U-602683, Provides Response to NRCs RAI Re Adequacy & Availabilty of Design Bases Info at Util,Per 10CFR50.54(f)

Provides Response to NRCs RAI Re Adequacy & Availabilty of Design Bases Info at Util,Per 10CFR50.54(f)

ML20138K758
Person / Time
Site:	Clinton
Issue date:	02/12/1997
From:	Connell W ILLINOIS POWER CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
U-602683, WC-091-97, WC-91-97, NUDOCS 9702190140
Download: ML20138K758 (75)

Text

lihnoes Power Company Chnton Power Station P o Box 678 Chnton. IL 61727 Tel 217 935-8881 ILLIN9IS PtyWER *

[$20 I

Wc-091-97 February 12, 1997  !

Docket No. 50-461 10 CFR 50.54(f)

Document Control Desk I Nuclear Regulatory Commission

{

Washington,DC 20555 i

Subject:

Illinois Power's Response to Nuclear Regulatory Commission's Letter dated October 9,1996, " Request for Information Pursuant to 10 CFR 50.54(f)

Rcggding the Adeauacy and Availability of Design Bases Information" i l

Dear Sir:

The purpose of this letter is to respond to the Nuclear Regulatory Commission's request for l information regarding the adequacy and availability of design bases information at Clinton l Power Station (CPS). This response is provided under oath pursuant to 10 CFR 50.54(f) by affidavit provided in Attachment 1. .

Information requested by the October 9th letter is provided in Attachment 2. The requested l response covers the five specific areas listed as Items (a) through (e). Responding to each 1 item separately would result in repeated presentation of some information. To avoid redundancy, the reader is referred to another section if the requested information is presented elsewhere.  ;

1 In addition, the NRC letter requests a description of any design review or reconstitution program undert ken, and if none has been performed, to explain the rationale for not j implementing such a program. The CPS design review is described separately. Several activities just prior to plant licensing, including the Independent Design Review, a 40,000 man-hour effort, verified that the Clinton design was adequate and in accordance with the license. A line-by-line review of the Final Safety Analysis Report was completed to ensure that it was accurate and traceable to design documents. Efforts since initial licensing have  ;

verified that our plant configuration, performance and procedures continue to conform to our design bases. Therefore, a design bases reconstitution program has not been necessary.

Processes to incorporate new designs and to change the existing plant design and configuration are controlled by a single integrated plant procedure. Design and configuration control provisions in this procedure have existed and have been implemented in some form since the CPS operating license was issued. Numerous inspections of design control by both external and internal teams have concluded that the as-built plant is being maintained consistent with its design and license.

/\k I

' \\

9702190140 970212 PDR ADOCK 05000461 P PDR

1 In preparing the IP response to the subject request, three aspects of plant operations and design control were emphasized: Technical Specifications, Operability Determinations, and  ;

use of the 10 CFR 50.59 Safety Evaluation process. NRC inspections and CPS self-assessments in response to recent plant events have indicated weaknesses in implementation of u.e Operability Determination and Safety Evaluation processes. By letter to Mr. A. B. Heach dated December 9,1996,IP provided the CPS Startup Readiness Action Plan which describes actions to be taken prior to re-start from the current ref ling outage, including those actions being taken in response to weaknesses in the Operabih ty Determination and 10 CFR 50.59 Safety Evaluation areas.

Additional long-term actions to improve CPS perfonnance are being formulated and will be included in a long-term improvement plan, a summary of which will be provided, by letter, to l the Region 111 Regional Administrator. A component of the long-term improvement plan l will be the performance of design bases review activities, including a vertical-slice inspection i of a Probabilistic Risk Assessment Level 1 system. Other discussion and descriptions contained in this letter and attachments should not be construed as implied commitments.

Descriptions of programs, processes and procedures presented in Attachment 2 are current as of the date of this letter. Future changes and revisions will be effected in accordance with CPS procedures and the license.

Based upon the CPS programs which monitor and maintain plant design and configuration, management overview of these programs, and the results of both internal and independent inspections, there is adequate confidence that Clinton Power Station's physical pir.nt and functional characteristics tre consistent with and are being maintained in accordance with the ,

design bases. If you have any questions on this matter, please contact me or Mr. Paul t Telthorst at (217) 935-8881.

Sincerely, i

f & hud Wil red Connell Vice President l WFM/ jaw Attachments: 1. Oath j

2. Information Requested cc: Director, Office of Nuclear Reactor Regulation, USNRC NRC Regional Administrator, Region III, USNRC NRC Clinton Licensing Project Manager NRC Resident Office, V-690 lllinois Department of Nuclear Safety Nuclear Energy Institute (Mr. Anthony Pietrangelo)

Attachment I to U-602683 Wilfred Connell, being first duly sworn, deposes and says: That he is Vice President of Illinois Power; that this response to NRC letter dated October 9,1996," Request for Information Pursuant to 10 CFR 50.54(f) Regarding the Adequacy and Availability of Design Ilases Information," has been prepared under his supervision and direction; that he knows the contents thereof; and that to the best of his knowledge and belief said letter and the facts contained therein are true and correct.

Date: This / day of February 1997.

Signed: t/M bed 7Wilfred Connell i

STATE OF ILLINOIS l I

j

$wiTT . COUNTY Subscribed and swom to before me this l2d day of February 1997.

bp22m:::::::::::::::::,

'Wfraw M 4

1hansiteheaf Ask,sesermum O' 17 (Notary Public)

% SWW611/NM

--- 1

Attachment 2 to U-602683 Page 1 of 71 Table of Contents Purpose and Response Structure . . . . .... ... .. .. ......... .. 2 B ac k g ro und . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Information Requested:  !

1.0 Plant Design and Construction Review . . . . . . . . . . . . .. . ....... 3 2.0 I tem a . . . . . . . . . . . . . . . .. .... ............ ...... . .... .. 19 3.0 item b . . ..... ....... . . . .. .. ...... .... . ... .. 38 4.0 Ite m c . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 5.0 Itemd................................................. 57 6.0 item e . .... ............ .... .. . ............... 65 Abbreviations and Definitions . . ..... .... ... .... .... ...... .. 70 i

i l

l

i l Attachment 2 to U-602683 Page 2 0f 71 Purpose and Response Structure The purpose of this letter is to provide information requested by the Nuclear Regulatory Commission in their October 9,1996 letter, pursuant to 10 CFR 50.54(f). This information, including description of activities that established the plant's design and operations and the processes that control them, provide confidence that Clinton Power Station is operated and rnaintained in a manner consistent with its design bases.

The Clinton Power Station response is organized in six sections, the first describing the validation of plant design and construction. Because of the extensive verification at the time oflicensing and several efforts since then, this information is provided in a separate section rather than dispersed among responses to items (a) through (e) as requested on page seven.

Sections two through six each address one of those items. Programs and processes are described in each section along with conclusions and objective evidence of CPS performance, where appropriate. In several locations, the reader is referenced to another section fbr infbnnation, to avoid redundancy.

Background

Sections 1.0 through 6.0 were written and compiled by members of a cross-discipline team of over thirty members from Engineering, Licensing, Operations, Plant Support (Corrective Action and Procedures), and Quality. Process experts and owners were the primary authors along with people who were responsible for design control at the end of Clinton's construction and licensing phase and through the first ten years of operations. Senior management sponsors monitored both the team's process for developing this response and the results.

The September 1996 event at Clinton Power Station was a watershed event. Subsequent extemal and internal inquiries and inspections have focused considerable attention on several of the processer which are described herein. Where applicable, recently reported weaknesses are candidly included in discussions of process effectiveness or in the conclusions.

Corrective actions already completed, in progress, or planned in either the Startup Readiness Action Plan (for Clinton restart) or the Long Term Improvement Plan, are referred to as well.

Illinois Power is committed to the safe operation of Clinton Power Station. Compliance with the licensed design is respected as crucial to ensuring continued health and safety of the public. Even considering recent events, the unusually thorough review of the plant's configuration, design and license at the time oflicensing; several cycles of above average l performance; and strong design and process controls, support adequate confidence that both l Clinton Power Station's physical plant and its operations are consistent with its design bases, and that identified deviations are corrected in a timely manner.

I l

Attachment 2 to U-602683 Page 3 of 71 Informatlon Requested 1.0 Plan.t Design and Construction Review

" Indicate whether you have undertaken any design review or reconstitution programs, and if not, a rationale for not implementing such a program. If design review or reconstitution programs have been completed or are being conducted, provide a description of the review programs..."

1.1 Introduction Comprehensive reviews and analysis of Clinton Power Station's design and construction have been performed to ensure that the design bases information for CPS structures, systems, and components (SSCs) is corsistent with controlled documents and drawings and is adequate and available. The majority of these activities were completed prior to full power licensing in February 1987. These reviews and analysis were done in four major areas:

1. Engineering analysis of programs and systems complies with design / design bases,

2. 1.icense document validation is consistent with the design / design bases,

3. As constructed plant is consistent with design / design bases,

4. System design is cousistent with design bases.

The engineering analysis of programs and systems for compliance with the design / design bases consisted of three engineering anahres, sub-categorized as " Independent Design Review"," Equipment Seismic Assessment", and " Control Room Reviews". The Independent Design Review was performed by an independent Architect Engineer and involved a comprehensive review which provided assurance that the overall design for CPS was adequate and con 0dence that the design bases was contained in the controlled documents and drawings. The Equipment Seismic Assessment provided CPS assurance that the ,

Emergency Power Supply and Decay Heat Removal Systems can withstand the Safe l Shutdown Earthquake and established that the system seismic designs meet the design bases 1 requirements. The Control Room Reviews provided assurance that all indications and controls required by the operators to support abnormal o,nerations are available and in a j manner that supports the design bases of the plant.

The license document validation was a review of the Final Safety Analysis Report, Safety Evaluation Report and Technical Specifications that verified consistency between these documents and the design and design bases. l Activities to confirm that the constructed plant was consistent with the design / design bases involved a comprehensive "Overinspection Program"," Construction Appraisal Team (CAT)  ;

Inspection", plus a "1E Panel Verification". The Overinspection Program involved a j reinspection of completed construction against design documents with the results providing l confidence that the as constructed plant was consistent with the design / design bases. The I NRC CAT inspection was an additional inspection of construction attributes and also

reviewed mspection programs, records, materials and workmanship to ensure design / design  ;

! Attachment 2 to U-602683 Page 4 of 71 bases requirements were being met. The 1E Panel Verification provided assurance that the panel wiring was consistent with the design documents which provided compliance with the design bases.

The final element constitutes a verification for a select set of systems that the system design is consistent with the design bases. It involved the " Post Accident Sampling System"," Fire Protection Program"," Control System Failure Analysis", and " Seismic Analysis for As-Built Safety-Related Piping Systems". The Post Accident Sampling System (PASS) review verified that CPS met the eleven design criteria used to implement the PASS design. The Fire Protection Program review validated CPS compliance with the National Fire Protection Association (NFPA) codes and provided confidence that the design bases requirements for the fire protection systems were incorporated into the design. The Control System Failure Analysis provided assurance that a failure of common power sources, common sensor or sense line, or the effect on non-safety control systems by a liigh Energy Line Break, was in compliance with the design bases requirements, by ensuring that any of the postulated failures did not cause a combination of failures different from the failure analysis considered in the USAR. The Seismic Analysis for As-Built Safety-Related Piping Systems provided assurance that the design bases requirements were reconciled to the as-built conditions for safety-related piping.

In summary, each one of the aforementioned design and construction review and analysis activities involved verification of the design bases and the supporting design documents.

Since initial licensing, CPS has performed specific activities to enhance its design bases information. These include the establishment of an Equipment Qualification Program, a i Technical Specification Instrument Setpoint Methodology Program, a Motor Operated Valve (MOV) Design Verification Program, and implementing the Improved Technical Specifications (ITS).

The Equipment Qualification Program provides assurance that the design bases requirements for safety-related equipment, relative to equipment qualification, are established, maintained, and available. The Technical Specification Instrument Setpoint Methodology Program I validated existing NSSS Tech Spec setpoint values to ensure adequate margin to design bases limits are maintained and provides a method for future setpoint calculations consistent with the design bases. The Motor Operated Valve (MOV) Design Verification Program provides assurance that active safety function MOVs will perforrr as required when subjected to design bases conditions. The Impros ed Technical Specifications (ITS) implementation process provides additional confidence that the Technical Specifications are consistent with the design bases.

1.2 Design Bases Verification Activities Following is an amplification of the previously summarized activities that were conducted to verify that the design bases is adequately described in controlled documentation.

1

Attachment 2 to U-602683  :

Page S of 71 1.2.1 Independent Design Review - Bechtel This comprehensive review provided assurance that the overall design for CPS was adequate and provided confidence that the design bases wr contained in the controlled documents and drawings. CPS was designed by Sargent and I andy (architect / engineer) and General Electric (NSSS Vendor), and Bechtel Corporation perbrmed the Independent Design Review (IDR).

l The purpose of this review was to assess the adequacy of the design of Clinton through reviewing selected design work and the process employed. The IDR began in June 1984 and was completed in January 1985. The assessment of the overall design was that there is reasonable assurance that the design was technically acceptable.

In perfonning the IDR, both vertical and horizontal reviews were employed. For the vertical .

review, three systems were selected: the shutdown service water (SX) system; a portion of the high pressure core spray (IIPCS) system; and the Class 1E ac Electrical Distribution System. In addition, design ofimportant common requirements was reviewed; this included design for high and moderate energy line break (IIELB/MELB), fire protection, and seismic II/I interaction. For the horizontal review, the adequacy of the design process for Clinton was examined. Work completed and reflected in the final report covered almost a 6-month l period of detailed review and investigation. The IDR Team expended approximately 40,000 manhours including 2,000 manhours during the system walkdowns. More than 2,900  ;

documents were reviewed and approximately 9,300 elements of evaluation were assessed.

This reflects an unusually extensive evaluation of broad scope. j A total of 84 Potential Observations were identified. Of these,76 were ruled valid and l l forwarded as Observation Reports for response; 62 were determined to require additional action for resolution. The number of Observation Reports made was relatively small  ;

compared to the large number of design details, documents, and criteria reviewed. None of l

the Observation Reports were regarded as safety-significant by the IDR Team. The results of the IDR were provided to the NRC by a series of reports and meetings.

The IDR provided additional confidence that the design of Clinton was in accordance with design requirements and published regulations.

1.2.2 Equipment Seismic Assessment Program l This program provided the assurance that the Emergency Power Supply and Decay Heat  !

Removal Systems can withstand the Safe Shutdown Earthquake and established that the design met design bases requirements.

This program for safety-related electrical and mechanical equipment was developed in 1982 l

in response to comments made by the Advisory Committee on Reactor Safeguards (ACRS).

The ACRS recommended that " specific attention be given to seismic capability of the emergency ac power supplies, the de power supplies, and small components such as actuators

! and instrument lines that are part of the decay heat removal system". This program was implemented at CPS in three phases. Phase I examined the adequacy of the design methods used for small bore piping (2" diameter or less). Phase il examined the as-built equipment configurations of the decay heat removal and emergency power supplies systems for seismic

Attachment 2 to U-602683 Page 6 of 71 concerns (Interaction Analysis Program). Phase 111 of this program evaluated the ability of equipment in these systems to withstand earthquake acceleration loadings.

Phase 1-Piping Design This phase reviewed small bore piping (2" diameter and under) designed by S&L to ensure that this piping was designed to withstand Safe Shutdown Earthquake (SSE) acceleration loadings. This review was accomplished by ensuring each of the safety related small bore lines in the Residual IIcat Removal (RII), Shutdown Service Water (SX), Diesel Generator (DG) and DG Fuel Oil (DO) systems had design calculations performed and by detennining the adequacy of design methods.

Phase 11-Interaction Analysis This phase consisted of walkdowns of selected safety related equipment in the decay heat removal and emergency power supply systems to identify equipment configurations that may be susceptible to damage from seismic events due to seismic interaction concerns. Two walkdowns were utilized.

One walkdown was conducted by I3 urns & Roe personnel who were trained in performing walkdowns for the CPS Interaction Analysis (IA) Program. The IA Program was used to identify, evaluate, and correct (if necessary) equipment configurations where the potential existed for equipment to interact during a seismic event. The purpose of this Program was to evaluate whether that safety related equipment could be damaged by mechanical interaction during a design basis earthquake. A detailed description of this program is included in NSED Instruction ME-2. " Interaction Analysis Program", which describes methods used for identifying potential interactions and for writing and dispositioning Potential Interaction Reports (PIRs).

The second walkdown, conducted by personnel from CPS, provided an independent review of the as-installed equipment using the same IA Program requirements.

Potential interactions, or any other anomalies noted during these walkdowns were evaluated by S&L and corrective actions were initiated where necessary.

Phase 111- Equipment Evaluation to the Revised Response Spectra This phase was an evaluation of the seismic capability of the equipment critical to the plant functions of the decay heat removal and emergency power supply. This evaluation was based on plant seismic response spectra determined by different soil structure interaction analysis methods than were used to generate the design basis response spectra. Equipment qualification data were used to evaluate the equipment based on these different spectra. The purpose of evaluating key equipment with these different spectra, which are referred to as the Revised Response Spectra, was to improve confidence in the capability of the equipment to withstand safe shutdown earthquake (SSE) acceleration loadings.

The problems identified in the above program were in the area of piping design. These l problems were identified during piping design review and were reported to the NRC as a potential reportable deficiency under 10 CFR 50.55(e). The problems were corrected and the program final report submitted to the NRC. This report discussed how the program was l

l l

Attachment 2 l to U-602683 l i Page 7 of 71 implemented at CPS, how IP program objectives were met, the types of problems identified by the program and how the problems identified were corrected. The report corcluded that j there was suilicient assurance that the emergency power and decay heat removal systems can I withstand the Safe Shutdown Earthquake. The seismic qualification of the Emergency Power l Supply and Decay lleat Removal Systems support the design bases requirements. )

1.2.3 Control Room Reviews IP performed several concurrent reviews associated with TMI actions, among them the Detailed Control Room Design Review, Safety Parameters Display System (SPDS) development and verification activities, and review for compliance to Regulatory Guide 1.97.

The purpose of the Control Room Reviews was to ensure that all indications and controls required by the operators to perform both Emergency and Normal Operating Procedures necessary to support abnormal operations are available and in a manner that supports the design bases of the plant. IP performed Control Room Reviews using the requirements of NUREG-0737 Supplement 1, NUREG 0700, and Regulatory Guide 1.97.

The Detailed Control Room Design Review was performed by a multi-discipline review team consisting of human factors specialists, experienced human factors consultants, and trained IP personnel which evaluated the functional tasks necessary by the operators to control the reactor during emergency operating conditions. As part of the effort, a survey of the control room was conducted to compare it to acceptable human factors design conditions described i in NUREG 0700. Iluman engineering discrepancies were identified and evaluated for l significance. As a result, design improvements were identified and implemented into the control room design based on their impact to safe operation of the plant.

The Safety Parameters Display System was designed to NUREG 0737 requirements considering the CPS Emergency Plant Guidelines and USAR Chapter 15 type transients and accidents. It underwent a verification and validation process to ensure correct implementation to the design regekements. Part of the final testing was a man-in-the-lc,op test to determine the effectiveness of the SPDS to operator response for simulated drills. The j testing showed an overall improvement to the operators' actions with the SPDS than without it.

Regulatory Guide 1.97 identifies parameters necessary to provide information to the operators to control manual actions, monitor that automatic actions correctly occur, and monitor for the potential loss of radioactivity barriers. IP reviewed the systems and panels associated with these parameters to ensure the operator has valid and reliable indications in compliance with the Regulatory Guide. Several design changes were implemented such as upgrading the Fuel Zone Reactor Water Level instrumentation to fully qualified 1E instrumentation. The instruments specified to comply with the Regulatory Guide are identified with a specific marking to allow the operator to crectly interpret plant status j during a transient, ensuring that the plant is operated within the design bases. l l Design changes implemented as a result of these reviews ensured a consistent and reliable

, method of operating equipment important to safety by the operators. Also, design standards such as an acronym list and a human factors standard were prepared to identify a consistent

.._a__ s a.. L. --, .4 a-... 1-mma i

Attachment 2 to U-602683 l Page 8 of 71 implementation of operator information in ongoing design changes. All of these provide i assurance that the Control Room indications and controls allow the operator the ability to monitor and operate the plant during plant transients and postulated accidents.

1.2.4 FSAR Certification Program This program established that the Final Safety Analysis Report (FSAR) reflected the CPS design and the design bases information.

Illinois Power performed a complete line by line review of the CPS FSAR. This was to ensure that the FSAR was accurate and traceable to design documents.

The project was performed by the NSSS vendor; General Electric Company, the Architect Engineer; Sargent and Lundy, and Illinois Power. Each performed the FSAR certification for the areas which they had responsibility for input. Illinois Power assumed responsibility for  ;

sections of the FSAR that neither GE nor S&L had responsibility in preparing. For the  :

sections that were reviewed by GE and S&L, IP performed a sampling review of those sections to reaffirm their accuracy. l Approximately 31,810 CCTs (documents used by the CPS Centralized Commitment Tracking program) were written to capture reference documents supporting FSAR  ;

statements. The amendments that incorporated the revisions from the FSAR certification were Amendments 36,37, and 38. The FSAR was certified to be correct in September 1986, at the same time that the final draft technical specifications was issued.  :

Since the initial FSAR certification, the following activities have been performed to determine the effectiveness of maintaining the USAR current. Inaccuracies and inconsistencies in the USAR have been identified by performing Safety System Functional Assessments. In addition, as a result of NRC Information Notice (IN) 96-17 " Reactor  ;

Operation Inconsistent with the USAR", CPS has taken several actions, including reviewing 1 samples of the USAR to determine whether USAR inaccuracies exist at CPS. CPS is committed to an initiative, of the Nuclear Energy Institute (NEI), to review portions of the i USAR. Another action taken as a result ofIN 96-17 was the NRC reviewing all plants'  !

conformance to partial and full-core ofiloads. As a result of this inspection, CPS was found l to have no significant inaccuracies. The NRC also established an initiative to review plants' USARs as part of routine NRC inspections. Wording in the CPS USAR was found to be consistent with observed plant practices, procedures, and parameters. In one of the inspection reports that performed a review of USAR commitments, two examples of inconsistencies were noted. In one case, a USAR change had been proposed, but had net been implemented, pending completion of the modification. The other was an inappropriate reference to the use of the Motor Driven Reactor Feed Pump. Neither inconsistency was considered significant.

1.2.5 Technical Specification validation by General Electric and Sargent & Lundy The program established by IP for initial development of the Technical Specifications (TS) ensured that the TS were consistent with the design basis of the plant. i l

Attachment 2 ,

to U-602683 Page 9 of 71 Initial development of the CPS Technical Specifications began in 1982 with utilization of the most recent draft of the Standard Technical Specifications (STS) in NUREG 0123 as applicable to the BWR-6 design. Using the STS, and coordinating with the NSSS supplier, General Electric (GE) and the architectural engineer, Sargent & Lundy (S&L), divisions of responsibility were assigned such that each Technical Specification section was assigned for development by either IP, GE or S&L.

For each Technical Specification a design-basis source document (s) was identified. These cross-references (TS to design-basis document) were compiled and then independently  !

reviewed by IP. IP's review also included a review of the CPS Final Safety Analysis Report and Safety Evaluation Report, for Technical Specification commitments and consistency with the licensing basis. A letter certifying the Technical Specifications for accuracy and consistency with these documents was submitted just prior to receipt of the low-power Operating License for CPS.

1.2.6 Overinspection Program This program was an extensive and detailed inspection conducted by IP to provide confidence that the construction of CPS was in accordance with the design documents. The results provided confidence that the design bases was incorporated into the plant construction via adherence to the design documents and the construction control process.

The Overinspection Program involved the inspection of a portion of completed construction work (completed was defined as installed, inspected, and construction tested) in order to verify the adequacy of the plant's physical construction. Illinois Power submitted an Overinspection Program Plan to Region III in November of 1982. The Plan was a statistically based random sample inspection to ensure that at least 95% of the inspected items in a lot were not defective.

There were over 2 million attributes inspected in the areas of structural steel, cable, cable trays, conduit, electrical hangers, electrical equipment, mechanical equipment, mechanical supports, instrumentation, llVAC duct, llVAC hangers, and pipe (large bore, small bore, and instrument), i The results of the inspection identified several thousand discrepant attributes but none were determined to be significant construction deficiencies reportable under 10 CFR 50.55(e) or would have resulted in inoperable equipment.

1.2.7 Construction Appraisal Team (CAT) Inspection The CAT inspection was conducted by the NRC at CPS during May and June 1985. The j CAT inspection provided additional assurance to the NRC and IP that the design and design bases were captured in the construction of the structures, systems and components (SSC) of CPS. Approximately 2500 inspection hours were utilized during the inspection for reviews l

ofinspection programs, records, materials, workmanship, and construction items. Some of the items selected for inspection included those which had been completed as part of the Overinspection Program.

1

Attachment 2 to U-602683

Page 10 0f 71 l <

l The CAT inspection included concrete placement and testing; electrical raceways, supports, I l cables and equipment; pipe, pipe supports and restraints; expansion anchors; heating,  ;

l ventilation and air conditioning; welding; nondestructive examinations; and structural steel. l Also included were the general quality aspects of procurement, maintenance, material l

! traceability, and processing field changes and non-conforming conditions.

The NRC CAT noted no wide spread breakdown in meeting construction requirements in the l samples ofinstalled hardware inspected by the team or in the project construction controls for l managing CPS. The findings were documented in the CAT inspection report sent to IP in August 1985 and the deficiencies and findings were resolved.

1.2.8 1E Panel Verification The electrical panels provide the means to implement the control functions for CPS. The ,

need for the wiring of these panels to conform to design drawings is essential in order to l operate the plant in accordance with the design bases. 1 Clinton Power Station compared wiring design documents with the as-built configuration of class 1E electrical panels in 1987. This was performed, in accordance with Nuclear Station l

Engineering Department procedures, by a select group of personnel, over a period of approximately two (2) weeks, and involved ninety two (92) panels.

Documented exceptions, where design documents were inconsistent with the as-built configuration, were categorized and, based on category, the appropriate corrective action document was initiated.

A final report summarizing the results discussed the exceptions identified and their  !

appropriate category. No exceptions were found which would have resulted in a reduction in I functional capability of CPS not allowed by plant design.

Overall, approximately 237,500 attributes were inspected resulting in the identification of 2,170 exceptions of all types. The more important items were scheduled for rework. before exceeding five percent power and none were determined to render plant equipment inoperable.

l 1.2.9 Post Accident Sampling System Evaluation The Post Accident Sampling System (PASS) was evaluated to ensure that design bases requirements had been implemented in the design.

The resulting evaluation report addressed the eleven (11) criteria of NUREG-0737, TMI Action Plan item II.B.3 entitled " Post Accident Sampling", as they apply to CPS. This report assisted the NRC Staff with their post implementation r. view of the CPS Post Accident Sampling System (PASS), as required in License Condition #6 of the CPS Safety Evaluation Report (NUREG-0835).

Each of the eleven criteria was presented with the clarification statement taken from the post-implementation review letter issued by the NRC to numerous operating plants in 1982.

l

Attachment 2 to U-602683

! Page 11 of 71 l Following each of the statements was the Illinois Power position on the design criteria that l was used to implement the PASS design at CPS.

l The NRC concluded that the Post Accident Sampling System met the requirements ofitem II.B.3 of NUREG-0737 and was therefore, acceptable.

1.2.10 Fire Protection Program The review of this program provided confidence that design bases requirements for fire protection systems were incorporated into the CPS design.

The Clinton Power Station USAR subsection 9.5.1 describes the design bases and design ,

features of the CPS fire protection system. USAR Appendix E, Fire Protection Evaluation Report (FPER), provides a detailed fire hazards analysis for each fire zone / fire area. USAR Appendix F, Safe Shutdown Analysis (SSA), documents the consequences of a postulated single fire and demonstrates the ability to achieve and maintain safe shutdown of the reactor in the event of such a fire. The fire protection quality assurance program for fire protection is also discussed in Section 4.0 of the CPS FPER. The FPER and SSA were provided to the NRC for review prior to commercial operation.

A report entitled "NFPA Code Conformance Evaluation" was prepared prior to CPS entering ,

into commercial operation. The report identified the level of compliance of the CPS fire I protection program with NFPA codes, and, where appropriate, provided technical justification for deviations based on the fire protection equipment and procedures which existed at that time. It is updated when necessary to clarify code deviations.

The NRC audited the CPS NFPA Code Conformance Evaluation and did not identify any deviations from the NFPA codes that were inconsistent with the conditions reviewed and approved by the Staffin the Clinton SER and its supplements, or that adversely affected the level of fire safety at the station. SSER 6 also stated that the inclusion of the CPS fire protection program into the FSAR and plant procedures meets the guidance given in Generic Letter 86-10, Fire Endurance Test Criteria..., and is, therefore, acceptable. SSER 6 states that on the basis ofits review, the NRC Staff concludes that the applicant's fire protection program for Clinton, with approved deviations, meets the Staff guidelines of Appendix A to BTP APCSB 9.5-1 and Appendix R to 10 CFR 50 and satisfies General Design Criteria 3.

1.2.11 Control System Failure Analysis An analysis was performed to ensure a failure of common power sources, common sensor or l sensing lines, or the effect on the non-safety control systems by a High Energy Line Break would not cause a combination of failures different than the failure analysis considered in Chapter 15 of the USAR.

CPS contracted Quadrex to perform an analysis on the effects of multiple non-safety related control systems failures to ensure their combinations of failures were within the failure analysis of USAR Chapter 15. The evaluation performed a " Top Down" method of failure i analysis such that all possible combinations of failures which could affect the reactor were considered regardless of the probability of that failure. The intent was to evaluate the failure

1 Attachment 2 to U-602683 Page 12 of 71 modes to ensure a certain combination of failures did not exacerbate the initiating conditions of the Chapter 15 analysis. A review of the USAR Chapter 7 systems determined that four non-safety related control systems had potential of affecting the reactor. The Reactor >

Recirculation Flow Control, Feedwater Control, Pressure Regulator and Turbine-Generator Control, and Anticipated Transient Without SCRAM systems, were then evaluated for the ,

top level worst case failure modes. l The analyses identified postulated combinations of multiple control system failures combined with Chapter 15 accident scenarios. Of these, one combination was not bounded in the Chapter 15 analysis. An independent analysis by General Electric (included in the Quadrex  ;

evaluation) using an NRC approved method was used to evaluate this combination of 100 F decrease due to loss of feedwater heating, combined with turbine trip with failure of the ,

bypass valves, and with recirculation flow in manual flow control. It did not result in conditions outside of designed limits. The consequences of this failure event were determined to be bounded by the Chapter 15 analysis of closure of all MSIV's. ,

Because of the potential to exceed 100 F decrease due to loss of feedwater heating, IP has implemented modifications to enhance the reliability of the Feedwater Heater System to minimize Probabilistic of failures and has included provisions in the operator procedures to SCRAM when 100'F decrease due to loss of feedwater heating is approaching. With these changes, multiple failures of control systems are within the initial conditions considered in the USAR Chapter 15 analysis.  !

l 1.2.12 Seismic Analysis for As-Built Safety-Related Piping Systems This analysis provided assurance that the design bases requirements were reconciled to the .

as-built conditions for the safety-related piping. )

NRC Bulletin IE 79-14 was issued as a result of the NRC identifying issues which can yield non-conservative results following seismic analysis of safety-related piping systems. It is essential that the design specifications and drawings used to obtain input information for the seismic analysis of piping systems reflect the as-built configuration to establish the validity of the seismic analysis. The bulletin provided the means of obtaining as-built input information specifically for safety-related piping 2.5 inches in diameter and greater.

A walkdown of the as-built configuration of the Sargent & Lundy (S&L), General Electric (GE), and Reactor Controls Inc. (RCI) piping subsystems was completed. S&L performed l reconciliation of the design bases versus the Baldwin Associates (BA) as-installed conditions l l by preparing addenda to the design / stress reports associated with this program. GE and RCI I incorporated the as-built reconciliation in the final design / stress reports which were their responsibility. j The NRC performed an audit of the 79-14 program in October,1985 which included as-built l

verification walkdowns. In general, the installed piping and supports were found to be in  !

accordance with the drawings and procedural requirements. One discrepancy was identified with the seismic qualification of a valve. The as-built condition was evaluated to have no impact to operability. Calculations were performed and the seismic qualification package was updated.  ;

i I

l l

Attachment 2 to U-602683 Page 13 of 71 1.3 Activities Enhancing Design Pases Information - Since Licensing The following activities represent additional effort by IP to ensure that design bases information is clearly identified, programmatically controlled, and is available.

1.3.1 Equipment Qualification Program ,

This program provides assurance that the design bases requirements for safety-related equipment, relative to Equipment Qualification, are established, maintained, and available.

The purpose of the Equipment Qualification Program is to ensure the safety-related equipment will function as expected under nonnal, transient, accident conditions and during seismic events.

The program at CPS consists of controls required to ensure that activities such as design, procurement, corrective action, training and maintenance are conducted in a manner which documents and maintains the Environmental Qualification (EQ) and Seismic Qualification (SQ) of plant equipment. This program provides for the accumulation and evaluation of vendor qualification reports, supporting analysis / calculations, as-built configuration data, industry operating experiences, maintenance schedules, and other supporting documentation. l These are maintained in qualification packages. 'Ibe availability of the design bases information, adequacy of the procedures, satisfactory compliance to existing standards, controls established to maintain the EQ/SQ design bases and the adequacy of the design basis l

for the Equipment Qualification program at CPS, are summarized in the following discussions.

Initial establishment ofthe EQ/SQ design bases at CPS S&L prepared and maintained packages (binders) for Environmental Qualification (EQ) ,

Seismic Qualification (SQ), and Pump and Valve Operability (PVORT) programs at CPS as defined in USAR Sections,3.11,3.9.3 and 3.10. These packages were turned over in 1989 and 1990 to IP (NSED) for maintenance and update per NSED procedures and instructions for the Equipment Qualification Program. Initial Design Baseline Training for NSED personnel was prepared and presented by S&L to provide engineers working knowledge of various design basis documents (calculations, design criteria , specifications, etc.) for balance of plant (BOP) systems and for interface with NSSS systems.

Supplements to Safety Evaluation Report (SSERs- NUREG-0853) documenting satisfactory resolution of NRC Qualification Review team audit concerns and issues, for verification of ,

I adequacy and validation of these programs at CPS are as follows:

. Environmental qualification of mechanical and electrical equipment - SSER 5, Section 3.11.1,3.11.5 and SSER 6, Section 3.11.

l

. Seismic and Dynamic Qualification of mechanical and electrical equinuent - SSER 7,  ;

Section 3.10.1. l

. Pump and Valve Operability qualitication- SSER 6 Section 3.10.23.

l i

i

Attachment 2 to U-602683 Page 14 of 71 On the basis of satisfactory resolution of the specific findings and generic comments from various NRC review teams, the Staff concluded that the equipment qualification programs for safety-related electrical and mechanical equipment at CPS met the applicable portions of the General Design Criteria (GDC) 1,2,4,14, and 30 of Appendix A to 10 CFR 50, Appendix B to 10 CFR 50, and Appendix A to 10 CFR 100.

Design review and reconstitution ofEquipment Quahfication Program NRC enforcement conference report 89023 (June 14,1989) addressed several issues and concerns with the Environmental qualification (EQ) program at CPS As a result, CPS committed to upgrade the Environmental qualification program. t included in the above committed corrective actions specific to EQ program were:

. Verihcation of the adequacy of the EQ boundaries

. Verification of the adequacy of the Master Equipment List

. Verification of the adequacy of the EQ packages

. Control of EQ changes through the Configuration Management Control Program i

. Review of the adequacy of the EQ procedures

. Review of the adequacy of the maintenance of the EQ equipment, including evaluation of preventive maintenance documents to verify that they contain proper frequency for  !

maintenance and contain correct provisions for performance of the maintenance of EQ  !

equipment as specified in the EQ manual (MS-02.00) i

. EQ walkdown of selected equipment (350 randomly selected items) to verify that the as-installed configuration of the equipment was in accordance with the requirements in the EQ packages.

. Review of the adegracy of the programmatic and organizational interface, which resulted in the improvement and development of the following NSED Procedures, Standards and Instructions:

1. Procedure E.6 " Environmental Qualification Package"

2. Procedure E.8 " Seismic Qualification Package"

3. General Design Review Standard GD(RS) 05.00 " Equipment Qualification Program Review Standard"

4. Instruction DE-15 " Control and maintenance of Equipment Qualification Program i Manual"- Engineering Standard MS-02.00.

5. Instruction DE-22 " Equipment Qualification Program Impact Assessment" l

6. Instruction DE-02 " Responsibility Listing" for Design Basis Documents l In response to IEIN 89-07 " Failure of Small Diameter Tubing in Control Air, Fuel Oil and Lube Oil Systems which Render Emergency Diesel Generators Inoperable", walkdowns of each divisional diesel generator were performed. Two deficiencies in instrument tubing supports were identified. MWRs were initiated to address and correct these deficiencies.

Neither of these items caused equipment to be declared inoperable.

The NRC E&TS inspection in 1992 found that installation of tubing runs for various instruments in the Division Ill Diesel Generator Skid, was not in accordance with the requirements identified in GE design documents. Specifically, instruments tubing runs were I

l l Attachment 2 to U-602683 i Page 15 0f 71 l I ty-wrapped with nylon ties in lieu of the requirement to use metal clamps. A Condition Report was written to document the impact of this non-conforming condition on Seismic Qualification of the Division III DG. These instrument lines were subsequently reworked to conform to the design basis configuration originally specified in the GE design documents.

l Additionally, a safety significance evaluation was performed by S&L, which concluded that l the condition identified in the above Condition Report was non-conforming but not l l

inoperable. l IP developed initiatives to prepare documents which consolidated the design bases input information for the EQ/SQ program at CPS. These documents now provide a summary of  ;

the principles, procedures, methods, and documentation requirements for the qualification and maintenance of the equipment as dictated by their functional and licensing or regulatory i requirements. The purpose of this upgrade initiative was to establish the design bases information for use in the design control process and configuration management program. I a) Impell Corporation prepared a report which describes the requirements and bases for the Environmental Qualification of CPS electrical and mechanical equipment l important to safety (safety-related, non-safety related affecting safety-related and  ;

certain post-accident monitoring equipment) and safety-related active mechanical  ;

equipment located in harsh environments. j b) S &L prepared a report which describes the design bases requirements and the rationale for the Seismic Qualification of safety-related mechanical and electrical i equipment, and seismic adequacy of the mounting of non-safety related l equipment / components in safety-related areas (Seismic Category 11/ I).

These documents provide infonnation for both NSSS and BOP equipment. However, the l

Reactor Pressure Vessel (RPV) and associated components mounted on and within the RPV are excluded since these design bases documents are maintained by GE. (Design changes in this area are developed by GE and controlled by the hardware change process described in Section 2.2.1). The design bases and the supporting information presented in these documents are incorporated into NSED procedures for the control and maintenance of the EQ/SQ packages (binders).

As a result of the activities and the processes in place as addressed above, there is reasonable assurance that the EQ/SQ design bases are in compliance with the NRC General Design Criteria for the Equipment Qualification Program at CPS. CPS is confident that the overall effectiveness of the current processes is adequate to ensure that the design bases for the EQ/SQ program are maintained current and available.

l 1.3.2 Technical Specification Instrument Setpoint Methodology A program was developed to validate the existing NSSS Technical Specification setpoint values. Using a systematic approach to uncertainties that is traceable to Regulatory Guide l 1.105 and Instrument Society of America (ISA) Standard 67.04, both on instrument setpoints, the program ensures that adequate margin to design bases limits is maintained.

I

Attachment 2 f to U-602683 Page 16 cf 71 1

i The original design for the NSSS supplied Technical Specification instrument setpoints had y

calculations prepared by GE using guidelines which were not rigorously detailed to ensure consistent implementation. As a result, IP participated in the development of the GE Setpoint Methodology.

As part of a IlWROG effort, NEDC 31336 was developed to provide a consistent implementation method for performing set point calculations associated with Technical Specification instrument setpoints. Those setpoints considered im}stant to safety were evaluated for impacts and uncertainties from instrument loop accuracy, calibration accuracy, process measurement accuracy, element accuracy, and drift. Instrument loop accuracy, in

• turn, considered device accuracies, temperature effects, pressure effects, seismic effects, power supply effects, radiation effects, environmental effects, and electrical interference i effects.

The GE scope of supplied Technical Specification setpoints were recalculated as part of this l cfTort. Three setpoints were determined to need changing. The design drawing and Technical Specifications were revised. The remaining setpoints were determined to be conservative, based on the new calculations, and the existing values were retained in the Technical Specifications. A setpoint calculation standard was developed to provide a consistent method for future setpoint calculations.

1.3.3 Motor Operated Valve (MOV) Design Verification Program .

1 CPS has carried out an extensive component design evaluation and component testing j program as recommended in NRC Generic Letter 89-10 to provide assurance that active '

safety function MOVs will perform as required when subjected to design bases conditions.

NRC Generic Letter 89-10 recommended that licensees develop and implement a program of l testing, inspection and maintenance to provide assurance that MOVs will function when subjected to design basis conditions. The program was applied to MOVs with active safety functions and required approximately 35 man-years of design engineering effort. i To determine MOV actuator setting minimum limits, design basis reviews at the system and component level were performed to calculate maximum expected differential pressures.

Ilased upon system hydraulic analysis, MOV component data, and other inputs, analysis was performed to determine if a MOV could support its design bases function. Design inputs were also determined for reduced voltage values, seismic limitations and environmental conditions. Evaluation ofindustry data and dynamic testing of a representative sample of MOVs was performed to validate assumptions used in the analysis. Existing settings were compared to the acceptance criteria. As necessary, actuator settings were adjusted and confirmed by static diagnostic testing. i If a MOV could not be accepted using conservative analysis, CPS pursued either a hardware modification of the valve to improve capability, a change in operating procedure to reduce j the worst case condition, or a dynamic test of the MOV to demonstrate that inputs which were less conservative than standard assumptions were appropriate.  ;

l Attachment 2 <

1 to U-602683 i Page 17 of 71 i

Before restarting from RF-6 (the current refueling outage), CPS will have completed the plant hardware activities associated with the baseline requirements to establish, test, and adjust all rising stem MOVs within the scope of GL 89-10, thus ensuring that they will i perform their active safety functions under design basis conditions. Programmatic controls are in place to ensure this capability and to perform periodic capability verification testing, trend MOV maintenance activities, and provide feedback from tests which may require subsequent changes to the baseline criteria. The determination that butterfly valves within the scope of GL 89-10 are capable of performing their active safety functions under design basis conditions is based on design margin. Baseline stem torque testing to measure seating torque will be completed by RF-10.

The GL 89-10 program documentation and test data provide an adequate basis to conclude that the GL 89-10 program MOVs are capable of performing their intended safety functions under worst-case design bases conditions.

1.3.4 Improved Technical Specifications (ITS)

In addition to the Technical Specification validation efforts previously discussed, CPS implemented the improved Standard Technical Specifications (ITS) on January 1,1995 based on NUREG-1434. This process used to apply the ITS to CPS provides additional confidence that the Technical Specifications are consistent with the design bases and the as-built plant.

During the development, review, and implementation ofITS a thorough review of TS and the USAR was perfonned to ensure correct and valid information was implemented into the ITS, USAR, and Operational Requirements Manual (ORM). Required changes to the USAR, identified during the review process, were incorporated by Licensing using the 10 CFR 50.59 process. The intent of the development ofITS and review of changes was not to revalidate the current TS content but to verify that the proposed ITS changes were valid and correct and the original ITS Bases were in compliance with plant design per the USAR. As previously discussed, the original TS were certified to be in conformance with the plant design a7d FSAR as part of a certification process in support of the initial licensing of CPS. Subsequent changes to the TS were made under procedure controls. In order to ensure that an adequate review of changes was being made when developing the ITS conversion submittal, each ITS section was reviewed at CPS by a multi-discipline review team. This team was comprised of i personnel from Operations, Operations Support, Licensing, Engineering, Maintenance, Nuclear Training, Quality Assurance, the Facility Review Group (FRG), and the Nuclear Review and Audit Group (NRAG). The review team ensured that appropriate personnel with expertise on a particular system or group function were used to perform the ITS review.

Many departments reviewed changes in specific areas on a case by case basis (e.g., Radiation l Protection, Chemistry, Plant Technical, NSED System Engineers and ISI). Personnel reviewing the ITS sections ensured that new requirements and values in the ITS were correct and valid, changes to the Design Features and Administrative Controls sections were correct and valid, ITS BASES were consistent with plant design and the USAR, and the BASES references were correct. Some plant walkdowns were performed for as-built verification.

Further, because the ITS license amendment was developed and reviewed in conjunction t

Attachment 2 to U-602683 Page 18 of 71 i with the ITS for the three other domestic BWR-6 plants, comments from their reviews were evaluated for applicability to CPS.

1 1

Training was performed in parallel with the NRC review prior to implementation ofITS. l l The training was conducted over a ten month period consisting of approximately 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br /> of j classroom training, using a case study approach. This allowed operators to review those l l areas where the requirements had changed significantly and provided an informal method for 1 l

verification and validation ofITS Comments made by the operations crews were also I tracked and resolved.

The Nuclear Assessment Department conducted an audit and two separate surveillances on the ITS implementation program and three audits shortly after ITS implementation to help  ;

ensure that problem areas had been identified. NRC inspections conducted in December of i

! 1994 and January of 1995 considered the preparation and implementation efforts ofImproved Technical Specification as being good and proactive. During the integrated inspection from March 26 through May 10,1996 the NRC performed a special inspection in the crea of Improved Technical Specification implementation. The inspectors found no discrepancies or l errors with ITS while conducting the integrated inspection.

1 1.4 Conclusion The above reviews were in-depth and thorough and included vertical and horizontal reviews of construction, design, and programs. Included were systems and topical reviews that were l

representative samples of CPS design and construction. Thousands of attributes were l reviewed with the results indicating high conformance of the design and construction to the design bases. The IDR concluded there is reasonable assurance that the design is technically l acceptable. The NRC concluded that further independent design review was not considered l warranted. The Technical Specifications were certified to be consistent with the FSAR, SER, i l and the as-built facility.

Based on the description and conclusion of the above activities, there is adequate confidence l that the design bases was adequate and available in the controlled documents and drawings at the time oflicensing. This established the design baseline.

The additional activities completed following licensing required IP to use and evaluate selected portions of the design bases and supporting design documents. This further verified the adequacy and availability of the design bases.

As the result of the above activities as well as the on going control processes discussed in Section 2.0 through 5.0, the design bases for CPS is adequate and available. Another design review or a design reconstitution program has not been warranted.

l

Attachment 2 to U-602683 Page 19 0f 71 2.0 item a Description of engineering and configuration control processes, including those that implement 10 CFR 50.59,10 CFR 50.71 (c) and Appendix B to 10 CFR Part 50.

2.1 Introduction The engineering and con 0guration control processes at CPS, for new designs or design changes which impact design bases, are controlled by a single integrated administrative procedure. This procedure is implemented by all Nuclear Program organizations at CPS, including Operations, Maintenance, Engineering, Licensing, Training and other support organizations. It contains steps for initiating Safety Evaluations (10 CFR 50.59) and identifying changes to the Safety Analysis Report (SAR); operating, maintenance, and testing procedures; design baseline documents; licensing documents and other configured items impacted by the design / design change. It also provides detailed instructions for meeting the requirements of 10 CFR 50 Appendix B, Criterion 3, Design Control, other associated criteria, and provisions of the regulatory guides and industry standards associated with these criteria.

Some implementation details are covered in supporting departmental procedures, which are  ;

referenced in the integrated plant procedure. The scope of this procedure includes all nuclear j safety related structures, systems and components and most non-safety related hardware. The l configuration control provisions in this procedure have existed and been implemented in a ,

procedurally controlled form since the original Operating License for Clinton Power Station was issued in February 1987.

While Illinois Power Nuclear Program organizations maintained control of the licensing and  !

design bases at CPS since issue of the Operating License, control of most changes to design l documents and information remained with the original Architect-Engineer (A/E) and Nuclear Steam Supply (NSS) designer until approximately 1991. Design and design changes issued during this period were developed within the contractors' Appendix B design control programs, and subsequently processed for implementation at CPS under the controls of the ConGguration Management and Modi 6 cation Cc,ntrol Programs. After transfer of design 1 bases documents, design transition training and development of a full set of design control l procedures, design and design change responsibilities were assumed by the Nuclear Station Engineering Department (NSED) at CPS. Because a portion of the NSS design documents were retained by the NSS designer, any design changes or analysis affecting these documents are still sought from the original NSS design organization through contractual agreements.

Throughout the operating life of CPS, program controls and implementing procedures have existed to align design baseline documents with changes, and to ensure consistency among these and associated operating, maintenance and testing procedures, training materials and licensing documents. These programs have been audited and inspected by numerous internal, external and independent third party organizations over the past ten years. These assessments found the program to be complete and in compliance with licensing commitments.

Implementation deGeiencies were noted during these assessments (further addressed in Section 2.11 of this response), and corrective actions involved improvements in procedural guidance and personnel training. Thus, the level of program controls has remained consistent,

Attachment 2 ,

to U-602683 Page 20 of 71 with revisions to policy documents and procedures primarily to add guidance details, to integrate activities for a more adaptable process, and to reflect nomenclature and '

organizational changes.

2.2 Design and Configuration Control (10 CFR 50 Appendix B) 2.2.1 liardware Change This section addresses the process controls for changes to design and plant hardware configuration (including computer software); and associated changes to operating, maintenance, testing, training and licensing procedures and documents. Corporate Nuclear Procedure (CNP) 2.06, Configuration Management, is the policy document for configuration control, and defines the scope of configured items. This includes configured items which may be changed separately from the design / hardware change process. Ilowever, these are ,

controlled by separate departmental procedures, which either contain provision; for Safety Evaluations and USAR changes and impact assessments similar to those contained in hardware change procedures, or have a pre-defined scope which excludes any impact on design bases or nuclear safety. The processes are addressed in Sections 2.2.2 and 2.2.3.

The primary procedure used to implement the engineering design and hardware configuration control processes is CPS No. 1003.01, CPS Hardware Change Program. All new designs, design changes or changes to design bases documents, issued by CPS engineers, are processed in accordance with this procedure. Controls established in this procedure ensure compliance with upper tier requirements such as 10 CFR 50, Appendix B, Criterion 3; Chapter 3 of the i Nuclear Program Quality Assurance Manual; CNP 2.06; and ANSI N45.2.11, Quality i Assurance Requirements for the Design of Nuclear Power Plants. It also requires that other l configured items such as procedures, training material, design documents, computer software I and licensing documents affected by the design or hardware change be identified and modified I appropriately. All CPS Nuclear Program departments work to this procedure.

In the approximate order presented in the procedure, the following is a listing of functions l

included in the change process:

. Responsibilities of various organizational entities in the process, including the Plant Manager, the Engineering Manager, the Design Authority, Safety Review Groups (FRG and NRAG), Project Team Leaders and Engineers

. Conceptual design approval

. Categorization of the change to establish level of controls required for processing (see Section 2.2.5.A for details on decision process)

. Requirements for obtaining designs from qualified outside organizations

. Determining / obtaining design inputs

. Controlling design interfaces

. Conducting in-plant walkdowns i . Cost estimates and scheduling

. Preparation or revision of calculations (per separate engineering procedure) l l

. . - _ _ _ _ . _ - - - = . . - ..

Attachment 2 to U-602683 l Page 21 of 71 l

. Preparation of design or design change output documents (affected design baseline l documents requiring change are identified as part of this function)

Initiation of procurement activities, including necessary changes to equipment / parts lists and inventories

. Determination ofimpacts on other configured items such as procedures and training l

materials, using engineering review standards or controlled transmittals to departments  ;

controlling the configured item (i.e., Plant Staff for operating, maintenance and surveillance testing procedures) i . Initiation of a Safety Screening, and when required, a 10 CFR 50.59 Safety Evaluation

. Independent Design Verification

. Installation instructions and testing requirements

. Development of work documents to implement plant hardware changes

. Facility Review Group (Safety) reviews

. Plant Manager approval

. Work Authorization

. Control of modification package revisions, supplements or cancellations

. Updates to the Design Status System (DSS) during modification processing

. Post Modification testing and results evaluation

. Resolution and tracking of open action items

. Release for Operation (full and partial)

. Closure of modification packages

. Control of records and updates to tracking and status systems

. Temporary modifications (see 2.2.4) l . Control of configuration item exceptions In aggregate, provisions of this procedure along with other supporting plant and departmental procedures, which are called out in CPS 1003.01, integrate both the engineering design and configuration control processes. The simplified flow diagram at the end of this section shows the major functions in the modification process, and Section 2.2.5 describes the process flow.

2.2.2 Reactor Core Reload Design and Configuration Control For each reload, the reactor core and the process computer data bank are designed to be consistent with the CPS design and licensing bases using NSED fuel management and design l control procedures.

l The Energy Utilization Plan (EUP) is issued to the fuel vendor each cycle in accordance with NSED F.0, Fuel Management, as the starting point for reload design. The EUP includes prioritized nuclear design criteria. Procedure F.0 also requires a verification of two sets of CPS reload design information required by the fuel vendor (GE): Fuel Release and Engineering Data (FRED form) and Operating Parameters for Licensing (OPL-3 form). The FRED form is prepared by the Nuclear Fuel & Analysis (NF&A) group and NF&A coordinates the review and update of the OPL-3 form by a team of engineers from disciplines covering the plant modifications or changes affecting the OPL-3 data. Once both FRED and OPL-3 forms are finalized by NSED and the fuel vendor, essential information is placed in an NSED Engineering Standard and applied as a reload analysis specification and design input l

l

l Attachment 2 to U-602683 i Page 22 of 71 for GE. Therefore, the same design bases are maintained and applied in the design analysis at CPS and reload analysis performed by GE.

l GE performs the reload design analysis based on an NRC approved reload fuel and analysis methodology. The CPS specific and cycle-dependent reload design information, including a listing of the fuel to be loaded and safety analyses results, are documented in the Supplemental Reload Licensing Report (SRLR) and associated Maximum Average Planar Linear lleat Generation Rate (MAPLIIGR) limit report. These reports are reviewed by a NSED team and finalized with GE. The final reports are sent to CPS Operations and Nuclear Training for applicability and adequacy reviews, per NSED P.4, Processing Vendor Information.

1 A Safety Evaluation is performed on the SRLR and MAPLIIGR reports to determine whether the changes to the reactor core involve a change to the Technical Specifications (TS) or an unreviewed safety question. if a change in the TS is determined to be required, a reload i licensing amendment is submitted to the NRC for approval. The USAR and Core Operating Limits Report (COLR) are updated based on the SRLR and MAPLilGR reports. These activities ensure that the licensing bases are kept current.

For each reload, changes in the reload fuel design (e.g., structure, enrichment, exposure capability, etc.) are identified and impacts on the plant are then evaluated. The design of the reference core loading pattern (RLP) for the new cycle is ensured to be consistent with the bases of the Rod Pattern Control System. In addition, the RLP is confirmed to be consistent with the cold shutdown margin requirements and the capability of the Standby Liquid Control System. The thermal-hydraulic characteristics (including core stability) of the new l fuel is evaluated for its compatibility with the other resident fuel bundles as well as the  !

design of reactor recirculation system. The integrity of reactor coolant pressure boundary is confirmed to be bounded by the pressure safety limit specified in TS. An evaluation of the zirconium (metal / water) reaction mass is made to ensure that it is bounded by the design basis of the hydrogen mitigation system. The emergency core cooling system (ECCS) as described in USAR Chapter 6 is verified to be maintained or bounded by the original USAR design. The ECCS criteria are ensured to be met with the new core design by evaluating the analysis methodology used and the calculated values for peak clad temperature, oxidation ,

fraction and hydrogen generation for the reload fuel. 'o maintain the ECCS design basis I with the reload fuel, the calculated exposure-dependent maximum average planar linear heat l generation rate limits fbr the reload fuel are implemented in the COLR. The impact of the reload fuel on the design of fuel pool storage is evaluated. In addition, its impact on the radiation sources as well as the design bases for radiological consequences described in l USAR Chapter 15 is also evaluated. A few Chapter 15 transients and postulated events (called limiting transients or events) are re-analyzed to ensure that the new core will be I operated safely, maintaining the health and safety of the public. This is accomplished i

through the implementation of the COLR operating limits resulting from the reload transient analysis such that the margin of safety is always maintained. In addition to the nominal reload analysis, the impact of the new core design on the plant-specific bases, for example, emergency operating procedures and station blackout, is also evaluated.

l l

l l

Attachment 2 to U-602683 i Page 23 of 71 The data bank for the process computer (3D Monicore) is generated by using the fuel vendor's OPL-7 form to formally transmit design input data between CPS and GE. The information collected in OPL-7 has the same bases as the SRLR and MAPLilGR reports. In addition, OPL-7 has the cycle-specific new bundle masses, core configuration, control blade locations, and LPRM data. NSED reviews and installs the data bank as a plant change in accordance with CPS 1003.01. Following this process results in the design and licensing bases being maintained consistent with each other and the reloaded core from the start of reload analysis to installation of the new core monitoring data bank.

During refueling outages, activities which would impact the cold shutdown margin design basis, such as refueling and control blade removal, are controlled by CPS 1898.00, Special Nuclear Materials Program; CPS 3703.01, Core Alterations; and CPS 9811.01, Shutdown Margin Determination. CPS 1898.00 is completed in accordance with refueling rules specified by the fuel vendor which are independently confirmed by NSED Procedure F.0.

After fuel movement is completed, core verification is performed to ensure that all of the fuel assemblies are in their proper location with the correct orientation. This ensures that the initial configuration of the core is consistent with the design basis of the safety analyses.

Core configuration monitoring during plant operation is described in Section 4.3.3.

2.2.3 Other Configuration Changes Some configuration items defined in CNP 2.06, other than plant hardware and design bases documents, are controlled by departmental procedures other than CPS 1003.01. CNP 2.06 also defines a category ofitems which are exempt from the controls of the Configuration Management Program. These are non-safety related items which do not directly affect or support plant operations, security or emergency operations, and are maintained in a controlled listing.

The primary group of non-hardware / design items requiring control are operating, maintenance and testing procedures, plus various administrative procedures which implement commitments contained in the USAR, Tech Specs or other licensing bases documents. Each Nuclear Program department has a procedure for developing, revising and issuing procedures which contains provisions for maintaining configuration controls over procedural development. The l procedure revision process requires reviews and impact assessments similar to the hardware change process, and conduct of a Safety Screening. When the proc:. Jure controls a nuclear safety-related activity or impacts licensing bases, a Safety Evelaation is required.

Another plant procedure, CPS 1003.02, CPS Field Configuration Change (FCC) Program, i

defines and prescribes controls for a very narrow scope of configuration changes to plant l hardware without the degree of controls prescribed in CPS 1003.01. These items are l non-nuclear safety related, and cannot impact design bases, licensing bases or nuclear safety.  ;

l Rigor was applied while writing CPS 1003.02 to define the scope cf change allowed within

. these limits. The control form for processing FCCs documents the absence ofimpacts on licensing or design bases.

An engineering procedure controls minor editorial and other changes which do not affect design bases information, to drawings and design documents defined as configuration items.

l l

l l-I

Attachment 2 to U-602683 Page 24 of 71

! 2.2.4 Temporary Modifications Temporary Modifications are controlled in accordance with the requirements of CPS 1014.03, i Temporary Modifications. This procedure establishes the scope and limitations for Temporary Modifications, along with strict controls for obtaining initial permits, installation, duration extensions, logging, tracking and removal. Like any other configuration change, a S uty Screening in accordance with CPS 1005.06, and when applicable, a Safety Evaluation are required, prior to approval of a Temporary Modification (Temp Mod) Permit. While prirnarily an operations procedure, engineering assistance in determining acceptable technical content of the modification and in performing Safety Evaluations is called out in procedure steps. The Temp Mod Log is maintained and controlled by on-shift operations personnel and reviewed weekly to ensure timely removal (or evaluation and extension) of Temp Mods.

Temporary Modifications extending beyond thirty days are audited by Operations on a quarterly basis to ensure proper configuration of the modification, including associated tagging, is being maintained.

Temporary Modifications are intended for one time use and normally for a duration ofless than thirty days. Some procedures contain longer duration, or repetitive use, Temp Mods in addition to the Temporary Modifications controlled by CPS 1014.03. The authorization and controls for this type of modification are contained in the approved procedure. Preventive Maintenance, Tech Spec Surveillance and some testing procedures, which require equipment or partial system outage conditions for short periods, frequently impose Temporary Modifications within the detailed steps. Normally these are completed within a day, and the installation and removal require verification. Like other documents affecting nuclear safety, these procedures receive the appropriate level of Safety Evaluation when initially developed or revised.

2.2.5 Description of Change Processes The simplified flow diagram at the end of this section depicts the major options and ftmetions in the design and configuration change processes. The following narrative leads the reader through this diagram, adding details as necessary to enhance understanding of the processes.

CPS 1003.01 and associated procedurs contain additional details. Also, this diagram does not include non-hardware / design chais s, which are described in Section 2.2.3, or core reload design described in Section 2.2.2.

if. Identylcation/ Classification Initially the need for a change is identified. The sources are many, including: changes as part of corrective action for internally or externally identified conditions, changes to conform with industry initiatives, changes to improve plant performance or maintainability, or a temporary change to hardware configuration pending design of a permanent change. The first decision is whether or not the change alters design bases.

(Al) If the change is minor, does not affect design or licensing bases and meets other criteria in CPS 1003.02, it may be processed as a Field Configuration Change.

l Attachment 2 l to U-602683 l Page 25 of 71 l

(A2) If the change is only temporary (nominally less than 30 days) it can be processed per the requirements of CPS 1014.03 (see Section 2.2.4 for description).

(A3) When the change is permanent and involves changes to design documents and hardware configuration, it is classified as either a Modification (MOD) or a Plant Change (PC). A decision matrix in CPS 1003.01 guides this decision making process. The major difference l between the MOD and PC is the magnitude and complexity of the design / hardware change.

The PC process employs most of the same steps as the MOD, however, the simplicity of the i change abbreviates the rigor for some steps and reduces the amount of formal documentation.

l (A4) The remainder of this description, therefore, focuses on the change which is categorized I as the full MOD.

B. PreliminaryProcessingbfuthori:ation ,

Preliminary steps for the full Modification inclode: development of a conceptual design; an estimate of costs associated with design, installation and processing of the modification; a schedule for implementation based on reasons for the change. Changes to ensure or enhance nuclear safety, meet regulatory commitments or implement corrective actions normally receive higher priority. For complex modifications these initial steps may include formation ,

of a team involving engineers from various disciplines, operations and maintenance l representatives, outside contractors and representatives from Nuclear Program support  !

organizations. The conceptual design along with initial cost and scheduling information is  !

presented to the Work Review Board (WRB) which authorizes development and implementation of the MOD (i.e., allocates resources) and assigns a priority, which in turn governs the final schedule.

C. Design Phase Blocks (Cl) through (C7) represent the design phase of the Modification process. These ,

functions are accomplished generally in the top to bottom order shown, however, many are j initiated in parallel. For example, once equipment specifications for large or long lead items l are completed, procurement may be initiated, even though all new or design change l documents are not final approved. Similarly, research on the Safety Evaluation may begin as l part of the design input ftmetion. Work document inputs may be collected in conjunction with initial plant walkdowns. The following further describes each of the ma.ior functions of the design phase:

(C1) The design development block encompasses most of the standard requirements of ANSI N45.2.11 and 10 CFR 50 Appendix B Criterion 3. For a Modification, CPS 1003.01 and supporting procedures, provide detailed guidance on obtaining and documenting design inputs, both from engineering disciplines, and from other potentially affected Nuclear Program organizations, such as training and plant staff. Other portions of plant design, and associated design documents affected by the new design or design change are identified.

Calculations are performed or revised as required to support the design. Change documents, sketches, drawings, specifications and other output documents are developed. When i developed, but prior to final approval, team interface meetings are held, or elements of the j design are formally transmitted for interface review and comment.

1

. - ~ _ - -__ . _ _ _ .

Attachment 2 to U-602683 Page 26 of 71 (C2) When equipment / material specifications are completed, long lead time procurement is initiated in accordance with supporting procedures for procurement and material control.

! (C3) Special in-progress, or final, inspection requirements are specified when these do not already exist in plant maintenance and testing procedures. Similarly, special testing requirements for individual components and equipment are specified, as appropriate, along with total system testing requirements, as required, for performance when installation is complete. Adequate inspection and testing instructions may exist in approved plant maintenance and testing procedures. When this is the case, engineering normally references these in the modification package, and they are later translated into job steps in the work control document by maintenance planning.

t

, (C4) When all of the design elements are completed, impact assessments are sought from affected Nuclear Program organizations either through team meetings, or by transmittal of appropriate design documents. These impact assessments are guided by CPS 1003.01 checklists, engineering standards and departmental procedures. The purpose of this key function is to identify all changes to configuration items required by the new design or design change. Impact assessments are described further below.

(C5) While not totally a function within the design phase, development of necessary work .

documents to implement the new design or design change are normally initiated prior to final design approval. They may not be completed when design is final approved, but should be so i

before the Plant Manager approves the Modification and work is authorized. Exception provisions exist for partial modification implementation and emergency modifications.

Engineers work with maintenance planners to develop the work documents, and to identify any elements of the design requiring change due to limitations imposed by the construction / installation process. The universal work document used for Modification implementation is the Maintenance Work Request (MWR) as described in CPS 1029.01. This is another key procedure in the CPS configuration control process. Other than some minor repair / rework provisions in approved preventive maintenance procedures, virtually all plant work to change hardware configuration is controlled by an MWR generated under the provisions of this procedure. MWR development for Modifications, includes detailedjob steps for installation, inspection and testing steps, a listing of references and procedures associated with the work, a complete material listing, industrial safety and radiological precautions, tagout requirements and notification points for engineering and quality

, inspectors. Any materials or components not purchased or withdrawn from inventory earlier are identified and procured by the maintenance planners.

(C6) When the design is fully prepared a Safety Screening is conducted, and when required, a Safety Evaluation. This process is described in Section 2.3.

(C7) During design development individual pieces of the design (i.e., calculations, material specifications) may have been independently reviewed and approved. Ilowever, when all design elements have been completed, an independent design verification is conducted on all Modifications containing changes to nuclear safety related structures, systems or components.

CPS 1003.01 specifies qualifications for the independent verifier. The Safety Evaluation documents are also reviewed and approved by qualified individuals during this final stage of

Attachment 2 to U-602683 Page 27 of 71 the design phase. Any changes necessitated by these final reviews and verifications may require additional interface reviews and impact assessments, if they alter substantial portions of the originally prepared design.

D. Implementation / Closure Blocks (D1) through (D6) are the major steps in the Modification implementation and package closure phase. j (D1) If a Safety Evaluation was performed during the design phase, it is reviewed by the l Facility Review Group (FRG). I The Modification is approved by the Plant Manager or designee. Also, at this time, and dependent upon installation schedule, the Modification can be work authorized. However, work authorization usually occurs later,just prior to actual start ofinstallation, by the normal work authority, which is the Shift Supervisor or other on-shift licensed Senior Reactor Operator (SRO).

(D2) Once work is authorized, installation proceeds in accordance with the approved MWR  !

and associated documents referenced and contained with the field work package. Typically,  !

in addition to the MWR, the work package will include " approved-for-work" copies of procedures and design documents, material withdrawal documents (traceability), copies of tagouts, radiological survey sheets and any other information required to complete installation. This package is carried to the work location in order that MWR and procedure steps can be followed and signed off as work is performed. CPS 1003.01 and CPS 1029.01 i contain provisions for resolving problems encountered during installation. If resolution involves any change to approved design, engineering becomes involved to prepare and process any changes, and iterate the necessary configuration controls exercised as part of the original Modification development.

(D3) Inspections and tests are conducted as specified in the MWR job steps. Inspections verify that the modification has been installed in accordance with the approved design, and post modification testing ensures that design bases parameters for the components are correct, and any changes introduced do not alter total system function to design bases requirements.

Some of these involve hold or witness points for quality inspectors or engineers.

(D4) Test results for special tests, or those not fully meeting specified criteria, are forwarded to engineering for evaluation. Tests conducted in accordance with approved plant test procedures, and having satisfactory results, may be approved by maintenance / operations supervision. When test results are satisfactory and open action items, which could impact proper system operation to design bases requirements, are resolved, the Modification is ready to be Released For Operation (RFO).

(DS) RFO is a function controlled by an on-shift licensed operator. When the MWR field work., including satisfactory testing and sign off by maintenance and engineering, and necessary action items (which can include procedure revisions and training) are completed, tagouts cleared, and systems interfaces associated with current plant operating status have been reviewed, the Modification is Released For Operation.

Attachment 2 to U-602683 Page 28 of 71 ,

(D6) M0dification package closure involves verification that all open actions are closed, i

remaining impacts have been resolved and all required documentation is present and  !

complete. The package is then forwarded to Document Control as a quality document, normally for life-of-plant retention. -

2.3 10 CFR 50.59 Safety Evaluations Safety Screenings and 10 CFR 50.59 Safety Evaluations are performed in accordance with the

! requirements of procedure CPS 1005.06, Conduct of Safety Reviews. This procedure implements guidance found in NSAC-125. A very narrow scope of minor configuration changes (Section 2.2.3 above) has been defined as having no impact on the design bases of ,

nuclear safety-related structures, systems and components, and thus have been pre-screened.

All other design and configuration changes require a formally documented screening which answers the following six questions. If any question is answered YES, then a Safety i Evaluation is conducted. All NO answers require substantiation, including documentation of specific licensing and design bases documents reviewed in making the negative determination.

1. Is this a change to the facility as described in the SAR?

2. Is this a change to a procedure as described in the SAR?

3. Is this a test or experiment not described in the SAR?

4. Does this change require a change to the CPS Technical Specifications?

5. Is this a change to the Technical Specification Bases?

6. Is this a change to the Operational Requirements Manual?

The requirement to conduct a Safety Evaluation or Screening has always been, and still is, an element of the CPS hardware change program. The Safety Evaluation asks the following seven questions, and again, justification for negative responses, along with reference to documents and USAR sections reviewed, mun be documented in the evaluation.

1. Will change increase the Probabilistic of a malftmetion of equipment important to safety evaluated previously in the SAR?

2. Will change increase the consequences of a malfunction of equipment important to safety evaluated previously in the SAR?

3. Will change increase the Probabilistic of an accident previously evaluated in the SAR?

4. Will change increase the consequences of an accident previously evaluated in the SAR?

5. Will change create the possibility of an accident of a different type than any evaluated previously in the SAR?

6. Will change create the possibility of a malfunction of equipment important to safety of a different type than previously evaluated in the SAR?

7. Will change reduce the Margin of Safety as defined in the basis for any Technical Specification?

All personnel performing Safety Evaluations and Screenings have received formal training on the process and procedure, and a controlled listing of qualified personnel is maintained. The training sensitizes both preparers and reviewers to the fact that even minor changes to design details can sometimes impact licensing commitments contained in the SAR. ,

Attachment 2 to U-602683 Page 29 of 71 Every Safety Evaluation completed is reviewed by the Facility Review Group before the l

change can proceed. If the Safety Evaluation identifies a change to Tech Specs, or an unreviewed safety question, it is reviewed by the Nuclear Review and Audit Group (NRAG) before proceeding. NRAG also has a sub-committee which reviews samples of other Safety l

Evaluations on an on-going basis. Also, in accordance with 10 CFR 50.59 provisions, any changes of this magnitude are submitted to the NRC for review and approval prior to implementation.

2.4 Licensing Bases and Changes The primary licensing bases documents are the Updated Safety Analysis Report (USAR) and appendices, including the Fire Protection Evaluation Report and Safe Shutdown Analysis,  ;

Environmental Protection Plan, Physical Security Plan, Emergency Response Plan and Off-Site Dose Calculation Manual, Technical Specifications, and the Operational Requirements Manual (ORM). In addition to these documents, another source of commitments to regulatory agencies is the response to various inquiries and notices of violation. If the latter are long term commitments, they are normally added to the appropriate section of the USAR by one of the periodic updates.

The USAR, Tech Specs and ORM are evaluated for impact along with configuration items when changes are made to design or hardware configuration. Impacts, are normally identified as part of the Safety Evaluation process required for every change.

While engineers, operators, maintenance personnel and others performing impact assessments or Safety Evaluations have gained familiarity with these documents, and might be expected to ,

look in the right places, additional tools have been provided. The text of the above i documents, except for the Physical Security Plan, are available in a (reference only) computer l data base, which is updated as revisions occur. Commitments are also contained in a data base called the Centralized Commitment Tracking (CCT) system. Both of these data bases are accessible to Nuclear Program personnel, and both are equipped with a word, or phrase, j search capability. Training and instruction on performing impact assessments and Safety .

Evaluations includes discussion of these computer tools.

As stated in previous descriptions of the change process, each change which affects design or licensing bases requires a Safety Screening as a minimum. One of the questions in the Safety Evaluation Screening Form :s "Is this a change to the facility as described in the SAR?" This i is further defined in proceoural guidelines as a technical change, as opposed to editorial.

When a technical change to the USAR is identified, a Safety Evaluation is performed in I accordance with CPS 1005.06. If the design / configuration change results in an acceptable change to the SAR, it is processed in accordance with procedure CPS 1038.03, Revising the Updated Safety Analysia Report and the Operational Requirements Manual. This administrative procedure is used to meet the requirements of 10 CFR 50.71(c). Seven revisions of the USAR (Revisions 0 through 6) have been issued, since submission of the CPS FSAR and issue of the Operating License. CPS continues to develop and submit a revision once per operating cycle.

l I

Attachment 2 to U-602683 Page 30 of 71 2.5 Procedure Impacts Startup, operating, maintenance, test and surveillance procedures received extensive reviews when initially written to ensure compliance with design and licensing bases. This is addressed further in Section 3.0 of this response. Operating, maintenance, test and surveillance procedures, including Post Modi 6 cation, Special Test, Preventive Maintenance and Tech Spec Surveillance, are con 6gured items. When impact assessments are performed as part of the design / con 6guration change process, applicable procedures are reviewed for necessary changes, and normally at two levels. The form used as part of the impact assessment function speci6cally lists CPS procedures as items to be reviewed for impact. Therefore, the person (or team) responsible for the design change will perform some level of procedure review. Also, changes with potential impact on plant procedures are transmitted to Plant Staff for review.

Individuals in this organization are more familiar with details of these procedures, and have tools (word search, as procedures are in a data base) to readily identify potential procedure impacts. When procedure revision is required to support operation or maintenance, a target date for issuance of an advance change or procedure revision is esttblished. Depending upon the substance of the change required, these procedure modi 6 cations are normally issued in  !

conjunction with the design change Release for Operation.

2.6 Design Document Control and Status CPS design documents (by number and title) aw maintained in a computerized data base called the Design Status System (DSS). Supporting analyses and calculations (mostly for balance of plant) are listed and revisions tracked in the Calculation Index. These on-line systems have controlled entry and are available for view to all personnel at CPS. DSS also contains design changes and their current status: either design approved, work authorized, work complete or released for operation and ready for incorporation. The design changes are initially posted against affected design documents in DSS when the design change document is authorized. As the modi 6 cation process progresses date entries are made when the modi 6 cation is complete and Released for Operation. Some design change documents are one j time exceptions to a general design detail, and are entered into DSS as " stamp af6xed" documents, which are not to be incorporated.

Design bases documents in DSS are categorized (A, B1, B2, C, etc.) based on their frequency of usage and importance as an aid to operational or engineering decision making. The category of the document governs the timing and periodicity of revisions to incorporate  !

outstanding change documents. For example, category A documents are targeted for revision within one month after a single change is ready for incorporation. Some lower category documents are never revised unless specifically requested by engineering. DSS, however, l always shows the outstanding changes, which can be used to construct actual as-buiP, or as-designed,information for the document.

Another feature of design document statusing at CPS is the red line/ green line process.

Several hundred category A documents (mostly piping and instrument drawings, and electrical schematics) are maintained in hard copy near the Main Control Room. When a modi 6 cation is work authorized, the drawings affected are marked in red to show the design changes

4 Attachment 2 i to U-602683 3 Page 31 of 71

(

potentially in progress. After work is completed and the system is operational, the as-built l configuration is marked in green. This provides current as-built information to the operators .

until the changes are incorporated and new drawing revisions are provided. i 2.7 Purchasing and Material Control  !

- Steps in CPS 1003.01 call for Engineering to initiate purchase requests for large or long lead  !

time items associated with a modification, uormally as soon as design for the item is finalized.  ;

If the design / design change involves new equipment, components or parts they are classified  !

per engineering procedures and added to the Master Equipment List (MEL). Depending upon the availability and lead time for spare parts for new equipment, an inventory may or may not  ;

be established.

l If the modification abandons installed equipment or components, the cognizant engineer must decide on the disposition of the items and identify necessary changes to the Master Equipment  ;

List and Material Management Information System (MMIS), which is a mainframe database  ;

used for inventory control. Options include complete removal from the plant, removed from service, not in service, or abandoned spare ifit is usable in other plant applications.

Engineering instructions invoked as part of the design change process provide guidance on abandoning equipment.

Parts substitutions, or other plant material changes, are processed like any other design or configuration change, in accordance with the appropriate provisions of CPS 1003.01 or CPS 1003.02.

2.8 Training and Other Impacts If the design change impacts operating or maintenance practices and procedures, the Nuclear Training and Support Department revir :s the modification and associated procedure changes to identify any changes required to operations or maintenance lesson plans and other training materials. The training review also includes an assessment for changes to the Main Control l Room simulator hardware and software. In the case of major modifications, which add new equipment, alter operating system parameters or introduce extensive changes to operating or maintenance procedures, training is conducted prior to releasing the system for operation. The l requirement to include training reviews is prompted by checklists in CPS 1003.01, and has been an element of the design change process since initial issuance of the CPS Operating License.

Like training, procedures and licensing bases documents, other Nuclear Program activities, which could be affected by design or hardware configuration changes, are identified under the impact assessment function of the program. The checklists associated with CPS 1003.01 and the supporting engineering review standards are very thorough in identifying areas of potential i impact.

- ~ - _ . _ _ _ - -- ._ - . _ . - . ._. -

Attachment 2 to U-602683 Page 32 of 71

2.9 Physical Configuration Verification Prior to initial licensing of the plant, an extensive as-built program was conducted to verify that the physical configuration of the plant matched design bases documents. Features of this program are described in Section 1.0.

Subsequent to initial operation the program described below in the history section of this l response went into effect. This has always included in-plant walkdowns (when possible) during design development, in-progress and post modification inspections, and testing to 4

demonstrate that the hardware changes were fully functional and satisfied design requirements for the system.

Additionally, design bases parameters are included in Preventive Maintenance and Surveillance Testing procedures. These are performed at specified periodicities to verify that essential design parameters such as setpoints, flows, pressures, timing, logic, etc. are being 3

maintained within design bases limits. Discrepancies or problems noted during these j maintenance and surveillance activities enter into the corrective action processes as described in Section 5.0 of this response.

2.10 Program History The policy documents for Configuration Management (CNP 2.06) and Modification Control (CNP 4.05) were first issued in 1983. These program controlling documents have been revised only four times, primarily to reflect nomenclature and organizational changes. (CNP l 4.05 was canceled in 1990; the same content was placed in a Modification Manual.) The substance and major functions of these programs for controlling design implementation, j design bases documents and other configuration items, including operating, maintenance and testing procedures; training material rnd licensing documents, have not changed appreciably since issuance of the original Operating License for CPS in February 1987.

Initially, implementing procedures were developed within individual Nuclear Program i departments (Operations, Maintenance, Engineering, Startup, Training and other support organizations) for performing their individual configuration and modification control functions. The CNPs served as integrating procedures, assigning roles to each of the departments. Also at that time new design and design changes were being developed and i i

issued by the original architect-engineer, Sargent & Lundy Engineers, and the NSS designer General Electric Company. A dedicated Configuration Management group in NSED existed i

. to monitor program implementation and track each modification from inception to completion.

Thus, at the point in plant history when plant structures, systems and components had completed start-up testing and were turned over to Operations, procedures and controls were l in place to maintain configuration and design bases. All new designs and design changes l issued (or not yet implemented) subsequent to turnover were processed under a Configuration I

and Modification Control program essentially equivalent to that currently in use. Also in place at the time of turnover (and subsequent license issue) was a computerized design document tracking and status system (Design Status System), which is still in use today. DSS listed design bases documents, outstanding change documents, and the status of i

Attachment 2 4

to U-602683 Page 33 of 71 l implementation of the changes. DSS was available on-line to all Nuclear Program

organizations. It was (and is) especially useful to engineers, operators and maintenance personnel in determining the exact design configuration, and status ofimpending changes.

In 1986 preliminary design control procedures were developed and issued within the engineering department, however, these were not implemented until 1989 after additional revisions to ensure compliance with regulatory, quality assurance program and industry standard requirements. Design changes developed by nuclear station engineers in this time frame were very minor and largely non-safety related.

In the 1988 to 1991 period, design transition was effected between NSED and S&L/GE. This involved transfer of original design baseline documents, including supporting calculations (approximately 75,000), and some computerized calculation programs, for the Balance of Plant structures, systems and components from S&L to NSED. Also during this period, many design output documents (drawings, specifications, vendor documents) for NSSS systems and components were transferred from GE to NSED. Early in the design transition, NSED developed a set of engineering review standards in preparation for assuming full design control. These were initially used as part of the Modification Control Program to review designs provided by S&L and GE, and to perform impact assessments. As NSED began to develop design changes in-house, these standards became key documents for detennining design inputs, performing interdisciplinary design reviews, and contributed to protecting the design bases. The design transition process also included extensive training for NSED engineers by both the original A/E design engineers and NSSS system engineers on the content of the design bases and methods used in its development. i l

In 1991, the engineering design control procedures were integrated with the Configuration and i Modification Control procedure into a single NSED procedure, which contained most of the modification process functions described in CPS 1003.01 today. Some nomenclature and organizational relations have changed, but functions remain essentially the same.

By 1992 NSED engineers had assumed the production role for most new design and design changes. Only designs requiring extensive, time sensitive effort or specialized expertise were assigned to the architect-engineer or other qualified design organizations. Changes or analyses within the NSSS scope, which impact design basis, have been infrequent over the past five years, but when required, have been obtained from General Electric.

2.11 Implementation Issues This section discusses some program implementation issues identified during a wide variety of audits, inspections and assessments conducted at CPS over the past nine years. Other issues are also discussed in appropriate parts of Sections 3.0 through 6.0 of this response.

Corrective actions have been completed for most of the deficiencies noted, and have resulted in continuing improvements to the design and configuration control procedures and practices through the years. In the case of recent inspections and assessments, such as the NRC Operational Safety Team Inspection (OSTI), corrective action plans are formulated and approved in either the Startup Readiness Action Plan or the Long Term Improvement P!an.

Upgrades to program procedures and personnel training are in progress.

Attachment 2 to U-602683 Page 34 of 71 2.11.1 Independent Third-party Evaluations Since CPS initiated operation in 1987, there has been seven evaluations of CPS performed by the industry sponsored oversight institute. These evaluations make an overall determination of plant safety, evaluate management systems and controls, and identify areas needing improvement.

During review of the evaluations of Clinton Power Station, the initial evaluation, published in 1988, found problems relating to configuration control and the design bases. This was noted in three of the first four evaluations. Of these three, two were related to insufficient safety evaluation of design or design bases information. Since that time, and in response to recent NRC concerns, the Safety Evaluation program has been, and is still being enhanced.

This is a part of the CPS Startup Readiness Action Plan sent to the NRC on December 9, 1996. These actions, for the 50.59 program, are to be completed prior to startup from our current refueling outage. The last three plant evaluations did not report any concerns regarding configuration control and the design bases. Therefore, from the viewpoint of our industry sponsored oversight institute, it would appear that progress has been made in configuration control and maintaining the design bases.

2.11.2 Safety Evaluation Program Improvements The recent NRC OSTI reported that safety reviews were weak with inadequate or missing reviews and that the approach to determining what constituted a change to the USAR and required a written Safety Evaluation was non-conservative in several cases. The inspectors  ;

identified several examples of violations for failing to conduct required Safety Evaluations.  ;

Insufficient emphasis on identification of USAR discrepant conditions and ensuring timely l resolution was apparent. Some personnel were noted to have a poor understanding of 10 l CFR 50.59 Safety Evaluation requirements.

Because the Safety Review process is so important to maintaining both design and licensing bases, CPS initiated a comprehensive independent (outside contractor) assessment of the Safety Evaluation Program, with emphasis on the Safety Screening process.

A comprehensive corrective action plan has been developed. This involves review of several hundred past Safety Evaluations and Safety Screenings, addition of details to procedural guidance requirements, extensive re-training for personnel qualified to perform these activities and program changes to limit the number of Safety Evaluation / Screening reviewers to a small, highly qualified group. Safety Screening / Evaluation for all design changes implemented during the current refunding outage will be reviewed prior to restart.

2.11.3 Licensee Event Reports Licensee Event Reports for Clinton Power Station submitted from 1986 (prior to receipt of  !

the Operating License) through the end of 1996 were reviewed. A search was conducted for Licensee Event Reports related to design bases issues. All Licensee Event Reports identified were then reviewed to determine whether they identified design basis weaknesses. Of the

Attachment 2 to U-602683 Page 35 of 71 total two hundred fifty Licensee Event Reports between 1986 and the end of 1996, eighteen .

Licensee Event Reports (7.2%) were potentially applicable to design basis issues. All but two of these eighteen events were self-identified by CPS personnel.

The types of problems identified by these eighteen Licensee Event Reports were then categorized as follows: (1) inadequate design development; (2) inadequate design review and implementation; (3) inadequate design installation; (4) inadequate design fabrication; and (5) unanticipated design interfaces (e.g., between systems or between components within a system). These problems led to inadvertent actuations of Engineered Safety Feature (ESF) equipment / systems, inoperable components / systems, plant transients and/or scrams and conditions outside the design basis of a system (s). Licensee Event Reports corrective actions were comprehensive and effective in preventing recurrence of these conditions. In these cases, design changes, procedure changes, additional training for applicable personnel and some plant modification program enhancements, dominated the corrective actions taken. In most instances, the conditions surrounding these Licensee Event Reports resulted in isolated occurrences of the associated events. In conclusion, the review of Clinton Power Station Licensee Event Reports determined that there have not been any major design bases program deficiencies leading to reportable events or conditions.

2.11.4 Notices c/ Violation Nuclear Regulatory Commission Notices of Violation issued for Clinton Power Station from mid-1987 to the end of 1996 were reviewed. A search was conducted for design bases issues.

The list of Nuclear Regulatory Commission Inspection and Enforcement issues formulated a basis for direct identification of noncompliance matters, related to design bases programs and processes. All Notice of Violations were reviewed to determine whether they were potentially applicable to design basis issues. A total of thirty-seven Notices of Violations were identified from this review.

The types of problems identified by these thirty-seven Notices of Violations were generally consistent with those categorized in the Clinton Power Station Licensee Event Report review.

Also, the types of corrective actions taken in response to the Notices of Violations were similar in nature to those identified in the related Licensee Event Report review. However, the Notices of Violation corrective actions had a broader scope impact on the continuing development of design bases programs and processes (e.g., design control, design documentation and maintenance, plant modification packages,10 CFR 50.59 unreviewed safety question determinations). Cumulatively, these changes have improved the comprehensive nature of Clinton Power Station design bases programs and processes.

2.12 Summary At the time ofinitial licensing of CPS, the design bases were assessed and validated to be adequate, and consistent with the physical configuration of the plant and licensing base documents (as described in Section 1.0). Since that time a design and configuration control program, which included provisions for initiating Safety Evaluations and identifying SAR changes, has been in effect. While changes to improve implementing procedures have been

I I

Attachment 2 to U-602683 l

i Page 36 of 71 made over the past ten years, the basic program functions for controlling design bases have remained consistent.

I f

t e

i l

I i

f J-i i

. . e I

PREURIWARY l l [

ADENTFICA T3ONr

• l PR CE INGl l DESIGN PHASE BIPLEnEENTATFONCLOSURE .

WSSWDCA TION . AUTHORtzATFON C . D  !

A e e .

s B > a l l l >

. .  ; ars C

.-_._._____y <

l l k---- -

g g l FRG Review I. I l l (C1) ------ O PlantMgr. Approval (D1) F 5

• Development Calculabons

• - g l

o ,,,n m  ; g a

_______Authodzabon [

Assessment l l l m___., ._ e t m

. . _ . . _ _ __ _ _ .___ _ (C2) .

___._?_. , i

! l l u" g

?

i l ,

Long Lead  ;

Pfewoment

• InstaHabon . (D2) l l l T  !

(f)  ?

Ternparary Moencebon - --

• * . tm I-.,___---?.__---

1 .

\

L_ ._____./

, { (C3) { f*

A (A2) . B . (CT) . 3

[I Inspecton & Teseng I (D3) g f _ _ . _ _ _

specaceman l

inp & TW m,

.t t

Demon Consgurahan Conceptual Design 3 mdependent Demon l Change Identned &

l l i .* Verscahon .

g- T- O

{

C categonred

/ \_.

Cosuscheduie . ----

--4----- f m3 E F Modecahon -? Desagn/ Safety l -

] ,( ,

Mod Authorizahon '

" ---] (C4) Eval Approval l (^~j, g g

Evaluate Test Readts

-]y__

g (**) ~ ' ~ " - - "

9 tmped Assessments (D4) f

[ ^97 E

.[_riegg .  ; Resolve impact ' .

Consguranon j'Piant Change ) l l C )

L"*"*j*N--j C

-- - . .-- 1 (C5)

- . . . t _. . . -

(") . .

(A1) (A3) l l 'l t s t

! l I

NW Release for Operanon (DS) y

Developmd l @

~

! l l T l l _.___J

_. , y  !

l l --, l ____.._t e l I- ' ,l 3 To>

• rm l l 10CFR$059 Padage Closure h(D6)

Sa% l G n l (C6) _______

e l l- Evaluabon l Vaultmg y i

-. _j w w i l l  !

. _ _ _ _ emg

%=-  :

i

.M tJ r

I i

i

. _ . _ _ . - - _ . _ _ _ ._. . . _ _ _ . _ . _ _ _ _ _ . . _ ._._______._._______.___.__________.____.___________._______.___._._m _ -

_ _ , _ - . - - , , . _ _ , , _ . , _ , _ , _ r.,.,. ,, , - . . , . -....m.,.., . . . , _ . _ . _ , _ .

Attachment 2 to U-602683 Page 38 of 71 3.0 Item b

" Rationale for concluding that design bases requirements are translated into operating, maintenance, and testing procedures."

3.1 Introduction Design bases information is translated into operating, maintenance, and testing procedures through the CPS procedure revision program. The program relies on the originator and an independent technical reviewer to ensure the procedures are consistent with the design bases.

The independent technical reviewer is tasked with identifying the need for cross-discipline reviews. The program contains provisions for the initiation of Safety Evaluations.

The CPS Emergency Operating Procedure program addresses the accident analysis design bases. These are Off-Normal procedures which specify action, including manipulation of plant controls, to reduce the consequences of an accident or potentially hazardous condition and to place the reactor in a safe condition while providing for a safe extended shutdown.

The program controls any changes made to emergency operating procedures and includes i independent assesssments for the need to conduct additional verification and validation, rcquirements to perform Safety Evaluations and the use of a multi-disciplinary team for j emergency operating procedure program changes. I When plant design changes are made, the operating, maintenance and testing procedures are revised accordingly. Section 2.0 above and Section 3.2 below describe this process. Design changes include but are not limited to hardware, configured software or design document changes.

Numerous internal and external design bases audits and inspections have been conducted since the issuance of the Operating License. These included reviews of operating, maintenance and testing procedures. Results of asssessments are discussed in Section 3.4.

The procedure control program has existed in a procedurally controlled form since before the Operating License for Clinton Power Station was issued.

3.2 Current Procedure Revision Control Program - Key Attributes 3.2.1 Procedurally Controlled Process The CPS plant staff procedure revision program for operating, maintainance and testing procedures is outlined in procedure CPS 1005.01, CPS Procedures and Documents, and in CPS 1005.07, Temporary Changes to Procedures and Documents. CPS 1005.01 describes the procedure revision process and currently establishes the requirements for the use of procedures at CPS. CPS 1005.07 describes the Temporary Change process and delineates the methodology and requirements for the performance of Temporary Changes.

Attachment 2 to U-602683 Page 39 of 71 3.2.2 Technical Reviews The originator of a procedure change is responsible for ensuring that vendor manuals, drawings and any other pertinent infomiation is reviewed prior to approval of the procedure change. CPS 1005.01 includes the Procedure Originator Review Checklist, which was developed as a guide to aid the originator in preparing procedure revisions and changes. The originator is also responsible for coordinating any required reviews, ensuring the resulting procedure is technically correct and satis 6es upper tier requirements. 4 l

) The procedure change is reviewed and approved by an Independent Technical Reviewer (ITR). A cross disciplinary review is performed when required by the Independent Technica.

Reviewer.

1 The Independent Technical Reviewer is knowledgeable in the area that the procedure addresses, is nonnally from the organization responsible for the performance of the procedure and has been approved by a department head. l Surveillance procedures have the additional requirement that changes to Technical  !

Speci6 cation implementing steps be reviewed by Licensing personnel prior to the change being made. Licensing personnel track NRC approved changes to Technical Speci6 cations to ensure that they are incorporated into plant procedures. CPS surveillance test procedures have steps to return components to their normal lineup (design bases condition) as part of the test restoration process.

3.2.3 Tracking Commitments i

Steps in procedures that satisfy regulatory commitments to organizations are annotated with a small "c". A small "c" is also placed in the reference section that lists the source of the commitment, linking the reference to the implementing step in the procedure. Any change made to the implementing step requires a review of the commitment to ensure that the procedure, as changed, continues to satisfy the commitment. CPS 1005.01 gives instructions ,

and requirements for the tracking of commitments in Plant Staff procedures.

i 3.2.4 Procedure Approvals Procedures changes are approved by the group supervisor and department head as a ,

i minimum. Nuclear Station Engineering must approve changes which require a Safety Evaluation. A change to a procedure that manipulates safety-related equipment, an adminstrative procedure or special test procedure requires final approval by the Manager -

, CPS. Any procedure change that requires a Safety Evaluation must also be reviewed and approved by the Facility Review Group (FRG) prior to the change being issued.

3.2.5 Safety Evaluations Changes to CPS procedures that are other than editorial or typographical require as a minimum that a Safety Screening be performed. CPS 1005.06, Conduct of Safety Reviews, delineates the requirement for Safety Evaluations. Personnel that perform Safety Reviews are quali6ed via training by the Licensing Department. The program and implementation

Attachment 2 to U-602683 Page 40 of 71 descriptions in Section 2.3 on Safety Evaluations for hardware changes also applies to procedures. The Safety Evaluation process with its key attributes was in place prior to receipt of the plant Operating License.

3.2.6 Procedure Validation Procedure revisions are evaluated by supervision of the group responsible for the performance of the procedure to determine if validation is required. Validation is defined as the " process of evaluating a procedure to confirm that the change reasonably produces expected results and that the change does not reduce safety of operations". If validation is necessary, one of the following methods is selected:

Walk-Through: Step-by step enactment of the procedure without operating equipment. Drawings may be used when equipment is not accessible.

Simulator: Performance of the procedure on the plant simulator.

Bench Test: Performing the proet Nre on equipment in the shop or equipment similar to actual plant equipment.

Actual Performance: Performing the procedure on plant equipment. The procedure must be approved and permission granted from the Shift Supervisor.

3.2.7 Periodic Reviews for Adequacy CPS procedures are reviewed biennially in accordance with CPS 1005.08, Periodic Reviews.

Surveillance procedures that are satisfactorily performed on a schedule ofless than or equal to 18 months are not required to be biennially reviewed.

Periodic reviews are defined as a determination by a qualified person as to whether or not a procedure or document will adequately fulfill its intended function. In addition to periodic reviews, procedures and documents are reviewed for adequacy in conjunction with the investigation initiated as a result of an unusual incident such as an accident, an unexpec!ed transient, significant operator error, or equipment malfunction which results in a reportable occurrence.

In addition to periodic reviews of procedures, procedure users can provide feedback to the Procedure Group to relay recommendations for enhancements. This creates more ownership for the procedures by the users and improves the continual maintenance of procedures.

Minor deficiencies in procedures can be identified earlier than the biennial review process.

The Comment Control Form in CPS 1005.01 is used to report enhancements and is not intended to be used instead of the Temporary Change process.

3.2.8 Emergency Operating Procedures Control Procedure CPS 1005.09, Emergency Operating Procedure (EOP) Program, controls the preparation, approval, and maintenance of the Clinton Power Station Emergency Operating Procedures. The current EOP Program contains controls for any changes made to EOP elements, including independent assessments for the need to conduct additional verification and validation, requirements to perform Safety Evaluations for changes, establishment of a i

Attachment 2 to U-602683 Page 41 of 71 dedicated EOP Coordinator, and the use of a multi-disciplinary team for EOP program changes. CPS continues to adhere to and participate in the BWROG Emergency Procedure Committee recommendations and guidelines. Deviations from the BWROG Emergency Procedure Guidelines (EPGs) are well documented in the Plant Specific Technical Guidelines Deviation Document. The CPS EOP program is designed to be pro-active to new information. Updates to the program are controlled to the same level as the original products.

3.3 Program History 3.3.1 Surveillance Test Procedures Surveillance Test Procedures were written to acceptance criteria based on design bases values i to meet the requirements of Technical Specifications and the Inservice Testing and Inspection Programs, i Prior to initial plant startup the Surveillance Test Procedures were reviewed to ensure they implemented the requirements of the Technical Specifications and were field verified.-

, CPS implemented the (ITS) Improved Technical Specifications on Jan 1,1995 as discussed pceviously in Section 1.3.4. Reviews were completed on Surveillance Test Procedures to ensure that revisions necessary because of changes in values in the ITS were issued prior to performance.

3.3.2 Operating Procedures j Prior to CPS receiving it's Operating License, operating procedures were written using l

, vendor manuals, drawings, system descriptions, other design output documents, the FSAR  !

and Technical Specifications as reference documents. As a minimum, a safety screening was performed on each procedure. Operating procedures were " walked down" in the plant without operating the equipment to verify the procedure matched the plant. Changes that

. were identified were incorporated prior to the performance of the procedure.

CPS integrated operating procedures include the use of Mode Change Checklists to ensure the systems required to be operable for entry into that mode are operable. Operability is ,

demonstrated by verifying that there are no outstanding items which affect system operability I or invalidate previous surveillances, and that attendant instrumentation and support systems are capable of functioning as required.

CPS Operating procedures have prerequisite steps for conducting system lineups. System lineups are performed following a refueling outage on systems selected by the Assistant Director-Plant Operations and approved by the Assistant Plant Manager-Operations.

Procedure CPS 1052.01, Conduct Of System Lineups, includes the requirements for conducting both full and partial system lineups.

1 During 1990 a review of operations department procedures was performed by an independent contractor to verify that the procedures conformed to Technical Specifications. System operating and surveillance testing procedures were reviewed. Only a few minor procedure  !

I

Attachment 2 to U-602683

( Page 42 of 71 t t l changes were required as a result of this review. However, the contract personnel did relay 500+ recommendations for enhancements that were subsequently reviewed and resolved.

l

3.3.3 Emergency Operating Procedures

! In January 1991, the entire EOP program was replaced. Starting with the implementation of l BWROG EPG Revision 4, previous EOP procedures were replaced with an entirely new

( program. A Corporate Nuclear Policy, a separate CPS administrative procedure, and an EOP j l Program Manual (which includes the Plant Specific Technical Guidelines, Writer's Guide, l Validation Program, and Verification Program) became the new EOP program. EOP 3 l

Flowcharts, Revision 20, received a 100% verification and validation. A Safety Evaluation i

! was performed for the new EOP program elements. Additionally, the new BWROG EPG l Revision 4 received an NRC SER.

In April 1991, the new CPS EOP program was inspected. NRC findings revealed short l

comings in the EOP program dealing with development of the EOP Support Procedures.

(Text based actions provided detailed operation instructions for the BWROG EPG Revision 4 directions.) A separate EOP administrative program for the text based procedures was developed. A 100% verification and validation of every EOP Support Procedure was performed. A Safety Evaluation was conducted for the EOP (Revision 21) flowcharts, EOP support procedures, and the new program. These improvements resolved the identified shortcomings and closed the issue.

3.3.4 Maintenance Procedures The original maintenance procedures were written by maintenance personnel with engineering assistance using vendor manuals, drawings and the FSAR. Vendors were often contacted. Due to the nature of these procedures, many were initially validated by performance on actual equipment during system outages. Temporary changes and/or revisions were made to the procedures to correct deficiencies.

The procedure that controls maintenance work, tasks the individual implementing the procedure to obtain a review by NSED or to generate a condition report to report deviations from design. Configuration and design changes are not allowed without design change authorization per the CPS hardware change program.

Clinton Power Station's preventive maintenance program consists of the preventive l maintenance work request and is controlled by an approved plant procedure. The preventive  ;

maintenance program identifies work that is required to keep the equipment operating in a safe and efficient manner. These requirements come mainly from vendor recommendations i but can also come from any department at CPS and include the requirements from the Environmental Qualification Program.

Qualified maintenance personnel can use the Field Configuration Change process. This process has a limited scope, it can only be used on components which are not safety-related, not quahty related, are not ASME code, and are not Augmented D (Radwaste) along with other restrictions. The process has requirements to maintain configuration control. This process was implemented in July 1996.  ;

~ ,. . - - -

Attachment 2 to U-602683 Page 43 of 71 Following corrective or preventative maintenance on equipment " post maintenance testing" is conducted to ensure components and systems are restored in accordance with codes, standards, Technical Specifications, and good engineering practices. By procedure, post I maintenance testing shall be performed on all components and systems required by the J

) Technical Specifications to be operable, when the work activity could have impacted the equipment or system's ability to perform its design function as tested by the Technical Specification surveillance requirements, if a Maintenance Work Request or Preventive 1

Maintenance is performed on equipment that is safety-related, IEEE,1E, Seismic Class 1, ISI related, EQ, ASME, or Code Class 3 A,3B,3C, BD, TT, or MC, then a post maintenance test  !

evaluation shall be performed. Post maintenance testing is done to ensure that component l and system performance parameters are within acceptable limits after maintenance, and i 4

demonstrate that a system or component will perfonn its function for operability i requirements. Post maintenance testing requiring component manipulation is perfonned using approved station procedures and is documented in the work document.

The CPS safety tagging procedure establishes controls to ensure that components are retumed to the proper position when safety tags are removed. The tagging authority (a licensed operator) determines the proper restoration position and annotates it on the tagout sheet. The person returning the component to the indicated position initials for it, and the component position is then independently verified. The tagging authority evaluates the need to perform the applicable system lineups. System restoration following a safety tag release results in a system configuration consistent with approved plant procedures. Safety Screenings are done for tagouts greater than six months old.

T 3.4 Current Implementation Issues

, The events surrounding the September 5,1996 Reactor Recirculation Pump seal failure and l subsequent inspections identified problems including those in the area of procedure adequacy, procedure adherence and the use of engineering action plans.

System engineer direction to operators was weak in that tests were conducted by direction of the system engineer using action plans or implementation plans. These activities should have been performed using approved procedures. The specific evolutions controlled by engineering action plans fortuitously did not result in any adverse safety consequences.

However, in each case, required reviews (e.g., Safety Evaluations) and control processes that existed to prevent adverse safety consequences were circumvented. Routinely conducting operating evolutions without properly reviewed and approved procedures was a programmatic safety concern.

These weaknesses are being addressed through the CPS Corrective Action Program. The short term actions are identified in the "Startup Readiness Action Plan" They include but are not limited to the following: a review of past action plans; the development of a new site procedure on Coordination plans,(Coordination Plans shall not be used as a controlling document to manipulate equipment); training on the coordination plan procedure; a review of the adequacy of policy statements on procedure adherence; training on procedure

l Attachment 2 l to U-602683 l Page 44 of 71 compliance; review of operations, testing and selected maintenance procedures for adequacy;

, and an evaluation of the procedure process (use, revision, backlog).  ;

i 3.5 Summary t

l The Clinton Power Station procedure development and revision control program for i operating, maintenance and testing procedures existed prior to the issuance of the plant Operating License. Procedure writers use centrolled design output documents in the procedure development process. The program has requirements for an independent technical i

review, cross-disciplinary reviews as required, use of the CPS safety evaluation process and i

management approvals. When design changes are made, the design change program requires evaluation of the need to revise operating, maintenance and testing procedures. These programs and the results ofinternal and external audits provide reasonable assurance that  ;

design bases requirements have been translated into operating, maintenance, and testing l procedures.

i l

)

l l

1 l

i i

l Attachment 2 to U-602683 Page 45 of 71 4.0 Item c

" Rational for concluding that systems, structures, and component configuration and performance are consistent with the design bases."

4.1 Introduction l

Illinois Power validated both the design of CPS and its construction in accordance with that design, by a series of efforts just prior to licensing as discussed in &ction 1.0.

Included was the Independent Design Review (IDR), completed in Janual y 1985. The IDR assessed the overall design and detennined that there was reasonable assurance that the CPS design was technically acceptable and in accordance with design requirements and published regulations.

This response focuses on the performance and configuration of systems, structures, and components and how CPS has maintained that performance consistent with the design bases since January 1985. The results of both internal assessments and external inspections provide the basis for concluding that the plants' configuration has been maintained in accordance with the design bases.

CPS established a baseline of Structure, System and Component (SSC) performance at the end of the plant's construction phase. Activities since have had the combined effect of maintaining the baseline performance. The modification process has ensured that the .

performance baseline is updated as equipment and/or operations have been changed. The baseline is updated by changes in plant design and configuration.

4.2 Establishing the Baseline of Plant Performance At the end of construction, the plant was turned over to Illinois Power for the Checkout and Initial Operation Phase (C&IO). The C&IO Phase testing consisted mainly of equipment energization, flushing and cleaning, and calibration ofinstrumentation.

Preoperational Phase testing was then performed to verify the operational performance of equipment on a system or subsystem basis. Next were the Preoperational and Acceptance Tests. Testing during this phase verified that systems were capable of operating in a safe and efficient manner consistent with the system design bases. These tests also established baseline data for equipment and system perfonnance for comparison with future tests to determine equipment or system degradation. Following the completion of successful Preoperational and Acceptance Tests, systems and subsystems were turned over to Plant Staff from the CPS Startup Group. Turnover packages included marked-up drawings, which identified the scope of the system or subsystem being turned over, open system-related items (punch list items), results of walkdowns which compared design to as-constructed configuration and other configuration information. The turnover process was l

completed prior to the Startup Phase.

i The Startup Phase commenced with fuel loading on September 29,1986, and concluded l

when the Startup Test Phase (STP) procedures were complete. The STP procedures were conducted to obtain engineering data to confirm the design bases, to demonstrate l interrelated system performance, to establish overall station operability and to ensure plant

Attachment 2 to U-602683 Page 46 of 71 capability to respond appropriately to anticipated transients and postulated accidents. The startup test results are addressed in the Power Ascension Test Program final report sent to the NRC on November 11,1987.

In some cases during the test phase after the STP, design changes were issued to resolve discrepancies on systems or subsystems. These changes were reviewed for impact on completed tests, based on the system turnover status, according to controlling procedures.

If a design change could affect previous test results, the system was retested. This process ensured that systems or subsystems turned over to IP were adequately tested to show performance consistent with the design bases following any design changes.

4.3 Maintaining the Baseline of SSC Performance Since the end of the Startup Test Phase, tests and programs have been established and 4 performed to ensure that equipment continues to perform its design basis function (s).

These testing and monitoring programs are discussed as follows:

4.3.1 Surveillance Testing Program i

The Surveillance Testing Program was developed to satisfy testing requirements in the Operating License Manual (Technical Specifications) and to obtain data to support the Inservice Inspection (ISI) and Inservice Testing (IST) Programs. The development and validation of the Technical Specification Surveillance Test Procedures are described in Section 3.0, the response to item (b). Each Surveillance Test Procedure is written to evaluate the performance ofits associated SSC by comparing the test results to specific acceptance criteria which are based upon design bases values.

J The quality of the CPS surveillance program has been good as validated by a recent internal surveillance (audit) that reported that STP is being effectively scheduled, tracked and performed within Technical Specification frequencies. NRC SALP reports 11 and 13 both described the program, procedures and/or quality of the STP as " excellent".

4.3.2 ISI/IST Programs CPS has ISI and IST Programs in place to meet the requirements of 10 CFR 50.55a paragraphs (f) and (g), CPS USAR, ORM and CPS Technical Specifications. These programs are in compliance with the ASME Code Section XI, here after referred to as the

" Code". The CPS ISI Manual contains the respective ISI and IST Program Plans which identify the components included in the scope of the program, Code classification, method ofinspection or testing and frequency.

Prior to fuel load, CPS performed Preservice Inspection on the components identified in the ISI program plan. These inspections consisted of performance of visual inspection, surface examination (liquid penetrant or magnetic particle (MT)) and/or ultrasonic testing.

Performing nondestructive examinations verified the absence of unacceptable flaws in these components. Since fuel load, CPS has been verifying the structural integrity of these components by performing inservice inspection as required by the Code. Over the course of six refueling outages, CPS has found one unacceptable flaw in piping

. _ - . =

Attachment 2 to U-602683 Page 47 of 71 components (detected by surface examination by MT) and several snubbers not meeting the functional test criteria. Appropriate actions were taken to restore the piping component and snubbers to their original conditions. CPS Repair / Replacement programs ensure that any repair or replacement performed on Code components meet the Code requirements and maintains and updates the design of the components or systems.

The original IST Program Plan was submitted to the NRC in December 1985 and CPS began performance testing of safety related components identified in the plan in 1986.

IST established the baseline measure of performance for the individual components when

. they were in a new condition. With the baseline established, the Code tolerances for allowable degradation are applied to determine the acceptance criteria for future testing.

Where design perfomaance limits are more conservative than those allowed by the Code, the most limiting criteria are applied. Successive tests are compared to the baseline, and components that fail to meet the acceptance criteria are either placed on an increased i testing frequency, as directed by the Code, or declared inoperable. Components declared inoperable are maintained as such until corrective action is completed and retesting indicates satisfactory perfomiance. During the course of the first ten years ofInservice Testing, several pumps and valves have been placed on increased testing frequency or ,

have been declared inoperable as required by the Code. j

4.3.3 Core Performance Monitoring 2

The CPS core is configured, as described in Section 2.2.2, to ensure that core performance  !

4 remains continuously in agreement with the desiga bases. The performance of the reactor core and process computer are monitored during each cycle to ensure that their configuration and performance are consistent with the CPS design bases. These monitoring functions are performed following both CPS and NSED procedures. After initial criticality, following fuel loading or refueling, a shutdown margin demonstration is completed to confirm acceptable agreement with fuel vendor predictions. Past shutdown margin surveillances have shown close agreement with the fuel vendor predictions and NSED calculations.

For the plant startup, from ambient conditions to full power operations, activities related to reactivity are governed by proceduto to ensure the validation of design bases and reload licensing analyses. During normal operations, reactivity anomalies are monitored by two different procedures. These two independent methods complement each other to ensure that there has been no significant fuel manufacturing variations, core loading error, or analysis error. Past performance of these two procedures regarding gross reactivity anomaly monitoring, have shown that the core performance was within the TS requirements and two methods in agreement with each other.

Routinely, procedures require that compliance to reactor power distribution operating limits be confirmed. Since these compliance checks are based on process computer results which themselves could be impacted by fuel vendor errors propagating throughout the fuel design and fabrication process, independent core follow analyses are performed by NSED in accordance with department procedures. These analyses ensure early

1 Attachment 2 to U-602683 Page 48 of 71 identification of core performance anomalies or process computer problems. These operating limits checks, performed by operations personnel, reactor engineers, and fuel management engineers, ensure that the safety limits are not exceeded during anticipated operational occurrences and would not be exceeded during design basis accidents. Past NSED analyses for plant operation at steady state conditions has shown that the process computer results were consistent with the predictive calculations with deviation I understandable and consistent with industry trends.  ;

After each transient event, equipment involved in the trip is analyzed to verify that it i performed adequately. If the transient induced a reactor trip, a post-trip procedural review  ;

is performed. These reviews and analyses are used to validate performance of core-related

)

systems in accordance with the design bases. Post-trip review results and transient analysis have shown that the transient events were bounded by the design transients and no fuel failure resulted.

4.3.4 Maintenance Rule Program The Maintenance Rule program has been established, in accordance with the requirements of 10 CFR 50.65 under Nuclear Station Engineering Department (NSED) procedure M.7, "NSED Maintenance Rule Activities" and the Project Document," Implementation of The Maintenance Rule at Clinton Power Station". This procedure evaluates the performance or condition of an SSC against established criteria, and provides reasonable assurance that they are capable of performing their intended functions when required. It also requires performance and condition monitoring activities be evaluated every refueling cycle.

When an SSC does not meet established criteria, corrective action is taken to restore functionality. If the cause of failure or unacceptable system performance is maintenance preventable and the corrective action has not solved the issue, goal setting and monitoring are established to bring improved performance.

Similarly, structures considered significant to the safe and reliable operation of CPS are l monitored (walked down) in accordance with a dedicated engineering instruction. This walkdown has a schedule frequency of ten years. A structural baseline walkdown was performed during Cycle 6 and the sixth refueling outage during 1996. During the walkdown, scoped accessible structures were considered acceptable. The results of this baseline walkdown identified surface conditions such as cracks in building floors and walls, and foundations of Switchyard structures, or surface conditions such as leaching,  !

scaling, spalling, paint pceling, corrosion, and coating failure. The surface cracks were found to be passive and within acceptance limits, while the surface conditions were found to not be detrimental to the structural or functional integrity of the structural member and were considered acceptable without further technical evaluation. For those surface l

conditions where repairs were considered necessary to mitigate further degradation, a Maintenance Work Request was written or the Facilities group was notified if repairs required coatings work. Follow-up inspections for surface cracks identified in need of

. ' r monitoring are scheduled.

l Attachment 2

, to U-602683 I Page 49 of 71 4.3.5 Operability Determination Program The CPS Operability Determination Program was based on the combined use of the Condition Report and the Limiting Condition for Operations procedures. The program '

was identified as weak by the 1996 NRC Operational Safety Team Inspection (OSTI). In l

response, CPS undertook a comprehensive evaluation of the Operability Determination l Program including a "backfit" review to ensure that equipment was operable. The scope of the program included open CRs which may have been associated with operability, closed CRs which had remaining open actions which may have been associated with operability, and other documents selected based upon a potential to be related to operability.

This effort resulted in about 250 CRs plus additional letters, standing orders, and other documents being evaluated. The investigation concluded as had the OSTI that the Operability Determination process was weak as it was written. However, no equipment was declared to be inoperable as a result of this extensive backfit review. In several cases >

where the supporting documents were found to be weak, the engineering evaluations were rewritten or maintenance was performed on the equipment. In spite of process weaknesses, personnel were sensitive to the SSC functional requirements and they had addressed and considered operability when evaluating non-conforming and degraded conditions.

Based on the above investigation and results, a new Operability Determination procedure was developed and issued to address OSTI concerns and those self-identified by the CPS investigation. The new procedure describes requirements for timeliness, documentation, and responsibility. Guidance from Generic Letter 91-18, was used to develop this procedure.  ;

The results of the backfit review and issuance of the new procedures provide reasonable l assurance that the design bases requirements of equipment evaluated for operability has been maintained. The Operability Determination Program review is an action in the CPS Startup Readiness Action Plan sent to the NRC on December 9,1996 and will be completed prior to j restart.

4.4 Updating the Baseline of SSC Performance Modification, installation, and testing requirements are required in preparing a modification. .

I The CPS Hardware Change Program procedure defines the method of defining and determining installation and testing requirements as described in Section 2.0. The implementation and testing of these modifications is defined in the Maintenance Work Request procedure and the Conduct of Clinton Power Station Testing procedure respectively.

These three procedures form the foundation for the definition and the performance of modification installation and testing process to include the revision or definition of design bases verification and its update. Each element of this process requires that the designer specify installation and test criteria, the installer fulfill installation requirements, and the tester meet specified test requirements. The activities ensure that the new SSC's configuration is consistent with either the existing or the revised design bases.

y s =. . . - . - . , . . . - + _ . = _ --- a -.s_ . x- - .-:: - - a .. -

Attachment 2 to U-602683 Page 50 0f 71 The modification process is amplified in Section 2.2 of this response. Because the testing of modifications is a key element of verifying a design change is capable of performing its intended design function and consistent with the design bases, the Post-Modification Testing requirements are specified in an elaborating section of the CPS Hardware Change Program ,

procedure. This procedure section defines the method and sources for determining testing requirements, such as industry standards, Pre-Operational or Startup Tests that may be affected, vendor technical documents, level (system, component or both) of functional test, and sequence of test. Also included, is a detailed method of test results evaluation which l includes such actions as verifying test results are consistent with the specified acceptance criteria.

As part of the modification acceptance process, the designer reviews the final installation and testing results to ensure the modification installation and testing requirements have been satisfied. After this review, the designer authorizes modification acceptance (a prerequisite step for Operations to approve the SSC released for operation) and makes the appropriate notifications.

In summary, the modification program defines the process to ensure changes which require design bases verification or changes are reviewed, approved and updated. The program has been audited by internal and external organizations. The overall effectiveness has been found to be acceptable and implementation deficiencies have been corrected.

4.5 Assessments of Plant Performance 4.5.1 HPCS/Div III DG SSFA - November 1991 As a response to a BWR-6 Owners Group commitment, Clinton Power Station committed to performing an operational readiness assessment of the Division 111 Diesel Generator (DG) and fligh Pressure Core Spray (HPCS) systems. The HPCS system and Division III DG systems were found to be operable. Eleven technical issues were identified during the j assessment, however the issues would not have prevented the systems from performing their design bases function. The following strengths and weaknesses were observed: j

. Weaknesses: Calculational problems were encountered. Some calculations were not retrievable to support the design bases. Some calculations contained errors or unstated and/or unverified assumptions. Lack of attention to detail was demonstrated by errors in drawings, procedures, system descriptions and calculations. Minor errors were found in the USAR which were characterized as not significant.

. Strengths: The plant was clean and equipment was well-identified. The design documentation and design analysis were readily retrievable.

4.5.2 Self Assessment Prior to EDSFI - November 1992 Prior to the NRC EDSFI inspection performed in January and February of 1993, Illinois Power conducted a self-initiated Electrical Distribution System Functional Inspection (EDSFI). This inspection was conducted over a four week period in October and November

Attachment 2 to U-602683 )

Page 51 of 71 of 1992 by a six man team of four Illinois Power personnel and two contract individuals.

The purpose of the self-initiated inspection was to prepare for the pending inspection and to identify areas where added effort might be needed. This 1600 man-hours inspection effort addressed approximately 120 questions.

The self assessment identified six strengths in the following areas: (1) prior self comparison and reviews of the NRC EDSF1 issues at other plants; (2) material condition vethe electrical i distribution equipment; (3) engineering technical support; (4) trending program for electrical l

equipment; (5) operator knowledge and (6) reviews of aging MWRs, tagouts and disabled '

annunciators. Several recommendations were made to help prepare for the NRC EDSFI.

Design basis calculations were reviewed and a recommendation was made to upgrade (old) calculations to current methodology when they are revised. No equipment was determined to ,

be inoperable during the inspection.

4.5.3 NRC EDSFI Assessment - February 1993 Following the self assessment, the NRC performed a four-week EDSFI at CPS in January and February 1993. This eight man team was composed of five NRC members and three consultants. During the inspection, CPS responded to 360 questions. I The team identified four strengths and four weaknesses, one violation relative to inadequate design control, and three unresolved items. These were inadequate or incorrect grid voltages, loss of voltage protection and degraded voltage licensing basis, and Diesel Generator starting air check valve testing. The violation was addressed immediately and the unresolved items were closed. All work is complete except for the ongoing long term degraded voltage corrective action program. The team determined the inspected electrical distribution systems were operable and engineering and technical support were adequate.

4.5.4 LPCS & RCIC SSFA - February 1994 CPS committed to the BWR-6 Owners Group to perform a second SSFA of the Low Pressure Core Spray (LPCS) and Reactor Core Isolation Cooling (RCIC) systems. The SSFA concluded that these systems would perform their intended safety functions and were operable. Three technical issues were identified during the assessment. The following strengths and weaknesses were observed:

. Weaknesses: Errors in mechanical calculations. Emergency Core Cooling System (ECCS) response time acceptance criteria were not comprehensive. Lack of design documentation to support General Electric (GE) design specification requirements.

Labeling problems. RCIC turbine lubrication oil sampling techniques. Training on LPCS water leg pump bearing replacements. Training lesson plans not updated to reflect modifications.

. Strengths: Electrical design was solid, well-documented. Indicative that the NRC EDSFI preparation, inspection and follow-up activities were effective. Detailed operations and maintenance procedures, knowledgeable personnel, and a strong equipment qualification program were observed. Other strengths were cleanliness and good general condition of

Attachment 2 to U-602683 Page 52 of 71 equipment, proactive activities regarding RCIC turbine, and responsiveness of corrective actions.

4.5.5 Internal Assessment of ADS - February 1996 CPS performed an assessment of the Automatic Depressurization System (ADS) and found ADS to be capable of performing its intended functions and operable. Seven strengths and seven weaknesses were identified.

. Weaknesses: The backup air supply to the ADS system had developed operational leakage as evidenced by the routine refilling of backup air bottles. Calculations were available but difficult to retrieve or find the calculation ofinterest. Some older calculations did not provide bases for assumptions. Documentation to support the ADS low pressure alarm point did not exist. Some GE design specifications did not match the as-built design.

. Strengths: Surveillances were determined to be excellent, well prepared and thorough.

System design documentation was readily available. NSED's design bases group knowledge and the engineering standard for determining instrument set points were excellent. More recent calculations were thorough. Maintenance could be performed on the system without requiring a plant shutdown. Post-maintenance and post-modification testing was determined to be thorough and well-documented.

4.6 Potential Configuration Changes Outside the Design Control Process,"De facto Changes" In recognition that good process controls cannot be effective if they are circumvented, this response attempted to determine how configuration changes could be accomplished by inadvertently bypassing the procedurally controlled CPS programs. Four Clinton Power Station programs or procedures with the potential to introduce an unauthorized design change were identified. For example, on line maintenance or testing could potentially result in plant equipment remaining in an "as left" condition different from that described in its design. The four programs or procedures are described as follows:

4.6.1 Discrepancy List - Maintenance Work Requests The Maintenance Work Request Discrepancy List documents equipment deficiencies and deviations from the approved design found during the course of work. These deficiencies would not be in the scope of the original MWR problem description and are documented on a form entitled MWR Discrepancy List. A resolution is required by engineering for each deficient item, before closure of the work package. Disposition of D-List problems is authorized by an engineer's signature, without review. The disposition includes determination that a field condition is not a discrepancy in design, and therefore does not warrant a design change document. This single signature disposition introduces a risk that the discrepancy will be overlooked as a change to design. Restrictions and guidelines for the use of D-lists are provided in Appendix C to CPS 1501.02, Conduct of Maintenance. This appendix clearly prohibits the use of D-lists to circumvent the CPS Hardware Change

Attachment 2

^

to U-602683 4

Page 53 of 71 i

process, the CR process or requirements of CPS procedures. D-Lists were reviewed during j the January 1997 independent assessment of CPS engineering, contracted through Enercon  ;

Services. Inc. (referred to as the " Independent Assessment" for the remainder of this j response). To determine if these procedures adequately control the use of this process, the  ;

independent Assessment Team reviewed six D-Lists for compliance with the procedural  !

requirements. The Assessment Team findings of January 10,1997, concluded that the D-list procedures were being properly applied.

i 4.6.2 Blanket Maintenance Work Requests The Independent Assessment Team believes that this type of change circumvents the CPS Quality Assurance Program (QAP) and requirements of the design process described in ANSI N45.2.11. CPS has used " blanket" MWRs which allow craft maintenance to install a plant change under certain requirements. These requirements have been determined by their nature to not affect safety. Blanket work orders have been issued to Security to maintain equipment on an as needed basis, and to Maintenance to clear clogged drains and fix doors, etc. These blanket MWRs are closed approximately every six months and new ones issued to allow a timely review of work completed. An Engineering Change Notice (ECN), the most used design change document, could be issued against a blanket MWR to modB) . ]uipment,.

such as a fire door.

Additional reviews of Condition Reports indicate that the practice ofissuing blanket MWRs have resulted in improper control in isolated cases. One blanket MWR routed cable on a seismic masonry wall without proper structural design review. Two CRs were initiated to addreas this issue. The specific MWR covered only routing new cables through a penetration seal. Two other blanket MWRs were also reviewed for similar issues, and problems were not identified. The use of blanket MWRs for routine maintenance was found to be acceptable as the deficiencies fbund were isolated cases of poor implementation.

4.6.3 Aging Maintenance Work Requests (MWRs) .

Aging MWRs could result in an unauthorized design change by failure to repair or rework broken components. The System Engineer is responsible to be aware of the operating status of the system, its expected performance, and maintenance work that is in progress. He is also expued to be familiar with open (i.e., not yet worked) MWRs. CPS uses two categories of maintenance work. Corrective Maintenance is defined as repair and restoration of equipment or components that have failed or are malfunctioning and are not performing their intended function. As a general rule, if the specific component (e.g., packing or bearing) requiring maintenance has failed, the action required to repair it should be classified as corrective maintenance consisting of preventive maintenance work. Preventive maintenance includes:

1. Predictive maintenance which involves continuous or periodic monitoring and diagnosis in order to forecast component degradation so that "as-needed" maintenance can be performed prior to equipment failure.

2. Planned maintenance activities which are performed prior to equipment failure. These include items such as scheduled valve repacking, replacement of bearings as indicated

Attachment 2  !

to U-602683 Page 54 of 71 from vibration analysis, major or minor overhauls and replacement of known life-span components.

3. Periodic maintenance activities that are accomplished on a routine basis (based on operating hours or calendar time) and may include any combination of external inspections, alignments or calibrations, internal inspections, overhauls, and component or  :

equipment replacements.  !

Three separate reviews of Maintenance Work Requests were recently conducted to address  ;

the material condition of the facility as a result of the shutdown on September 5,1996. '

During each of the three reviews, three organizations (Operations, Plant Engineering and Maintenance) completed independent analyses. The purpose of each of the three reviews was to ensure that material deficiencies which could impact our ability to successfully startup and operate the plant in a safe manner have been appropriately addressed. The process for reviewing open MWRs used both best judgment and specified criteria. MWRs were not to be excluded on grounds such as parts availability, planning status, or difficulty. The Scope Review Committee was responsible for the decision to work open MWRs prior to startup.

The specified criteria for review in each of the three evaluations was:

1. Represent a condition that degrades a significant margin or barrier to operating limits.

2. Represent a undesirable challenge or complication to normal safe operation of the plant, particularly if other barriers of protection are degraded, or other contingencies are not possible.

As a benchmark, on November 30,1996, there were 813 open corrective MWRs with thirty-eight percent of those being outage related. At that time there were forty-eight open i non-outage corrective MWRs that were between one and tivo years old, and seventeen greater than two years old. During the past four years there has been an average of 665 open '

corrective MWRs, with the highest nt mber (813) occurring in 1996. About thirty-six percent of the open corrective MWRs have been outage related during this four-year internal.

Data for each month of 1996 indicates that there has been approximately twenty open l corrective MWRs, greater than two years old. For open corrective MWRs between one and two years old, there was an increase in April from about twenty-five to approximately forty, likely related to the fifth refueling outage which occurred in the spring of 1995. Open corrective MWRs has been a performance monitoring parameter at CPS for several years and goals for 1996 included no more than twenty open corrective MWRs between one and two years old, and no more than two greater than two years old. As committed in the Startup

Readiness Action Plan, all MWRs greater than six months old will be reviewed prior to  ;

l restart.

4.6.4 Testing When done at a relatively high frequency (weekly) or in difficult circumstances, testmg could result in an unauthorized design changes by not returning the plant to design conditions.

Unauthorized design changes could include missing pipe caps, mis-positioned valves or switches, attached hoses, and installed test equipment. There is a low probability for an unauthorized design change at CPS due to testing.

l l

l l

l 1

Attachment 2 to U-602683 Page 55 of 71 CPS 1302.02, Conduct of Clinton Power Station Testing, establishes the policy and administrative controls for Nuclear Station Engineering Department's (NSED) Testing ,

Program. The engineering testing programs include special tests, surveillance test, performance and inservice tests. These tests are directed, supervised, performed, or administered by certified or qualified individuals. Testing personnel require unique and specialized knowledge in addition to degrees in engineering or scientific fields or specialized training programs. Competency in these positions is assured through initial and continued  ;

indoctrination and training programs. The procedure provides guidance to ensure testing personnel perform assigned activities in accordance with applicable requirements of CPS and NSED Procedures, ANSI Standards,10 CFR 50, other industry and regulatory requirements, the USAR, and the Improved Technical Specifications.

l The Independent Assessment Team reviewed two modification packages for Post Modification Testing. Although the sample size is small and does not reflect all Post  ;

Modification Testing, they determined that testing requirements were adequately described in these two modification packages and performed before the modifications were declared operational. In addition, there has been no substantial evidence by Clinton Power Station review of failures to restore plant equ!pment line-ups (Condition Reports), following post modification testing.

The policy and administrative controls governing surveillance testing is CPS 1011.02, Implementation and Control of Surveillance Testing. CPS 1011.02 and 1011.06, Routine Surveillance Tracking and Scheduling, are applicable to the scheduling, performance, review and record retention of surveillance tests. The surveillance procedures are written according to Appendix D, of CPS 1005.01, Procedures and Documents. Surveillance procedures use restoration steps with completion sign off to return the system or component to normal alignment. There has been no substantial evidence of failure to restore (Condition Reports),

following surveillance testing.

Local leak rate testing is conducted by CPS 1305.01, Primary Containment Leakage Rate Testing Program. This procedure provides administrative controls to implement testing j required by 10 CFR 50, Appendix J," Primary Reactor Containment Leakage Testing for  !

Light Water Cool Nuclear Power Reactors". The testing program is divided into the three required boundaries: (1) Type A," Integrated Leak Rate Test",(2) Type B," Local Leak Rate Test for Non-Valves Penetrations" and (3) Type C," Local Leak Rate Test for Containment Isolation Valves and Isolation Valve Test Boundary Air Leakage Rates". Actual valve manipulation is specified in CPS 98xx series procedures, in discussion with the LLRT Coordinator, who is responsible for the Appendix 3 Program, data sheets for testing specify restoration of the test boundary. Normally, restoration is accomplished using system operating procedures (Valve Line Up Instructions) with valves outside of the boundary "noted out" of(removed from) these valve line up instructions.

Restoration of the boundary is not specifically addressed by the primarily containment leakage rate test program but there has been no evidence of failure to restore (Condition Reports), following Appendix J testing.

Attachment 2 q to U-602683 4 Page 56 cf 71 j 4.7 Conclusion Adequate evidence exists to conclude that CPS is operated and its configuration is maintained in accordance with the design bases. The baseline of SSCs has been established, is maintained and is updated as necessary to remain current.

1 I

l l Attachment 2 l to U-602683 i Page 57 of 71 5.0 Item d l

" Processes for identification of problems and implementation of corrective actions, including actions to determine the extent of problems, action to prevent recurrence, and reporting to N RC."

5.1 Introduction Clinton Power Station processes for identifying problems and implementing corrective actions include the Condition Report Program, the Quality Program, and several oversight groups. These programs work together to ensure that adverse conditions are identified and resolved appropriately.

The Corrective Action Program established to meet 10 CFR 50 Appendix B requirements has t included the Condition Report (CR) procedure, CPS 1016.01, CPS Condition Reports, since l before plant licensing. This procedure provides a means for all Nuclear Program personnel to identify, report, track, document, resolve, and trend adverse conditions. It contains provisions for notifying management (including the Shift Supervisor when appropriate),

initiating operability and reportability evaluations, and taking immediate actions to correct or mitigate the adverse condition. Further, steps in the procedure require determinution of the i condition's significance, assign ownership, and direct root cause investigations, when l appropriate. Actions resulting from Condition Report investigations and evaluations are l initiated and performed under provisions of other departmental procedures.

5.2 Current Condition Report Process The following describes the Condition Report process at CPS, shown on the simplified process flow chart at the end of this section. Numbers refer to the flow chart box number.

J (1) All personnel at Clinten Power Station are responsible for identifying adverse conditions I and initiating Condition Reports. " Adverse condition"is an all inclusive term which can be  :

any of the following: failures or malfunctions, inadvertent trips, deficiencies, deviations, defective items and degraded or non-conforming conditions. When determining if an adverse condition exists, no differentiation is made between safety related and non-safety related systems, structures or components.

(2) Upon initiation of a CR, the initiator discusses the condition with a management staff i member within one hour. If the management staff member notification cannot be completed and documented, the CR is hand carried to the Shift Supervisor (SS) within two hours of initiation. Discussion of the CR with the management staff member and/or Shift Supervisor includes a review of the condition, any immediate actions taken to resolve or mitigate the condition and any additional comments or information which would be helpful in understanding the condition. At this time, the management staff member makes an interim l significance classification and assigns an owner to the CR.

(3) The SS reviews the CR for impact on plant operations, the need for operability determinations, and for internal and external notification or reportability requirements. The reportability requirements include those specified in Licensee Event Reports (LERs),

Attachment 2 to U-602683 Page 58 of 71 Security Event Reports (SERs), Offsite Dose Calculation Manual (ODCM), Technical Specifications and the Operational Requirements Manual (ORM). When the SS review identifies a potential operability concern, the SS initiates appropriate actions.

(4) The SS decides whether an Operability Determination is needed and contacts Engineering as necessary to obtain a technical evaluation, or other input required to make the determination. If the SSC is inoperable, appropriate actions are taken, such as entering a Limited Condition of Operation (LCO). The SS ensures required notifications are made and dacumented on, or in an attachment to, the CR (such as an Event Notification Work Sheet) i and identifies the reportability determination and reporting criteria on the CR form. When assistance is required, the SS documents the specific engineering assistance required on the j CR and contacts NSED to initiate this action. NSED performs evaluations, including Operability and/or Past Operability, as appropriate. ,

I (5) The CR is then forwarded to Plant Support Services (PSS) for entry into the corrective -

action tracking data base (CATS). CATS is an electronic data base used to organize and status Condition Reports and their associated actions. It is also used to monitor and track l I

identified corrective actions until completed.

(6) The CR is then forwarded to the Corrective Action Review Board (CARB) which is the  ;

management oversight of the corrective action program. The CARB reviews original CRs l for proper classification and owner assignment. CARB also reviews the root cause and l corrective action plans for Significant CRs. The CARB oversees and helps ensure high l quality of root cause investigations, associated corrective actions, and thoroughness of i documentation, as described in the section 5.3 below. When the CR describes a condition which is reportable as an LER, an assessment of the safety consequences is performed by the CR owner. Licensing provides guidance on developing these assessments. For an LER condition, the root cause investigation, corrective action plan development and safety assessment are coordinated with Licensing and completed within fifteen days from the identification of the condition. This supports the thirty day LER reportability requirement. If the originator, Management Staff Member, or SS determines that the condition impacts the function of system, structure, or component (SSC) within the scope of the Maintenance Rule, separate prescribed actions are required, which are listed NSED procedure M.7 NSED Maintenance Rule Activities.

(7) The CR is screened by the CARB and one of three classification is assigned as follows:

Close Only: not a significant event and no action required beyond immediate actions.

Normally submitted for trending purposes.

Significant: A condition that affects or is likely to affect safe operations, capability to shutdown the reactor, maintain safe shutdown, or mitigation of accidents which could result in potential off-site exposure. Root cause analysis is required.

Other: A condition which is not significant, but merits investigation and correction.

(8) The CR owner develops a corrective action plan, coordinates assignments, and completion of each corrective action.

i J

Attachment 2 to U-602683 Page 59 0f 71

, (9) CARB and Nuclear Assessment Department (NAD) review the action plan and the expected completion date for each corrective action for Significant CRs.

(10) A copy of the corrective action plan is provided to PSS to update the CATS database.

(11) The CR owner compiles a CR completion package which documents resolution and closure of the CR. All documents showing completed corrective actions are attached to the

CR for vaulting or referenced by the closure package if required by other procedures to be vaulted.

(12) The CR owner signs and dates the CR upon completion and forwards it to the department CR coordinator for review.

(13) The CATS database is updated and the CR closed.

1 5.3 Corrective Action Program History The Condition Report Program was established prior to initial plant start up. As systems were turned over to lilinois Power from the contractor, Baldwin Associates, adverse material conditions were addressed using the Non-Conforming Material Report (NCMR). NCMRs l involving design or hardware conditions were dispositioned by Engineering and any changes i

! required to design were obtained from the appropriate design authority (Sargent & Lundy or  :

1 General Electric).  !

1 In 1989, NRC Inspection Report 89-032 identified that some Condition Reports had been closed with various corrective actions incomplete and not being tracked. Clinton Power Station initiated a review of CRs written during the preceding two years to verify that corrective actions were completed or properly tracked. " Properly tracked" meant the following:

l 1. USAR changes had approved Safety Evaluations and Licensing had acknowledged I receipt.

2. Design changes were approved and listed as ' mandatory' in the Design Status System.

3. Procedure changes had the revision issued and commitments were cross-referenced in the reference section of the procedure.

i 4. Maintenance Work Requests (MWR) were generated to implement the stated action and were numbered with a designated series number.

5. If a Licensing Event Report (LER) or Notice of Violation (NOV) was involved, actions listed in the LER/NOV response were also tracked within the CR.

Also in response to the NRC inspection, CPS established the requirement that all corrective i actions be independently verified as adequate and complete before CR closure. The verification also checked for administrative errors, proper internal tracking, affected material released from hold and completion of stock code changes. This requirement remained in j J

effect until August 1996, when it was superseded by the improvements discussed below. I In September of 1995, a Corrective Action Program Improvement Team (CAPIT) was formed as a selfimprovement initiative. The team recommended improvements to nearly

Attachment 2 i to U-602683 l

Page 60 0f 71 every phase of the corrective action process including problem identification, resolution, prevention, and administration. A new position, Corrective Action Program '.dministrator, was created to implement the recommendations. Benchmarking was performed with various SALP 1 power plants. Using the data from the benchmarking and the recommendations from the CAPIT, improvement plans were formulated and training was developed and implementud. On August 13,1996, a new revision to, CPS No. 1016.01 was issued. The philosop.,, of the new program was accepted by CPS employees as shown by the subsequent l increase in the CR generation rate. The number of CRs generated increased from the l monthly average of approximately 70 per month to 80 in the second half of August, followed by 211 in September (all before the single loop event on September 5,1996), and then 455 in l October,413 in November, and 259 in December. CPS also contracted Failure Prevention & j

]

Improvement Intemational (FPI) to assist in reducing the human performance error rate. As part c.f that contract, FPI performed an assessment of the CPS Corrective Action Program.

4 They determined that the program was adequate and performance was repeatable. They noted a strength in plant personnel's understanding of when and how to identify an adverse condition. FPI suggested some impmvements durMg the assessment and continues to assist CPS with implementation. Enhanced root cause analysis training is in progress for a core  ;

group of Root Cause analysts and performance monitors.

Prior to the review of the CPS Operability Determination Program and its revised procedure l as discussed in Section 4.3.5, CRs were the method used to document operability evaluations.

Although some implementation weaknesses were found by the OSTI, as discussed above, the Condition Report Prograra functioned adequately in documenting degraded /non-conforming conditions. The backfit review of about 250 CRs relating to operability determined that there <

were no cases ofinoperable equipment not already documented.

, 5.4 Quality Oversight Quality oversight at Clinton is comprised of three types of activities: audits, surveillance's i and inspections. These three primary activities are conducted in conjunction with a plan for gathering information to monitor plant performance. Identification and resolution of deficiencies is the responsibility of all individuals performing activities under the Quality Assurance Program. The checks and balances concept of Quality Assurance has been incorporated in each activity in the operation of the Clinton Power Station. These checks and balances ensure the acceptability of an item, process, or activity. The performance of intra-departmental independent reviews verifications and evaluations provides one level of checks and beu ace, while similar reviews performed by personnel of a different department provide a second level of checks and balances.

Several methods are employed such as receipt inspections, acceptability of equipment test performance, design verifications, supervision oversight, self assessments, and oversight by a Quality organization.

The audit section and the surveillance section of the Nuclear Assessment Department (NAD) work together to review both the administration and hardware for a process. The NAD Audit Section focuses primarily on the establishment and implementation of programmatic

)

a

Attachment 2 to U-602683 Page 61 of 71 issues / requirements. The NAD Program Monitoring (surveillance) Section compares field compliance to specified requirements, which are either regulatory or internal commitments.

The Quality Verification Section (inspection) focus on specific pieces, parts or components.

The Quality Verification Section ensures compliance of field work to program, procedural, and administrative requirements.

Condition Reports are used for deficiencies identified during performance of an audit.

Programmatic and generic issues are classified as audit findings. Audit findings require a root cause investigation and generic corrective actions to prevent recurrence. The proposed root cause and corrective actions require the approval of NAD.

5.5 Management Oversight The Corrective Action Program and associated processes are in use constantly and therefore, continuously being assessed for proper flow and adequacy by users and oversight organizations. The Corrective Action Review Board (CARB), Facility Review Group (FRG), Nuclear Review and Audit Group (NRAG), Independent Safety Engineering Group (ISEG), and the Nuclear Assessment Department each provide oversight.

CARB has oversight functions integrated with tre Condition Report process. In addition to those described in Section 5.2 above, CARB ens tres that corrective actions for Significant CRs are properly documented and can be implemented. CARB reviews recent Condition Reports and communicates concerns to the Nuclear Assessment Department to help identify possible topics to trend.

The FRG reviews Significant CRs, proposed changes or modifications to systems or components that affect nuclear safety, and reportable events such as any condition specified in 10 CFR 50.73. They also review other CRs to help ensure that Safety Evaluations, when required, have been performed.

The NRAG provides an independent review of conditions which could affect safe operations of the plant. They review Condition Reports with Safety Evaluations to ensure that an action to resolve a CR does not result in an unreviewed safety question. They review proposed changes to Technical Specifications or the Operating License and violations of codes, regulations, orders, Technical Specifications, license requirements, or ofinternal procedures or instructions having nuclear safety significance. They review Condition Reports for significant operating abnormalities or deviations from normal and expected performance of unit equipment that could affect nuclear safety.

The ISEG is an independent group responsible for observing and reviewing selected plant activities (including CPS plant operating characteristics; NRC issued documents; industry advisories and LERs; other sources of plant design and operating experience information; and plant activities including maintenance, modifications, operational problems, significant events and operational analyses). They provide senior management additional insight into where improvements can and should be made to procedures, programs, equipment, and training to improve plant safety and reliability. ISEG members issue the appropriate corrective action document when a review has identified a condition adverse to quality.

Attachment 2 to U-602683 Page 62 of 71 The Nuclear Assessment Department trends conditions adverse to plant safety or quality to determine if a potential trend exists. Equipment failures and reliability concerns documented on Maintenance Work Requests are also trended. The results of these trend analyses are documented and reported to management. When an evaluation determines that an adverse trend exists, a Condition Report is initiated.

5.6 Corrective Action Program Performance The following examples demonstrate performance of the Corrective Action Program.

5.6.1 Fire Protection Audits The Clinton Power Station Fire Protection Program has been audited in accordance with the Illinois Power Nuclear Program Quality Assurance Manual on ten occasions since 1987. A total of four audit fmdings and fourteen Condition Reports were issued. These fmdings and Condition Reports are considered minor discrepancies in implementing Fire Protection Program procedures. None identified signincant deHeiencies in Fire Protection Program controls or procedures. The conditions identiGed have been corrected, or corrective actions scheduled. Audit reports and results of corrective actions are readily retrievable for detailed i evaluations.

5.6.2 Quality Assurance Audits of Engineering, Design or Plant Configuration I Among the many NAD audits, thirteen have been performed on Engineering, design or plant 1 configuration from 1988 until the present. The focus and extent of these audits increased us IP assumed design control functions from the architect engineer and the NSSS vendor.

The 26 audit Sndings and 12 Condition reports issued relating to design can be characterized  ;

as identifying a lack of rigor in implementation of procedural requirements, including l inadequate documentation in certain steps of the design / design change processes. None of the findings or CRs identified conditions or issues which required change to a previously 3

approved design, or impaired operation of a nuclear safety related structure, system or component. Further, while corrective actions sometimes involved improvements to procedural details, none of these required significant change to, or addition of, major program functions. These audit reports and results of corrective actions for fmdings are readily 4

retrievable for detailed evaluation.

5.6.3 Results of the review of the CR and Q trending programs for problems associated with design.

Design related problems have been routinely identified on Condition Reports since the initial licensing of Clinton Power Station. The number of these events documented on Condition Reports has risen in the last year as a result of the sensitivity threshold for issuing Condition Reports being lowered. The number of root cause evaluations required for design related Condition Reports, however, has declined in the past two years (only six since January 1996).

The majority of corrective actions associated with design related Condition Reports which

Attachment 2 to U-602683 Page 63 of 71 required a root cause evaluation have resulted in revision to procedures, drawings, and manuals or the initiation of plant modifications to resolve the design issues.

A review of Condition Repons and the Corrective Action Trending program for design related problems was conducted for the period of January 1,1992 through January 20,1997.

Condition Reports prior to this period are also in a database, however, data for each report does not lend itself to the level of analysis perfonned on those entered over the past five years. Additionally, the recent population is considered to be of more relevance.

This review and analysis revealed four hundred and sixty-two (462) Condition Reports which were coded with one of the design related categories. Because the trending system allows multiple codes this population selection did not distinguish between primary, secondary or ancillary codes. These 462 design related Condition Reports represented approximately ten percent of the total number (4789) of Condition Reports written during this same period.

Through mid-1996 the annual average was approximately sixty; a total of 184 were written in 1996, including the last four months after program changes lowered the initiation threshold ,

for Condition Reports. )

Of the 462 CRs identified as some type of design related problem, only ninety-one (91) were I classified as significant enough to require a root cause investigation; an average of I 8 per year. The Condition Report program is linked with the Licensee Event Report process in that a CR is ;vritten for every event that becomes an LER. Referring back to Section 2.11.3, the ,

analysis of LERs identified eighteen (18) which were design related over a ten year period, or  !

I 1.8 per year. Thus, the 60 to 70 design related problems identified on CRs annually resulted in an average of 18 requiring root cause analysis for the entire period. Of those classified as significant, approximately two (2) per year become Licensee Event Reports. This analysis also shows that the Corrective Action Program has been effective in identifying and resolving design related problems oflesser significance, and strengthening program controls such that more significant events are minimized.

i l

5.7 Summary 1 The Corrective Action Program satisfies the requirements of 10 CFR 50 Appendix B. It was established at CPS prior to initial plant start up. The program implementing procedures have been changed or revised many times to improve the process, and continues to be improved as CPS strives to become more effective in timely identification and resolution of conditions which could adversely affect nuclear safety. However, the basic requirements originally established in the Corrective Action Program have always been, and continue to be, in place.

These points are partially illustrated by the results of the review of past Condition Reports i used to determine Operability. No inoperable equipment not previously identified, was l found during this backfit review as discussed above in the Operability Evaluation Program, l Section 4.3.5. CPS has consistently identified, evaluated, and addressed significant adverse conditions. Root cause evaluations and corrective actions to prevent recurrence have always been a part of the program. The Clinton Power Station Corrective Action Program identifies conditions adverse to quality, clearly defines corrective actions, and tracks them to  ;

completion by department programs or procedures. l

Attachment 2 to U-602683 Page 64 of 71 Flow chart of the CPS Corrective Action Process ci 6 .

l ii;3' i

j t,, - - .

., g

+, ,

1]

y: .

I I g g "4 4 -

g i

I fs j c- 1 / \ 5

_/lyx)

,i, I i

"l .r 9

}

3 ,_S i

y i \1 j/ ,__ 3 1 -

3, h, 7 I

8 l

?

1 I -

i i i e

.g,, 4,/: x.

y s_

-g . - , _

'g i

i e uj_

i i . e . -- . _ . .

g; e < gg l- s i & LN 0 t

} 1; ,  !; l +l a,sgl 11

,u

,li, i /s s  ;,,-s -+,3 { . .:

i"5 \ of -

,gi b .-

jn i i

- 'gj _,_,a

, =a = - m.,

l '

s.. .

, i l l

, , , .'l e _.,.. ,__I S. . _ _ _

I I l l

,/\ ,,' g g,

I s

, ,J , l j

E .. l .

[f

' 1 l

l 15 ' l' i j

. s'li ' a i  ;

i

?_ --- . ~.

i : . s ---

e

Attachment 2 to U-602683 Page 65 of 71 6.0 Item e "The overall effectiveness of your current processes and programs in concluding that the configuration of your plant is consistent with the design bases."

6.1 January 1997 Independent Assessment of Nuclear Station Engineering As a result of the forced shutdown on September 5,1996 and the follow-on NRC special inspections, Clinton Power Station retained Enercon Services, Inc. to assess the Nuclear Station Engineering Department. The assessment, completed on January 10,1997, followed defined checklists and interview questions that covered the intent of NRC Inspection Procedure 37550, " Engineering" and Procedure 35551, "Onsite Engineering"; however, the assessment team focused the evaluation based upon past assessment experience, current major industry issues, and a review of previously identified problems by external and intemal regulators and oversight groups. The fur.ctional areas evaluated by the Assessment Team included: change control, temporary moditkations, engineerig involvement in site activities, design basis configuration, manag: ment and organization, effectiveness of self assessments, effectiveness of Engineering A ssurance/ISEG, the 10 CFR 50.59 Safety Evaluation Program, and engineering prog ams. This assessment is referred to (as in Section 4.6.1 above) as the " Independent Assessment" The assessment findings regarding change control, design bases configuration, and Safety Evaluation process are as follows:

Design Control The plant change process needs to more strongly implement requirements in the CPS Quality Assurance Program (QAP) and ANSI N45.2.11 regarding documenting design inputs and design analysis. The plant change process could allow individuals to by-pass existing procedural requirements for design input and design analysis required by the ANSI standard with regard to design inputs and assumptions about this input. It is unclear whether or not the signature for design verification can suffice for an independent review in accordance with ANSI requirements without proper documentation of the design inputs, calculations, and design analysis.

Confign:atlon Control CPS has recently implemented the Field Configuration Changes (FCCs) process that allows making Smited configuration changes outside of the design change processes, as a maintenanse activity. The FCC process is intended to apply to non-safety related configuration changes only. More importantly, the process is fundamentally non-conservative in that it relies on one individual to determine if the licensing or design bases is impacted. No independent review is required in the process.

Design Bases Configuration The team evaluated the general knowledge of NSED personnel regarding design bases information and how this information is maintained and controlled, focusing on Engineering's role. The Assessment Team noted the completeness of the NSED design

Attachment 2 to U-602683 Page 66 of 71 library, finding it to be maintained current and well indexed. During interviews the Assessment Team found that the level of knowledge of design and licensing bases, although adequate, varied widely. The Assessment Team generally found design and licensing bases information available, but dependent on knowledgeable engineers to locate specific information.

Safety Evaluation Program The 10 CFR 50.59 Safety Evaluation Program, requirements are specified in procedure CPS 1005.06, Conduct of Safety Reviews. Appendix A to this procedure provides detailed guidance, including the use of a screening process to determine if a full safety analysis is required. The Assessment Team identified several recent Condition Reports where individuals failed to perform adequate safety screening / evaluations. This is an adverse trend that suggests there is a systemic problem in the implementation of CPS 1005.06.~ More l importantly, the apparent lack of tracking resulted in a failure to detect this adverse trend.

The assessment team recommended (1) that management clearly communicate their j expectations for the use of Safety Screening in lieu of full Safety Evaluation, (2) that the '

procedure be revised to include proper guidance for the screening process, and (3) that IP expand the 10 CFR 50.59 training program.

UpdatedSafety Analysis Report l The Assessment Team noted cases where some Safety Screening / Evaluation preparers used a narrow interpretation of what constitutes a design change impact on the USAR. Safety Screenings rather than full Safety Evaluations were completed, resulting in some USAR licensing bases information not being properly updated.

Response

In response to the Independent Assessment findings, over two hundred Safety Screenings performed for design changes made during the current refueling outage, were recently reviewed by a dedicated team which evaluated conformance to plant procedures, Nuclear l Regulatory Commission regulations and guidance, and industry standards. As a result,  !

approximately twenty-five changes with only Safety Screenings were determined to require full Safety Evaluations. Deficiencies noted during this review suggested a weakness in the implementation of the process. The review team noted that removal of some procedural guidance from screening questions in February 1995 may have misled personnel to believe that changes to a structure, system or component not explicitly described in the Updated Safety Analysis Report, did not require a full Safety Evaluation, although, this position is contrary to station procedures and training. Clinton Power Station is aggressively pursuing resolution of specified deficiencies noted in the report of the Independent Assessment on Safety Evaluation design control, configuration control, and design basis. These activities are part of the Startup Readiness Action Plan and will be included in the Long Term Improvement Plan.

Attachment 2 )

to U-602683 i Page 67 of 71 6.2 Conclusion and Rationale The Clinton Power Station Design Status System presently identifies over 380,000 total i documents. including current documents of approximately 170,000 drawings (94,000 safety related),17,000 procedures (9,500 safety related),2,400 vendor manuals (543 safety related),

and 1,450 parts list (900 safety related). Since the time oflicensing there have been approximately 21,000 change documents, including over 4,000 changes to design which affected multiple design documents. These documents are used for design and configuration  !

control, and operation (procedures) of over 80,000 components, including about 24,000 )

safety related items that are required to operate the facility.

Although some discrepancies probably exist in these documents, Clinton Powa Station is confident that these are minor and do not impact the operability of safety related equipment.

Clinton Power Station will perform a vertical slice inspection to confirm adequacy of design bases and design documents. The system selected will be one that mitigates core damage,

identified as " level one"in the Clinton Power Station Probabilistic Risk Assessment. This action will be part of the Long Term Improvement Plan, as discussed in the cover letter. 1 A significant number ofinspections and audits, both internal and external, have been conducted to identify deficiencies in the design basis. Two new programs have also been i completed to upgrade and maintain the design bases. Examples of these efforts are as follows:

. There have been eighteen Licensee Event Reports concerning design bases issues, from prior to receipt of the Operating License through the end of 1996. All except two have

, been self-identified by CPS personnel. These Licensee Event Reports are the result of inadvertent actuation of Engineered Safety Feature (ESF) equipment, inoperable components, plant transients or scrams, and conditions outside the design bases of a system. In most instances, the conditions surrounding these Licensee Event Reports resulted in isolated occurrences of the associated events. Corrective actions in these cases

include; design changes, procedure changes, additional training for applicable personnel,

and some enhancements to the plant modification program. There has not been any

. major design and configuration control program deficiencies leading to a reportable event or condition. All corrective actions for these Licensee Event Reports have been l adequately resolved and inspected by the Nuclear Regulatory Commission. 1

. During the past eleven years there have been eleven NRC Notices of Violation related to failures to maintain design bases requirements or failures to perform adequate safety reviews. The types of corrective actions taken in response to the Notices of Violations were similar in nature to those identified in the related Licensee Event Report review.

However, the Notices of Violation corrective actions have had a broader scope impact on the continuing development of design bases programs and processes at CPS.

Cumulatively, these changes have had a positive impact on improving the comprehensive  ;

nature of CPS design bases programs and processes. j

. The Nuclear Assessment Department at CPS has conducted thirteen inspections on

. Engineering, design and plant configuration since licensing. Deficiencies identified j

Attachment 2 to U-602683 Page 68 of 71 during performance of an audit are documented in Condition Reports, and programmatic,

. or generic issues are classified as audit findings which required root cause analysis.

There have been twenty-six audit findings and eleven Condition Reports issued as a result of these inspections. Appropriate corrective actions have been taken to resolve all audit findings and identified deficiencies. Audits of Engineering, design and plant configuration by the Nuclear Assessment Department will continue to be conducted to ensure program effectiveness.

. From September 1987 through August 1996, only five of the approximately 230 routine Nuclear Regulatory Commission Inspection Reports discussed configuration control and maintenance of the Clinton Power Station design bases. Three of the reports identified i noncompliance issues while two were very positive regarding configuration control and

. design bases maintenance. Appropriate corrective actions were taken to resolve those i

three issues.

. Design bases deficiencies have been routinely identified on Condition Reports, as part of {

the corrective action program at Clinton Power Station. The annual average number of I design related Condition Reports between 1992 to 1995 was sixty-seven. As a result of lowering the threshold for CRs in 1996, there were one hundred eighty-four design l related Condition Reports initiated during the past year. As discussed in Section 5.6.3, )

the number of Condition Reports relating to design compared to the number of significant i 1 issues indicates the minor nature of most deficiencies.

. Clinton Power Station completed an Electrical Distribution System Functional l Inspection, and Safety System Functional Inspections on the High Pressure Core Spray,

. Division Three Diesel Generator, Low Pressure Core Spray, Reactor Core Isolation Cooling and the Automatic Depressurization System. In addition the Nuclear Regulatory  ;

Commission conducted an Electrical Distribution System Functional Inspection in l February 1993, which resulted in one Notice of Violation for inadequate design control.

Corrective action has been taken to address all issues from both the self and Nuclear Regulatory Commission inspections on these systems. The results of these inspections confirm that administrative controls for the design bases are adequate.

. In 1988 Clinton Power Station began a design transition program to establish design )

capability within the Nuclear Program organization. In 1991 this transition was completed, and since that time the majority of design changes and analyses have been produced by the Nuclear Station Engineering Department. During the past six years only those designs requiring extensive. time sensitive efforts or specialized expertise have been assigned to outside qualified design organizations. When products from these organizations are obtained, they are processed to implementation under the same program controls used internally. Changes or analysis of the Nuclear Steam Supply Systems design bases have been infrequent, but when required they have been obtained from General Electric.

. Clinton Power Station converted to Improved Technical Specifications on January 1, 1995, following issue of Nuclear Regulatory Commission Amendment No. 95, on December 2,1994. Associated with this conversion, a thorough review of Technical

Attachment 2 to U-602683 Page 69 of 71 Specifications and the Updated Safety Analysis Report was conducted to ensure that information contained in the Improved Technical Specifications was valid and that the ITS administrative controls, design features, and Limiting Conditions for Operation

. changes were correct. This review also ensured that the Improved Technical Specifications Bases were in compliance with plant design as described in the Updated Safety Analysis Report. Audits by both the CPS Nuclear Assessment Department and the Nuclear Regulatory Commission shortly after implementation of the Improved Technical Specifications identified no discrepancies.

. The Clinton Power Station USAR provides a level of detail consistent with requirements of Regulatory Guide 1.70, Revision 3, and is updated once per operating cycle as required by 10 CFR 50.71(c). It has been revised six times. The seventh revision to the Updated Safety Analysis Report is currently being prepared.

In summary, Clinton Power Station has efTective controls to ensure that the design bases is '

being maintained, and that the plant is being operated in compliance with the design bases and provisions of the Operating License. Based on establishing a validated design baseline at the time oflicensing, continuous and effective control of design changes, both internal and external audits, and effective resolution ofidentified deficiencies, Clinton Power Station can i conclude, with adequate confidence, that the plant is consistent with the design bases.

l i

I

Attachment 2 to U-602683 Page 70 of 71 Abbreviations and Definitions A/E Architect Engineer (BOP designer)

ACRS Advisory Committee on Reactor Safeguards BA Baldwin Associates (firm that constructed CPS)

BWROG Boiling Water Reactor Owner's Group (GE sponsored)

CARB Corrective Action Review Board (management overview of CR program)

CAT (NRC) Construction Appraisal Team CCT Centralized Commitment Tracking (site-wide commitment system)

CFR Code of Federal Regulation l CNP Corporate Nuclear Procedure (high level guidance for CPS)  !

CPS Clinton Power Station CR Condition Report (CPS program to report conditions adverse to quality) I DG (cmergency) Diesel Generator '

DO Diesel Generator Fuel Oil (system)

DSS Design Status System (controlled, mainframe index of design documents, current and historical E&TS Engineering and Technical Support (ir.spections)

EOP Ernergency Operating Procedure EQ/SQ Equipment / Seismic Qualification ESF Engineered Safety Feature EUP Energy Utilization Plan ,

FCC Field Configuration Change FPER Fire Protection Evaluation Report FRG Facility Review Group (internal safety review panel)

FSAR Final Safety Analysis Report (operation phase)

GD(RS) Clinton NSED intemally written General Design Review Standard GDC 10 CFR 50, Appendix A General Design Criteria for Nuclear Power Plants GE General Electric Company (NSSS designer / supplier)

HELB/MELB High energy line break / moderate energy line break HPCS High Pressure Core Spray (system)

HVAC (station) Heating, Ventilation and Air Conditioning IA Program CPS Interaction Analysis Program (plant walkdowns for seismic event interaction concerns)

IDR Independent Design Review (by Bechtel,1985)

IP lilinois Power (licensee)

ISEG Independent Safety Evaluation Group ISEG Independent Safety Engineering Group ISI Inservice Inspection (program per ASME code)

IST Inservice Testing (program, per ASME code)

ITS Improved Technical Specifications LAN Local Area Network LPCS Low Pressure Core Spray MAPLHGR Maximum Average Planar Linear Heat Generation Rate

Attachment 2 to U-602683 Page 71 of 71 MEL Master Equipment List MMIS Material Management Information System MOD Modification (change to plant design / configuration)

MOV Motor Operated Valve MSIV Main Steam Isolation Valve (2 per main steam line, total of 8)

MWR Maintenance Work Request NAD Nuclear Assessment Department ("QA")

NFPA National Fire Protection Association NRAG Nuclear Review & Audit Group (independent management oversight group)

NSED (Clinton) Nuclear Station Engineering Department NSS/NSSS Nuclear Steam Supply / System ORM Operational Requirements Manual OSTI (NRC) Operational Safety Team Inspection PASS Post Accident Sampling System (required by NUREG-0737)

PC Plant Change PM Preventive Maintenance PMT Post Maintenance (Modification) Testing PPMPS Power Plant Maintenance Planning System PRA Probabilistic Risk Assessment PSAR Preliminary SAR (construction phase)

QAM Quality Assurance Manual QAP Quality Assurance Program (10 CFR 50, Appd B)

RFO Released for Operation RII Residual Heat Removal S&L Sargent & Lundy Engineers (BOP designer)

SAR Safety Analysis Report (SAR)

SCRAM control rod insertion causing the core to become sub-critical and reactor I shut down SRO (NRC licnesed) Senior Reactor Operator SSC Structure, Systems, and Components SSE Safe Shutdown Earthquake SSSF Safety System Functional Assessment STS Standard Technical Specifications SX Shutdown Service Water Tech Specs (TS) Technical Specification TEMP MOD Temporary Modification USAR Updated Safety Analysis Report (living document)

WRB Work Review Board (prioritizes and approves work) i

]