Table 5.3 adjustment is made since a common water delivery and supply system exists I both automatic and manual water based systems. I

' Each of these values in Tables 5.1,5.2, and 5.3 is approximately an exponent of 10.

Issue Date: 08/10/99 A4-15 Revision 1 DRAFT 06XX

?, '.

l Li <

I Sten 5: Determination of Fire lanition frecuency i

I The next step is to determine the fire ignition frequency for the fire area, zone, or room of

.I concem. If a fire ignition frequency can be obtained for the specific fire area, zone, or room of l l cor.cern from the plant specific IPEEE, it should be used. However, if the iPEEE does not  !

II:provide it, then it may be selected from Table 5.4' l

Table 5.4 Generic ignition Frequencies I Plant Buildings or Rooms .

I sulktine erRoom - lenttien Frequency (IF)/ Yr

.I Control Room 7E-3

{

l Cable spreading Room SE 3 l Diesel Generator Building SE 2 l switchgear Room 1E 2 i Battery Room 3E 3 to 1E 2 i Reactor Building 3E 2 l Auxiliary Building 6E 2 i Tuttiine Building 6E 2 l Containment 9E 3 l

l Stec 6: Inteareted Assessment of DID Findinas (Excludina SSD) and Fire lanition Freauencv I Once Steps 4 and 5 have been completed, the res ive DID findings for a given fire area, I zone, or room of concern are assessed collective by summing, using the following formula, I the fire Ignition Frequenc IF) and the DR for eac of the fire protection DID elements. This 1 value is called the Fire M ation Frequency (FMF) and inputs into the Significance ,

1 Determination Process (S ) (NUREG/CR 5499) to determine the change in risk. l 1

1 FMF = IF + FB + MS + AS + CC (when appropriate)

I 1

l where'IF = Fire ignition Frequency i FB = Fire Barrier i MS = Manual Suppression / Detection I. AS = Automatic Suppression / Detection l CC = Dependencies / Common Cause Contribution

.I I Table 5.6 below shows the association between the FMF and the ap aroximate frequency in i Table 5.7 (same as SDP Table 1," Estimated Likelihood Rating for in tiating Event Occurrence i During Degraded Period").

I

  • Generic ignition frequencies for specific buildings or rooms are provided in Table 4.4a (taken from AEOD data base, NRC's ?Special Study: Fire Events-Feedback of U.S. Operating Experience-Final Report." June 19, 1997).

- 06XX DRAFT Revision 1 A4-16 lasue Date: 08/10/99 l

o . .,

, 1 I

T bl3 5.6 A:ncl:tI:n cf FMF to Tcbla 5.7 1 \

(SDP Table 1) Approximate Frequencies for Calculation l of Delta CDF l F liigation Frequency Table 5.7 Approximate Frequencies FMF > 2 1 per 10 to 108 l 2 g FMF >4 1 per 108 to 108 l

]

8 4 2 FMF >-4 1 per 10 to 104 l

-4 g FMF >-5 1 per 10d to 108 l l 42PMF>4 1 per 10s to 108 l FMFs4 Less than 10' l l

The approximate frequency (same as FMF) is adjusted in Table 5.7 by the length of time that I the degradation existed. In practice, as part of the initial assessment, the inspector should I assume that the degradations are simultaneous, and that all occur for the length of time i 1 associated with the longest degradation. This is a conservative approach, and if desired, can I be refined. To adjust the time of the degradation, a letter is selected on the basis of the I degradation time from Table 5.7. The degradation of 3-30 days decreases the frequency by 1 10, and the degradation of less than 3 days decreases the frequency by 100. I l

t l

I l

l l

l Issue Date: 08/10/99 A4-17 Revision 1 DRAFT 06XX

I I

l Table 5.7 Estimated Likelihood Rating for initiating Event Occurrence l During Degraded Period l

I Approx. Freq. Example Event Type Estimated Likelihood Rating

>1 per 1 10 yr Reactor Trip A B C Loss of condenser 1 per 10 10' yr Loss of Offsite Power B C D Totalloss of main FW Stuck open SRV (BWR MSLB (outside entrnt) )

Loss of 1 SR AC bus Loss of Instr /Cntrl Air Fire causing reactor trip 1 per 108 108 yr SGTR C D E Stuck open PORV/SV RCP seal LOCA (PWR)

MFLB MSLB inside PWR cntmt Loss of 1 SR DC bus fbod causing reactor tnp 1 per 108 10' yr Small LOCA D E F Loss of all service water 1 per 10' 10*yr Med LOCA E F G l I Large LOCA (BWR)  !

1 per 10s 10'yr F G H Larbe ISL CA LOCA (PWR)  !

Vessel Rupture l <1 per 10*yr G H H I Source: SDP Table 1, NUREG/CR 5499 > 30 days 30 3 days <3 days 1

I i Exposure Time for i Degraded Condition l

I Sten 7: Intearation of Adiusted FMF with SSO I

I The FMF, which has been adjusted by the length of degradation, represents the integration of I IF with the DR associated with each of the fire protection DID elements, in this step, the FMF l

l is integrated with the SSD capability that is free from fire damage. i 4 l l Fire damage has the ability to induce a transient, a loss of offsite power (LOOP), a loss of I cooling accident (LOCA), or a loss of reactor water makeup function. Assuming a postulated I fire scenario, the sequences corresponding to the appropnate initiator that are impacted by the I inspection findings are evaluated using Table 5.8 (same a: SDP Table 2)," Risk Significance l Estimation Matrix.-

I .

I in the FPRSSM, the CDF associated with the impact of the DID findings is strictly what is I calculated. However, for l I considered as the ACDF.This purposes of usingsince is conservative this model, the CDF the dueCDF dueDID to the to findings the DID isfindings will be '

06XX DRAFT Revision 1 A4-18 Issue Date: 08/10/99

y .,.

{

great:r thin ACDF. Note th:t in tha columns of SSD ts the mitigating equipment increases in i Table 5.8, failure probabilities decrease by a factor of 10. I I

- Sten 8: General Rules for AccIvina FPRSSM l i

\

l '

Since a fire barrier failure is represented by a probability, the ACDF is a combination of two I contributions: a contribution from barrier failure, and one from the barrier success. Table 5.1 I can be used to calculate both of these terms. For purposes of discussion, the term referring to I the case in which the barrier fails will be called the double room term and the case in I which the barrier succeeds will be called the single room term The(SRT).(DRT)SRT andI DRT arej shown by the figures 8.1 and 8.2 below. '

I Single Room Term (SRT) Mre Barrier Prevents Rra/ Smoke Propagation l l

Mre Area B Mre Area C S S O Train A SSO Train B 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> fire barr/er(fire barrier Fire affected area i successful. No fire / smoke impact on fire area B I

I l

l Figure 8.1 l

Double Room Term (ORT) Mre Barrier FnIIs to Prevent Rre/ Smoke Propagation l I

Rre Area B . Mre Area C SS O Train A S S O Train B Fire affected area urf r barrierfails(fire /smokeimpacts I

l Figure 8.2 Issue Date: 08/10/99- A4-19 Revision 1 DRAFT 06XX I A

l l The safe shutdown (SSD) equipm.nt failId for the SRT is the combin1 tion of mitigating equipment, I associated cables, and actions in fire area C alone. The SSD equipment failed for the DRT is the I combination of mitigating equipment, associated cables, and actions in B and C.

I I As a result, the SSD impact can be different depending on whether the SRT or DRT is calculated.

1 Note that the mitigating equipment for the DRT is a subset of or can be equal to the mitigation i equipment for the SRT.

I I Both the SRT and DRT are not needed in all cases. The following rules provide guidance on when to l use these terms. The purpose of the first rule is to prevent the overestimation of ACDF due to the I approximation that CDF totalis equal to ACDF. The SSD/SRT and SSD/DRT should also be I calculated or estimated for the entire initiator for the fire area (s) for the following comparison:

l l (Rule 1) If SSD/SRT = SSD/DRT (i.e., no SSD equipment or components in adjacent fire area)

I and the only finding is against a fire barrier, the ACDF = 0.

I I (Rule 2) If the fire barrier has a high degradation and rule #1 does not apply, just use the DRT I to calculate ACDF.

I I (Rule 3) If the fire barrier has a medium degradation and rule #1 does not apply, I

I For 3-hour fire barrier, use only DRT if SSD/DRT is greater than or equal to 10 times i SSD/SRT, I

I For 1-hour fire barrier, use only DRT if SSD/DRT is greater than or equal to 3 times j l SSD/SRT, I

I otherwise use SRT + DRT.

I I (Rule 4) If the fire barrier has a low degradation: l l  !

I For 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> fire barrier, use only SRT if SSD/DRT is not greater than or equal to 100 times  !

I SSD/SRT,  !

l .

I otherwise, use only DRT.

l l For 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> fire barrier, use only DRT if SSD/DRT is greater than or equal to 10 times l SSD/SRT, I

I otherwise, use SRT + DRT.

I I (Rule 5) If SSD/SRT is equal to SSD/DRT and a finding against either MS or AS exists, only I the SRT is necessary.

l I

I Once it is established which terms (DRT, SRT) are needed to calculate ACDF, these terms are I calculated or a sequence-by-sequence basis, so that the appropriate credit for SSD is given to each I sequence, I

I Steo 9: Modifications Necessarv To Add (mosct of Sourlous Actuations l l

l The decision to use the SRT, DRT- or both terms is made before considering spurious actuations.

I However, once this decision is made, the impact of spurious actuations on SSD should be added I provided the spurious actuation or actuations increases the severity of SSD by at least a factor of 10.

I If the spurious actuations pass this test, then a factor of -1 should also be added to the FMF to 1 account for the probability of spurious actuations.

I 06XX DRAFT Revislun 1 A4-20 issue Date: 08/10/99 l

A

l1IIIl I

l l l l I l l I e w e n n n d e

d e

d e

d e o it e e o R l

le h e e n ) R R R W r r 7

(

Y G G f

o ye n w e n n n ra er d d d o e e e e vt ) e e e B t w e e e od 6 R R R e r r r ce l

( Y W G G G ei Rla _

n r h e it yta e )s X i

r n wcntumtn w e n n n n X

6 ia aciin d d e e e 0 h t r R O emdarr t nl et t < )

5

(

R e

R e lo le it h e r e r

e r

e e

r T 1 suads yd u n n Y W G G G G F 1

senur a o c A

R

% (

m D 1

=

a F

t e MD PS

)

P f

o y

n e

2 l

e i n

o s

e nfo o

r e

t e b a

i

i3 v it t

v u l e2 o c

h ysn w e n n n n c. T e

- g R it ) d lo t

e e e e 5 ip e

l e e ri

+a n O wcc .nhetsn

.aami R e

Y le ih W G e

r G

e r

G e

r G

e r n P C S D 2-h st IS n t r

.dmia

)

4 4 dr gm id

.n oot t r (  : A a ion ae rl s,.duu t nns e i

S iFnr ti 1l a 1 r(ocearo c r

e( u A

r m o l

= o S P R s .

n h+

- ia it yf n n r w e n n n n 8_

t e R wcon O maya n i lo it h

e e

e e

e e

e e

e e

e e

5 s r r le r r r r r r r

e tedet s nvd

)

3 Y W G G G G G G a v i yuoe (

M d sdci l m 2 1 rrfeea T

hy f 1i t c on e a n n n n n n

+ wn a R e ya r r i t i e e e e e e

e e

e e

e nmd n O s+et r

)

2 h a. r r r r r er ieat u e v svd

( W C G G G G G G inoe trsd ye dici a l 1 sr 2t rea rf e s hc y s min r

es t

n n n n n n n n ivin R ewa t shnd

)

1 e

e e

e e

e e

e e

e e e e e

e e

dar O ycu ( r r r r r r r r 9 3 t s ad G G G G G G G G 9 2 2e er /

0 1

/

8 0

d p) g oeP  :

i ntn oS tD e t h S A B C D E F t

a toeimf vl G H iEe t

n kr2 oo D I

iF L (2 e u

s s

I

t

  • d n f o

y a c s t c d s ) n g n D a n g e S p Nn n m a s s e u

q dn s Ms s I n

r g

a e - e g n e r iF h R d n i

r k s T dn ne u F n O it w P d s A n i

d F i r s r i v io I

D F F

g oo n n

o i n e F f

ev h

n f

o M F

n p

t yt i

ns e o g a a r t r s r le

& Ttsplo t

i t e 2a n s i n d i p s u=

ce r u eu s g ll o me i e r

e m

t e

s A p st ec f i

t sq n e F u c ed p a u s e a cc n i r s e ed d n lu o f o

s e 4 f o

N k

r f nt ka i F

ov f o n s s

A f

s e s a oc 9 9

n on PeH f o

E t n m o A o l u o n e /

e et s

)

Mito it la ap g

ie

/

l a

g n

p

  • m a

v e m

n e

n im d

e e

a it n

o R a la it a

ic sc ne /

0 1

Sc t ah n u i lt g r e

r g r g

r e

e l

er 8 Se s f t

o o a u is s

t e o e n e

d o s c ro 0 Rto e o Uc r e G Mu i t g G Q- A -D i- n n  :

e Pr F

r Fi sa e - -

I

- - - t a

(P e f

o er R

(

1 p

  • 3 p

4 p

5 p

6 p

7 p

8 p

9puio r D

yk g na oe t s

e t e t e t e t e t e t e t ep e

oF t i v s s s s s S sS u df ct es s r

s ko pn s oe ec s i inse hn t

ea 2

2-Mc N 4 yd nr wr A igr n i eS r

ek r s ci d SR n a

ela ci k s tpen es ntn a e ct ir e esu cns i

Ho i f

r cee acr nP f o -

t Nt gf io S s w

e ) n o

ngn e ne i r o sae v o ks W

i se e t t

a egs i

Rc E r

c n n ons o E e

p o i

m dEe s ).

e i

s r

" r t

r E c e oP is P s

n t e t e sgas3e e

t r I o nes i

co W i r p

d e nina t

ei oa rn t f P

ns

" i f

e r

c n

a ednh c

inieP Lt r(

Pi erm on it o g

e h f o

t r

o ke Ft e ci t ep p

sm h r g

n i

n i p

m t inu o e e

t y

e 1

5. D e

r u

f r s oa nd o n s

W d i

t n

e s

S 1

r c

f S

a

- is i

n o

v i

F g tia as r t ah pg R

(

e t

e SI pN2Se t p

V Ms, R

T e

eis r e F Pn i Y A R

D X

X 6

0 IlIiIlli1Il ylI l I IIlllllIll1

I Attachment 1 1 I

AppIlcation of I Fire Protection Risk-Significant Screening Methodology I to I Hypothetical Cases I 1

Case 1: Cable Spreading Room i I

A single CSR exists in a plant. The CSR is located adjacent to a fire area that contains the remote i shutdown panel (RSP). A 3-hour barrier separates the two fire areas. The CSR has an automatic I carbon dioxide suppression system. A credible fire scenario can be developed that will damage I cables and expose the barrier to fire. The ignition frequency for the CSR is SE-3/yr. I 1

Examole 1 A I l

The 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> fire barrier wall has a high degradation. The automatic carbon dioxide suppression I system has also a high degradation. The fire brigade has a medium degradation. Each of these i degradations has lasted longer than 30 days. l I

Since the fire barrier has a high degradation, only the DRT is used for SSD. No credit is given for i SSD for the DRT since no equipment or human actions exist at the RSP to mitigate core damage I outside of the two areas which are separated by the degraded fire barrier. I I

The fire mitigation frequency (FMF) = IF + FB + AS + MS I I

where IF = ignition frequency i FB = fire barrier i AS = automatic suppression / detection l MS = manual suppression / detection I l

Thus FMF = 2.3 + 0 + 0 - 0.5 = -2.8 I I

From Table 5.7 (SDP Table 1) locate the Approximate Frequency = 1E 2 to 1E 3. Since the I degradation is greater than 30 days, select C from the table. I I

Since both trains of SSD could be damaged by the fire and no recovery capability exists outside the I area of concern, select none from Table 5.8 (SDP Table 2). As a result, the color representing the I i change in CDF is Red. I I

Examote 1B I I

Suppose the 3-hour fire barrier wall has been improved to a medium dearadation. All other I degradations remain the same. SSD for the SRT is 1E-1 due to the RS> which is a factor of 10 less I than SSD for the DRT. Therefore, we can still only use the DRT. I l i Thus; FMF = -2.3 - 1 + 0 - 0.5 = -3.8 I I

From Table 5.7 (SDP Table 1) locate the in Approximate Frequency =1E-3 to 1E-4. Since the I condition lasted longer than 30 days, select D from Table 5.7. I I

Given the SSD still equals none, Table 5.8 (SDP Table 2) will produces Red. I I

Examole 1C. I I

Issue Date: 08/10/99 A4-23 Revision 1 DRAFT 06XX 1

I Suppose the 3-hour fire b2rrier wn!! cnd automatic supprsssion systsm are repnired so th:t no I d:gr:dation exists in eith:r. Tha manu11 supprassion continues to hava a medium degradation.

l l Since the 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> fire barrier wall has only a low degradation, the relationship between SSD/DRT and I SSD/SRT needs to be re evaluated. The SSD/DRT is not greater than 100 times the SSD/SRT, I therefore, use the SRT in this case.

I ,

1 Thus; FMF = 2.3 + 0 - 1.25 - 0.5 = -4.05 l l 1 From Table 5.7 (SDP Table 1) locate Approximate Frequency = E-4 to 1E 5. Since all degradations I lasted longer than 30 days, select E from Table 5.7.

l l ' Given that the SSD is equivalent to the human r'ecovery of a failed train, Table 2 produces a White I condition.

I-l Case 2: Auxiliary Feedwater Room i

I An AFW fire area contains a turbine auxiliary feedwater (TDAFW) pump. The only other AFW pump, I the motor driven auxiliary feedwater (MDAFW) pump, is located in a different fire area. The MDAFW l pump cabling runs through the AFW room, but is protected by a 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> fire barrier. The AFW room I is protected by an automatic sprinkler system. The cables for the MFW pumps have not been traced.

1 The ignition frequency for the AFW room (excluding that equipment protected by the 1-hour fire i . barrier) is 3E 3/yr.

I I in this case, the initiator that the fire produces is a plant transient condition. Loss of AFW and no I credit for MFW dictates that the dominant se uences will be those failures. The two sequences that I are dominant iven the transient initiator are 1) loss of AFW, loss of MFW, and loss of feed and I bleed capabili 2 loss of AFW, loss of mal feedwater (MFW), and loss of high pressure i recirculation R . Each of these se I failures impa(t c all hese sequences. quences will need to be evaluated for the AFW room sin

! High 'r essure Injection is not located in the AFW room and, therefore, feed and bl I available after the fire. The RHR, which ,

i 1 operations i Therefore, andavailab.

HPR is also supplies t

(feeds)e.he highprovides pressure injection for HPR is not locatedcooling in the AFW for room.the sum 1

l l '

l l Examole 2A I

I The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> barrier has a high degradation. The automatic sprinkler suppression system has a high I degradation. The fire brigade has a medium degradation. Each of these degradations has lasted I longer than 30 days.

I I Since the barrier has a high degradation, only the DRT is used for SSD.

I I For sequence 1, the SSD/DRT is feed and bleed capability . For sequence 2, the SSD/DRT is HPR.

I I The fire mitigation frequency is the same for sequences 1 and 2, is I

l FMF = -2.5 + 0 + 0 0.5 = -3.0 1

I For each case, from Table 5.7 (SDP Table 1) locate the Approximate Frequency = 1E-3 to 1 E-4, I select D.

I I For both sequence 1 and 2, Table 5.8 I sequence has 1 train as SSD/DRT). Th(SDP Table 2) produces a White condition (since i AFW room.

06XX DRAFT Revision 1 A4-24 issue Date: 08/10/99

o i- . 1 Examole 2B l l

Suppose the 1-hour fire barrier is restored to its full functional condition. Now it is assigned a low I degradation.

degradations asThe automatic in Example 1 sginkler system and the fire brigade continue to have the same I

1 I

The fire mitigation frequency, is the same for sequences 1 and 2: 1 I

FMF = -2.5 + -1 + 0 + -0.5 = -4.0. I I

Therefore, locate the Approximate Frequency = 1E-3 to 1E-4, and select E from Table 5.7 (SDP I Table 1). 1 I

To decide whether a DRT, or both the DRT and SRT is needed, compare the SSD/DRT with l SSD/SRT. (SSD/DRT has already been calculated above for both sequences.) l I

For sequence 1, SSD/SRT is made up of the MDAFW and feed and bleed, which are two diverse I trains of systems . For sequence 2. SSD/SRT is made up of MDAFW and HPR, which are again two I diverse trains of systems. The SSD/SRT for both sequences is again the same. I I

Therefore, in each case SSD/DRT = 100 times SSD/SRT. Thus the DRT is the only term needed for i sequences 1 and 2. The SSD/DRT was 1 train for both sequences. I l

Therefore, from Table 5.8 (SDP Table 2), each of sequences 1 and 2 produces a Green result. I (Rules for adding Greens are still under development at this time. Addition of Greens may become a i j White.) l I

i 1 l

)

l 1

1 l

l l

Issue Date: 08/10/99 A4-25 Revision 1 DRAFT 06XX 1

e a Appendix 5 SIGNIFICANCE DETERMINATION PROCESS AND ENFORCEMENT REVIEW PANEL This appendix provides guidance concerning ,a. Joint NRR/OE/RES/ Region review panel which has been established to help ensure that the significance determination rocesses (SDP) described in appendices 1,2,3, and 4, which use a risk characterization, are im emented in a consistent manner. Consistency is important since SDP provided the bases f r the assessment and enforcement programs.

The panel will include the following:

The panel will be chaired by the Branch Chief or an alternate Section Chief from the inspection Program Branch of NRR.

One member of the Operational Support Team from the Probabilistic Safety Assessment Branch, NRR A management member or a designated altemate from the Office of Enforcement (OE).

As designated by the panel chairman, there will be regional representation to include a DRP Branch Chief and a SRA from at least 1 of the 3 remaining regions not associated with the issue being i reviewed.

Designated regional panel member and a SRA from the region associated with the issue being reviewed.

A member representing the Office of Research. 1 Other interested parties may attend by invitation of the panel members.

The regional panel member should normally be the projects section/ branch chief responsible for the site for which the SDP was conducted or another person designated by regional management.

Another regional section/ branch chief should be designated by regional management as the altemate regional panel member.

General Procedure:

The panel will meet bi weekly if necessary, for the purpose of reviewing all Phae 2 evaluations that I were determined by the initial review to be of potential risk significant (i.e. marginal whites or any 1 issue greater than green) and to indeperidently discuss all proposed potential risk significant issues I being considered before iney are issued in their final form.

The designated regional panel member is responsible for bringing any proposed risk significant assessment inputs or violations to the attention of the panelin a timely manner so that the issuance of the inspection report is not unnecessarily delayed. A panel questionnaire similar to that attached I to this Appendix should be used. I It is expected that all decisions r arding the assessment or enforcement actions will be made by consensus, all members agreein . If there is no consensus, the matter will be referred to the Director, Division of System Saf and Analysis, and the director of the Office of Enforcement for resolution.

Issue Date: 08/10/99 Revision 1 DRAFT 06XX

m .

The panel will also deal with any policy issues that'are identified by any panel member or associated with the activities of the Operation Support Team from the Probabilistic Safety Assessment Branch, NRR.

The panel may also request program support from RES and other NRC groups to further development and use of the SDP. - Additionally, the panel may cause audits of the SDP to ensure appropriate guidance and training has been provided to the field inspectors and their managers.

The panel shall meet, in person or by telephone conference call, on a schedule that is mutually a reed to b the panel members and that will not unnecessarily delay the issuance of the inspection report.

The designated altamate may act for the member.

Others including, the regional inspector, resident inspector, project manager, etc., may be asked to I attend

{

the meeting or provide input to the discussions.

The panel shall maintain a record of all risk decisions results reviewed by the panel so they will be available for future comparison. Eventually, these will be used to develop a set of examples which could be added to the SDP assessment guidance.

j

- The panel shall continue to review potential risk significant issues until NRC management agrees that I such reviews are no longer needed. For the present, it is recommended that the panel plan on performing these reviews for the pilot plant efforts and the first year after the new reactor oversight process takes effect (i.e., until January 1,2001) or until adequate SDP guidance, with appropriate examples, is developed and provided to the regions.

)

06XX DRAFT Revision 1 issue Date: 08/10/99 e

o v Appendix 5 Attrchment 1 l SDP AND ENFORCEMENT REVIEW PANEL WORKSHEET Worksheet #

! Panel Date .

Region Licensee Facility Docket No(s),

License No(s).

Ins No(pection s). Report Date of Identification Date when SDP Phase 1 Screening Complete Date when SDP Phase 2 complete Date of Exit Interview Panel Chairman Responsible Branch i Chief / Lead Inspector l

l' HQ SRA Representative i

OE Representative HQ Attendees l Regional Attendees

1. Brief Summary of issues / Potential Risk:

include a short statement of the issueMolation. If available, attach sections of the draft inspectkm report or summary of inspecten hndings. Also provide any Wcable LERs, heensee coE+he, etc.

l Issue Date: 08/10/99 Revision 1 DRAFT 06XX I y eg m9ge e6 - m6*WW@W M' '*i# 9P'

o , .

2. Regional Recommended Significance:

Desenbe the proposed significance . is a pre-decisional regulatory conference necessary? Is action warranted against any individual? How does this action fit into overall strategy associated with the Plant Assessment Process?

3. Analysis of Significance:
a. Risk Significance - SDP Assessment (worksheets attached of licensee's Significance Review if available. Is there a nee). d forProvide a SDP Phase Summary 3 review prior to final disposition?
b. Actual Consequences or Outside SDP process

( wmful, so.s. dose, release, reporting. other):

4. Re:ommended Assessment Color and Enforcement Action (Pilot Process)

Comoarison with the Non Pilot Enforcement Policy

5. Apparent Severity Level (s) and Basis under non- pilot Enforcement Polley:

Indicate Seventy Level for each violation or group of violations. Reference examples from enforcemeni policy supplement.

Address aggregabon, repettiveness, wmfulness, etc.

6. Factors for application the non pilot Enforcement Policy:

These items should be addressed for each violation or group of violations.

a. Enforcement History Last 2 years:

Ust SL ill or above, Orders, similar violations, etc.

~

b. la Credit Warranted for identification? Explain:

Desenbe method of identification (NRC, bconsee, revealed through event, allegation, etc.). Describe any missed opporturuties.

c. Is Credit Warranted for Corr l g,gpgandcompr.n.nsiv.ective Actions?

? inciude date ucensee was Explain:

..re of -.m requmng correcove .ceon u

d. Should Dis:retion Be Exercised to Mit Consider issues in Figure 61," List of issues That Warrant May.igate Discreton." or Escalate If yes, Klentify Sanction?

issue and briefly explain.

7. Is action being considered agal'nst individuais?
8. Non-Routine issues / Additional Information/ Lessons Learned:
a. Is generic communication (IN, GL, etc.) needed for this lasue?
b. Is inspection or significance determination guidance needed?
c. Is there a need for NRR programmatic guidance or interpretation of requirements?
d. Are there any other lessons learned?
e. Are these issues related to an allegation?

06XX DRAFT Revision 1 lssue Date: 08/10/99 a - e + ,

[

,..-( ,

f. I la there any other Information about this case that should be considered and is l lmportant to note?
8. Panel Decision:

4 4

i Issue Date: 08/10/99 Revision 1 DRAFT 06XX

1, NRC INSPECTION MANUAL AAAA Inspection Procedure XXXXX SUPPLEMENTAL INSPECTION FOR REPETITIVE DEGRADED CORNERSTONES, MULTIPLE DEGRADED CORNERSTONES. MULTIPLE YELLOW INPUTS OR ONE RED INPUT PROGRAM APPLICABILITY: 2515 FUNCTIONAL AREA: Initiating Events.

Mitigating Systems Barrier Integrity Emergency Preparedness Occupational Radiation Safety Public Radiation Safety Physical Protection INSPECTION BASIS:

The NRC's revised inspection program includes three parts: baseline inspections: I generic safety issues and special inspections; and supplemental inspections {

performed as a result of risk significant performance issues. The inspection i program is designed to apply NRC inspection assets in an increasing manner when risk significant performance issues are identified, either by inspection findings evaluated using the significance determination process (SDP) or when performance indicator thresholds are exceeded. Accordingly, following the identification of an inspection finding categorized as risk significant (i.e., white, yellow, or red) via Table 2 of the SDP, or when a performance indicator exceeds the

" licensee response band" threshold, the NRC regional office will perform supplemental inspection (s). The scope and breadth of these inspections will be based upon the guidance provided in the NRC's " Assessment Action Matrix" and the Supplemental Inspection Selection Table (included in 2515 Appendix B).

This procedure provides the supplemental response for repetitive degraded cornerstones, multiple degraded cornerstones, multiple yellow inputs, or one red .

input to the Assessment Action Matrix. The intent of this procedure is to provide  !

the NRC with supplemental information regarding licensee performance., as necessary to determine the breadth and depth of safety, organizational, and l programmatic issues. As such. this procedure is more diagnostic than indicative, and includes reviews of programs and processes not inspected as part of the baseline inspection program. The results of this inspection will aid the NRC in deciding whether additional regulatory actions are necessary to assure public  :

health and safety. These additional regulatory actions could include orders, confirmatory action letters, or additional supplemental inspections, as necessary Issue Date: 08/19/99 DRAFT XXXXX .

,. leeway has been built into the procedure to allow it to be customized, to better a reflect the previously identified performance issues.

02.01 Strategic Performance Area (s) Identification: - Using the information contained in the Assecsment Action Matrix, identify the strategic performance areas for which performance has significantly declined. The scope of this inspection will focus on the key attributes of these identified strategic performance areas. Specific inspection requirements pertaining to each strategic performance area and key attributes are contained in Sections 02.03 - 02.05 of the procedure. Also. Section 02.02 " Review of Licensee Control Systems for Identifying. Assessing, and Correcting Performance Deficiencies" should always be performed regardless of the strategic performance areas selected for review.

02.02 Review of Licensee Control Systems for Identifying. Assessing. and Correcting Performance Deficiencies Once significant performance concerns have been identified in the Action Matrix, the NRC requires confidence that licensee systems for identifying. assessing, and correcting performance deficiencies are sufficient to prevent further performance degradations. The following inspection requirements evaluate whether licensee programs are sufficient to prevent further declines in safety that could result in unsafe operation.

A. Determine whether licensee evaluations of, and corrective actions to.

significant performance deficiencies have been sufficient to correct the deficiencies and prevent recurrence.

B. Evaluate the effectiveness of audits and assessments performed by the quality assurance group, line organizations, and external organizations.

Focus on how the performance data is integrated with other data to arrest declining performance. This review includes the organization's response to identified issues.

C. Determine whether sufficient resources have been provided for performing work including the management of maintenance backlogs and correction of known deficiencies.

D. Evaluate the effectiveness of processes for communicating performance expectations, including the establishment of performance goals to address performance deficiencies.

E. By reviewing selected aspects of the employee concerns program, ensure that employees are not hesitant to raise safety concerns and that safety significant concerns entered into the employee concern program receive an appropriate level of attention.

F. Evaluate the effectiveness of the organization's use of industry information for previously documented performance issues.

Issue Date: 08/19/99 DRAFT XXXXX

  • ?

i NRC INSPECTION MANUAL AAAA Inspection Procedure XXXXX SUPPLEMENTAL INSPECTION FOR REPETITIVE DEGRADED CORNERSTONES. MULTIPLE DEGRADED CORNERSTONES. MULTIPLE YELLOW INPUTS OR ONE RED INPUT PROGRAM APPLICABILITY: 2515 FUNCTIONAL AREA: Initiating Events.

Mitigating Systems Barrier Integrity Emergency Preparedness Occupational Radiation Safety Public Radiation Safety Physical Protection INSPECTION BASIS:

The NRC's revised inspection program includes three parts: baseline inspections:

generic safety issues and special inspections; and supplemental inspections performed as a result of risk significant performance issues. The inspection program is designed to apply NRC inspection assets in an increasing manner when risk significant performance issues are identified. either by inspection findings evaluated using the significance determination process (SDP) or when performance indicator thresholds are exceeded. Accordingly, following the identification of an inspection finding categorized as risk significant (i.e., white, yellow, or red) via Table 2 of the SDP. or when a performance indicator exceeds the l

" licensee response band" threshold, the NRC regional office will perform {

supplemental inspection (s). The scope and breadth of these inspections will be based upon the guidance provided in the NRC's " Assessment Action Matrix" and the Supplemental Inspection Selection Table (included in 2515 Appendix B).

This procedure provides the supplemental response for repetitive degraded cornerstones, multiple degraded cornerstones, multiple yellow inputs, or one red input to the Assessment Action Matrix. The intent of this procedure is to provide the NRC with supplemental information regarding licensee performance, as necessary to determine the breadth and depth of safety, organizational, and programmatic issues. As such, this procedure is more diagnostic than indicative, and includes reviews of programs and processes not inspected as part of the baseline inspection program. The results of this inspection will aid the NRC in deciding whether additional regulatory actions are necessary to assure public l health and safety. These additional regulatory actions could include orders. '

confirmatory action letters, or additional supplemental inspections, as necessary .

1 Issue Date: 08/19/99 DRAFT XXXXX .

i.

to confirm that corrective actions to the identified performance concerns have .'

been effective. i This procedure was developed with consideration of the following boundary conditions:

e the NRC is performing the inspection:

e the procedure is not intended to be used for event response:

  • new issues identified by the team will be evaluated using the safety determination process during the course of the inspection; other process issues will be. documented in the inspection report: and.

. the procedure is intended to provide insight into the root and contributing causes of performance deficiencies, but is not intended to be a substitute for a more focused root cause analysis of specific performance issues to be performed by the licensee or by a third party.

XXXXX-01 INSPECTION OBJECTIVE (S) 01.01 To provide the NRC additional information to be used in deciding whether the continued operation of the facility is acceptable and whether additional regulatory actions are necessary to arrest declining plant performance.

01.02 To provide an independent assessment of the extent of risk significant issues to aid in the determination of whether an unacceptable margin of safety exists.

01.03 To' independently assess the adequacy of the programs and processes used by the licensee to identify. evaluate, and correct performance issues.

01.04 To independently evaluate the adequacy of programs and processes in the affected strategic performance areas.

01.05 To provide insight into the overall root and contributing causes of identified performance deficiencies. ,

01.06 To determine if the NRC oversight process provided sufficient warning to significant reductions in safety.

XXXXX-02 INSPECTION REQUIREMENTS The intent of this procedure is to allow the NRC to obtain a comprehensive understanding of the depth and breadth of safety, organizational, and performance i issues at facilities where performance data indicates the potential for serious '

safety issues. The procedure is not intended to duplicate the scope of previously performed baseline and supplemental inspections; however, some repetition may be necessary where previous inspections were not sufficient to '

fully scope the breadth and depth of licensee performance issues. Considerable XXXXX Issue Date: 08/19/99 2

,. leeway has been built into the procedure to allow it to be customized, to better e reflect the previously identified performance issues.

02.01 Strategic Performance Area (s) Identification: - Using the information contained in the Assessment Action Matrix, identify the strategic performance areas for which performance has significantly declined. The scope of this inspection will focus on the key attributes of these identified strategic performance areas. Specific inspection requirements pertaining to each strategic performance area and key attributes are contained in Sections 02.03 - 02.05 of the procedure. Also. Section 02.02 " Review of Licensee Control Systems for Identifying. Assessing, and Correcting Performance Deficiencies ~ should always be performed regardless of the strategic performance areas selected for review.

02.02 Review of Licensee Control Systems for Identifying. Assessing, and Correcting Performance Deficiencies Once significant performance concerns have been identified in the Action Matrix, the NRC requires confidence that licensee systems for identifying. assessing, and correcting performance deficiencies are sufficient to prevent further performance degradations. The following inspection requirements evaluate whether licensee programs are sufficient to prevent further declines in safety that could result in unsafe operation.

A. Determine whether licensee evaluations of, and corrective actions to.

significant performance deficiencies have been sufficient to correct the deficiencies and prevent recurrence.

B. Evaluate the effectiveness of audits and assessments performed by the .

quality assurance group, line organizations, and external organizations. I Focus on how the performance data is integrated with other data to arrest l declining performance. This review includes the organization's response to identified issues.

C. Determine whether sufficient resources have been provided for performing work, including the management of maintenance backlogs and correction of  ;

known deficiencies.

D. Evaluate the effectiveness of processes for communicating performance expectations, including the establishment of performance goals to address performance deficiencies.

E. By reviewing selected aspects of the employee concerns program, ensure  !

that employees are not hesitant to raise safety concerns and that i safety significant concerns entered into the employee concern program receive an appropriate level of attention. i F. Evaluate the effectiveness of the organization's use of industry information for previously documented performance issues.

Issue Date: 08/19/99 DRAFT XXXXX

~

02.03 Assessment of Performance in the Reactor Safety Strategic Performance -

Area P A. Inspection Preparation:

1. Develop an information base to allow the review of the effectiveness of corrective actions.
a. Compile performance ir. formation from the licensee's corrective action program, audits, self-assessments, licensee event reports (LERs), and the inspection report record (both the inspection reports and the PIM) for the time period determined by the team manager,
b. Review the compiled information and sort the issues by the key attributes listed below.
2. Select a system (s) for focus using the plant specific individual plant evaluation (IPE) and issues identified as part of the performance information developed above.
3. Perform the following inspection requirements for each key attribute focusing on the selected system.
4. The Inspection Requirements for the emergency response organization (ER0) readiness key attribute are meant to be performed as written.

if performance in this cornerstone was not the cause for this inspection. If ERO performance was the reason for entering this procedure, a more detailed ER0 assessment plan will be necessary.

In this case, the specific inspection plan shall include the additional inspection requirements and shall be approved by the team manager.

B. Key Attribute - Design:

Inadequacies in the design, the as-built configuration, or the post-installation testing of plant modifications can cause initiating events, affect the capability and reliability of mitigating systems, and the margin of safety in barrier design. As plants age, their design basis may be misunderstood or forgotten such that an important design feature may be inadvertently removed or disabled as changes are made to the plant.

Independently assess the extent of risk significant design issues by performing the following inspection requirements. The review shall cover the as-built design features of the selected system to verify its capability to perform its intended functions with a sufficient margin of safety. Focus will be on system modifications rather that original system design. Information from this inspection will be used to assess the licensee's ability to maintain and operate the facility in accordance with the design basis.

~

XXXXX Issue Date: 08/19/99

v

1. Assess the effectiveness of corrective actions for deficiencies

}. involving design.

2. Select several modification to the system for raview and determine if the system is capable of functioning as specified by the current design and licensing documents, regulatory requirements. and commitments for the facility.
3. Determine if the system is operated consistent with the design and licensing documents.
4. Evaluate the interfaces between engineering, plant operations, ,

maintenance, and plant support groups.  !

l C. Key Attribute - Human Performance By nature of the design of nuclear power plants and the role of plant personnel in maintenance, testing and operation: human performance plays an important part in normal, off-normal and emergency operations. Human performance impacts each of the cornerstones and therefore should be considered across this entire inspection.

The team members reviewing the specific key attributes should coordinate their activities to ensure that the following requirements are addressed:

1. Assess the effectiveness of corrective actions for deficiencies involving human performance
2. Review specific problem areas and issues identified by inspections to determine if concerns exist in the following human performance '

areas:

a. Organizational Practices such as pre-job briefings, control room team work, shift turnover, self-checking and procedural l use and adherence,
b. Training and Qualifications,
c. Communications,
d. Control of Overtime and Fatigue,
e. Human-System Interfaces including work area design and environmental conditions.

D. Key Attribute - Procedure Quality Inadequate procedures can cause initiating events by inducing plant personnel to take inappropriate actions during plant operations, maintenance, calibration, testing, or event response. Adequate procedures also assure proper functioning of mitigating systems during operation, maintenance, and testing. Emergency and abnormal operating procedures are also essential for mitigating system performance and l

< assuring appropriate actions will be taken to preserve RCS and . I Issue Date: 08/19/99 DRAFT XXXXX l

containment integrity. To the extent that there are procedure ,

deficiencies associated with the above noted activities they should be  ;*

identified as causes of problems in other key attributes.

Determine the technical adequacy of procedures by verifying that they are consistent with desired actions and modes of operation by completing the following inspection requriements.

1. Assess the effectiveness of corrective actions for deficiencies involving procedure quality.
2. Evaluate the quality of procedures and as applicable, determine the adequacy of the development and revision processes.

E. Key Attribute - Equipment Performance Equipment failure or degradation can cause initiating events during power operation and losses of decay heat removal during shutdowns. To limit challenges to safety functions due to equipment problems, licensees should have programs to achieve a high degree of availability and reliability of equipment .that can cause initiating events. The availability and reliability of equipment is also critical to mitigating the impact of initiating events on plant safety. Strong preventive and corrective maintenance programs are an integral part of assuring equipment availability and reliability.

Determine that the licensee is adequately maintaining and testing the functional capability of risk significant systems and components by completing the following inspection requirements.

1. Assess the effectiveness of corrective actions for deficiencies involving equipment performance, including those equipment / system issues raised within the context of the Maintenance Rule.
2. Determine if the licensee has effectively implemented programs for control and evaluation of surveillance testing, calibration, and inservice inspection required by the Technical Specifications and 10 CFR Part 50.55a(g).
3. Assess the operational performance of the selected safety system to verify its capability of performing the intended safety functions.

F. Key Attribute - Configuration C-ontrol Loss of configuration control of risk-significant systems or equipment I can lead to the initiation of a reactor transient and/or can compromise I mitigation capability. Maintaining proper water chemistry in the RCS is essential to long term reliability of both the nuclear fuel and the RCS pressure boundary. Proper configuration control is necessary to maintain assurance that the RCS pressure boundary is maintained intact and monitored for degradation. Containment integrity depends on maintaining the configuration of penetrations and safety-related systems that need to respond following an accident. Also, maintaining the XXXXX Issue Date: 08/19/99

V containment within its design limits ensure that it will be able to

? accommodate a design basis or severe accident.

Assess the licensee's ability to maintain risk-significant systems and the principle fission product barriers in configurations which support their safety functions by completing the following inspection requirements.

1. Assess the effectiveness of corrective actions for deficiencies involving configuration control.
2. Perform a walkdown of the selected system. In addition, if the selected system does not have a containment over-pressure safety function, conduct an additional review of such a system.
a. Independently verify that the selected safety system is in proper configuration through a s'ystem walkdown.
b. Review temporary modifications to ensure proper installation -

in accordance with the design information.

3. Determine that the work control process uses risk appropriately during planning and scheduling of maintenance and surveillance testing activities and the control of emergent work.
4. Determine whether the primary and secondary chemistry control programs adequately control the quality of plant process water to ensure long-term integrity of the reactor coolant pressure boundary.
5. Assess the programs and controls (tracking systems) in place for ,

maintaining knowledge of the configuration of the fission product barriers including: containment leakage monitoring and tracking, containment isolation device operability (valves. blank flanges),

and reactor coolant leakrate calculation and monitoring.

6. Review the results of the plant specific IPE relative to the system (s) selected. Determine if the IPE is being maintained to reflect actual system conditions regarding system capability and reliability.

G. Key Attribute - Emergency Response Organization Readiness Implementation of the Emergency Response Plan is dependent on the readiness of the emergency response organization to respond to an emergency. Licensee Self-assessments of preparedness during drills and j exercises are used to identify successful performance and areas for improvement. Self-assessment and corrective action resolution is critical to ERO proficiency. In-addition, timely ERO augmentation of onshift personnel is critical to overall performance.

l Determine whether shift staffing for emergencies is adequate in numbers l and in functional capability and that administotive means are available and maintained to augment the emergency organization in a timely manner.

Issue Date: 08/19/99 DRAFT XXXXX l

1. Assess the effectiveness of corrective actions for deficiencies .

involving emergency response. .'

2. Verify that adequate staffing is available onshift for emergencies.
3. Verify the capability to activate the emergency response facilities and augment the response organization within the requirements of the licensee emergency response plan.
4. Perform walk-throughs with shift crews to assess the ability to perform their emergency assignments, responsibilities, and authorities.

02.05 Assessment of Performance in the Radiation Safety Strategic Performance Area To be developed.

02.06 Assessment of Performance in the Safeguards Strategic Performance Area To be developed.

02.07 Group the safety performance deficiencies identified during the inspection by appa. rent root and contributing causes.

02.08 Compare the team's findings with previous performance indicator and inspection program data to determine whether sufficient warning was provided to identify a significant reduction in safety. Evaluate whether the NRC assessment process appropriately characterized licensee performance based on previous information.

XXXXX-03 INSPECTION GUIDANCE General Guidance ,

This procedure provides a framework for conducting a comprehensive assessment of licensee performance in affected strategic performance areas. As such, the procedure is broad in scope, but is designed to allow focus in certain areas where performance concerns have already been identified. While some inspection should be performed for each key attribute, cer.ain inspection guidance is only applicable if problems are identified in that area. The team leader should ensure that an appropriate balance'is maintained between determining the depth of previously identified issues and determining the breadth of performance issues within the strategic performance area.

In order to consolidate inspection activities, the team manager may decide to include a continuous main control room r/>servation as part of the inspection.

Experience has shown that this type of observation is most effective if performed with two inspectors per shift for a minimum duration of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The intent is XXXXX Issue Date: 08/19/99

.. for one inspector to observe main control room activities, while the second inspector ooserves activities external to the main control room (work control.

operator rounds, testing. system walkdowns, and personnel interfaces between departments). The results from the main control room continuous observation should satisfy several inspection requirements for the key attributes of configuration control, equipment performance. human performance, and procedure quality.

Soecific Guidance 03.01 Strategic Performance Area (s) Identification.

No additional guidance provided.

I 03.02 Review of Licensee Control Systems for Identifying. Assessing, and Correcting Performance Deficiencies 1

A. The inspector should evaluate whether evaluations into significant ]

deficiencies are of a depth commensurate with the significance of the issue. Evaluations should ensure that the root and contributing causes of risk significant deficiencies are identified. Corrective actions should be taken to correct to immediate problems and to prevent recurrence. More specific guidance for assessing root cause analyses and licensee corrective actions is contained in supplemental inspection procedure 95001. In fulfilling this inspection requirement, consideration should be given to previous NRC reviews of root cause analyses, including those performed during previous supplemental inspections. To the extent possible, this inspection should focus more on evaluations and assessments associated with programmatic performance issues and organization deficiencies, rather than those related to specific hardware issues.

B. Line organization. quality assurance, and external audits and assessments should be reviewed to determine whether the licensee has demonstrated the capability to identify performance issues before they result in actual events of undesired consequence. The findings of these audits and assessments should be integrated with more quantitative performance metrics and compared to those findings identified during this and other NRC inspections. Management systems should be in place to process and act upon this performance data as appropriate. The inspector should evaluate management's support to the audit and assessment process, as evidenced by staffing of the quality organization, responsiveness to audit and assessment findings, and contributions of the quality organization to improvements in licensee activities.

C. Processes for authorizing modifications and allocating resources for completing work.should give adequate consideration to safety (risk) and the need for abiding by regulatory requirements. Sufficient resources should be available to maintain a manageable maintenance backlog and prevent the need for multiple work-arounds that could increase the likelihood of an initiating event or complicate accident mitigation.

D. Performance goals directed at performance issues should be in alignment throughout the organization. To complete this requirement, a review Issue Date: 08/19/99 DRAFT XXXXX

7 .

should be performed of corporate, site and organizational strategic -

plans, as well as other associated licensee documents. -

E. Using the guidance contained in Inspection Procedure 40001, perform a limited review of the licensee's program for the resolution of employee concerns. In selecting samples for review. focus on those concerns and programs specifically applicable to the strategic performance areas which are the subject of this inspection. The intent of this review is to determine: (1) whether weaknesses in the employee concerns program have contributed to previously identified performance deficiencies: (2) whether additional safety issues exist that have not been adequately captured by the corrective action program: and. (3) whether weaknesses in the employee concerns program have resulted in issues associated with the maintenance of a safety conscious work environment.

F. The team's review of licensee industry information programs should be limited to those problems that might have contributed to the previously identified performance concerns. For example, weaknesses in licensee programs to review and assess vendor information may have contributed to equipment problems.

03.03 Assessment of Performance in the Reactor Safety Strategic Performance Area A. Inspection Preparation:

1. No specific guidance provided.
2. System Selection. During the planning process. the team leader should select a system (s) based on the plant IPE. past safety system functional inspections that may have already been performed on a system by the licensee or by other NRC teams, and through review of issues contained in the Assessment Action Matrix. The team leader may cons.ider selection of a less prominent safety system that may have received less review from the NRC staff and the licensee.

The team should select a number of electrical, mechanical, and instrumentation and control components for detailed review. The majority of these components should be from the principal system with the remainder from support systems which are necessary for successful operation of the principal system or from interfacing safety systems served by the principal system.

3. No specific guidance provided.

l 4. No specific guidance provided.

B. Key Attribute- Design The design review portion of the inspection should be performed by

, inspectors (or contractors) with extensive nuclear plant design experience. It is alsa important that the inspectors performing the design review have a gaad understanding of integrated plant operations.

XXXXX Issue Date: 08/19/99 l

)

.- I l

,- maintenance, testing. and quality assurance so that they are able to relate their findings to the other areas being inspected.

The inspectors should focus their review on the system selected in paragraph 02.03. A.2. Specific supplemental inspection procedures are available for certain systems (e.g. service water. electrical. I/C) and should be considered as additional guidance for evaluating their functional adequacy. Prior to evaluating the selected system. the inspectors should review the design basis documents such as calculations  !

and analyses. The review should provide the inspectors an understanding j of the functional requirements for each system and each active component J

throughout the range of required operating conditions including accident and abnormal conditions. The intent is to focus on the risk significant aspects of design that could contribute to an increased frequency of initiating events, degradation of mitigation systems, or degradation of barrier integrity. The inspection is not intended to be a re-validation of the original system design.

In selecting a sample of modifications to the system to be reviewed. the  ;

inspectors should concentrate on those' modifications with the potential to significantly alter the system design and functional capability. The sample should include modifications involving vendor supplied products or services where practicable. since the licensee's ability to oversee vendor supplied services is an important aspect of design control. Inspectors should consider expanding the sample of modifications. if iignificant problems are found. Thic expansion should consider other similar modifications and should not be limited to the initially selected system.

The following inspection guidance covers a comprehensive number of design areas. The inspectors should focus their review as necessary to best reflect previous performance deficiencies.

1. No specific guidance is provided for this requirement.
2. For the selected modifications:
a. Verify that the design and licensing input and output information has been properly controlled.
b. Check the adequacy of design calculations for the selected modifications and Consider the following when evaluating the calculation design parameters of the following components: i (1) For valves: What permissive interlocks are involved? What differential pressures will exist when the valve strokes?

Will the valve be repositioned during the course of the ,

event? What is the source of control and indication power?

What control logic is involved? What manual actions are required to back up and restore a degraded function?

(2) For oumos- What are the flow paths the pump will experience during accident scenarios? Do the flow paths change? What permissive interlock and control logic applies? How is the pump controlled during accident Issue Date: 08/19/99 DRAFT XXXXX

7 conditions? What manual actions are required to back up . I and restore a degraded function? What suction and '

discharge pressures can the pump be expected to experience I during accident conditions? What is the motive power for the pump during all conditions? Do vendor data and J specifications support sustained operations at low flows?

{

(3) For instrumentation and automatic controls: What plant parameters are used as inputs to the initiation and control system? Is operator intervention required in certain scenarios? Are the range and accuracy of '

instrumentation adequate? What is the extent of surveillance and calibrations of such instrumentation?

c. Compare the as-built design vsth the current design basis and the licensing requirements for the selected system and consider the following questions:

(1) Verify that the modification does not invalidate assumptions made as part of the original design and the accident analyses, including interfaces with supporting systems. For example, are service water flow capacities sufficient with the minimum number of pumps 'available under accident conditions? Are. the voltage studies accurate and will the required MOVs and relays operate under end-of-life battery conditions and degraded grid ,

voltages? Are fuses and thermal overloads properly sized?

Are current de loads within the capacity of the station batteries? Is the instrumentation adequate in range and accessibility for operations to control the system under normal and abnormal conditions? Are maintenance frequencies sufficient to maintain the equipment within the range of acceptable operating parameters such as motor operated valve friction factors? Are test results for the system consistent with the design assumptions?

(2) Does the modification invalidate design input parameters provided to accident analyses vendors?

-(3) Have modified structures surrounding safety equipment. >

components. or structures been evaluated for seismic 2-over-1 considerations? Have modified equipment or components under the scope of 10 CFR 50.49 been thoroughly evaluated for environmental equipment qualification considerations such as temperature, radiation, and humidity?

I

d. Verify whether the selected modifications have introduced an l unreviewed safety question.
e. For.the selected system, review recent changes to maintenance  !

procedures and operating procedures to confirm that the changes have not introduced new design parameters or changed current {

. design parameters. Confirm that any such design changes have ]

XXXXX Issue Date: 08/19/99

L .

. beensubjectedtotheformaldesignchangeprocess(e.g.50.59 l review). j Examples of potential inadvertent design changes follow:

(1) changing maintenance / surveillance procedures to tighten the packing on the main steam non-return check valves such that they are -no longer free-swinging gravity-closing valves:

(2) changing emergency operating procedures to require that operators immediately throttle auxiliary feedwater following a reactor trip to prevent pump runout / failure that could otherwise occur during a main steam line break.

f. Ensure that verification and validation of computer programs used for design and for monitoring of important safety features has been adequately accomplished.
3. Consistency between_ system design and operation.
a. Verify that operating procedures, training documentation and training programs are consistent with the current design.
b. Verify that operator actions can be performed in the required time-frame to mitigate design basis events. Verify that any changes to operator actions resulting from system modification (s) have been subjected to a safety evaluation and are consistent with the UFSAR including the accident analyses.

(1) Was reliance on the operator actions approved by the NRC? {

(2) Is there reasonable assurance that, under all anticipated circumstances (e.g. lighting, ambient temperature, i radiation levels) operators can perform the actions within the times assumed in the accident analyses?

4. Evaluation of communications affecting design control
a. Assess the ability to communicate accurate information on the status of system modifications. Plant policies on updating design related material such as the UFSAR may not support timely documentation of changes to the system. Verify that provisions are in place and being followed to assure the accurate recording of the as-designed and as-built conditions during the interim period between modification implementation and incorporation into the plant design basis documents.
b. Verify that operations involves engineering in determining the operability of degraded SSC's.

Issue Date: 08/19/99 DRAFT XXXXX -

c. Verify that operations, engineering, maintenance, and affected .

plant support grouos are involved in 'the evaluation and c concurrence process for approving:

(1) performance of non-routine maintenance activities (2) temporary modifications (3) field change requests

. d. Review the licensee's control of vendor supplied services and products including the evaluation for technical adequacy and  ;

quality assurance. The licensee's evaluation and control of vendor supplied services and products should be multi-disciplinary in its approach, including operations, engineering, maintenance, and the affected plant support groups.

e. Verify that self-revealing deficiencies and those identified

.by the licensee's vendor- control process are properly communicated to the vendor.

C. Key Attribute - Human Performance

1. Using data from the corrective action program. LERs. and licensee assessments, determine if human performance issues have contributed to performance issues. Evaluate the overall effectiveness of human performance corrective actions.
2. Review the following attributes of human performance, as related to the_previously identified human performance issues.
a. Organizational Practices - perform only those steps related to previous performance deficiencies.

(1) For operations, assess whether:

(a) The turnover environment is adequate for clear communication: whether on-coming operators are walking down panels with current operators or independently; and whether the turnover process is procedura11 zed and procedures are being followed:

(b) the operators exhibit attentiveness and a questioning attitude:

(c) necessary plant status information is identified, and equipment / operational problems are discussed in enough detail for the oncoming shift to understand.

After turnovers, verify that the operators have sufficient knowledge of the plant conditions and activities in progress.

XXXXX. Issue Date: 08/19/99

.~

.. . Inspectors should try to observe at least two different )

shifts, including a back-shift. j 4

~

(2) For on-line maintenance work windows, complex surveillance and tests, verify that the activities are coordinated with the control room, the shift supervision is maintaining j effective control of plant operations, and the control  !

room is implementing the compensatory measures required by -

the risk / safety evaluation. Observe pre-evolution briefings and communication between operations and other disciplines to verify that effect on safety and risk is being considered.

(3) Review a number of scheduled and non-scheduled maintenance activities. Question the control room operators to determine their awareness of ongoing activities that could affect plant operations, and the priorities in resolving plant issues and equipment problems. The intent '

here is for the inspector to verify that control room personnel are appropriately aware of ongoing activities.

such as maintenance, surveillance and testing, plant equipment taken out of service, and their impact on plant operation: and are implementing the necessary actions.

(4) Perform a tour of the plant and note indications of operator work-arounds or conditions that might require work-arounds including:

(a) unapproved job aids or marking:

(b) inadequate equipment labeling:

(c) inadequate maintenance, surveillance, or operating procedures:

(d) equipment that is not performing as designed:

(e) the potential for adverse environmental condition (s), e.g., insulation removed frca high energy lines, doors left open that are required for area isolation during a high energy line break in an adjacent area, and open doors that may render l blowout panels and back-draft dampers inoperable.

(5) Observe operators perform evolutions, tests, and response ,

to annunciators, if possible.  !

(a) Verify that TS and/or procedure prerequisites were satisfied prior to execution of the procedure. ,

(b) Determine if operator actions or compensatory measures were required due to degraded equipment or plant conditions resulting in an operator work-around.

(c) Evaluate whether the evolution was performed in accordance with approved directives and night orders if applicable. Directives and night orders -

Issue Date: 08/19/99 DRAFT XXXXX

are often -issued by plant management. and disciplines like chemistry, reactor engineering, and systems engineering.

(6) If applicable, review the control room disabled annunciator logs. For selected safety-significant annunciators, question the operators as to why annunciators are in alarm conditions, what operator response was required by the procedure (s) and if taken, if continuously lit annunciator windows prevent annunciation of new alarm conditions, and why and how annunciators are removed from service. For control room and local annunciators that cause operator distractions, determine if a controlled process for their removal is in place that includes an assessment of operational impact, compensatory actions, authorization, and corrective actions for -

restoration. Also, review the alarm summary printout to determine if any significant alarms occurred that were not documented in the control room logs, and whether the operators were aware of and had taken appropriate action.

Review of the alarm summary printout may lead to important operator performance indication during and after a transient.

(7) Review the licensee's administrative procedure for shift supervisor's conduct and duties. Verify that shift command and control is maintained.

(8) Observe routine activities of nonlicensed personnel.

Determine whether these individuals are knowledgeable about the the current status of SSCs and equipment performance and understand the impact of ongoing work activities. Verify that procedural requirements are being met and that the procedure is implemented using the correct level of use (i .e. continuous, reference, etc. . .)

Determine how the individuals identify and communicate deficiencies to control room or supervision, and whether deficiencies are resolved using the corrective action program rather than implementing their own work-arounds.

b. Training and Qualifications For identified areas of human performance problems, verify that training and personnel qualification is adequate and appropriate for the level of work being performed.  ;

(1) If possible, observe classroom training and work in progress using the checklists of NUREG-1220. Training Review Criteria and Procedures. Rev.1.

(2) Using the guidance in Inspection Procedure 41500, perform a limited review of training problem areas. If necessary. l interview trainees, supervisors, and instructors using i the IP 41500 guidance.

XXXXX- Issue Date: 08/19/99

l l

c. Communications - perform only those steps related to previous performance deficiencies.

l (1) The inspector should assess the quality of communications '

by observing that:

(a) Communications are consistent with licensee procedures during the conduct of operations, maintenance and testing activities:

~ i (b) Instructions. or information disseminated using the plant's phone and paginr systems are clearly and concisely communicated:

(c) Personnel inform the appropriate level of management for any abnormal conditions or significant changes in plant equipment and systems.

(2) The inspector should review a sample of written logs and shift status reports or updates to verify that they: i (a) provida sufficient detail to allow a full j understanding of operationally significant matters. {

including abnormal occurrences or test results and any compensatory measures taken:

(b) describe changes in plant or equipment status.

(3) An evaluation should be performed to assess whether communications between departments and licensee management provide information needed for continued safe plant operation. Included should be:

(a) an evaluation of the responsiveness and timeliness to requests for assistance and problem resolution:

(b) an evaluation as to whether other departments are aware of the extent and significance of deficiencies that. cross-cut organizational boundaries.

d. Control of Overtime and Fatigue In instances where previous performance issues were related to the use of excess overtime perform the following reviews.

(1) Review the licensee's process for controlling overtime.

(2) Interview personnel identified as having worked overtime to determine how management ensures that personnel are not assigned to safety related duties while in a fatigued condition. ,

Issue Date: 08/19/99 DRAFT XXXXX

.- 1 (3) Interview personnel involved in working hours in excess of .

those listed in the plant's technical specifications (with or without approval) to evaluate indications of recurrent / routine use of overtime.

e. Human-System Interfaces including work area design and environmental conditions (1) Using the guidance contained in Inspection Procedure XXXXX perform a review of identified problem areas.

(2) As necessary, if specific problem areas are identified the inspector should: l (a) walk down several control panels to evaluate the size, shape, location, function or content of.

displays, controls, and alarms:

(b) evaluate panels and equipment for correct labeling:

(c) evaluate work areas for accessibility of equipment, equipment layout, emergency equipment location, including location of remote panels:

I

. (d) evaluate the impact of environmental conditions on human performance.

D. Key Attribute - Procedure Quality

1. Evaluate to what extent procedure quality has contributed to previously identified performance issues. In performing this evaluation, select a sample of procedures which reflect instances where problems with procedures have been documented in LERs. NRC inspection reports, or licensee assessments or audits. Focus on the technical adequacy of the procedures using the following guidance as a pplicable.
2. Development and review of procedures.
a. When reviewing procedures, the inspector should assess the technical ' adequacy of the procedures and determine if the procedural steps will achieve required system performance for normal, abnormal, remote shutdown, and emergency conditions.

The inspectors should determine if the system is operated in accordance with the system design.

b. Determine whether the procedures will accomplish the activity within the design characteristics and regulatory requirements.

During this evaluation, the review may include technical specifications. limiting condition for operation. UFSAR descriptions, vendor manuals, design information, piping and >

instrumentation drawings (P& ids), and instrumentation and electrical wiring and control diagrams.

l XXXXX Issue Date: 08/19/99

e

, c. Reviee maintenance procedures for technical adequacy. Determine if the procedures are sufficient to perform the maintenance task and provide for identification and evaluation of equipment and work deficiencies. Verify the use of quality verification holdpoints for independent verification of important attributes. Check the procedure content against the vendor manuals to verify that the procedure satisfies the vendor requirements for maintaining the equipment in proper working order. Verify that important vendor manuals are comple.te and up-to-date. Documents, such as vendor manuals, equipment operating and maintenance instructions, or approved drawings with acceptance criteria, may by reference be part of a procedure. If these documents are so used, the documents (or applicable portions) require the same level of review and approval as the procedure that references it.

d. If the technical adequacy of procedures is a concern review the following.

(1) Review a sufficient number of procedures to provide assurance that the procedures (including checklists and related forms) in the plant working files are current.

(2) Verify that personnel have the ability to reference an up-to-date and accurate copy of documents. This is necessary because the controlled drawings may not be revised, unless changes due to modifications are extensive. As an interim measure, some utilities have merked-up a controlled set of the control room documents to show the design changes. In such situations. the inspector should also verify that revisions of the controlled documents incorporating the marked-up changes are performed in a timely manner following the modification.

(3) Procedure changes should be in accordance with licensee processes and regulatory requirements. Verify the adequacy of all procedure changes which resulted from recent (within the last year) license change (s) or revision (s) to a technical specification.

(4) Verify procedure changes are in conformance to 10 CFR Part 50.59. This item applies only to changes to procedures which are described or summarized in the UFSAR. normally a small portion of the procedures in use at the facility.

General guidance and contrasting examples relating to the procedure changes which can be made by the licensee are described in NRC Inspection Manual Part 9900. " Guidance on 10 CFR 50.59 -- Changes to Facilities. Procedures, and Tests (or Experiments)."

(5) Through discussions with personnel and a review of approved procedures, determine if engineering and 1

Issue Date: 08/19/99 DRAFT XXXXX l J

technical support personnel contribute to the development, -

review, and approval of procedures.

(6) Incorporating accepted human factors principles about format and writing style into procedures increases the likelihood that the procedures will be easier to use and follow. Standards for format and writing style can usually be found in the licensee's writer's guide. Usability should be determined by evaluating the degree to which procedures follow the guidance outlined in the writer's guide.

(7) When a writer's guide is not available or if the writer's guide is in question. procedure usability can be determined by evaluating the elements of writing style, format and organization described in Inspection Procedure 42700. " Plant Procedures.~

e. Verify temporary procedures were properly approved and did not conflict with technical specifications requirements. Review a sample of temporary procedures and temporary procedure changes issued during the past year to determine that the approval and subsequent review requirements of the technical specifications are being followed. Determine whether the licensee has procedural limitations on how long a temporary procedure or a temporary procedure change can be in effect, and compare this with observed practices.
f. Review the method by which the licensee incorporates temporary changes to emergency or significant event procedures. The method used should not be so complicated as to preclude proper and timely operator action during abnormal plant conditions.

The NRC position concerning control of procedural adherence is described in NRC Inspection Manual Part 9900. " Technical Guidance. Operations -- Procedural Adherence."

g. NRC Inspection Procedure (IP) 42001. " Emergency Operating Procedures." and the NUREGs referenced in it provide additional guidance for reviewing, developing, implementing changing and maintaining emergency operating procedures. The team leader should consider adding an emergency preparedness specialist inspector to the team if a detailed review of emergency plan implementing procedures is to be conducted.

E. Key Attribute - Equipment Performance

1. Corrective actions.
a. Based on implementation of the maintenance rule. 10 CFR 50.65

" Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants", the inspectors should evaluate the maintenance area by concentrating on performance examples that have shown to be a product of poor maintenance programs.

Performance issues should be identified by the inspectors XXXXX Issue Date: 08/19/99

T .

during the review of non.-conformance reports, machinery history

results, plant tours, observation of maintenance work activities. LER reviews. and NRC and licensee's assessments.

Risk significant SSCs identified with poor performance should receive the highest priority. After identifying the performance issue, the inspectors should attempt to determine its cause and use this performance example as a means to establish issues in any of the maintenance related programs.

The inspectors should also see if the licensee appropriately i implemented the maintenance rule in correcting the performance {

issue and whether the licensee is maintaining an appropriate balance between SSC availability and reliability, {

b. Examples of maintenance program issues include a relatively large maintenance work request backlog related maintenance 4 work not being accomplished in accordance with written l administrative and procedural controls, and not identifying ]

procedures for needed changes.

2. Programs and processes for testing.
a. Determine that effective methods have been implemented for review and evaluation of surveillance test / calibration data, including procedures for reporting deficiencies, failures.

malfunctions, etc.. identified during the tests / calibrations or inspections with required verification of operability.

b. Review a sample of post-maintenance tests to ensure that the l tests are adequate to ensure that the equipment has been I returned to an operable configuration.
c. Verify that the surveillance test procedure acceptance criteria i are adequate to demonstrate continued operability. l
d. Verify that the licensee is effectively calibrating instruments that are important to safety. The Technical Specifications do not specify calibration requirements for some of these instruments. for example: boric acid tank temperature; discharge pressures for various engineered safety feature pumps: safety injection accumulator level and nitrogen cover gas pressure; cooling water flow to containment coolers; main steam isolation valve limit switches used to verify valve closure time and provide input to reactor protection system.
3. Operational performance of systems and components. Observe any maintenance or testing performed on the selected system while the inspection team is onsite.
a. Walk through the system operating procedures and the system P& ids. If any special equipment is required to perform these procedures, determine if the equipment is available and in good working order. Verify that the knowledge level of operators is adequate concerning equipment location and operation.

Issue Date: 08/19/99 DRAFT XXXXX

b. Conduct interviews with licensee personnel to determine how the '

system is operated. Determine if system operation is consistent with the intended safety function.

c. Determine if the environmental conditions assumed under accident conditions are adequate for remote operation of equipment, such as expected room temperature, emergency lighting, steam, radiation levels, etc.
d. Review the maintenance program for the selected system to ,

determine if the preventive maintenance (PM) requirements are adequate and comprehensive,

e. Review applicable design documents, vendor manuals, generic communications (i.e. Bulletins. Information Notices. Generic Letters, and special studies) and verify that the licensee has integrated and implemented the applicable items into the maintenance program.
f. Conduct interviews with personnel to determine what maintenance and modifications have been performed. Determine if the maintenance and modifications are consistent with the licensing hasis.
g. Determine if engineering input into maintenance activities is at an appropriate level to ensure safe and reliable plant operations.
h. Verify that methods and responsibilities have been designated for performing functional testing of structures, systems, or components following maintenance work and/or prior to their being returned to service.

F. Key Attribute - Configuration Control

1. Select a sample of the corrective action process /PIM issues related to configuration control and review the adequacy of the corrective actions implemented. Review all operability determinations that have been completed on the selected system.
2. System Walkdown
a. For the selected system, obtain current drawings and review the associated operating procedures and UFSAR sections. Review the licensee's system lineup procedure, system design basis documents, and determine whether the documents are consistent with the as-built configuration.

Compare system line-up procedures with drawings to ensure that they are consistent (e.g., valve positions. installation of blank flanges and caps)

b. Review jumper, lifted lead, and other temporary modification logs. Determine (1) if an adequate technical review was

~

XXXXX Issue Date: 08/19/99

, performed before the plant modification was performed. and (2) if plant drawings were updated, as needed, to reflect the change. Temporary modification reviews should assess the thoroughness of 10 CFR 50.59 evaluations. The licensee's controls for limiting the duration of temporary modifications should be reviewed. Assess the role of the plant, system, and design engineering groups in the temporary modification process.

c. Determine if accessible valves in the system flow path are in the correct positions by either visual observation of the valve; by flow indication: or by stem, local or remote position indication and that they are locked or sealed if appropriate.
d. Verify that valves do not exhibit excessive packing or boron leakage, missing hand-wheels or bent stems. Ensure that local and remote position indications are functional and indicate the same -values. Remote manual operating devices should be functional.

4

e. Verify that pump seals do not show signs of excessive leakage.
f. Verify that cooling water is aligned to bearings and seals and that oil bubblers and bearings do not show signs of excessive leakage.
g. Verify that power is available and correctly aligned, functional, and available for components that must activate on receipt of an initiation signal.  !
h. Verify that major and support system components are correctly labeled, lubricated, cooled, and ventilated to ensure fulfillment of their functional requirects i
1. Review system mechanical joints (packing, flanges, body to bonnet joint) leakage requirements and verify that known  ;

o leakage is properly addressed and that observed leaks are accounted for.

j. Determine if selected instrumentation, essential to system actuation,. isolation, and performance, is correctly installed and functioning, correctly calibrated, and displaying indication consistent with expected values. Instrument elevations are consistent with design documents.
k. Identify whether actual or potential adverse environmental condition (s) exist, and the adequacy of any compensatory measures.
1. Identify whether components inspected for the system are consistent with the UFSAR description. Determine whether a 10 CFR 50.59 safety evaluation was performed for any items that differ from the UFSAR description.

~

Issue Date: 08/19/99 DRAFT XXXXX

m. Identify additional equipment conditions and items that might degrade plant performance by verifying whether: -

(1) Freeze protection, such as insulation, heaters, heat tracing, temperature moritoring, and other equipment, is installed and operational. .

)

(2) Hangers and supports are in their proper positions, aligned correctly, and intact.

(3) No unauthorized ignition sources or flammable materials are present in the vicinity of the system being inspected.  !

(4) Cleanliness is being maintained.

(5) Temporary storage of material and e,quipment is in accordance with the licensee's seismic control procedures and does not interfere with equipment operations or operator. actions.

3. Maintenance Work Control
a. . Determine the nature and extent of the licensee's backlog of corrective. an:1 preventive maintenance, especially concerning equipment of high safety significance. Assess the licensee's efforts to integrate preventive and corrective maintenance to minimize equipment unavailability.
b. Assess the licensee's process for planning work, including the assessment of risk and the inclusion of new emergent work into the schedule. Review the licensee's policies with respect to schedule generation and the use of risk insight. Select several work packages on safety related equipment and determine how risk was factored into their scheduling.

(1) What risk assessment tools are provided to the operators?

(2) What risk training has been given to the planning staff?

(3) Who has the absolute say in allowing work to progress?

l (4) How is emergent work factored into previous risk evaluations?

c. For. the selected systems review the operating performance history and the associated maintenance rule performance goals and compare them with the assumed out-of-service times in the IPE. Ensure that the assumptions are conservative with respect to actual equipment performance.

Verify that the risk information used in the planning process is derived from the IPE.

a XXXXX Issue Date: 08/19/99

__ -yc

. d. If warranted as a result of past performance deficiencies.

select one or more safety system tag-outs for inspection.

Determine if the tagout is adequate for the work to be accomplished. Verify in the plant that operators are thorough in tagging and isolation of plant equipment. Verify by observation that tags are properly hung and equipment has been placed in the designated position. Determine if equipment status changes and corresponding entry into or exit from technical specification action statements are appropriately documented.

e. If warranted as a. result of past performance deficiencies, determine if the licensee has adequate controls to ensure the independent verification of equipment status, particularly when equipment is returned to service.
f. Verify that maintenance activities are coordinated with control room operations and that appropriate briefings and turnovers '

are held with control room operators.

g. Equipment that is environmentally qualified should be identified as such prior to maintenance and sufficient controls should exist to ensure it is returned to that status upon reassembly, i
h. The inspectors should review the following: long-term (typically greater than six months) tagouts (caution and danger tags). disabled control room annunciators and instruments. '

control room deficiencies, operator work arounds and other equipment deficiency tracking systems to assess the  ;

significance of these conditions.

]

1

1. If warranted as a result of past performance deficiencies. '

review the licensee's process for using rapid response maintenance teams.

J. Verify that work control procedures have been established to require special authorization for activities involving welding.

open flame, or other ignition sources and take cognizance of nearby flammable material. cable trays, or critical process equipment. Ensure that work control procedures have been established to require a firewatch, with capability for communication with the control room. if an activity identified above is to be performed in the proximity of flammable material ' cable trays, or vital process equipment.

4. Chemistry Controls - limit reviews to primary and secondary chemistry which could degrade the RCS pressure boundary.
a. Review records of completed chemical analyses to determine if required analyses have been performed. l
b. Review trends of recorded water quality data.

Issue Date: 08/19/99 DRAFT XXXXX

c. Assess corrective actions taken when chemical variables have exceeded the established levels or limits, including .'

consideration of the timeliness of these actions.

d. Assess the effectiveness of measures taken to prevent the introduction of chemical contaminants into primary and secondary coolant water and to detect the presence of these contaminants.
5. Fission Product Barrier Assessment
a. Observe a selected portion of the containment isolation lineup and independently verify whether valves, dampers and airlock doors are being properly controlled in accordance with the Technical Specifications.

Select several components and independently verify that they are in their required positions. Where possible, confirm valve position indication by direct observation of valve mechanism.

For valves that isolate on a containment isolation signal verify proper breaker position and availability of power supply. Also._ for motor and air-operated valves, verify they are not mechanically blocked and power is available, unless it is required to be otherwise. Inspect piping and the associated test, vent and drain valves. if any, for possible leakage paths.

b. Assess the licensee's method of calculating the RCS leakrate.
c. Containment temperature and pressure monitoring - review the licensee's procedures for ensuring' that the containment atmosphere and/or water space meets the design basis assumptions for average temperature and pressure.

G. Key Attribute Emergency Response Organization Readiness Evaluations conducted in accordance with this procedure are limited to the

. staff, activities, records, and facilities of the licensee. Where necessary to verify licensee performance concerning interactions with organizations and persons involved in offsite emergency preparedness, these activities are limited to reviews of pertinent records available through the licensee. If additional information is needed about offsite emergency preparedness, it can be obtained from FEMA.

Should a more detailed assessment plan need to be developed, the following inspection procedures provide relevant inspection guidance:

82201 Emergency Detectica and Classification 82202 Protective Action Decision Making 82205 Shift Staffing and Augmentation 82207 Dose Calculation and Assessment 82701 Operational Status of the EP Program

~

XXXXX Issue Date: 08/19/99

I i

, Licensee provisions for shift staffing and augmentation may be found in

, the site-specific emergency plan and should be commensurate with the goals  ;

in Supplement 1 to NUREG-0737. The inspector should review relevant '

portions of the emergency plan and other relevant documentation. In addition administrative mechanisms to meet shift staffing and augmentation goals should be consistent with the emergency response plan to assure required staffing levels are maintained.

1. Corrective Action Evaluate the effectiveness of corrective actions for emergency preparedness deficiencies. By a review of the licensee's corrective action system (s), commitments, maintenance logs, work orders and other relevant documentation, and by discussions with responsible personnel and

~ direct observation..it can be determined whether identified problems were reviewed by appropriate management, prioritized commensurate with safety significance, appropriately assigned and whether corrective actions were technically correct and performed in a timely manner.

2. Onsite Staffing
a. Ensure that the minimum onshift staffing meets the requirements of the emergency plan,
b. 9~e that the fire brigade staffing meets the requirements u e fire protection plan. Regulatory guidance and requirements regarding the adequacy of fire brigade staffing can be found in 10 CFR 50. Appendix R. the facility Fire Hazard Analysis Report the Technical Specifications, the Update Final Analysis Report. NRC Appendix A to Branch Technical Position BTP 9.5-1 " Fire Protection Program." or NRC Branch Technical Position BTP CMEB 9.5.-l " Fire Protection Program."
3. Emergency Response Staffing
a. Ensure that the ERO staffing accounts for the positions needed to be filled in the technical Support Center (TSC) and the Emergency Operations Facility (E0F) in accordance with the emergency plan,
b. Review relevant licensee records and documentation to determine if augmentation drills were held as required by the emergency plan and whether augmentation goals were met. If the augmentation goals are not consistently achieved in drills (i.e., the last person capable of all assigned functions arrives more than 15 minutes past the goal). further review and discussion with the licensee should be conducted to determine the cause.
c. Administrative mechanisms to meet shift staffing and augmentation goals should be consistent with the emergency plan. The inspector should review the following:

Issue Date: 08/19/99 DRAFT XXXXX

(1) The administrative system in effect to ensure that

  • offshift personnel are available if needed (e.g.. Duty ,

.0fficer system, pagers, etc.).

(2) The call-in procedures used by the licensee and periodic documentation of their effectiveness in assuring that the emergency response organization can be properly staffed.

(3) Documentation to verify augmentation times.

4. Verification of Licensee Performance
a. Perform a walk-through with a shift crew, including the Shift Supervisor and Shift Technical Advisor, on one or more shifts.

During the walk-through, personnel should be able to (1) evaluate hypothetical conditions or data. (2) identify respective emergency action levels. (3) evaluate or, where appropriate. perform dose calculations (4) classify .the emergency using the latest procedures, and (5) recommend appropriate protective actions.

b. A small sample of significant changes to the licensee's emergency operating, abnormal operating, emergency response l procedures and equipment can be examined and discussed with  ;

personnel to determine whether they are aware of the changes, understand them and have received training appropriate for their use.

c. If possible, observe a fire drill, practice session, or review a past drill to assess the effectiveness of the organization and training of the fire brigade. Attention should be placed on the interaction between the brigade and the control room, and their ability to minimize the damage to equipment needed for the safe shutdown of the reactor.

4 03.05 Assessment of Performance in the Radiation Safety Strategic Performance Area TBD 03.06 Assessment of Performance in the Safeguards Strategic Performance Area TBD 03.07 Using the results from this inspection. in conjunction with information obtained from the NRC's review of previous root cause analyses that may have been performed by the licensee or others, attempt to group the ~

apparent causes of the risk significant performance issues. The issues should be grouped using a structured technique such as that provided by MORT analysis. An attempt should be made to provide insight into the upper level causes of the performance iscues, as applicable. Also SRA's and other team members should conduct a detailed assessment of the

. collective safety assessment of the team's findings. This information XXXXX Issue Date: 08/19/99 m ._ _ . . _ . _ _ _ . _ . - .. .

]

E . 1

',, will be useful in evaluating the adequacy of licensee proposed corrective actions to the performance issues, and to aid in deciding if additional regulatory actions are warranted.

03.08 Perform a limited review of the NRC's assessment and inspection process at the subject facil.ity.

1. Should the results of this inspection indicate that a significant reduction in safety has occurred, compare the team's findings with current assessment data (both PIs and inspection findings) to determine if sufficient warning was provided. If the results of

' this inspection indicate that a significant reduction in safety has not occurred. compare the team's findings with the current assessment data to identify inconsistencies in the plant performance data.

2. Evaluate whether the NRC assessment process appropriately

-characterized licensee performance based upon the data that was provided. For example, were inspection findings appropriately H screened using the Significance Determination Process (SDP) for risk significance, and was this data appropriately entered into the NRC action matrix.

XXXXX-04 RESOURCE ESTIMATE The resource estimates provided are for direct inspection only, based on a three week on-site inspection. The hours required to compete the inspection may be less for plants where previously fdentified performance issues were isolated.

k At facilities with previously identified issues in multiple strategic performance areas, the hours may exceed the estimates provided.

Team Leader 120 4 Licensee Control Systems 240 -

Design 360 -

Human Performance 120 Procedures 120 -

Equipment. Performance 120 -

l Configuration Control 240 - 1 Emergency Organization Readiness 80-Radiation Safety - TBD Safeguards - TBD l.

t Review of Assessment Process 40 (not direct inspection) l XXXXX-05 REFERENCES END

)

Issue Date: 08/19/99 DRAFT XXXXX o

.4 . . _ . .. . w .. ? -- .m s . . . . .+ _ . . e.

- kthA4 r - . - ., -

, . , , . 7,..,,. .

7. .' . ..L *L- _

.) {

bel 99-02 [ Draft Rev. B]

Regulatory Assessment Performance Indicator Guideline gEI B U ( lI A I I R I I 5 1 155Ii19Ii l

i May 1999 5DITI 400 1774 I litill. NW WASHINGTON, O( 20006-3708 202.739.8000 www.ne

_ . . . . i NEI 99 02 (Draft Rev B) 7 May 1999 4

l 1

reponing periods are different than previously reported., If available at the tim 2 LER reference is noted.

3 4 The quanerly data repons are submitted to the NRC under 10 CFR 50.4 requir 5

should apply standard commercial quality practices to provide reasonable assura 6 quarterly data submittals are correct. Licensees should plan to retain the da 7

historical data requirements for each perfonnance indicator. For example, data as 8

the barrier comerstone should be retained for 12 months, data for safety system un 9 should be retained for 12 quarters.

10 11 The criterion for reponing is based on the time the failure or deficiency is identified, w 12 exception of the Safety System Functional Failure indicator, which is based on 13 LER. In some cases the time of failure is immediately known, in other cases there may 14 time-lapse while calculations are performed to detennine whether a deficiency e 15 some instances the time of occurrence is not known and has to be es 16 clarification is provided in specific indicator sections.

17 18 Numerical Reporting Criteria 19 Final calculations are rounded up or down to the same number of significant figu 20 Table 1.

21 22 Where required, percentages are reported and noted as: 9.0%,25%. j 23 24 Pilot Plant Project (June 1999 - December 1999) 25 A six-month pilot project will test and assess the new NRC regulatory assessmi 26 to full industrywide implementation on January 1,2000. Eight pilot sites have bee 27 test the complete process. Additional plants may also be involved in testing the perf 28 indicator segment, as described in this document.

29 30 The pilot olants will make reports. as described in this document. on a monthly basis 31 durine the nilot orotect. The data will be submitted electronically to the NRC within 14 32 calendar days of the end of each month.

p/4 33 to includeindicator 34 ThepiMfplants will make the initial data submittal to.NEtby May 14,1999, .

35 d or two years ([Q/98 .4 Q/99) or at least sufficient to calculate one indicator. Su  !

36 Cjat8y-data repons for thepilot plants will be submitted using a web-based PI in 37 38 program. For data that is not readily available, the l 39 Appendix B. l 40 {

41 42 Thexiata fof the June 14, }999 repon willinclude Aprjl 43 put only'use dat/from(wo months of the quarter. Similarly, for the Au i 44 quanerly repon and indicator calculations will assume that quaner 3Q/

3 i

+

. l 1J d d d d d e e e .

e e s s s e

s s a a d a a b 99 9

%r b 9 b 9 b 9 S ku.

it,.

d 9 8 9 9 0 6 9 9 0 6 9 9 0

/ 9 9 0 9 0 p Q *Q1n 1

i t

Qn 1 Q1 Qn 1 t

  • n '4 o 4 4 o

'4 o 4 o N

l a / \

hi l i

9 9 9 9 9

Sf d l

i J

9 Q

d d

9 Q

9 Q

d 3

Q d

3 3 3 3 e '

m~ d d d e e e 9 s 9 i

g . s 9 s 9 %a 96 s a S a 9 a 9

/b a

\b b /

e7 J 1 b b R F 8 9 R% 1 9

R 9

&9 9 & 9 9 & 9 &

g% 1 J

t 1

9 Q n/'9 9d Q n ./dQ n6 9 9 Q d n/ 9 d3 n/

9 Q 9 9 i

n "

3 o7 3 o go7 3 o7 o7 t

r d d d o

p d

e s

e s

e s

a e

s a

a a b 9 e Jl of d b 9 b 9 h 9 R 9 9 9 9 9 9/ 9 9 9 9/ 9 9/ 9 9/

i u 96

)9 r Q7 Q7 Q7n Q7n Q7n _

MI t -

d B9

/d v 9 t o d 3

d n 3 o d

'3 o 3 o 3' o _

e 1 a Ry t

a c f

D i

r M

7 d~

i n I12 t N _

9 9

(

2 B I t i

a \ 9Q 9 9 9

9 9 9 0 X e W.t Q Q Q _

c

[9 1 d "2

- d _

1 "

9 9

I D n "2 2" 2 l a -

E N m N E r 9 9 P o e 9 nS 9

n6 n/ 9 n . .

n/ 9 d

P 9d& 9d&r o5 o5 A fr Wla t, i

9 o5 9 o5 9d&

99d& o5 9 9 e &t 9d& Qe9 Qe9 dQs9 e9 P - 1 1

Qs9 e9 dQs9 e9 a/ a/

d 2b4 2b4 s9 a/"

d s9 a/

"2 b 4 "2 b 4 a/

t  : 2b4 n

l a - -

P d e

8 0t 7: li 9g9h f- h 6 / hg9 7 g9 h

[9 u9 h

0 o 1f 4 / g9 g9 9 u9 9 u9

~

1 9 u9 QoQ 9 u9 QoQ QoQ QoQ QoQ r P Mu. l t

d r d r d r d h r d _

r k

/h/f t.1 hjtf"f i /' I h"I t # .ftM Y I fhf t

f -

f o -

s l

n r e e - - a u ht e l hi u gn ht c a c a o i s nr v si n l d n

r a e n o mh m u i m a r we l

a E u mta r i l l n N o n e cnt h a c c x o d l d nq u o i i O l a

i t R a er hg si i t e, r t a

u -

T l

a c cn g a r t n na l

utr o u ir s e r e _

e t

S e C nr t p G r R i i

t i

t a r i

t p o l amqt uh r

0 i ea u

o _

w E r mo l 0 s l N C op e l

a c

l ad gh 0, an gq i ac _.

R 0 u t

r i t mni nta 7 rt n i t ~

m,~ C_

0 ae at p r i

O 0 ,dt h i

r r r rd e

t r c _

7 e n f c ocol N ia pv t a pnp eo f o

a r o e o e nnil n~

S f s n e t

a r s _

u

_ T pl a a s

r u

omrem s o h e s t nlpe e

r u _

s pi tc or

~

E or s ut r o sninh t _

mur ni ea nt a s af utg h et _

p.,NVE l

h et f r _

af c r oe f r oau l f a rolah i

e a r on i o au _

h ei a w Treur r c r cl eq .

e q l

G r

N S ah i bg t t bi m snne bms e d d, b g n

wmrcr mi i

de bi w I

mi n ~

T n ns s u o e n e n d a um ut r n o A na n a um ut r n o m nl i n a ep I

er ep a eh e op herc nl ht re T

I l

ph c he t r r h wh c n t s t t -

nt s c U .

NI U. . S - .

r

I - -

l d d d d d d d d d e e e e s

e s

e s

e s

e s s a

s da

, s s a a a a g a a a b99 a

b9 9 b 9 b 9 b 9 b 9 b 9 b 9 g

r b9 9 b9 M 9/ 9/ 9 M 9 M 9M 9/

9 9 9 9 0 M

9/ 9 0 9 0 9 0 90 9 u 90 0 90 90 Q1n Q1 Q1 Q1n *Q1n Q Q 1

  • Q1 1
  • n n
  • Q1
  • n j

n n *

  • n
  • 4 o 4 o o 4 o 4 o 4 o 4 o 4 o 4 o 4 o g

t -

m g

i t 9 9 9 9 9 g 9 9 9 9 9 9 9 9 g

, t Q 9 Q

9 Q

9 Q

9 Q Q Q N dQ 'Q Q -

d d i

d 3

d 3 '3" 3 d

3 3 3

\ 3 3 '3" d

e d

e d

e s 9 d

es 9 j

9 d

e s

h c s 9 d

e s 9 s d

e 9 s d

e 9

s 9 s 9 a a 4 a 9 a 9 a 9 ba t a a M yd j b

a 9

/ a b

9

/ b 9

/ b M R

b b /

8 b /b 8

9

/

8 b

9

/

B -

il 9

B 9 8 9 8

& 9

& 99 9

& 9 9

& 9

& 9 & 9 & -

gt J i

9 & 9 & 9 9 9 9 9 9

9 Q 9 9 Q 9

9 Q 9 'Q 9 Q 9 l

t Q nM'Q" nM d

3 o7 3 o7 9 9 Q d n/

3 o7 9

9 'Q3 nMd o7 3 o7 nM / n/d n/

o7 3 o7

" n/d 3 o7 3 o7 3 o7 9 n/d n/ 9

\

d e

s d

e s

d e

s d

e s

d e

s d/e s

a /a d

e s

d e

s a

d e

s a

d e

s a x -

n a a a a a b b b 7ad b b 9 b b b b 9 9 9 9 9 9 9/ 9 9 9 9/ 9 9 9 9 9aJ 9 9 9 9 9/ 9 9 9 9 9/ 9 9 9 9/ 9 9M 9/ 9 9/

Q7

/

Q7 Q Q7 'Q7 Q7n m i

Q7 Q7 Q7 n NdQ7

  • n " n ,

3h d n 3 o d n 3 o d n 3 o 'g "3 3 o n d n 3 o d n 3 o 3 o 3 o '3" o a m

- L

\ a.

= -

y25 1 9 9 9 9 9 9 9

9 9

9 9

9 9 w gI J 9 9 9 9 Q Q Q Q -

tt i Q Q Q Q '*

d "

l d d d

  • 2 2 2-d
  • 2 2 -

2 2

\ 2 '2" 2 2

/ B N I -

\9 9 9 9 9 a

-L 9 9 nM 9

n/ 9 9

n/ 9 9

n/ 9 n/ 9 n/ 9 n/ 9 +

n n/9 n/9 o5 9 o5 9 o5 y2;M 9 o5 9 o5 9d& 9 o5 9 o5 9 9d&

o5 9 o5 9 9d& 9d& 9d&e9 9d&

9 o& 9d& 9d&

9 9d& Qs9 dQs9 e9

  • Qs9 e9 s 4

! e9 s Qs9 e9 Qs9 e9

  • Q e9 s 9 "Q a/

e9 s9 e9 a/

  • Qa/

s 9d Qe9 s9 a/

  • a/ a/

s I

d aM 2b4 2b4

    • a/

d 2b4 a/

  • 2b4 a/

2b4 2b4 2b4 2b4 2b4 2b4 .

a j

t =

d I h h h h 6 g9 h L.

h h h h 6 g9 h 6 g9 6 g9 6 g9 6 g9 a i

6 g9 7 # g9 6 g9 6 g9 9 u9 9 u9 9 u9 9 u9

@7l @ 9 u9 9 u9 9 u9 QoQ'QoQ 9 u9 9 u9 9 u9 QoQ'Q or Q'QoQ -

(

QoQ dQoQ Q orQ *Q or Q QoQ r r -

r r

l t

d hr hr *l d2t h *1 2 h *1 2t h *l

  • d r
  • 2t h "1
  • 2t h "1 2t
  • h "1 d 2t h *1 2t
  • h *l >

- I / g*M 2t t .

g g

g n n r -

n r r o i i

t o -

i e g r o

f E w g t r

f y w o n p e -

- N y o n a e t i g i e

l b

u l t g i l l l n r a

ba fo t b o r -

O t i i

n r q a T

l i llo f it o p e l itr p e ht l

i a

a S b r ht i

a l t a o e v -

a t a o e v i

a e p r a

R l i e p r e n a v p e e n e

E a e a r i n e p ht r v e r ht i e r e s b -

a N a r e s r b ht n r u oetr m _ R n ( ht n u oe r Um(m i

o t u O Um n i

s o t t e n sr h d a r

p C y m es r u

h d ar e ts i s u e e r u o

i t t s o e e r u t

s y) r l q ns , S i

l e y) r l b

i u

q y s n u h b a iu q g a i b s t

s n u h a q ng S ei a o e l e n

) a y ei a o e l h l i a

D E S h r h l i

a e i n ht t r e b va rt r i

l b rt o a s T

i a re nh t t e a v s r a o ic inh c l l a op _

gM a b n -

v.

wer l t i S v l R

e Y a w ic n o s a b

l a

i a

v n

u wp e j e s nea l i

a a v

a u

e n S n r a U P ine n i

a e ni a i e r r a r na G a r v n r u

i e i o v a u u aht tr tr f o a u ah et f n s r

N meAC f s n s rt t r u f s u d o en D

(9 I t s y om u d e o p en i s ome d r e

n p

x r ht i

e T y c r e d n x ht e s r e e n er eet s c 29 091 A Sy ebi n et e r e n at er e s r i c e et rbi nt at r t r r u vr i

G nt nr r t u v P mr n ra l pa l u au 9

9 ya - I t r g mru a a l

pa nu l

u oer h u ou l a u nu uq fa q oe h s fe e uo

- T l u pq uq f a h s ignf pq l

EM -

gL I

a mnf i 4 M SE . . . . . l

l

v. -

a d d d d d d d d d d -

e e

s e

s e

s e

s e

s e

s e

s e

s e

s e

s -

d a a a a a a a a a a G)! l, b99 b99 b9 9 b9 9 b9 9 b9 9 b9 9 b9 9 b9 9 b99 -

Jo 9/ 9/ 9/ 9/ 9/ 9/ 9/ 9/ 9/ 9/

cN 90 90 90 90 90 90 90 90 90 90 -

  • Q1n Q1n
  • Q1n *Q1n *Q1n *Q1n *Q1n *Q1n Q1n *Q1 t

3 l

  • n
  • 4 o 4 o 4 o 4 o 4 o 4 o 4 o 4 o 4 o 4 o

_ - o yJ kl b yd y 9

9 9

9 9

9 9

9 9

9 9

9 9

9 9

9 9

9 9

9 niM Q Q Q Q Q Q Q Q Q d d d* d *Q d d d

3' 3 3 3' 3' 3 3 3 3 3 d d d d d d d d d. d e

e e e e e e 9 s e e s

e s 9 s 9 s s 9 s 9 s 9 s 9 s 9 s a a 9 a 9 a a a a M a 9/ ba 6 a 9 b

a M b 9 b 9

b 9 b M b 9

@j t i s b 8 b

8 8 b /

8 8

/

8

/

R 9

/

8 S

/

8 9 9 9 9 lM v

9 9 & 9 9 & 9 9 & 9 9 & 9 9 & 9 & 9 & 9 & 9 & 9 &

t Q 9 Q 9 Q 9 Q 9 Q 9 Q 9 Q 9 Q n/ 9 dQn/

9 9 9 Q d n/ 9 9 -

' n/ 9 9 n/9 e

9 9 n/ 9 d n/ 9 d n/ d d d n/ d n/

3 o7 d

3' o7 3 o7 3' o7 3 o7 3' o7 3 o7 3 o7

' 3 o7 _

3 o7 -

d d d d d d d d d d e e e e e e e e e e -

i s s s s s s s s s s ynd a a a a a a a a a a b b b b b b b b b b ht e 9 9 9 9 9 9 9 9 9 9 9 9 9

9 9/ 9 9 9 9 9/ 9 9/ 9 e

9 9/ 9 9 9/ 9 9 9/ 9 9M 9 9/ 9

)9 D9 Wl d i

Q7 Q7 Q7 Q7 Q7 Q7 9/

Q7 Q7 96 Q7 Q7 ve 19 t

d n d n d n d n d n

  • n
  • n d n d n
  • n 3 o 3 o 3 o 3 o 3 o 3' o 3' o 3 o 3 o 3' o Ry l

a iMa r 4 D

(

7 71, 2 2

J1 1 9 9 9 9 9 9 9 9 9 9 -

0-9 Wl 4 t

9 Q

9 Q

9 Q

9 Q

9 Q

9 Q Q 9 9 Q

9 Q

9 Q

9 I

d "2 "2 "2 d "2

d d

2" 3-I "2 2" 2 2 2 E B N -

a 9 9 9 9 9 9 9 9 9 9

}l d

e nM n/ 9 n/ 9 n/ 9 n/ 9 n/ 9 n/ 9 n/ 9 n/ 9 n/ 9

}2 t

9 o5 9 oS 9 o5 9 o5 9 o5 9 o5 9 o5 9 o5 9 o5 9 o5 gb 9d& 9d& 9d& 9d& 9d& 9d& 9d& 9d& 9d& 9d&

Qs9 "Qs9 dQs9 'Q e9 Qe9 Qe9 e9 e9 "Qs9 i ! e9 e9 e9 a/

e9 "Q sa M "Qs9 e9 a/

d s

aM *2b4s9 d

a/

d

" a/ a/ a/ "Q s a/ 9 "

s9 a/

2b4 2b4 2b4 2b4 2b4 2b4 2b4 2b4 2b4 t '

yd i 7

kb h h h h h h h h h 6 g9h -

' u / g9 6 g9 6 g9 6 g9 6 g9 6 g9 6 g9 6 g9 6 g9 gM 9 u9 9 u9 9 u9 9 u9 9 u9 9 u9 9 u9 9 u9 9 u9 9 u9 -

Q QoQ o Q QoQ 'QoQ QoQ QoQ QoQ QoQ -

"QoQ l' r "Q o r r 'Q

  • hr d r r d r d r r r -

2t h *l "2 th

" h

  • h "1 2" h *1 2" h "1 "2 th "I "2 th "1 hT *1 2t "1 2t "1 -

/ t 2t t t 8 -

g g g -

g n

_ n n r n r

- i i

t o i g

i t

r f o

w g r f w o n o p e ty o g n o

-- e l g i t e l

b i

l l

l n

i t

r q l b

_ l o n r o r a i

b f o i o i a -

f it r p e l a t r p e li -

ia t

a o e ht l

i a

t a o p

e r

ht a v

e p r v e e n a v a p e e n a r_li q

p i t

y

(

p e

r ht e

r e

ht n

i s

r b e

oe r U n e r

ht r

e ht n

i s

r u

b e

o er m (m b u i o

n m,l a m n

i s o t t e n s t t -

y e r h d ar e s i r h d ar -

u e r u i t i

x _

_a v s t

s u e eu t s y) s o le a y r o l r i q y r

u b i q -

n s )n u h b u S ei s n o h

a u q g ei o e a q g a e l U

l ht ra e n h eni i

h a ht t r

_ l i l l a ri b a r t -

~t e b a v s r t

v nh e a v s r m i nh ao o ic l

a a o -

Ma _

l a b l wp l

e b n i

n

_sy c p -

i a a t

s s l a a v u we m s a e ine l

ia v u n

e r

_S ine i

a a e n r a e a n e R a r r v n i e -

r r v r o r o a u u iah t t f a u u aht r -

mlv a t f n s r t a f n s o

t -

- f s o om u d e o p

t en I c

ome s u d e p eni n r x r h i I r d n x r h e

m r e e r n er nt e et e d.o er n e ee t

s c l

a et eet t

s c _

e bi u bi at i at r mr u

oevr t

R mr

-otr l pa r t r ri u vr nr a a l

pa r l t r a

u ou u ia l

u a d u oe au a u a u u nu t

a nf c

uo l pq nu uq f q h s is e nf l

pq uq f q h s c m-I I

- - - - - R - - - - -

l y

d e

s a

4., m, b9 9 t

9 9 9 9 9/ 9 3J 9t 90 9 9

9 9

9

  • Q1n t

i t t t t t c c c c c 4 o O O O O O yih t

9 9 9 9 9 e 3t f

i 9 9h9 9 g 9 h9 9 9 9 h9 9 9g*h9 9h9 9 g g*. g .

u 't 'y ou p.

u 't. 'y 'y ou 'tp.

nE 9 Q lyop u

op t yop t J

uhr eS r r r uhr eS l l l l d

3' uh Se J t J t uh J t eS Juh t eS J t d

e s 9 9 9 9 9 i

a 9 9 9 9 9 9 yJd b 9

/

8 9 't 9 't 9 't 9 't 9 't 9l if 9 9 ? 9 s 9 s 9 s 9 s d

9 l'y uug 'y g u 'y g u u 'y g u -

i l

Q 9 u u l'y g u n/9 u l l l d

3' o7 Ju A J uA J uA J uA J uA d

a e s

72 l a

b Gh 9 9 9 9 9 9 9 9/ 9

[iJ 9 9 9 9 9

%i l l

Q7 'y '

y 'y 'y 'y

' n l u

l u

l u

l u

l u

- 3' o J J J J J -

a -

f 9 9 9 9 9 Q)2 t i

9 9hg 99 9h g 9

' 9 9h g 99 9h

' ' g 9 9

9hg 9 9 _

[T l J 9

Q l

i r u 'e l i

u 'e l i

u 'e ir u'e l l i

u 'e pro n t

J d r o pr n r pro n pr on r o pr n Ath uJ u u Aht J u 2 Ath Ju Aht J Aht J 4-

-_ B i 9 Wa d n/ 9 9 9 9 9 9 Wua 9 o5 9 99 9 99

' 9

' 99 9

' 99 9 99 Wl 9d& ir 'y l l

'y l l

'y l Qs9 y -

t e9 i r iyr i

r i

r A

d a/

pa pa pa pa pa 2b4 AM AM AM AM AM 4

i

- i N 9 9 9 9 9 Md a . / 7 9m 7 9 7 9 7 9 7 9

$l Ph h 9h' gf i&

9h'gh 9h'

' 9h' 9h'gh d g9 W - gh ' gh '

i l

9 u9 QoQ

.lth #f" r

A fr ut u e or pr 6 fh M_ P t ac e r l

i pr or AhM t uc a

l ipr r or AhM AthMt uc a

l i

r or pr uc a

l irpror AhM t uc a _

_ r y e t s d k d r t i e a e a v - a, i f e _

- r u i

o! i I t

E t c

1 t n *

-_ oq ps N A i1c3 r

ro3 e d'n as e u r o O c m e- ro c1 imen e

gm d

I u a o s, h T

i

- si ev S f

l ninf nd i

a p S f t e i ,d s, C t aslun k g s r e R p tyl on e i o a R e o r s ur p yl en e l E S ivt nt i o e _

r "e

t i m r a i i t g L h r m u f he N ivne o S cl c a e i ) i a dt f h s g t R t k ie n f t en l t l t w i mt C a ai c a a f o t

p F a e gn O

i i

vi f a v i

t si C R Si c Cquep Su e im L n t i m oCr e

t o

)

m l a s yr u Y

(

Cq e g l n uep pe n m Res Re e m d in l

I T o a yr o ty 3d s m I

e d el e I t r e g vTr i

I r s e s oca fo o gF ta a y df o i t t -

v.

c fe 7. e st R y So e

t s s c y tad i Cp n

l R n a0 G d i k h n ,

u fs$ y s S l t S Rr e f umhh cm .

i a t 1 E t n c mm mr i

e n sL t

ct f

a oRd T l a e n ia n o ep L oBf r

N a a r t o l a uf pg mepeo D m rF e r l o

cg ym c. grr l o mn S n t e beCo t I merb n myg (9 t R o g e p e o io l i a e y m0i s p xi 29 C9 n E C u pd n S s C at a c e g m uTa S u 1

nr o r ms ei i na n mfoen t

o ml

- 1 r t r 9 -

y ed e m I

R o ixiuo eir hi e. u hk i i

x 9 ya t n or R t

c a ruqp c r eu t

c ec ca a a te cr ee n Mr ape t

l EM f e

a Duf A a e MCree r TC e a Hl a c TL o N7 S . R R . . R . . C .

l d d d d d d e

e s

e s

e s

e s

e s

e s

V2 a a a a a a J1

  1. ;i t b9 9 b9 9 b9 b9 9 b9 9 b9 9 JJf 9/ 9/ 9/ 9 9/ 9/ 9/

9f 90 90 90 90 90 90 Q1n Q1 *Q1n *Q1n Q1 *Q1n i

'4 o '4 no 4 o 4 o

  • n 4 o 4 o 2

2 l

i f

@i l M

l d

9 9

Q d 9

9 Q

9 9

Q

  • ' d 9

9 Q .Q d

9 9

d 9

9 Q

3 3 3 3 3' 3' d d d d d d e

s e s e s

e s

e e 9 9 9 9 s 9 s 9 rD id b a 9 b

/

a 9

/ b a 9

/ b a 9

/ b a 9 b

/

a 9

/

Mi Yrh r

9 9

8

& 9 9

8

& 9 9

8

& 9 0

B

& 9 9

8

& 9 9

8 l Q 9 Q 9 Q 9 Q 9 Q 9 Q 9 d n/ 9 d n/9 d n/ 9 d nM d n/ 9 d n/ 9 3 o7 3' o7 3 o7 3 o7 3 o7 3 o7

_ d d d d d d

- e e e e e e s s s s s s rM 1 b

a b

a b

a b

a b

a b

a R h 9 9 9 9 9 9 9 9

)9 iU R.M 9/ 9 9 9/ 9 9M 9 /9 9 9/ 9 9 9/ 9 D9 7 Q7 Q7 Q7 Q7 Q7n v9 e1 ~

I

'3" o n d n 3 o d n 3 o D7 3 o n

  • n 3' o d'

3 o Ry l

a lam r --

D 7 t a

git

( l i

t 2 9 9 9 9 9 9 0- i 9 9 9 9 9 9 9 l Q d Q d Q d Q d Q d Q

9 * "

l "2 2" 2 2" 2 2" 5-E N B l

9 9 9 9 9 9 pta t i

i n/9 9 o5 9 o5 n/ 9 9 o5 nM 9 o5 n/ 9 n/ 9 9 o5 9 o5 n/ 9

  • . J 9d& 9d& 9d& 9d& 9d& 9d&

l Qs9 e9 e9 Qe9 Qe9 Qs9 e9

'Q a/e9 s9 l '

  • a/

2b4 "Qs9 2b4 a/ d 2b4 s9 a/

d 2" b4 s9 a/

"2b4 2" b4 a/

4 2

p1 g f g 6 h J hg9 7hg9 g6 1

/ g9 9 9 7hg9 9 u9 9 u9 9 9 9 u9 9 u9 i

l E dQoQ r dQoQ r n "Q o

Q QoQ d r QoQ r

- N f

[hf' t f Th*tl

' Y i

t 4J P( I

/ h ("

t "2 thr f a 1 O p T i c

S y i d R l t

r e e g E t e a t

a ht n P p i t

t a N nr nr i y g r

u R e e eu l l f ic e t n d vt vc i r o i

ear t h i r

O ec a D dn at r

il u s a qu t

C l l ad pn b d a

s e

u g un n e i d

vaetne y S i t S

t t c a o t l e e n m __ E cn ai ay i

t a R se t

e

_ t a s h ve r m N d r n op dl e n

z r e

t m

t is e

r a ._

D E e a, er mr i a, tit e a b n h a t

al u t e

s n

e S

a . _

R c

n e e r g r e m st s y r N n

g_ _

A a i s e c h i sd a e

r mq O c u m b r r c ea S n S i

s A l

P m r t u y E r e g er g e s O m o,sr o N f o x n n R e i A s

m. R f e, ri e, f it no Er x orer ms e i te t

a s

er g P r u i po p s yt rep c fotre ce e ll l r g_ Y P id r s l

r s e Ocr a i f

r a r ct r ua e e k a Rexqu i e

C s d e e d fi e r R f qu u s u t

Ey e, 8 No bmg fi q f q

- N i c oi n t t oienh y o g o g E r r e eu r

e tut c r n n ei ki el s l u d uni n r

ei n

_ G z b rt b r g e bt r o n t bt r R E mop mpri on g r m iv l

t a di v a

a lar o mo E /

l up upu e u q,-

o nre tr ope t

up Nr e l

- M i r No Nod m Nr Tip l e Tr E D E A

?.

l

)

_ d d d d e

s e

s e

s e

s a a a a b9 9 b9 b9 9 b9 9/

90 98 90 9/

90 9M 90

]_. Q1 *Q1n *Q1n Q1n

'4 no 4 o 4 o 4 o

_v v

, 9 9 9 9 9 9 9 9 J d Q Q d Q Q d d 3 3 3 3' d d d d e

s e

s e

s e

s 1

2 a 9 a 9 a 9 a 9 b S 8

b S S

b 9

/

g b 9

/

g 9 9 9 9 v!i 9 & 9 & 9 & 9 &

Q 9 9 Q 9 Q 9 d n/ 9 'Q " n/ 9 d n/ 9 d n/ 9 3 o7 3 o7 3 o7 3 o7 I

d d d d a

e s

e s

e s s e

ra i; a a a a r i b

9 b

9 b

9 b

9 e ft t 9

9/ 9 9 9/ 9 9 9/ 9 9 9/ 9 t -

i Q7 Q7 Q7 Q7

-J

' n 3' o d n 3 o d n 3 o d n 3 o t

2 ptn 1

f 9 9 9 9 9 9 9 9 i

Q Q Q Q l '

2 d

2 2

"2 6-B 1 9 9 9 9 y2 1 n/ 9 n/9 n/ 9 n/ 9 pt r

ia 9 o5 9 o5 9 o5 9 o5 9d& 9d& 9d& 9d&

.J i

Qe9 s9 "Qs6 a e9 "Q

e9 s9 'Qs9 e9 "2b4 a/

2b4 2b4 a/

  • 2b4 a/

l E .

yau N 7 7 t

O 7 4 g9 h h h 4 (hg9

/u9 t

g9 g9 Wta i T

S 9 u9 QoQ QoQ 9

o 9u9 QoQ rQ l

R E

N I

. " h

/tl*

r Y I r

"7 th( f' Mu9 i

h E

N e

" r

/t#"

h

_ R n s O e t c ngt O s o e T n en n _

_ C s i

t r c S e uie vu iat e n s r -

Y e e e R r n u ml l

- d r r c E of f

_ a n i t

e v

h q aa r u r

u c

c n

e r

r N

R O c Eve c l ai o nr _

A c g g o u icrt O

e c ea i

_ f h n a t

, S f i e

c o C n o r ic gt E nt r e n1 e N oop r a e Y m o adl u n l

o i r i qi O r t

ae n u T m da ge m~ o E I s u T t cr or E Rinh r n i f e it r a e pe F t a A o ih it xt r A l

a tr f I

C ect d r a ea c Mo o D S m~

u; e p g a i

)

r u de uq g Cps s B n

~

A r lsr n i q N o Der e u au h c R l v

n i

s iggn d g nn O o Ogx _

e e cd i

u L I /n R p ns i

hi t ei t t T d a Si r e -

A yr Tuin R

g'~ N s h e E cc e n r

ep o inr n p o A I

D R Ed e D

r O l a

t e f r f ver fus A M fRss eo (9 -

I T n o u r oe oe R C o cd n o r c rt h D r 29 09 A i ec e s^hg t

C e ed r e P t a b o b g O b r s s us e minr ani n mceu

- 1 I

9 9 ya U p ma L

/

S C u ue uu u ru B T uc sl EM l

C c c Nra Nd Nd U E NOsava N7 O O * -

  • P R
  • ii 6 ! f Ik .

.s o r

.*# l d d d d d d l e s

e s

e s

e s

e s s e

1d1 a a a a a a M* b9 9 b9 9 b99 b9 9 b9 9 b9 9 Lf F  ;

9/ 9/ 9/ 9/ 9/ 9/

RM 90 90 90 90 90 90 y t Q1n i Q1 *Q1n Q1n Q1n Q1n

.J

  • 4 o
  • n 4 o 4 o 4 o 4 o 4 o a

L s2 D f f

E 9 9 9 9 9 9 -

f

[

yi R 9 Q

9 Q

9 Q

9 Q

9 Q

9 Q

7J

- d 3

d 3

d 3

d 3

d 3

d 3 ~ _

d , _

- m d d d d d e e e e e s

e s

i s 9 s 9 s 9 s 9 9 9 a a a a a a pda f b

9 9

/

8 b

9 9

/

B b

9 9

/

8 b

9 9

/

8 b

9 9

/

8 b

9 9

/

8 t

Q'i f 3

9 & 9 & 9 & 9 & 9 9 _

Q 9 Q 9 Q 9 Q 9 Q 9 Q 9 .

d n/ 9 d n/ 9 Tl -

d n/ 9 d' n/9 d n/ 9 d n/ 9 -

3 o7 3 o7 3 o7 3 o7 3 o7 3 o7 -

~

d d d d d d L s e e s

e s

e s

e s

e s

2 a a a a a a b b b b b b

" . 9 9 9 9 9 9

)9 J . 9 9/ 9 9 9/ 9 9 9/ 9 9 9/ 9 99/ 9 9 9/ 9 D9 1 Q7 Q7 Q7 Q7 Q7 Q7 ve 19 3 d n d n d n d n d n d n 3 o 3 o 3 o 3 o 3' o 3 o Ry l

a n M f.

D 7 'L

( ' 2 1 2 ' mI 9 9 9

9 9

9 9

9 9

9 9

0- Tt! 9 -

9 Q Q Q Q d Q Q -

9 - J d d d d d -

l 2 2" 2 2 2" 2 7-E ~ _

B -

N -a L 9 9 9 9 9 9 5 2 i n/ 9 n/ 9 n/ 9 n/9 n/ 9 n/9 2ii 9 o5 9 o5 9 o5 9 o5 9 o5 9 9d& o5 9d& 9d& 9d& 9d&

7'&E 9d&

vl dQs9 e9 a/ Qs9 e9 d

Qe9

  • s9 d Qe9 s9 a/

d Qe9 s9 a/

Qs9 d

e 2b4a/

e9

- l

' i 2b4 "2 b 4 a/

2b4 a/

2" b4

  • 2b4 c s

a n y' L r l

7 i x o p2 t 1

t i

$ d e

n '7, hg9 7 g9 h 7 g9 h 7 g9 h 7 hg9 f

r e 7 g9 h -

pf l J I 9 u9 9 u9 QoQ 9 u9 QoQ 9 u9 QoQ 9 u9 QoQ P 9 u9 QoQ

  • 3 e

c dQoQ r

  • r d2t hr *1 d r d2 thr *1 m d a 2t h" r _

/h"t/

l a

n 2" h t "1 2" h t "1 r

1 =

g , _

- mr o _

r E o s r eo f g P

_- N f

r e

t c

e y f e wb e r er yn bi t y

' _ o e e e t t o h

f t er

- O P e i

l rfd f c r o it l sr )r of ac n =

l T t d )r i b e r u l t e p i b

t n nb ot a

- _ S n u us r u s a g b oo r I f a nh et er a eir R

E e

m ooa h h r o

n sh r o ralia n ir m0h e b0. no m md e r e nh i

l e e vp mta o _

unc e vu u3 s _

N p e anc e )s o ad n e I m2i t o l at R lper r e -

r p 3 g uya f r

R iu i (a t i

oaf i nut s erf ms ae r -

E Dff f r a hff a o nbi z e m7 ni l

e ib Dh ySDee Der 1

4 O E q ooed ymr a eoo c ed a l

P i n ogr t _

ot r n to ri un a H C  :

s ht f r o r u l

g

~ y V

t a g t t  : et rh Hdem m sP ad t

o s s iot q nir ce nirI d o c a i r I ~

N t e ur  : vo a e r e l

vug _

M i

r T e urd S; t c o r t

r r Rnt c f f e ru as n t

ri n t .

O c of o g u C t t ef o a I n d uF ev P h er itr s n or e D s 5 s ef a o e s nn l

I c

T l

f c s t

l:

T e C. r e I . o e , r ice a

/

) iea _

aos a sr are gia t oo et r n 0i D fbyo i

l f

C S s a .

o 3 az t

f a

n es P f 0 e eb pe n o z n i

d ) ru enna gi u u t g e1 l F ed enr i s acq o u nna a

!T 1

E t i yi e b io yzdo n sf t

t T A o i sd .

et sna r a

z bl a i a F

(

s n aeh e r ,

P h et sne g h n not r O r a d em t t e e) o i

( h o ebyi n h o e rgt e a ir e y e y t, h _

r o p p ea l

R y t p p y t r z r es e i(cs p c t usg t -

M'm P a r r o t n ol e o mio t r t

t o t n md of q r u m dv o i

n i

l uwu a c ee r l c f nr t e t

d-u i l dt f - nn

=

L t

A as ded cb pe as dsed e c og No di a i i i

m efb s S oea r o ro ei ra _

_ A d n s ed a r i i

en s s

, r l o aol rd ! e r mn o rf mi e - ed g cu s J. dresi e eir e f - b s -

e cu sd e ei l

C r nir a n e

r riua uto r V VV N i0 c u n b r tl t s si t r t

s2 o n S y esh o miu r s me 6 n uqs u a e u tn qe I

c -.

pe u vi p c I TTd S i e e x p qar w. y qcp C CCse o x cv i

.Y x e nu x e e e CCCu D h r s ee u n e Nr r q t i Nf ie t

r i r C (e er ud C (e erb r o I paI _

H

  • P - F - .

P P - - - .

! 3

Retrieved from "https://kanterella.com/w/index.php?title=ML20216G034&oldid=3206581"