ML17309A613

Forwards Response to NRC Request for Info Re Adequacy & Availability of Design Bases Info,Per 10CFR50.54(f)

ML17309A613
Person / Time
Site:	Ginna
Issue date:	02/07/1997
From:	SMITH R E ROCHESTER GAS & ELECTRIC CORP.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
NUDOCS 9702140141
Download: ML17309A613 (168)

Text

CATEGORY j.REGULAT.FORMATION DISTRIBUTION TEM (RIDS)ACCESS ON NBR:9702140141 DOC.DATE: 97/02/07 NOTARIZED:

YES DOCKET FACIL:50-244 Robert Emmet Ginna Nuclear Plant, Unit 1, Rochester G 05000244 AUTH.NAME AUTHOR AFFILIATION SMITH,R.E.

Rochester Gas&Electric Corp.RECIP.NAME RECIPIENT AFFILIATION Document Control Branch (Document Control Desk)

SUBJECT:

Forwards response to NRC request for info re adequacy 6 availability of design bases info,per 10CFR50.54(f).

DISTRIBUTION CODE: A074D COPIES RECEIVED:LTR ENCL S1ZE: TITLE: Responses to 50.54(f)Req.for Design Basis Info NOTES:License Exp date in accordance with 10CFR2,2.109(9/19/72).

05000244 E RECIPIENT ID CODE/NAME PD1-3.PD INTERNA CENTER 01 EXTERNAL: NRC PDR ,COPIES LTTR ENCL 1 1 1 1 3 3 1 1 RECIPIENT ID CODE/NAME"VISSING,G.

NRR/DRPM/PGEB COPIES LTTR ENCL 1 1 1 1 D E N NOTE TO ALL"RIDS" RECIPIENTS:

PLEASE HELP US TO REDUCE WASTE'ONTACT THE DOCUMENT CONTROL DESKI ROOM OWFN 5D-5(EXT.415-2083)TO ELIMINATE YOUR NAME FROM DISTRIBUTION LISTS FOR DOCUMENTS YOU DON'T NEED!TOTAL NUMBER'F COPIES REQUIRED: LTTR 8 ENCL...8 ANn ROCHESTER GAS AND ELECTRIC CORPORATION

~89 EAST AVENUE, ROCHESTER, N.Y.14649-0001 ROBERT E.SMITH Senior Vice President Energy Operotions AREA CODE 716 724-8074 FAN 716 724-8285 February 7, 1997 U.S.Nuclear Regulatory Commission Attn: Document Control Desk Washington, D.C.20555

Subject:

Response to NRC Request for Information Pursuant to 10CFR50.54(f)

Regarding Adequacy and Availability of Design Bases Information R.E.Ginna Nuclear Power Plant Docket No.50-244

Reference:

NRC letter J.M.Taylor to R.W.Kober dated 10/9/96, re: Request for Informa-tion Pursuant to 10CFR50.54(f) regarding Adequacy and Availability of Design Bases Information On October 9, 1996, the Nuclear Regulatory Commission issued the Referenced letter requesting that licensees provide information that can be used to verify compliance with the terms and conditions of their license and NRC regulations, and to verify that the plant Updated Final Safety Analysis report (UFSAR)properly describes their facility.Specifically the NRC requested the following information: (a)Description of engineering design and configuration control processes, including those that implement 10CFR50.59, 10CFR50.71(e), and Appendix B to 10CFR Part 50.(b)Rationale for concluding that design bases requirements are translated into operating, maintenance, and testing procedures.(c)Rationale for concluding that system, structure, and component configuration and performance are consistent with the design bases.(d)Description of processes for identification of problems and implementation of corrective actions, including actions to determine the extent of problems, action to prevent recurrence, and reporting to NRC.(e)Assessment of the overall effectiveness of RG&E's current processes and programs in concluding that plant configuration is consistent with the design bases.9702140141 970207 PDR ADQCK;,05000244 P'.'I, tr, y PDR k f q

("f")In addition the NRC also requested that RG8cE indicate whether we have undertaken any design review or reconstitution programs;rationale for not implementing if such programs have not been implemented; and a description, status, and schedule as applicable for such programs.The attached report is our response to the NRC's request.~For Requested Action (a), we have provided a summary discussion of our licensing, design and configuration control processes.

~For Requested Actions (b)and (c), we have focused on the numerous programs and projects conducted from initial plant operation to the present to confirm and enhance the physical and functional characteristics of the plant with respect to their design bases.We also discuss our recent efforts to confirm consistency between the UFSAR, plant proce-dures, and plant configuration.

~For Requested Action (d), we have provided summary descriptions of our corrective action processes for identification and determination of the extent of problems, as well as for implementation of corrective actions and reporting to the NRC.~For Requested Action (e), we have compiled and evaluated the results of various reviews intended to scrutinize our processes and controls and lead to continuous improvement.

These include in-line process controls and reviews, internal Quality Assurance audits and surveillances, and third party reviews and inspections, including those conducted by the NRC.Additionally, we have provided a brief summary of our on-going design review and retrieval efforts which center around reviewing the UFSAR for accuracy with respect to plant procedures and equipment and retrieving and reviewing design bases documentation from the plant's original NSSS supplier and Architect/Engineer.

The information presented herein, in conjunction with RGEcE's culture of openness and willingness to address issues, has given RG&E reasonable assurance that the R.E.Ginna Nuclear Power Plant is being operated and maintained within its design bases, that it is fully capable of fulfilling its safety functions, and that the health and safety of the public is being protected.

Very truly yours, TZ Robert E.Smith It Attachment, xc: Director, Office of Nuclear Reactor Regulation U.S.Nuclear Regulatory Commission Washington, D.C.20555 Mr.Guy Vissing (Mail Stop 14C7)Project Directorate 1-3 Washington, D.C.20555 Mr.H.J.Miller, NRC Regional Administrator.

U.S.Nuclear Regulatory Commission Region I 475 Allendale Road King of Prussia, PA 19406 Mr.P.Drysdale Ginna Senior Resident Inspector UNITED STATES NUCHU'ttR REGULATORY COMMISSION Xn the Matter of Rochester Gas.&Electric Company R.E.Ginna Nuclear Power Plant))Docket No.50-244)))Mr.Robert E, Smith, being duly sworn, states that he is Senior Vice President, Energy Operations of Rochester Gas&Electric Company: that he is authorized on the part of said company to sign and file with the Nuclear Regulatory Commission the document attached hereto;and that the document is true and correct to the best of his knowledge, information, and belief.Robert E.S h Subscribed and sworn before me, in and for the State of New York and the County of Monroe, this~Day of 1997 My Commission expires: r~/PFI Notary Public LORETTAMARSHALLPARKER Notary Public m the State of New York MONROE COUNTY Commission Expires Dec.12.19'Jl..

~~

ROCHESTER GAS 4, ELECTRIC CORP.10CFR50.54(f)

RESPONSE 97021 401 4 1 10CFR50.54(f)

Response-Summary Rcport Final Rcport Title Page 2/787

~J'-,~I t t' TABLE OF CONTENTS Page A~~CRONYMSooosooooooooooeoooooooooooooooooooosooooooooooooooooooooooooooooooooooooooeoeoooooooooooooo S UMMARY REPORT............................................................................

1 IN T'RODUCTIONoeoooooooooooooooooeooooooooooooooooooooooooooooooooooooeoooooooeoosos

~1 DEVELOPMENT OF RG&E's RESPONSE.............................

2 RE PORT OVERVIEWeooooosooooososssssssssoooooooooeosoosssosossssoooooooeeosooos

~3 IOCFR50.54(f)

RESPONSE........................................................

4 RE SPONSE (a)................................................................

4 SPONSE (b)................................................................

5 RE SPONSE (C)oooooooooooooooooeoooooooooooooooooooooooooooooooooooooooooooooo 7 RE SPONSE (d)................................................................

10 RE SPONSE (e).................................................................

13 RE x/ccsssx RESPONSE (P)oooooooooooooooeooooooooooooooooooooooooooeooooooooooooeooeoeo 15 A TTACHMENT A.................................................................................

18 A TTACHMENT B..................................................................................

36 A TTACHMENT Ceeoosoooooooeoooooos

~~sso~~~esses~~~ooooeooooe

~soooso~~oooooe~~esses~~eooeoo~oooo~44 TTACHMENT D...'...............................................................................

62 A TTACHMENT E.................,................................................................

69 A 10CFR50.54(f)

Response-Sununasy Report Final Rcport Page i 2/7/97

'C Z C 0 9 9 L 8 6 O'E'K'K, ZT 0T CC VT 9;K 9T L'I 8'K 6T OZ ACRONYM S The following is a list of acronyms used in this report and their meanings: A/E ACRS ACTION ADFCS AEC AFW ALARA AMSAC ASFI ASME ATWS CATS CCW CFR CIE CMIS COLR DBD DCR ECCD ECCS EDG EDSFI EOP EPC EPIP EQ ERG ESFAS EWR FSAR GL GORR GSM HPES HVAC IN INPO IP IR ISI IST ITS LAR LCO LER LOCA LTOP ICATION REPORT CTION ARCHITECT ENGINEER ADVISORY COMMITTEE ON REACTOR SAFETY ABNORMAL CONDITION TRACKING INITIATION OR NOTIF ADVANCED DIGITAL FEEDWATER CONTROL SYSTEM ATOMIC ENERGY COMMISSION AUXILIARY FEEDWATER AS LOW AS REASONABLY ACHIEVABLE ATWS MITIGATION SYSTEM ACTUATION CIRCUITRY AUXILIARY SYSTEM FUNCTIONAL INSPECTION AMERICAN SOCIETY OF MECHANICAL ENGINEERS ANTICIPATED TRANSIENT WITHOUT SCRAM COMMI'IMENT

&ACTION TRACKING SYSTEM COMPONENT COOLING WATER CODE OF FEDERAL REGULATION CHANGE IMPACT EVALUATION CONFIGURATION MANAGEMENT INFORMATION SYSTEM CORE OPERATING LIMITS REPORT DESIGN BASIS DOCUMENT DRAWING CHANGE REQUEST ELECTRICAL CONTROLLED CONFIGURATION DRAWING EMERGENCY CORE COOLING SYSTEM EMERGENCY DIESEL GENERATOR ELECTRICAL DISTRIBUTION SYSTEM FUNCTIONAL INSPE EMERGENCY OPERATING PROCEDURE EMERGENCY PROCEDURE COMMI ITEE EMERGENCY PLAN IMPLEMENTING PROCEDURES ENVIRONMENTAL QUALIFICATION EMERGENCY RESPONSE GUIDELINES ENGINEERED SAFETY FEATURE ACTUATION SYSTEM ENGINEERING WORK REQUEST FINAL SAFETY ANALYSIS REPORT GENERIC LETTER GINNA OWNERS REVIEW REPORT GINNA STATION MODIFICATION HUMAN PERFORMANCE ENHANCEMENT SYSTEM HEATING, VENTILATION, 4, AIR CONDITIONING INFORMATION NOTICE INSTI'HITE OF NUCLEAR POWER OPERATION INTERFACE PROCEDURE INSPECTION REPORT INSERVICE INSPECTION INSERVICE TESTING IMPROVED TECHNICAL SPECIFICATIONS LICENSE AMENDMENT REQUEST LIMITING CONDITION FOR OPERATION LICENSEE EVENT REPORT LOSS OF COOLANT ACCIDENT LOW TEMPERATURE OVERPRESSURE PROTECTION 10CFR50.54(f)

Response-Summary Rcport Final Report Page ii 2/787 4 r l~~sr p mr, p r e F MDAFW MDCN MOV MR MRPI MTC ND NEI NERP NOG NOV NRC NSM.NSARB NSSS ODCM OE PAID PCR PIR PORC PTLR QA QAPSO QC RCM RCS RGB RHR RM RP RPS RSAC RSE S/G SAFW SAR SBO SCAQ SE SEP SER SEV SFP SGRP SIPE SQUG SR SSC SSFI ST STA SWSROP SW MOTOR DRIVEN AUXILIARY FEEDWATER MODIFICATION DESIGN CHANGE NOTICE MOTOR OPERATED VALVE MAINTENANCE RULE MICROPROCESSOR ROD POSITION INDICATION MODERATOR TEMPERATURE COEFFICIENT NUCLEAR DIRECTIVE NUCLEAR ENERGY INSTITUTE NUCLEAR EMERGENCY RESPONSE PLAN NUCLEAR OPERATIONS GROUP NOTICE OF VIOLATION NUCLEAR REGULATORY COMMISSION NUCLEAR SAFEI Y Bc LICENSING NUCLEAR SAFETY AUDIT AND REVIEW BOARD NUCLEAR STEAM SUPPLY SYSTEM OFF-SITE DOSE CALCULATION MANUAL OPERATING EXPERIENCE PIPING 4, INSTRUMENTATION DIAGRAM PLANT CHANGE REQUEST PORC INDEPENDENT REVIEWER PLANT OPERATIONS REVIEW COMMI ITEE PRESSURE A TEMPERATURE LIMITS REPORT QUALITY ASSURANCE QA PROGRAM FOR STATION OPERATIONS QUALITY CONTROL RELIABILITY CENTERED MAINTENANCE REACTOR COOLANT SYSTEM ROCHESTER GAS AND ELECTMC RESIDUAL HEAT REMOVAL RESPONSIBLE MANAGER RADIATION PROTECTION REACTOR PROTECTION SYSTEM RELOAD SAFEIY ANALYSIS CHECKLIST RELOAD SAFEIV EVALUATION STEAM GENERATOR STANDBY AUXILIARY FEED WATER SAFETY ANALYSIS REPORT STATION BLACKOUT SIGNIFICANT CONDITION ADVERSE TO QUALITY SYSTEM ENGINEER SYSTEMATIC EVALUATION PROGRAM SIGNIFICANT EVENT REPORT or SAFETY EVALUATION REPORT SAFETY EVALUATION SPENT FUEL POOL STEAM GENERATOR REPLACEMENT PROJECT SIGNIFICANT INFREQUENTLY PERFORMED EVOLUTION SEISMIC QUALIFICATION UTILITY GROUP SURVEILLANCE REQUIREMENT/

OR SAFETY RELATED SYSTEM, STRUCTURE AND/OR COMPONENT SAFEIY SYSTEM FUNCTIONAL INSPECTION SURVEILLANCE TEST SHIFT TECHNICAL ADVISOR SERVICE WATER SYSTEM RELIABILITY OPTIMIZATION PROGRAM SERVICE WATER lOCFR50.54(0 Rcsponsc-Summary Report Final Rcport Page rll 2/7/97

SWSOPI TAVE TDAFW TPCN TRM TSR UFSAR USQ VTM WOG WRfIR SERVICE WATER SYSTEM OPERATIONAL PERFORMANCE INSPECTION AVERAGE REACTOR COOLANT SYSTEM TEMPERATURE TURBINE DRIVEN AUXILIARY FEEDWATER TEMPORARY PROCEDURE CHANGE NOTICE TECHNICAL REQUIREMENT MANUAL TECHNICAL STAFF REQUEST UPDATED FINAL SAFETY ANALYSIS REPORT UNREVIEWED SAFETY QUESTIONS VENDOR TECHNICAL MANUAL WESTINGHOUSE OWNER'S GROUP WORK REQUESTffROUBLE REPORT 10CFR50.54(f)

Rcsponsc-Surety Rcport Final Rcport Page iv 2/7/97 10CFR50.54(f)

RESPONSE

SUMMARY

REPORT INTRODUCTION On October 9, 1996, the NRC issued a letter requesting that licensees provide information that can be used to verify 1)compliance with the terms and conditions of their license and NRC regulations and 2)that the plant UFSAR properly describes their facility.Specifically the NRC requested the following information: (a)Description of engineering design and configuration control processes, including those that implement 10CFR50.59, 10CFR50.71(e), and Appendix B to 10CFR Part 50;(b)Rationale for concluding that design bases requirements are translated into operating, maintenance, and testing procedures;(c)Rationale for concluding that system, structure, and component configuration and performance are consistent with the design bases;(d)Description of processes for identification of problems and implementation of corrective actions, including actions to determine the extent of problems, action to prevent recurrence, and reporting to NRC;and (e)Assessment of the overall effectiveness of your current processes and programs in concluding that the configuration of your plant is consistent with the design bases.("f')In addition, the NRC also requested that RGB.E indicate:~whether we have undertaken any design review or reconstitution programs,~if not, a rationale for not implementing such a program,~if design review or reconstitution programs have been completed or are being conducted, a description of the review programs, including identification of the systems, structures, and components (SSCs), and plant-level attributes (e.g., seismic, high-energy line break, moderate-energy line break), including how the program is intended to ensure the correctness and accessibility of the design bases information for our plant and that the design bases remain current,~if the program is being conducted but has not been completed, an implementation schedule for SSCs and plant-level design attribute reviews, the expected completion date, and method of SSC prioritization used for the review.Note that this request did not carry a letter designation in the NRC letter;however, for reference, it will be referred to as ("f")herein.This report is Rochester Gas and Electric's (RGEcE's)response to the NRC's request.IOCFR50.54(t)

Response-Summary Report Final Report Page i 2/7/97 4~J, 1 re>~4 Ua/gal 0)I V 0 N DEVELOPMENT OF RG&E's RESPONSE To coordinate the preparation of this response, RG&E assembled a dedicated team of four senior engineers from Nuclear Safety&Licensing (NS&L).This NS&L team was supported by the efforts of over fifty subject matter experts (SMEs)who contributed information regarding specific processes, programs, activities, and assessments.

Management and technical oversight were provided by the active participation of NOG Engineering, Operation's, and Nuclear Assessment management.

RG&E's approach to this report was developed to 1)ensure that it would be fully responsive to the NRC's j'equest, and 2)establish confidence that the report would represent the collective knowledge of those most closely associated with the operating, maintenance, and engineering activities that support the safe and reliable operation of Ginna.Specifically, RG&E's response development proceeded as follows:~The NS&L team developed an outline of the most relevant topics (programs and processes) used to maintain Ginna Station.~SMEs were designated for each topic on this list based upon their familiarity with the topic.For historical topics, SMEs were typically selected based on their role in the activity at that time, regardless of their current function within RG&E.~The list of topics and assigned SMEs was then distributed to the SMEs along with information regarding the NRC 10CFR50.54(f) request, the findings and conclusions of the NRC leading to the request, and management expectations for RG&E's response.~Each SME developed a summary description of the topic assigned.~The dedicated NS&L team collected these descriptions, compiled them, and further edited and summarized them into a draft of the RG&E response.~Review of the response included two full reviews by the SMEs, including a final attestation of thoroughness to RG&E management.

~The Plant Operating Review Committee (PORC)reviewed both an early draft and the final report and provided a recommendation of approval to the Senior Vice-President, Energy Operations.

~The Nuclear Safety Audit and Review Board (NSARB)conducted an extensive review and discussion of the response.The NSARB gave specific assignments to the non-NOG members of the NSARB to maximize the quality of the input from outside members.The NSARB review included Senior Managers from both RG&E and other utilities as well as a member of the RG&E Board of Directors.

The NSARB discussion resulted in a recommendation of approval to the Senior Vice-President, Energy Operations.

~Finally, the methods used to develop this response were independently reviewed by a team consisting of an RG&E Nuclear Assurance engineer and a Niagara Mohawk nuclear licensing engineer.By following the thorough development and review process described above, RG&E has concluded that there is substantial evidence for reasonable assurance that the Ginna Station is being operated and maintained within its design bases, that deviations are resolved in a timely manner, and that the health and safety of the public is being protected.

10CHU0.54(f)

Response-Summary Rcport Final Report Page 2 2/7/97

'j4 REPORT OVERVIEW This document consists of a Summary Report of the information provided in response to.the NRC's request which briefly explains for Requests (a)through (e)l)the processes in place for license, design, and configuration control, 2)the programs and projects that have confirmed and enhanced the consistency between design bases, plant procedures, plant configuration, and plant operations, 3)the processes to identify and resolve problems, and 4)our overall assessment of their effectiveness.

The

SUMMARY

REPORT ends with (), a description of our on-going design review and reconstitution efforts which center around 1)reviewing the UFSAR for accuracy with respect to plant procedures and equipment, 2)retrieving and reviewing design bases documentation from the plant's original NSSS supplier and Architect/Engineer (A/E), and 3)confirming correct documentation of changes to the original design and licensing bases as a result of later plant modifications and additions to our NRC docket.Following this summary report are a series of Attachments that provide additional details for Requested Actions (a)through (e)from the NRC.Specifically:

ATTACHMENT A: Supporting information for Requested Action (a).The Attachment provides a brief discussion of our licensing, design and configuration control processes.

ATTACHMENT B: Supporting information for Requested Action (b).The Attachment discusses several projects undertaken to update plant procedures as well as our recent efforts to confirm UFSAR-to-procedure consistency.

ATTACHMENT C: Supporting information for Requested Action (c).The Attachment focuses on the numerous programs and projects conducted over the years since initial plant licensing to maintain and enhance the physical configuration and functional characteristics of the plant with respect to the design bases.ATTACHMENT D: Supporting information for Requested Action (d).The Attachment provides a brief description of our corrective action processes for identification and determination of the extent of problems as well as implementation of corrective actions and reporting to the NRC, as appropriate.

ATTACHMENT E: Supporting information for Requested Action (e).The Attachment compiles the results of various reviews intended to scrutinize our processes/

controls/configuration and lead to continuous improvement/enhancement.

These include in-line process controls and reviews (including self-assessments), internal Quality Assurance audits and surveillances, and third party reviews/inspections (including those conducted by the NRC).lOCFR50.54(l)

Response-Sununaty Report Final Report Page 3 2fl87

'i4~-~pa,~wc~j r 10CFR50.54(f)

RESPONSE The R.E.Ginna Nuclear Power Plant is a 480 MW Westinghouse two loop pressurized water reactor, plant located on the shore of Lake Ontario in western New York.It is owned and operated by Rochester Gas and Electric Corporation (RG&E).It was licensed in 1969.RG&E's intentional approach to the design, operation, and maintenance of Ginna Station (planned and systematic actions necessary to provide adequate confidence that a structure, system, or component will perform satisfactorily in service)gives RG&E confidence and assurance that Ginna is fully capable of fulfilling its safety functions, i.e., that Ginna is operated and maintained within its design bases.The following has been RG&E's approach:~Ginna was licensed to.a set of regulations and codes.~RG&E developed programs (including the quality assurance program and administrative procedures) to meet those regulations.

~We developed both feedback mechanisms and a corrective action process intended to ensure that those programs continue to meet that set of regulations.

~Self-assessments and third party reviews supplement our internal feedback mechanisms.

~When regulations change or are added, our programs are modified to address our commitments to the new requirements.

This Report is intended to provide the NRC with the information requested.

However, it is not comprehensive.

RG&E has attempted to focus on those processes and programs having the most significant impact on plant design bases configuration and conduct of operations.

In responding to the NRC's request, RG&E has attempted to provide both historical data and descriptions of our current design/configuration control and corrective action processes.

Our processes are under constant evaluation and subject to change to incorporate improvements.

As a result, processes may be different in the future from what is described herein.NOTE: In the following descriptions, references in parentheses refer to the Attachments and Section numbers within the Attachments.

For example, item"(A.l.G)" will be found in Attachment A, Section 1.G;item"(C.2.K)" will be found in Attachment C, Section 2.K, etc.(a)Description of engineering design and configuration control processes, including those that implement 10CFR50.59, IOCFR50.71(e), and Appendix B to 10CFR50: The processes that implement these and similar regulatory requirements can be categorized as those that 1)control license requirements and 2)control engineering design and configuration.

1.The processes to control license requirements reside in directives and procedures which control License Amendments (A.l.A), Technical Specification Bases changes (A.l.B), Safety Reviews and Safety Evaluations (A.l.C), UFSAR updates (A.l.D), changes to Quality Assurance requirements (A.1.E), changes to the Security Plan (A.l.F), changes to the Emergency Plan (A.l.G), ASME Code relief requests (A.l.H), and Regulatory IOCPRSO.S4(Q Response-Summasy Report Final Report Page 4 2/7i97

~4, 1 4'4k a tl Commitment changes (A.l.I).Additionally, as the NRC provides generic regulatory guidance or identifies new concerns, RG&E evaluates their applicability to Ginna and assesses whether.the concerns are already known and being addressed.

If applicable, and not already covered by on-going activities, RG&E tracks and incorporates appropriate changes (A.l.J)to licensing documents and afFected procedures/practices.

2.The primary processes for engineering design and configuration control include.the Plant Change (permanent modification) process (A.2.A), the Temporary Modification process (A.2.B), and the processes for the administrative control of procedures (A.2.C)and drawings (A.2.F).The Maintenance Work Control System (A.2.D)is intended to ensure that proper engineering controls are brought to bear on equipment problems and that equipment is correctly restored to service after maintenance.

The Procurement Engineering Process (A.2.G)is intended to ensure proper engineering controls are exercised in the purchase, specification, receipt inspection, and storage of components, parts, and materials used to maintain and modify the plant.The Operator Work-Around control process (A.2.E)looks for plant configurations which can impact the operation of the plant and cause the Operators to use compensatory measures.RG&E also evaluates recommendations regarding equipment which are communicated via NRC generic communications or industry notices (A.l.J).As appropriate, RG&E will implement these recommendations and.incorporate them into the design basis of the plant.[Note: other programs required by our license or by regulation are discussed in section (c).]Our processes incorporate defense-in-depth, including multi-disciplined reviews, which provide independent and balanced perspectives.

Compliance with these processes is part of the RG&E culture.That culture and these processes are the product of continuous improvement.

RG&E is responsive to new industry and NRC initiatives/developments and incorporates them, as applicable, to keep our processes current.The Nuclear Operations Group stafF(A.3) is trained, in sessions tailored to the user groups'pecific needs, to use engineering design and configuration control processes correctly.(b)Rationale for concluding that design bases requirements are translated into operating, maintenance, and testing procedures:

RG&E has established a series of administrative controls for processes which control procedures or instructions.

These include the Plant Change Process (B.l.A, A.2.A)to determine the impact of modifications on plant proc'edures, the procedure change process with its associated 10CFR50.59 review (A.2.C), and the Maintenance Work Control System (B.1.C, A.2.D)with its multi-disciplined reviews of procedures/instructions being incorporated into work packages.In a related manner, the Operating Experience process can enhance/update the design basis (B.1.D), in that RG&E reviews and addresses NRC generic communications and incorporates 10CFR50.54(l)

Response-Summary Report Final Report Page 5 2f7/97 Ct ZaL>>e LV 8, resulting RG&E commitments into plant procedures and programs.These are tracked to closure via the Commitment and Action Tracking System (CATS).Design basis requirements are incorporated into procedures which govern the operation, maintenance, and testing of plant systems, structures and components (SSCs).Examples of this are heatup/cooldown limitations in Operations startup/shutdown procedures, restrictions in Emergency Operating Procedures, and acceptance criteria in surveillance testing procedures.

RG&E has undertaken a series of comprehensive projects to upgrade procedures, making them more usable and verifying the correct implementation of requirements.

These efforts have given RG&E confidence in the validity of important plant documentation.

Examples include the development of plant Emergency Operating Procedures (B.2.A), the Calibration Procedures and Maintenance Procedures Upgrade Projects (B.2.B), the upgrade of Inservice Testing procedures (B.2.C), the Improved Technical Specifications (ITS)implementation plan (B.2.D)which are intended to ensure that surveillance requirements were properly addressed, and RG&E's response to Generic Letter (GL)96-01 (B.2.E)regarding completeness of circuit testing.RG&E has undertaken several sampling projects (B.3.A, B.3.B, B.3.C, B.3.D)to check if information in the UFSAR is accurately reflected in plant procedures and to determine if on-going commitments (some of which are reflected in the UFSAR)can be traced back to the original requirements.

Generally, where differences have been identified and evaluated for resolution, the plant implementing documents and the plant configuration have accurately reflected the design bases and the UFSAR has not been updated properly.This gives RG&E confidence that, even though the UFSAR has not always been up to date, important configuration control and design basis information has been correctly translated to the plant equipment and procedures.

Nonetheless, RG&E recognizes the need to 1)correct the UFSAR in the short term and 2)improve processes to maintain long term UFSAR accuracy.RG&E notes that one reason for differences between plant programs and the UFSAR is the timing of updates.New information resulting from plant changes is sent directly to program administrators, whose programs are audited for compliance separately from the UFSAR.RG&E has not required that the UFSAR be updated as quickly as the programs it describes.

Consequently, the UFSAR, with its refueling cycle update (since 1984;see related UFSAR history (A.l.D)), has not been used as a real-time confirmation of impact on the design basis.The Nuclear Operations Group staff is formally trained (B.4)on procedures to maintain their knowledge level and keep them abreast of changes.For some new procedures and even some procedure changes, the Responsible Manager determines that formal training of affected staff is required.Appropriate individuals are then trained on the procedure/change as well as its bases.This training helps communicate design basis information throughout the organization.

Note: Additional information regarding self-assessments, internal reviews, and third party reviews which support our conclusions in this section are found in section (e).10CFR50.54(ri Response-Summary Report Final Report Page 6 2f187

~.V,'"4If'I If ,'g I0 f~<<P efI~y~<<>q1 (c)Rationale for concluding that system, structure, and component configuration and performance are consistent with the design bases: RGB has ensured that Ginna Station accurately reflects its design bases by implementing programs to keep the plant configuration consistent with design basis information, performing inspections to identify configuration discrepancies, and initiating and completing a series of projects which have enhanced the knowledge and use of design basis information.

I P~ro rams~Operations performs periodic verifications of safeguards systems configuration (C.l.A)intended to ensure that the valve, breaker, and instrumentation alignments of the major flowpaths needed for system operation are consistent with the design bases.~The Surveillance Test program (C.1.B)is intended to ensure equipment operability in accordance with its design bases for equipment required by the Improved Technical Specifications (including relocated previous Technical Specification requirements).

~The Preventive Maintenance programs (C.l.C)at Ginna are established to monitor and maintain critical plant equipment such that in-service failures are minimized and performance reliability is enhanced, thus better assuring that equipment important to the safe operation of Ginna is available when required.The performance of many components is trended to detect degradation before failure.~, The Safety Classification process (C.l.D)is intended to identify and classify plant components which perform safety-related functions.

This information is used in various plant processes including plant modifications, procurement (especially for components and parts), and maintenance planning~The Electrical Load Growth Control program (C.l.E)is intended to ensure that acceptable levels of margin are maintained on the electrical distribution system power supplies.~The Environmental Qualification program (10CFR50.49)(C.l.F)is intended to ensure that a harsh environment, resulting from a postulated accident, will not be a common cause of equipment failure for electrical equipment needed to cope with that accident.~The 10CFR50, Appendix R and Fire Protection program (C.l.G)is intended to maintain configuration control of equipment necessary to mitigate the consequences of fires.s~The Improved Technical Specifications Transient Monitoring program (C.l.H)tracks reactor coolant system transients to ensure that the ASME.Class I component fatigue design basis is maintained.

lOCFR50.54(Q Rcsponsc-Sunnnary Rcport Final Rcport Page 7 2fI/97 a l-~~I'4 h

~The Heavy Loads Program (C.1.I)controls lifting activities to avoid or minimize damage'hat could result from dropping a load greater than 1500 pounds onto safety-related equipment.

~The Motor Operated Valve (MOV)program (C.l.J)is intended to,establish the design conditions and required thrust values for each MOV based upon review of accident analyses, normal and abnormal operation, and Emergency Operating Procedures.

~The Nuclear Fuels Reload process (C.l.K)is intended to ensure that the reload pattern will produce the required energy and will be bounded by the core parameters assumed in the accident analysis.I~ns ections~System Engineer (SE)periodic walkdowns (C.3.A)are designed to take advantage of the SE's knowledge of the design configuration of the system to help maintain system configuration control.s~The System Engineer performance monitoring program (C.3.B)consists of monitoring in accordance with the requirements of 10CFR50.65, the Maintenance Rule.This program assesses, on an on-going basis, the effectiveness of maintenance on key systems, structures, and components in order to identify and correct performance problems.~The Shift Technical Advisor or Designated Plant Management Plant Tours (C.3.C)contain a stated objective of checking for unauthorized modifications to the facility.P~ro'ects~The Improved Technical Specifications Project (C.2.A)consolidated much of Ginna's licensing basis.Significant multi-disciplined review was performed to ensure that appropriate operability restrictions were placed upon equipment assumed in the UFSAR accident analysis.~The Systematic Evaluation Program (SEP)(C.2.B)provided 1)an-assessment of the significance of differences between the then-current NRC technical positions on safety issues and the design bases of the plant, 2)a basis for NRC decisions regarding resolution of those differences, and 3)a documented NRC evaluation of overall plant safety with respect to the reviewed topics.~The Instrument Setpoint Verification Project (C.2.C)was intended to establish the design basis and ensure the adequacy of existing setpoints and calibration values for important plant instrument and control loops.lOCFRSO.S4(0 Rcsponsc~Sununary Rcport Final Rcport Pa8c 8 2/7/97 0 h4C P Pygik'~,,4tp g

~Comprehensive Piping and Instrumentation Drawing (P&ID)and Electrical Controlled Configuration Drawing (ECCD)upgrade projects (C.2.D and C.2.E, respectively) which field verified controlled configuration drawings against the plant.~The Station Blackout analysis (C.2.F), EWR 4520, shows how Ginna meets the safe shutdown requirements of 10CFR50.63, Loss of All Alternating Current Power.~The DC Fuse Coordination Study (C.2.G)was intended to ensure that the DC distribution system maintains its design basis configuration and to demonstrate that the DC system will be able to meet its design requirements.

~The Seismic Upgrade Project (C.2.H)consisted of extensive piping/support analyses and appropriate field modifications to upgrade supports to more current standards.

~Seismic Qualification Utility Group (SQUG)reconstitution program (C.2.I)is being performed to upgrade the seismic qualification design basis for equipment on the Ginna Safe Shutdown Equipment List to the SQUG Generic Implementation Procedure.

~The T, reduction/18 month fuel cycle/UFSAR Chapter 15 reanalysis (C.2.J)reestablished the accident analysis design basis.~In response to GL 89-13, RG&E performed a series of actions to intended to ensure the acceptable performance of plant Service Water (SW)Systems (C.2.K).These actions included evaluations to confirm that the SW system is capable of fulfilling its design basis function, enhanced maintenance to prevent degradation, and testing to demonstrate performance.

Actions included implementation of a Zebra Mussel control program and a Service Water erosion/corrosion monitoring program.~RG&E has reconstituted major parts of the Gin'na design bases as follows: 0 replaced steam generators (S/Gs)(C.2.L)in 1996.In the course of designing the replacement S/Gs and planning their installation, RG&E retrieved the design bases for several aspects of the plant.Tasks of significance to design basis verification included the Safety Evaluation for the task, retrieving the containment design basis to permit cutting holes in the top of the dome, and reconstituting the design basis structural adequacy of the containment spray system (the latter being an emergent as an issue during the S/G replacement outage).0 performed an Instrument Air System functional review (C.2.M)0 upgraded the Off-site Power System (C.2.N)0 upgraded the Spent Fuel Pool (SFP)Cooling System by adding another cooling loop (C.2.0)0 performed a Containment Isolation System review (C.2.P)0 upgraded to a Steam Generator (S/G)Advanced Digital Feedwater Control System (ADFCS)(C.2.Q)0 upgraded to a Microprocessor Rod Position Indication (MRPI)System (C.2.R)10CFR50.54(f)

Rcsponsc-Summary Rcport Final Rcport Page 9 2/787

0 added Anticipated-Transient-Without-Scram (ATWS)Mitigation System Actuation Circuitry (AMSAC)(C.2.S)0 added a Standby Auxiliary Feedwater (SAFW)System (C.2.T).The Nuclear Operations Group stafF is formally trained (C.4)to report deficiencies in configuration or performance of SSCs via RG&E's.corrective action program.Note: Additional information regarding self-assessments, internal reviews, and third party reviews which support our conclusions in this section are found in section (e).(d)Processes for identification of problems and implementation of corrective actions, including actions to determine the extent of problems, action to prevent recurrence, and reporting to NRC: CORRECTIVE ACTION PROGRAM RG&E has recently implemented a corrective action process and program focused on the RG&E Abnormal Condition Tracking Initiation or Notification (ACTION)Report.This process integrates all aspects of problem identification, evaluation; and resolution initiation into a single process that can be tracked and trended to assist in assessing the effectiveness of various.programs, processes, and organizations, and that can be readily improved through management oversight and communication of expectations

~1 The ACTION Report process is currently implemented via IP-CAP-1, Abnormal Condition Tracking Initiation or Notification (ACTION)Report.The ACTION Reporting process is a single corrective action program for the identification and resolution of any condition event, activity, concern, or item that has the potential for affecting the safe and reliable operation of the Ginna Nuclear plant.RG&E's ACTION Report process may be used by any individual who observes or is aware of such a condition.

The process includes requirements and provisions for:~Identification of problems and concerns~Initial screening of identified conditions for immediate safety and/or operational concerns and prioritization of the condition for resolution

~Disposition and cause determination for the condition including classification of the condition for tracking and trending~Implementation of corrective actions as appropriate for the condition including.remediation of the condition, and long term actions to prevent recurrence

~Requirements for reporting appropriate conditions to the NRC, e.g., as required by 10CFR21.Section (D.1)of this report provides an explanation of the RG&E ACTION Reporting process.lOCFR50.54(f)

Response-Sumnury Rcport Final Rcport Page 10 2/7/97

~c e 1~s I The unified and integrated ACTION reporting, which replaced a number of older corrective action processes, has permitted RG&E management to better manage the process and to consciously drive down the problem identification threshold.

This lower threshold is intended to ensure that more conditions, even those which, taken separately, appear to be of low significance, are being reported for tracking/trending and, as appropriate, corrective action.The process (D.3)for classifying a reported condition as adverse to quality or non-conforming, as well as evaluating the significance of the condition, is part of the ACTION Report process.Specific guidance is provided in attachments to IP-CAP-1.Conditions found to be Significant Conditions Adverse to Quality (SCAQ)are evaluated to determine the effect of continuing activity.If continued activity would obscure or preclude the identification of the deficiency, increase the extent of the deficiency or lead to an unsafe condition, stop work action is taken.The ACTION Report process directs, when appropriate, the use of IP-CAP-2, Root Cause Analysis, to determine the extent of problems as well as the actions to prevent recurrence, and the use of A.61, 10CFR21 Screening, Evaluating, and Reporting to determine reportability under 10CFR Part 21.Nuclear Assessment is responsible for trending identified problems and corrective actions (D.4)per ND-CAP, Corrective Action Program, based upon data from ACTION Reports.Trending provides RG&E management with a measure of the overall effectiveness of the corrective action process and how well management expectation for reporting and use of the system are being communicated to cognizant personnel.

Trending also contributes to RG&E's understanding of how well other processes, including those for design and configuration control, are functioning and where improvement and enhancements are prudent.OPERABILITY ASSESSMENT RG&E has established formal administrative processes for determining the operability of systems and equipment (D.2).These processes track safety-related equipment out-of-service as well as certain inoperable non-safety-related equipment to ensure that the aggregate impact of multiple minor deficiencies in more than one system or subsystem does not place the plant outside its design bases and Improved Technical Specifications (ITS).In addition to its association with the corrective action process at Ginna, evaluating and determining operability of systems, structures, and components with respect to plant Technical Specification requirements and design bases is an integral part of the processes that directly affect plant configuration and performance, e.g., work control, inservice testing, modifications.

10CFR50.54(0 ResPonse-Summasy Report Final Report Page ll 2/787 T 1 I c a Ill,y,,P'ip lg 7~gs'I I j I~

REPORTIN T THE NRC RG&E meets applicable NRC Reporting Requirements (D.S)for both immediate and written reports.A rev'iew of RG&E's reports to the NRC and NRC enforcement history confirms that appropriate reports have been made.In addition, RG&E has submitted at least eleven voluntary reports, which did not meet the threshold for NRC reporting, since 1988.There is continuous interaction and communication between RG&E and the NRC (D.6).Except for some periodic reporting, normal communication, which becomes part of the Ginna docket, is typically between the Vice President, Nuclear Operations and the NRC.Informal communication occurs at various levels of the organization.

Examples include NRC attendance at PORC or at NSARB and discussions with the NRC Resident Inspectors, NRC Project Manager, or other members of the NRC staff TRAINING The Nuclear Operations Group staff ha received formal training on the ACTION Report process (D.7).The ACTION Report process training encompasses conditions adverse to quality and non-conforming conditions.

Operations receives periodic training on the operability process and on reporting to the NRC.Root cause analysis training is conducted for selected staff Training supports methods to prevent recurrence by re-training, as appropriate, and by training on lessons-learned from previous corrective actions.CONFIDENTIAL EMPLOYEE CONCERNS For any employee or contractor who desires anonymity or who feels a concern is not being addressed by the corrective action program described above, RG&E has an Employee Concerns Program (D.8).RG&E considers that the very small number of concerns requiring use of the"Employee Concerns Form" or"NRC Form 3", coupled with the large numbers of ACTION Reports generated (currently averaging about 100 per month), is evidence of our success in communicating directly with our employees about safety concerns.The attitude of both our employees and management is to encourage the identification of potential safety issues.We are constantly improving our problem identification processes to encourage self-reporting by, for example, lowering the reporting threshold for ACTION Reports and rewarding employees for identification of significant issues.r 10CFRSO.S4(t)

Response-Summuy Rcport Final Rcport Page 12 2/7/97 "Q 4W<", o 0~f (e)The overall effectiveness of our current processes and programs in concluding that the configuration of our plant is consistent with the design bases: RG&E has reasonable assurance that the R.E.Ginna Nuclear Power Plant is fully capable of fulfilling its safety functions, i.e., that it is operating safely and can continue to operate safely, and that its configuration is consistent with the design bases.-The three primary reasons for reaching this conclusion are: 1.Our programs are intentionally developed to meet applicable regulations, are the product of continuous improvement, and have been strengthened by the incorporation of third party best practices.

Consider, for example, one of the most fundamental processes that can impact the configuration of the plant with respect to the design bases, the plant change (modification) process:~Our design control process is intended to ensure that the affected design bases requirements are researched and understood before the plant is modified.~Our design verification process (E.l.A)provides an in-line review to ensure that the design control process was performed correctly.

~PORC (E.l.B)approval of 10CFR50.59 Safety Evaluations for modifications and related operational issues is intended to ensure that the plant configuration is kept consistent with the design bases.~NSARB oversight of station operation and PORC activities gives further assurance that a proper safety focus is maintained throughout the process.Our programs have withstood the test of internal and external assessment.

Both RGB QA (E.2.D)and the NRC have identified numerous process strengths.

Specifically, a review of NRC Inspection Reports (E.3.A)reveals the following recurring themes:~a reference to strong modification control and corrective action processes, and~good support and review by both Engineering and the Plant Operations Review Committee (PORC).Where there have been weaknesses, deficiencies (E.2.C), or Notices of Violation (E.3.B), our corrective action program has been effective in restoring compliance and preventing recurrence of the problems.2.A significant sampling of systems has been done in the past (" vertical slice" design basis audits).Despite some discrepancies, the detailed inspection results consistently show that plant systems are operable and configuration is consistent with the design bases.RGB'nitiated its first Safety System Functional Inspections (SSFIs)with the Auxiliary Feedwater system in 1988.This was followed by an Auxiliary System Functional Inspection of the Instrument Air system in response to NRC Generic Letter 88-14.The NRC conducted SSFIs of the Residual Heat Removal (RHR)system in 1989 and the Electrical Distribution system (EDSFI)and Service Water system (SWSOPI)in 1991 10CFR50.54(f)

Response-Sun@nary Report Final Report Page 13 2/7/97

'C I l'" ic Ir, y 1'I (E.3.C).Although weaknesses were noted, the teams did not identify any situations where the cited weaknesses had adversely affected the capability of the systems to function..

t In 1989, RG&E performed a comprehensive assessment of the RHR SSFI findings which led to enhancements in RG&E's design and configuration control processes to broadly address the weaknesses cited in the SSFIs.Specific improvements were:~an improved Plant Change Process was implemented

~'Design Basis Document Retrieval project was initiated~a searchable master list of Design Analyses was created as part of the Configuration Management Information System (CMIS)~common procedures were created for engineering/plant interfacing activities

~Design Engineers were assigned systems (preparation for becoming System Engineers)

~a hydraulic model for the Service Water system was developed/validated

~a test program for molded case circuit breakers was developed~an electrical load growth control program was developed.

3.RG&E has undertaken large scale efforts in design basis reconstitution and has further efforts underway.Examples include:~a comprehensive evaluation and extensive reanalysis of Ginna's UFSAR Chapter 15 accidents in order to support a reduction in T, and an 18 month fuel cycle after steam generator replacement,~analysis compilation for the Bases and procedure validation associated with conversion to the Improved Technical Specifications,~upgrades via the Systematic Evaluation Program (SEP), including a major seismic upgrade,~a comprehensive review of testing of the reactor protection system (RPS)and engineered safeguards feature actuation system (ESFAS)intended to ensure that circuits are tested end-to-end (response to Generic Letter 96-01),~major Piping and Instrumentation Drawing (P&ID)and Electrical Controlled Configuration Drawing (ECCD)upgrades,~a safety instrumentation setpoint reanalysis,~a comprehensive DC fuse coordination study, and~a rigorous safety classification process, which characterized the safety functions of plant equipment.

RG&E has expended considerable effort throughout the life of the plant to keep design information current.Our programs are the product of continuous improvement, and they will continue to improve in the future.As problems arise, we are committed to using good engineering judgment to bound and solve them, expanding the solution into a programmatic look, as necessary.

We value continued input from both the NRC and the industry to maintain safe and reliable plant operation.

10CFR50.54(f)

Rcsponsc-Summary Rcport Final Rcport Page 14 2/7/97 N~~.~1 e)~v.

("P')The NRC request also contained a request to indicate whether we have undertaken any design review or reconstitution programs or a rationale for not implementing such program(s):

RG&E is confident in the ability of Ginna Station to perform its intended safety functions and protect the health and safety of the public in the event of an accident.Nevertheless, in responding to NEI initiative 96-05, we noted that descriptive information in the UFSAR has not always been rigorously modified in accordance with plant or procedure changes.RG&E, therefore, intends to undertake a voluntary initiative to perform a thorough UFSAR review during the NRC s 2-year Enforcement Discretion period for self-identification of discrepancies (expected completion date of October 18, 1998).RG&E will implement a method of UFSAR review which will meet or exceed the guidance of NEI 96-05, Guidelines for Assessing Programs for Maintaining the Licensing Basis, but the application will be extended to the entire UFSAR.Based on our experience with vertical slice design basis audits and with performance of the pilot NEI 96-05 initiative at Ginna, a minimum impact on safety functions can be expected from our UFSAR search.RG&E's design basis retrieval efforts to date have been focused primarily on topical areas instead of on system Design Basis Documents (DBDs)[see section (c)];however, RG&E has developed pilot DBDs for the following systems and topics in an effort to find the process and format that would add the most value:~Reactor Coolant System~Safety Injection System~Chemical Volume and Control System~Reactor Protection System~Auxiliary Feedwater System~Instrument Air System~Appendix R/Fire Protection.

Based upon experience with the above efforts, RG&E concluded that the source documents needed for DBD development were not readily available to RG&E.As a result, RG&E initiated an effort to retrieve the original source documentation for the plant design bases from the NSSS vendor and the station Architect/Engineer.

This information is also being.supplemented with records of plant modifications and changes, as well as with formal correspondence between RG&E and the NRC.RG&E also concluded that compiling design basis information in separate, hard copy reports was not the most effective means for maintaining or distributing design basis information to our Nuclear Operations Group technical staff As a result, the above DBDs were not accepted as Controlled Configuration Documents (CCDs)for Ginna.Rather, RG&E is pursuing the following course of action: IOCFRSO.S4(f)

Rcsponsc-Summary Rcport Final Report Page lS 217i97

" Pl I 1 1 e III 9 I l',x~t I~w Make desi n basis information available electronicall to Ginna technical staff'pecifically, RG&E has recently completed retrieving and converting to electronic images the original design basis source documents and calculations formerly held by'Westinghouse (our NSSS supplier)and Gilbert/Commonwealth Associates, Inc.(our Architect/

Engineer).

RG&E has retrieved about 8,500 and 7,800 design basis source documents from Westinghouse and Gilbert/Commonwealth Associates, Inc., respectively.

We expect these documents to be in a searchable/retrievable electronic format by the third quarter of 1997.It is RG&E's intent to use this information in electronic form to increase the design and licensing basis knowledge level of Nuclear Operations Group personnel and to provide the tools and training to facilitate self-identification and resolution of potential NUREG-1600"Old Design Issues." This will be accomplished by providing electronic access for Nuclear Safety&Licensing personnel to our licensing correspondence, as well as, in the near future, by providing electronic access to validated original NSSS and A/E documentation for NOG personnel.

Collate and validate selected information for s ecific s stems and to ics and link this electr nicall with the SAR RG&E intends to examine these design bases source documents to verify design bases information for high-and medium-risk significant systems based upon our plant Probabilistic Safety Assessment (14 systems total)as well as selected safety-related topics.The focus of this effort will be design bases as defined in 10CFR50.2 consistent with the SECY-91-364 emphasis that"Design bases...include only the design constraints that form the bases for the stafFs safety judgments." Plant modifications and our licensing database will also be examined.The order for review is intended to be the same as that used for the original design of the plant, namely starting with the Reactor Coolant System (which sets design parameters for other systems)and working outward from there (with the exception of efforts in support of the two internal SSFIs in 1997 which are discussed below).Any discrepancies will be documented, evaluated, reported, and dispositioned in accordance with our current corrective action procedures.

This verified information will then be made available via electronic links to appropriate sections of the UFSAR.RG&E's schedule for completion of the above examination and verification of system and topical design bases information has not been established yet.RG&E intends to develop a firm schedule in the third quarter of 1997 based on experience gained in the interim from conduct of the UFSAR review, the SSFIs scheduled, and our continuing effort at design basis source document review and will provide the schedule to the NRC at that time.Several process weaknesses were also highlighted by this 10CFR50.54(f) review effort.Accordingly, RG&E will develop process improvements in the following areas:~Develop a means of tracking commitments in procedures to ensure that licensing commitments are controlled

~Enhance current processes, which can potentially affect information in the UFSAR, to require timely generation of UFSAR Change Notices 10CFRSO.S4(0 Response-Summary Report Final Report Page i6 2/7/97 WP)Ih~~a'MaL" E'0 0~1J,*=bSDl~$~

~Add UFSAR accuracy requirements to self-assessments and QA audits/surveillances.

These process improvements will be developed and implemented concurrent with RGBs review of the UFSAR, i.e., to be complete by October 18, 1998.RGB'as scheduled, and incorporated into our business plan for 1997, the performance of two internal SSFIs.Systems selected for these SSFIs are the Component Cooling Water (CCW)System and the Service Water (SW)System.These SSFIs will provide an additional measure of the eFectiveness of our current processes and programs, many of which have been implemented and/or enhanced since our last series of SSFIs.RG&E will identify and resolve any deficiencies or weaknesses using our normal corrective action process.Based on the results of these SSFIs, we will also assess the need to conduct additional SSFIs in conjunction with the other design bases efforts described above.Our training programs will support implementation of the process improvements listed above.We also will use our training programs to inform appropriate Nuclear Operations Group p'ersonnel regarding new and enhanced understandings of systems design bases as they are identified by our SSFI investigations and design bases source document reviews.10CFR50.54(t)

Response-Summary Report Final Report Page 17 2/7/97 1 P 4 ill<'1~I I l%*

10CFR50.54(f)

RESPONSE ATTACHMENT A (a)Description of engineering design and configuration control processes, including those that implement 10CFR50.59, 10CFR50.71(e), and Appendix 8 to 10CFR Part 50.NOTE: THIS ATTACHMENT IS SUPPORTING DOCUMENTATION THAT IS TO BE READ IN CONJUNCTION WITH ITS CORRESPONDING SECTION IN THE

SUMMARY

REPORT.IT IS N~T A STAND-ALONE DOCUMENT.This Attachment is organized as follows: A.1.PROCESSES TO CONTROL LICENSE RE UIREMENTS A.l.A.License Amendments (10CFR50.90)

A;1.B.Improved Technical Specification Bases Control Program/Control of COLR, PTLR, and TRM A.l.C.Safety Reviews and Safety Evaluations (10CFR50.59)

A.l.D.UFSAR Updates (10CFR50.71(e))

A.l.E.Changes to Quality Assurance (10CFR50.54(a))

A.l.F.Changes to the Security Plan (10CFR50.54(p))

A.1.G.Changes to the Emergency Plan (10CFR50.54(q))

A.l.H.ASME Code Relief Requests (10CFR50.55a)

A.l.I.Regulatory Commitment Changes A.1.J.Tracking/Incorporation of Generic Regulatory and Industry Concerns A.2.PR ESSES F REN INEERIN DESI N AND NFIG ATI N ONTROL A.2.A.Plant Change Processes (10CFR50, Appendix B)A.2.B.Temporary Modifications A.2.C.Administrative Control of Procedures A.2.D.Maintenance Work Control System A.2.E.Operator Work-Arounds

/Challenges A.2.F.Drawing Change Control Process (DCRs)A.2.G Procurement Engineering Process A.3.TRAINING IOCFR50.54(0 Response-Attachment A Final Rcport Page 18 2/7/97 A.1.PROCESSES TO CONTROL LICENSE RE UIREMENTS A.1.A.License Amendments (10CFR50.90)

A license amendment request (LAR)is concerned with changes to the Ginna Station Facility Operating License and Attachment A to that license.(Attachment A is referred to as the Improved Technical Specifications (ITS), a document representing a large portion of the Ginna licensing basis, since it requires equipment to be operable as assumed in the UFSAR Chapter 15 accident analysis.)

With respect to the ITS, a LAR is required for 1)any ITS change that is not a basis statement and 2)those bases changes which involve an unreviewed safety question.[Note that all bases changes require at least a 10CFR50.59 Safety Review.]Per RG&E's administrative requirements for LARs (ND-LPC, License Program Control, EP-2-S-700, License Amendment Requests, and A-601.7, Preparation, Approval, and Implementation of Amendments to Technical Specifications), LARs are reviewed and recommended for approval by PORC, reviewed by the NSARB;and are then submitted to the NRC by the Vice President, Nuclear Operations, or another office of the corporation, under oath or affirmation.

A.I.B.Improved Technical Specification Bases Control Program I Control of COLR, PTLR, TRM Design bases associated with the Ginna Improved Technical Specifications are documented in the ITS Bases portion of the Technical Specifications.

Also, in accordance with 10CFR50.36 as part of Ginna ITS implementation, design bases subject to periodic change, e.g., due to core fuel reload and those related to non-design basis accident analysis, have been removed from the ITS and are now contained in a series of associated documents.

RG&E has implemented a process to control and evaluate proposed changes to these design bases documents.

Unlike the Ginna original Technical Specifications, the ITS Bases are under RG&E control such that ITS Bases changes, e.g., resulting from necessary clarifications and interpretations, can be implemented by RG&E without prior NRC approval.The ITS Bases can be changed via the Technical Specification Bases Control Program per IP-LPC-2, Updated Final Safety Analysis Report and Associated Documents Control.Under this program, RG&E evaluates proposed Bases changes prior to implementation to ensure they do not change a Limiting Condition for Operation (LCO)or involve a 10CFR50.59 unreviewed safety question (USQ).If either a change to an LCO, or a USQ is identified, the proposed change would require a License Amendment as described in (A.l.A)above, approved by the NRC, prior to implementation.

In addition to the ITS Bases, three other documents, directly related to the ITS, are also controlled by RG&E under the ITS Bases Control Program.These are: 10CFR50.54(f)

Rcsponsc-Attaclnncnt A Final Rcport Page 19 2/787

~4~+0 I'a'a I tr 4 il 1'll 1

~Core 0 eratin Limits Re ort COLR: This document contains cycle-specific parameter limits required by the ITS that may change as a result of a refueling outage.The values may be changed by RG&E provided the values are determined in accordance with NRC-approved methodology specified within the administrative controls of the ITS.In addition to ITS requirements, the COLR currently contains a table listing major parameters used by the accident analysis.~Pressure and Tem eralure Limits Re ort TLR: This document contains specific values required by the ITS that are related to reactor pressure vessel pressure and temperature limits, including RCS heatup/cooldown curves, and the low temperature overpressure

'rotection (LTOP)system for the current fluence period.The values cannot be changed without NRC approval;however, an License Amendment Request has been submitted to place this document under RG&E control similar to the COLR.~Technical Re Nirements Mammal: This document contains previous requirements that have since been removed from Technical Specifications and placed under RG&E control.Typically, these items relate to non-design basis accident analysis assumptions which are required by a NRC regulation and that relate to the plant Operations staff e.g., fire protection measures required by 10CFR50, Appendix R.A.1.C.I Safety Reviews and Safety Evaluations (10CFR50.59)

The 10CFR50.59 process is sub-divided into the Safety Review and the Safety Evaluation, implemented by IP-SEV-1, Preparation, Review, and Approval of Safety Reviews, and by IP-SEV-2, Preparation, Review, and Approval of lOCFR50.59 Safety I" valuations, respectively.

The various processes which control plant activities (such as the Plant Change Process, procedure preparation/revision, and ACTION Reports)include requirements to consider their impact on nuclear safety in accordance with the Safety Review/Safety Evaluation process.I The Safety Review includes an established set of screening questions which are used to determine if a Safety Review is sufficien and that a subsequent 10CFR50.59 Safety Evaluation is not required.These screening questions are intended to ensure that proposed changes do not affect nuclear safety, do not involve an unreviewed safety question, and do not involve a change to the Technical Specifications.

Examples in which a Safety Review suffices include cases where another existing Safety Evaluation addresses the change and cases where the change is inconsequential, e.g., spelling, grammar, or a list of personnel names.The 10CFR50.59 Safety Evaluation is a.formal, written, technical evaluation performed when a proposed activity does not meet the screening criteria of the Safety Review so that relevant changes to procedures or to systems, structures, and components described in the UFSAR may be"specifically defined and evaluated.

The evaluation uses a prescribed format intended to ensure proposed plant changes are evaluated with respect to safety considerations of the current plant design basis, preserve the UFSAR, and conform to Technical Specifications.

10CFR50.54(0 Response-Attachment A Final Report Page 20 2/7/97 0, I': F 4a,~'g'y~g~,~

A qualified individual independently reviews the adequacy of the Safety Evaluation against the licensing basis and the UFSAR.The Manager, Nuclear Safety&Licensing, reviews and approves the Safety Evaluation.

Safety Evaluations are then presented to the on-site review function (PORC)for their review and recommendation of Plant Manager approval.A summary of approved Safety Evaluations is provided to the NRC in accordance with 10CFR50.59(b)(2).

A.1.D.UFSAR Updates (10CFR50.71(e))

Histo of the Ginna UFSAR Ginna Station received its original Provisional Operating License based on the information provided to the AEC in the Preliminary Facility Description and Safety Analysis Report in 1966, as well as the answers provided in response to'.AEC and ACRS questions.

This compilation of information was consolidated into the Final Facility Description and Safety Analysis Report ("FSAR")in 1969.The Provisional Operating License was issued on September 19, 1969.Two supplements to the FSAR were issued in 1971 and 1973;otherwise, there was no change to the FSAR until after the publication/implementation of 10CFR50.71(e).

At that time, RG&E compiled docketed correspondence regarding Ginna Station and descriptions of modifications performed since plant startup to evaluate what information to add to the FSAR to bring it in line with 10CFR50.71.

As part of a major update in 1984, RG&E also enhanced the descriptive information in the FSAR.This resulted in the original 3 volume FSAR expanding into an 8 volume Updated FSAR (UFSAR).Periodic updates of the UFSAR have been submitted to the NRC since that time with the latest, Revision 13, having been submitted in December, 1996.Chan es to the UFSAR Changes to the UFSAR are controlled by ND-LPC, License Program Control.This document describes the requirements of 10CFR50.71(e) and tasks the Nuclear Safety&Licensing (NS&L)group with overseeing the program.IP-LPC-2, Updated Final Safety Analysis Report and Associated Documents Control, establishes the instructions for submitting, reviewing, and processing changes and revisions to the UFSAR.IP-LPC-2 provides direction on when to prepare a change to the UFSAR and lists the types of information to be reviewed for inclusion in the UFSAR.Each request for a change is supported by a change package of supporting documentation.

Change packages are reviewed by cognizant personnel, including Nuclear Safety&Licensing, Systems Engineering, and Operations.

Approved change packages are then incorporated into the next UFSAR revision per 10CFR50.71(e).

A.1.E.Changes to Quality Assurance (10CFR50.54(a))

Changes to Nuclear Directives (NDs)which may afFect commitments made to the NRC in the.QA Program for Station Operations (QAPSO)are ev'aluated in accordance with ND-LPC, License Program Control, by QA and Nuclear Safety&Licensing per 10CFR50.54(a) prior 10CFR50.54(f)

Response-Attachment A Final Report Page 21 2/7/97

'C~1'>4hkk>>'<k'"4~~~'ww to implementation of the change.Changes which, through evaluation, cannot substantiate nNo impact" on commitments are considered to be reducti'ons in commitment.

Changes evaluated to be commitment reductions need review and concurrence by the NRC prior to implementation.

Annually, QA prepares a QAPSO transmittal which identifies the following:

~The changes and reasons they were made.~The basis for concluding that the revised program continues to satisfy the 10CFR50 Appendix B criteria and the existing NRC-endorsed program description commitments Per QA-LPC-1, Revision and Control of the QA Program for Station Operations, a copy of the transmittal is forwarded to the NSARB, the PORC, NS&L, the Vice President, Nuclear Operations, and the Senior Vice President, Energy.Operations for review.'hen all comments have been resolved, the original of the submittal is signed by the Vice President, Nuclear Operations, or another officer of the corporation, and transmitted to the NRC.A.1.F.Changes to the Security Plan (10CFR50.54(p))

Changes to the Security Plan are controlled by ND-LPC, License Program Control.Any changes to the Ginna Station Physical Security Plan which do not result in a reduction of physical security effectiveness are made'in accordance with 10CFR50.54(p).

These changes are reviewed and approved by the Supervisor, Nuclear Security and then by the PORC prior to being submitted to the NRC, as required by ND-LPC.Changes to the Security Plan which would result in a reduction of physical security effectiveness must be made under the provisions of 10CFR50.90.

These changes are reviewed by the Supervisor, Nuclear Security, PORC, and the NSARB.The changes must then be approved by the NRC prior to implementation.

In addition to the appropriate review of changes, two other-annual reviews are conducted:

~QA-"Applicability and Adequacy of the Security Plan and Associated Security Activities" (Required by 10CFR73.55(g)(4))

~Operations/Security

-the'Security Plan and Contingency Plan (to evaluate their potential impact on plant and personnel safety).10CFRSO.S4(0 Rcsponsc-Attachment A Final RcFctt Page 22 2/7/97 tk tl A.1.G.Changes to the Emergency Plan (10CFR50.54(q))

ND-LPC, License Program Control, and A-205.2, Emergency Plan Implementing Procedures Committee, govern changes to the Nuclear Emergency Response Plan (NERP)and to the Emergency Plan Implementing Procedures (EPIPs).NERP or EPIP changes are reviewed by the EPIP committee, as a subcommittee to PORC.This committee currently has representatives from Emergency Planning, Operations, Engineering, Radiation Protection and Chemistry, Maintenance, Training, and Public Relations.

The committee is intended ensure that NERP and EPIP procedure changes do not decrease the effectiveness of the plan and that the changes meet the standards of 10CFR50.54(q).

Changes are reviewed by the Corporate Nuclear Emergency Planner and are approved by PORC.Appendix H of the NERP contains a cross-reference of the emergency planning requirements (found in NUREG-0654) to the section of the NERP that meets the requirement.

This is intended to ensure that changes to the NERP and EPIPs are reviewed against the plan requirement and that the plan requirements reflect the emergency planning bases prescribed by the NRC in NUREG-0654.

A.1.H.ASME Code Relief Requests (10CFR50.55a)

Inservice Inspection and Inservice Testing programs are implemented by ND-IIT, Inservice Inspection and Testing.ND-IIT applies to the examination, repair, replacement, modification, and testing of Class 1, 2, and 3 systems and components in accordance with the American Society of Mechanical Engineers (ASME)Boiler and Pressure Vessel Code,Section XI, 1986 Edition (the Code).ASME Code relief requests are used to obtain NRC approval of a position different'than that described by the applicable Code (primarily with respect to the ISI/IST program).Relief requests usually involve testing and acceptance criteria, but they can also be used to resolve or change design or construction requirements.

Requests are developed by the cognizant ISI/IST Engineer and Laboratory Inspection Services personnel.

Nuclear Safety A, Licensing reviews the request.The request is then sent to NRC for review and approval with a copy to the Ginna Senior Resident Inspector.

Approved relief requests effectively provide alternate methods of meeting design basis requirements.

A.1.I.Regulatory Commitment Changes The engineering design and configuration control process (involving generating new commitments and deleting or modifying existing commitments) is detailed in several Nuclear Directives, Interface Procedures, and engineering department procedures.

This process is intended to 1)control amendments to the Facility Operating License and changes to programs that implement license conditions, commitments, or regulations, and 2)assign responsibility for implementing these requirements.

t 10CFR50.54(Q Rcsponsc-Attachment A Final Rcport Page 23 2/7/97 II~t+g e 1 w~'>\re>la~~~b L N a><<'i g I 4' A Commitment and Action Tracking System (CATS)was implemented in 1989 as an aid to ensure that regulatory commitments and action items are tracked'to completion, are adequately documented, and are searchable.

Guidelines for processing documents through CATS are provided in EP-3-S-701, CA TS Document Processing.

CATS contains open active commitments, as well as one-time, completed commitments made since 1989.Additionally, as part of our design basis documentation program, docketed correspondence from initial plant licensing through 1994 has been catalogued and is contained within another searchable database which enables the user to electronically search for a desired topic and then view the image of the related document.Correspondence since 1994 is being added.The requirement to evaluate effects on regulatory commitments has been incorporated into change processes at Ginna such as the 10CFR50.59 Safety Evaluation process and the change impact evaluation portion of the Plant Change Request (PCR)process.A.1.J.Tracking/Incorporation of Generic Regulatory and Industry Concerns The generic regulatory process enhances/updates the design bases in that RG&E reviews and addresses NRC generic communications and incorporates any resulting RG&E commitments into plant procedures and programs.These initiatives are transmitted by NRC, e.g., via Information Notices (INs), Bulletins, and Generic Letters (GLs).The items are tracked within RG&E using the Commitment and Action Tracking System (CATS).The administrative procedures governing implementation of the CATS are intended to ensure that such generic regulatory documents are appropriately reviewed for their specific applicability to Ginna, including any efFect on plant operations, procedures, and configuration.

RG&E review of such generic regulatory correspondence has resulted in design basis plant enhancements such~Enhanced instrumentation hardware and operating procedures to minimize the potential for loss of decay heat removal cooling during refueling and especially during reduced inventory operations (GL 88-017)~Enhanced pump recirculation piping and test procedures to minimize long term~degradation of the RHR pumps due to periodic testing at very low flow (Bulletin 88-004)~Revised maintenance procedures and guidelines intended to ensure and document that vapor barriers and seals are reinstalled for electrical equipment after maintenance to minimize the potential for water intrusion into electrical enclosures (IN 89-063).RG&E has also established an administrative process (A-1404, Operating Experience Program, as controlled by IP-LPC-1, Commitment and Action Tracking)for screening and evaluating Operating Experience (OE)(consisting of industry events and vendor notices)for applicability to Ginna.The process is intended to ensure that these notices are reviewed for impact on operability, possible unreviewed safety questions, potential degradation of, or 10CFR50.54(f)

Rcsponao-Attachment A Final Rcport Page 24 2/7/97

=I"g'I I I I I'I i e~I challenges to, safety systems/equipment, and possible effects on implementation of Emergency Operating Procedures.

For vendor notifications, the process also determines whether 10CFR21 reportability is required.I The on-going OE review process assists in the evaluation of the need to upgrade the plant design bases.A brief review of past (since 1990)OE items found applicable to Ginna and involving configuration control or design basis issues identified approximately 30 items of significance to Ginna.The OE review process determined whether the item was already under evaluation and being resolved by RG&E.If not, the items were recommended for further action and tracked under the Commitment and Action Tracking System.Examples of industry events screened as applicable to Ginna which involve configuration control topics include:~SER 91-007, Failure to Control Valve Lineup Status Resulting in a Reactor Coolant Drain Dote~SER 91-021, Plant Transients Caused by In-House Distribution Transformer Failures~SER 95-008, Service 8'ater Spill in Switchgear Area/Loss of Physical Separation Bettveen Safety-Related Electrical Facilities.

A.2.PROCESSES FOR ENGINEERING DESIGN AND CONFIGURATION CONTROL A.2.A.Plant Change Processes (10CFR50, Appendix B)BACKGROUND The primary process for ensuring consistency between plant design bases, plant configuration, and conduct of operation has been the RG&E design control process.Over the life of the plant, the design control process has undergone several evolutionary changes intended to improve the quality of design control and to ensure that appropriate aspects of the process were applied to changes, including those of lesser scope.During the later stages of plant construction and the first few years of plant operation, changes to the plant were made by the NSSS supplier, the A/E, and by RG&E.These early changes made prior to adoption of 10CFR50, Appendix B, were not always captured in detail, because the configuration documentation required at the time was far less than currently is expected.Many of the configuration management efforts discussed in Attachment C aided in properly documenting these earlier changes.Also, several large design projects were performed by the A/E in the early 1970s using the Ginna Station Modification (GSM)package.In the 1970s, the Engineering Work Request (EWR)became the major process for plant modifications.

The EWR was later supplemented by plant processes for Technical Staff Requests, Technical Evaluations, and Temporary Modifications.

In 1994, the Engineering Work Request (EWR)modification process was replaced by the Plant Change Request/Record (PCR)process.The underlying requirements for these processes have been applicable portions of 10CFR50 Appendix B, the RG&E QA program, and ANSI 45.2.11 requirements.

The basic steps in the design control process are as follows: 10CFR50.54(0 Rcsponsc-Attachment A Final Report Page 25 2/7/97 I g i't~M il~l+a~)q I C , gVyg a ewe~1 a P~ldfiii-fiiiifi fi i fi ifi I iififi fit deficiency or to improve upon an existing condition.

~Desi nIn utDevelo ment-The functional and designbasis requirementsfortheaffected systems, structures, and components ar'e developed to the extent required to perform the design change and assure that overall plant design bases and functions have not been adversely affected.For lesser, self-contained modifications (component parts.equivalency), this may be quite limited;however, for complex changes, design input development can represent a major design basis reconstitution effort to determine effects on system performance, interaction between systems, and physical proximity concerns for otherwise unrelated components and systems.For Ginna modifications, a controlled Design Criteria document is required which documents the results of these efforts.~10CFR50.59 Safet Evaluation (described elsewhere in this document)-Based upon the Design Criteria for the modification, the safety screening/evaluation is intended to ensure that the change is not a 10CFR50.59 Unreviewed Safety Question, that no Technical Specification changes are required, and that it is within the current licensing basis for Ginna.If not, a Licensing Amendment Request must be submitted to, and approved by, NRC prior to implementation of the change.~En ineerin Desi nOut uts-BasedupontheDesignCriteriaand SafetyEvaluation for the change, engineering design outputs are developed.

Some outputs are to demonstrate that the design is consistent with the design bases.These are typically design analyses, calculations, and technical reports.Other design outputs communicate how the design change is to be implemented so that the resulting configuration will reflect design bases.These typically include drawings, sketches, and specifications including acceptance criteria.~Inde endent Desi n Verification

-A review of the development and results of the design change to conclude, independent of the cognizant design personnel, that the various outputs of the design control process have indeed met the requirements of the design inputs, specifically the Design Criteria and Safety Evaluation.

Verification may include multiple reviewers for complex, interdisciplinary changes and is sometimes complemented by Operations and Maintenance impact reviews.~Construction and Fabrication Out uts-These are detailed outputs, based upon the Engineering Outputs, used to communicate to the fabricator and installer how the change should be implemented and intended to ensure that the resulting configuration will reflect the design bases.These may include fabrication and installation drawings, procedures, work orders, vendor documents, bills of material, and quality assurance inspection and test plans.~Confi ration Chan es-These are change notices issued to ensure consistent configuration control of documents and processes affected by the design change they may include, but are not limited to, changes to operating, maintenance, and periodic test 10CFR50.54(t)

Response-Attachment A Final Report Page 26 2/7/97 (gl C~A 4 I procedures, training modules, drawings and specifications, safety classification lists, applicable vendor document files, and UFSAR descriptions.

Procedural guidance is provided for the priority and timing of such changes relative to the implementation of the design change.~Im lementati n of Modification

-The construction and fabrication outputs are used to build and install the change.Installation activities are governed by the plant work control processes and include provisions for establishing equipment holds and tagging with consideration for complying with Improved Technical Specification and equipment operability concerns, processes for consideration of field changes to the design and implementation based on emerging field information (Modification Design Change NoticesPvK)CNs]

and Temporary Procedure Change Notices[TPCNs]), and records update requirements to ensure the change is documented as part of the appropriate equipment history records.~Post-Modification Testin-Functional testing of the equipment and/or system(s)is performed to demonstrate that actual performance meets the design bases requirements following implementation of the design change and prior to relying upon the design change and associated systems to perform safety-related functions.

~Close-Out-A final confirmation that all aspects of the design change have been properly implemented, completed, and documented.

Close-out is intended to assure that final configuration and procedures associated with operation of the modified system are consistent with the design bases for the change as documented in the design criteria and Safety Evaluation.

It is also intended to ensure that the bases and configuration resulting from the change are readily available for future reference, by submitting the appropriate documentation to records.RG&E PLANT CHANGE RE VEST CR The procedure which describes the flow of engineering work, organizational responsibilities, and implementing procedures for developing, reviewing and approving the Engineering documents required for a plant change is IP-DES-02, Plant Change Process.Interfaces between design and implementing activities are also addressed including installation, testing and turnover.IP-DES-02 also covers processing of a Plant Change Record (PCR), which is used to document plant changes.The PCR provides flexibility in its use to most efFectively accommodate the needs of a specific plant change.Screens are used to develop each plant change package with the technical and administrative content commensurate with the nature of the change.For simple, smaller scope plant changes, the PCR may be used as a"stand-alone" document.For larger, more complex plant changes, the PCR is used primarily as a design record.The PCR form is intended to be elastic.That is, it can be expanded to include necessary and applicable information to document and summarize the plant change, or it can be compressed to omit topics or information which are not applicable.

10CFR50.54(Q Rcsponsc-Attadrrncnt A Final Rcport Page 27 2/7/97 Procedures and documents which implement portions of the PCR process and which may be used for a PCR include: Engineering and Interface Procedures EP-2-P-1-10, EP-2-P-111, EP-2-P-112, EP-2-P-114, EP-2-P-117, EP-3-P-121, EP-3-P-122, EP-3-P-123, EP;3-P-124, EP-3-S-125, EP-3-P-126, EP-3-P-131, EP-3-P-132, EP-3-P-133, EP-3-P-137, EP-3-P-138, EP-3-P-139, EP-3-P-140, EP-3-P-151, EP-3-P-162, EP-3-S-304, EP-3-P-306, EP-3-P-700, EP-3-S-901, IP-SEV-1, IP-SEV-2, Vendor Technical Document Control Process CMIS d'c Fire Protection Program Databases, Data Input Guide UFSAR Change Requests Component Safety Classification

.Document Change Request Design Control Design Analysis Drawing Control Engineering Specification Design Verification Equivalency Evalualion ALARA Desi g 7 Review Fire Protection!Appendix R Conformance Review Human Factors Review Computer Software Control Erosion/Corrosion Conlrol Program Environmental Qualification Program Modification Desi gv Changes Procurement ASME Xf Repair, Replacement d'c Modification Program Implementation 8'ork Priori tization Change Impact Evalualion License Amendment Requests Records and Document Control Preparation, Review and Approval of Safety Reviews P-R-A of 10CFR50.59 Safety Evaluations 2.Ginna Station Procedures A-302.2, A-401, A-601, A-606, A-1303, A-1603.0, Evaluation of Parts to Determine Safety Classification Control of Procurement Documents Prepared for Ginna Station Procedure Conlrol Drawing Change Requesls Storage d'c Preservation of Materials and Equipment-Ginna Station Overview of the Gimta Station 8'ork Control System IOCFR50.54(f)

Rcsponsc-Attachrncnt A Final Rcport Pago 28 2fl/97

~ll'I r 3.Quality Assurance Procedures QA-603, Controlled Document Distribution QA-1702, Records Nuclear Training Manual TR-5.5.1, Tracking Plant Changes 5.Ginna Station Simulator Procedures GSS-1.1, Simulator Modification Control The specific responsibilities of the Engineer(s) assigned the PCR include:~Initiate the Plant Change Record (PCR)~Determine the type of the plant change~Determine the safety classification of the plant change~Perform Equivalency Evaluation (when applicable)

~Perform a Safety Review or initiate a Safety Evaluation of the plant change (when required)~Determine interfaces/support required for the plant change design development and ensure that support personnel are informed about and involved in the design as it is developed~Perform a Change Impact Evaluation (CIE)to determine and identify the administrative, engineering and safety requirements for the plant change~Specify the design input requirements (including developing Design Criteria, if necessary)

~Develop the required design output documents (such as drawings, specifications, design analyses, bill of materials, and vendor documentation)

~Obtain required reviews, verification and approval of the plant change package~Support plant change implementation activities

~Update affected engineering documents to reflect the plant change~Confirm that affected systems drawings have been updated and that new or revised system/plant procedures have been completed~Coordinate any resulting training issues with the Training Department

~Facilitate the identification of reliability, operability, maintainability and testability issues for assigned systems~Contribute to post-modification system or component testing requirements

~Assist in the resolution of testing anomalies~Assess the impact of the plant change on the Maintenance Rule program~Review design outputs to confirm that details will not have an adverse effect on plant safety or operation~Monitor progress of change installation 10CFR50.$4(Q Rcsponso-Attaclmrcnt A Final Rcport Page 29, 2/7/97 I.A

~Submit the PCR and related records and documents to Records Management for retention and/or distribution Appropriate reviews and approvals for the above actions are included in the associated procedures.

USE OF AND CONTROL OF OUTSIDE ENGINEERING RESOURCES RG&E understands that, as the licensee for Ginna Station, we are ultimately responsible for the design and design bases of the plant.We maintain a limited professional relationship with both our NSSS supplier and original A/E.However, only our NSSS supplier performs regular engineering'tasks, and these are limited to 1)fuel reload and associated accident analyses and 2)owner's group activities.

Most plant Changes are developed and implemented using RG&E engineering resources.

For larger projects, RG&E does make use of outside engineering resources based upon 1)their knowledge and expertise at the specific task, 2)their general overall knowledge of Ginna, and 3)their past performance.

When outside engineering is used, RG&E formally exercises design responsibility through the development and control of the detailed Design Criteria and Safety Evaluation documents, as well as through appropriate engineering and design reviews of outputs proposed by our engineering services suppliers.

For example, for the Steam Generator Replacement Project (SGRP), RG&E elected to procure replacement steam generators from a fabricator other than our original NSSS supplier.RG&E worked cooperatively with both the steam generator fabricator and the installer to develop the Design Criteria, the Safety Evaluation reports, and the detailed equipment specification that established the design bases and criteria for the generators and their installation.

Approval and control of these documents were maintained by RG&E.Further, RG&E performed detailed design reviews of the technical reports, analyses, and output documents developed for the SGRP.The SGRP was completed in the Spring of 1996 on schedule and under budget, with no major technical problems, and with an adequately documented conformance to design bases.These accomplishments were in no small part due to RG&E's extensive technical involvement throughout the course of the project.A.2.B.Temporary ModiTications A-1406, Control of Temporary Modifications, is used for most temporary modification installations and provides requirements for their control and documentation.

It is intended that the scope, number, and duration of temporary modifications should be minimized.

Temporary modifications are defined as temporary minor alterations made to plant equipment, components, or systems that do not conform with approved drawings or other design documents.

These alterations are temporary in that they are expected to be installed for one operating cycle or less.The following are examples of temporary modifications:

~lifted leads~pull circuit cards~disabled alarms~temporary power cables (not extension cords)10CFR50.54(f)

Rcsponsc-Attachment A Final Report Page 30 2/7/97 c.k'y'll'QP 0 i*1 0

~setpoint changes~mechanical.

jumpers, such as spool pieces, hoses, tubing, piping or valves~temporary leak repairs (e.g., mechanical clamps)~installed or removed blank flanges~disabled relief valves or safety valves~installed or removed filters or strainers~plugged or covered floor drains~temporary pipe supports~temporary special rigging attachments to safety-related systems/components/structures

~temporary computer software changes that perform a Main Control Board alarm control function.Temporary modifications controlled by other approved procedures, e.g., certain jumpers installed to support testing and removed as part of recovery from that test, are excluded from the requirements of A-1406.Proposed temporary modifications are prepared by an assigned Engineer using the applicable design inputs for the affected system/component(s).

Although procedural requirements differ somewhat, the responsibilities of the assigned Engineer are considered to be similar to, and as significant as, those listed above for permanent plant changes.The applicable design inputs and their evaluation are documented as part of the procedural process.Testing requirements, if any, for the temporary modification are identified by the assigned engineer.A Safety Review is performed for each Temporary Modification.

A Safety Evaluation is performed, if the Safety Review screening indicates that one is needed.Any required mode restrictions are noted.The assigned Engineer determines the process for permanent resolution (such as conditions for removal, EWR, TSR, WR/TR, etc.)and the expected removal date.The selected design inputs and evaluation are reviewed by a second Engineer experienced in the related subject matter or affected system.The results of the review are documented.

Selected documentation, e.g:, Operating Procedures, and control room copies of P&IDs are changed to reflect the temporary modifications.

For example, affected control room P&IDs are affixed with a label indicating the temporary modification and its identification number.A.2.C.Administrative Control of Procedures Procedural Hierarch The requirements for the development of procedures associated with Ginna Station are established in ND-PRO, Procedures, Instructions, and GNidelines.

The basic organization and hierarchy of procedures is established by ND-NPD, Nuclear Policy and Directives Manual Description, and are as follows:~Licen in Documents-Documents (such as the Facility Operating License, UFSAR, and Improved Technical Specifications) which have been developed as a method for RG&E to show compliance with regulatory requirements/guidelines, industry standards/practices, and commitments made to regulatory agencies.lOCFR50.54(t)

Response-Attachment A Final Report Pat,c31 2/7/97 P, kCfFY,~'l>*w e-Uk E

~Nuclear Policies-High level statements'of commitment and endorsement from senior corporate management to the major principles of Nuclear Safety and Quality Assurance, assigning corporate responsibility for these principles.

~Nuclear Directives s-Provide management direction for implementation of commitments to regulatory requirements, industry standards, and corporate policy.~Nuclear Interface Procedures

-Govern activities involving interfaces between organizational departments and activities performed by more than one department where a common methodology is desired.~De artment and Section Administrative Procedures

-Define the organization, assign responsibilities within departments, and prescribe methods of accomplishing departmental activities below the level addressed in NDs and IPs.~Technical Procedures

-Step-by-step procedures which prescribe methods for accomplishing activities outlined in higher tier documents within an individual section.Examples of Technical Procedures are Operating Procedures, Radiological Protection Procedures, Maintenance Procedures, and Surveillance Procedures.

ND-PRO also has provisions for, and restrictions on, other procedural vehicles such as Instructions, Guidelines, Temporary Procedures, and Contractor Procedures.

Procedure Develo ment and han es ND-PRO, Procedures, Instructions, and Guidelines, includes requirements, regulatory guidance, and management expectations for the administrative control of procedures.

New or revised procedures required by the Administrative Controls Section of Improved Technical Specifications, or otherwise important to safety, receive a Safety Review.If a Safety Review identifies potential changes that may affect nuclear safety or that are described in the UFSAR, a 10CFR50.59 Safety Evaluation is performed.

Typically, a procedure change requires documentation detailing the reason for the change, impact on equipment/systems and their operability, effect on plant operating modes or operating equipment requirements, potential impact on affected Nuclear Operating Group organizations and their specific activities and responsibilities, and effect on nuclear safety.In addition to the above requirements, major changes to Emergency/Abnormal procedures require a more extensive verification and validation.

In addition to'the typical technical accuracy review to verify incorporation of and compliance with appropriate technical information such as the UFSAR and Improved Technical Specifications, this validation process utilizes either the simulator or a walk-through to physically test the procedure steps.The changes are also reviewed by the Emergency Procedures Committee (EPC)for technical adequacy, programmatic requirements, and safety significance.

The EPC is multi-disciplined, including representatives of Operations, Systems Engineering, Training, and NSEcL.10CFR50.54(f)

Rcsponsc-Attachrncnt A Final Rcport Page 32 2/7/97 q~e A.2.D.Maintenance Work Control System The Maintenance Work Control system can potentially impact the configuration of the plant.A-1603.3, Work Order Planning, provides direction for the Maintenance Planners that material substitution, part modifications, setpoint changes, and plant changes are not permitted without an engineering evaluation, which provides for a safety review.Post-Maintenance/Modification Testing (PMT)is performed to verify that equipment/

components fulfill their design function when returned to service following maintenance or modification.

The Maintenance Planner is provided with direction from procedures A-1603.3 and A-1603.6, Post-Maintenance/Modification Testing, for PMT requirements.

PMT associated with modifications is specified in the associated engineering design outputs.A.2.E.Operator Work-Arounds

'/Challenges RG&E has established a formal administrative process (A-52.16, Operator 8'ork-Around I Challenge Confro/)to evaluate long term equipment deficiencies which, although they do not in themselves compromise the ability of the plant to operate within Improved Technical Specifications, have the potential to affect Operator decision-making and/or response time.The process establishes screening criteria and tracking requirements for items which are potential work-arounds.

Items classified as Work-Arounds are given increased priority for evaluation and resolution.

Management awareness is maintained by quarterly PORC reviews of the Work-Arounds and periodically discussing/listing them in the daily plant management/staff meeting (typically, once per week).PORC reviews de-classification or resolution of all Work-Arounds; additionally, any items unable to be appropriately resolved are submitted to PORC for resolution.

Items not evaluated as true'Work-Aroundsn by the screening criteria may be tracked as"Challenges" and are considered for their aggregate effect on Operations.

A.2.F.Drawing Change Control Process (DCRs)Drawings are updated per QE-324, Preparation, Revie~, and Disposition of Denting Change Requests.When the need for changes is identified via field walk-down, completion of a modification, or discovery of typographical errors, a DCR is used to implement these changes.The DCR process includes precautions intended to ensure a design change is not inadvertently implemented via DCR.A Responsible Engineer dispositions a DCR as follows: t~Check for completeness and accuracy,~Verify that the DCR does not affect plant operation or any existing design bases, (For cases in which the field condition reported via DCR does affect operation or design bases, 10CFR50.54(f)Response-Attachment A Final Rcport Page 33 2/7/97 0~v'+~g gl'.4 l~)IL 4 p (~A sty l~tc~CQ' appropriate action is taken to resolve the problem, e.g., a plant or procedure change or ACTION Report.)~Identify additional drawings potentially affected by the DCR, screen the DCR per 10CFR50.59, and incorporate the change(s)into the affected drawings.A.2.G Procurement Engineering Processes ND-PES, Control of Procurement Acti vities, establishes the requirements 1)for the procurement, verification, and acceptance of items and services, and 2)for the qualification and performance evaluation of suppliers.

IP-PES-2, Control of Procurement Documents Prepared for Ginna Station, provides instructions for preparation, review, and approval of procurement and upgrade documents for safety-related and safety significant materials, parts, components, and services for Ginna Station.The process includes requirements to determine the safety classification of items to be purchased.

For safety-related and/or safety significant items, the process specifies requirements for parts safety classification based upon 1)the component's safety class, 2)evaluation of the components safety function(s), and 3)a failure modes and effects analysis of the component.

Technical and quality requirements for the purchase are developed, as well as receipt inspection and acceptance criteria.For receipt inspection, especially for commercial items dedicated by RG&E to safety-related service, RG&E makes extensive use of our in-house Laboratory and Inspection Services metallurgical and materials expertise.

This includes in-house electron microscopy with x-ray spectroscopy to determine material compositions.

For example, during the Ginna Steam Generator Replacement Project, RG&E performed its own independent metallurgical evaluations of each lot of safety-related tubing as it was produced and prior to its actual insertion into the replacement steam generators.

The RG&E procurement processes also governs specification and implementation of special storage requirements, shelf life restrictions, and in-storage periodic maintenance as required.As needed, processes also require Technical Evaluations which are intended to ensure that procurement activities do not inadvertently result'in a design change to the facility.Specifically, Technical Evaluations assess replacement components, parts, and materials for equivalency.

Differences affecting configuration and/or design are identified and evaluated for impact.The procurement process also requires review of Operating Experience information for past industry experience with the items to be procured.A.a TRAINING In order to achieve compliance with the administrative and procedural requirements governing the engineering design and configuration control processes and programs discussed in responses to Requested Actions (a)through (e), RG&E has established an overall integrated training program and a dedicated Nuclear Training Department.

The Training Department's responsibility is to provide a training program which ensures Nuclear Operations Group 10CFRSO.S4(Q Rcsponsc-Attachment A Final Rcport Page 34 2l7/97 ka I.)), 0 m~-y~*II personnel are knowledgeable and familiar with the requirements, objectives, and management expectations for these processes, based upon user groups'pecific needs.Ginna's training program is accredited by the National Nuclear Accrediting Board and must undergo periodic accreditation renewal.Each established training user group has a committee that identifies the curriculum for the necessary training of that group.Training includes initial introduction to selected processes as well as on-going updates for major changes and/or lessons learned, as applicable for job performance.

Training objectives and content vary to focus on targeted populations (Operations, Maintenance, Planning, Engineering, etc.).Specific information is outlined in lesson plans, qualification signature records, and self-study assignments.

Training is also extended to contract personnel, depending on assigned duties.The Nuclear Training Department has developed and implemented administrative.

configuration management processes intended to ensure training materials and modules are kept current with actual plant configuration and operation.

'inna Station has constructed and operates a stand-alone control room simulator for the training of plant licensed operators.

The simulator training is intended as one part of operator training to ensure operators are familiar with control room configuration and procedures, so that plant operation is consistent with requirements.

RG&E has also used the Ginna simulator to assist in the validation of new procedures (e.g., the Emergency Operating Procedures) and system modifications (e.g., feedwater controls tuning for the Steam Generator Replacement).

10CFR50.54(f)

Response-Attachment A Final Report Page 35 2/7/97

~e h~e I ,~ee' 10CFR50.54(f)

RESPONSE ATTACHMENT B (b)Rationale for concluding that design bases requirements are translated into operating, maintenance, and testing procedures.

NOTE: THIS ATTACHMENT IS SUPPORTING DOCUMENTATION THAT IS TO BE READ IN CONJUNCTION WITH ITS CORRESPONDING SECTION IN THE

SUMMARY

REPORT.IT IS NOT A STAND-ALONE DOCUMENT.This Attachment is organized as follows: B.l.PR ESSES WHICH NTROL PRO ED B.l.A.Plant Change Process B.l.B.Procedure Changes (10CFR50.59 Reviews)B.1.C.Maintenance Work Control System B.l.D.Operating Experience B.2.PRO RAMSfPRO ESSES TO UP RADE PROCEDURES B.2.A.Emergency Operating Procedure (EOP)Development Program B.2.B.Calibration and Maintenance Procedure Upgrade Programs B.2.C Inservice Test (IST)Procedure Upgrade Program B.2.D.Procedure Validation to Improved Technical Specifications B.2.E.RG&E Response to Generic Letter 96-01 B.3.SAMPLING PROJECTS F R RE UIREMENTS-TO-PROCEDURES B.3.A.UFSAR Validation in accordance with NEI Guidelines B.3.B.UFSAR-to-Procedures Review B.3.C.Radiation Protection Group Review of UFSAR B.3.D.On-Going Commitment Sampling Programs B.4.TRAINlNG AND TRAINING CONFIG ATION MANAGEMENT B.1.PROCESSES WHICH CONTROL PROCEDURES B.1.A.Plant Change Process The Plant Change Process is discussed in A.2.A.The process includes a review for potential impacts on plant procedures and programs and requires that changes be processed to ensure procedures and programs are revised to reflect the impact of the change.10CFR50.54(f)

Response-Attachment 8 Final Rcport Page 36 217/97 9't e+4M~'I1<<g e t B.1.B.Procedure Changes (10CFR50.59 Reviews)The controlling process for procedure control and change is discussed in Attachment A (A.3.C).The process includes requirements for a Safety Review, and a Safety Evaluation as appropriate, of proposed procedure changes.This process is intended to ensure compliance with 10CFR50.59.

B.1.C.Maintenance Work Control System Ginna's work control process is discussed in Attachment A (A.2.D).The work control process includes provisions for multi-disciplinary reviews of work instructions and work packages, as well as operations review for impact on plant operating and Improved Technical Specification systems and equipment.

The work control process also determines post-maintenance testing requirements intended to ensure equipment returned to safety related service is operable following implementation of maintenance instructions and procedures.

The Work Control process is established with administrative controls intended to ensure maintenance does not inadvertently alter the plant design or configuration unless specifically authorized by the design change process as discussed herein.B.1.D.Operating Experience The RGB Operating Experience (OE)process is discussed in Attachment A (A.1.J).The OE process provides a means for RG8cE to compare Ginna-specific procedural methods against lessons-learned throughout the industry and also against generic safety concerns of the NRC.Some specific examples of events cited by OE for review at Ginna have been:~Boron Dilution J vents at PNb (INPO SOER 94-002, NRC IN 93-32)-RG&E reviewed the plant design and associated procedures to ensure the potential for over-dilution was llliilimized.

~Inadequate Testing of Emergency Diesel Generators (NRC IN 91-013)-RG8cE reviewed the EDG test procedures to determine if testing demonstrated operation at peak loading conditions.

The review resulted in a dynamic load study for the EDGs and a full load test at a representative power factor in 1992.IOCFR50.54(f)

Rcsponsct-Attachment 8 Final Rcpott Page 37 2/7/97 B.2.PROGRAMS/PROCESSES TO UPGRADE PROCEDURES B.2.A.Emergency Operating Procedure (EOP)Development Program In response to NUREG-0737, Item I.C.1, the Westinghouse Owners Group (WOG)developed Emergency Response Guidelines (ERGs)to serve as standard templates for the construction of plant-specific EOPs.RG&E initiated a program to develop plant-specific EOPs based upon the WOG guidelines.

The generation of effective symptom-based EOPs from these guidelines required a coordinated effort between engineering and operations to address aspects of plant operation that could not be satisfactorily resolved on a generic basis.The program was intended to ensure that the WOG ERGs would be effective with the specific plant configuration and design at Ginna Station.B.2.B.Calibration and Maintenance Procedure Upgrade Programs In the period 1989-1992, RG&E upgraded and enhanced the majority of the Ginna Maintenance and Calibration Procedures.

Among the objectives of these upgrade efforts were 1)to provide adequate detail to ensure maintenance and calibration were performed correctly, 2)to ensure the procedures reflect manufacturer's recommended maintenance practices or that departures from such practices were clearly identified and evaluated, 3)to incorporate limits and precautions needed to ensure compliance with UFSAR and Technical Specification requirements, and 4)for calibration procedures, to ensure the use of accurate setpoints and tolerances accounting for loop uncertainties.

Supplemental to this effort, RG&E also undertook to upgrade the control of Vendor Technical Manuals for plant equipment (C.l.L).B.2.C.Inservice Test (IST)Procedure Upgrade Program During NRC Inspection No.88-10, concerns were identified with RG&E's Inservice Pump and Valve Testing Program;specifically that the program did not comply with certain requirements of ASME Code Section XI, and that implementing procedures, in some cases, did not comply with the Program.RG&E initiated Corrective Action Report (CAR)1877 to identify the causes of these problems and to resolve them.The CAR found'that the problems were caused by 1)inadequate review of modifications affecting the IST Program, 2)a design basis functional review of all pumps and valves at Ginna Station to determine inclusion in the program, 3)lack of a comprehensive selection criteria for inclusion in the program, 4)lack of independent assessment of the program, 5)lack of detailed test specifications, and 6)misinterpretation of Code requirements.

The corrective actions included 1)a review of ASME Code Section XI requirements against plant equipment design and configuration, 2)a review of IST implementing procedures to identify discrepancies, augmented testing, maintenance, and inspections to enhance the IST Program, 3)a revised IST Program and procedures to resolve identified discrepancies, and 4)revisions to the plant change process to ensure future review for impact on the IST Program.In addition, responsibility of the IST Program was transferred to Engineering from Quality Assurance to enhance the coordination 10CFR50.54(f)

Response-Attachment D Final Repott Page 38 2l7i97

.f,i'W<~it.g,,

of the IST Program with proposed plant changes and to allow for independent assessment of the Program via future QA audits and surveillances.

As a result of the efforts under CAR 1877, the IST Program was enhanced, was brought into compliance with, and is maintained in compliance with license requirements and actual plant configuration and design.B.2.D.Procedure Validation to Improved Technical SpeciTications To support Ginna's conversion to Improved Technical Specifications (ITS)in February, 1996, RG&E conducted a review (using a team assembled from Operations, Mechanical Maintenance, Electrical Maintenance, Testing, Chemistry, and Reactor Engineering) to verify that procedures properly implement and reference the ITS.This review determined that approximately 1370 procedures would require changing (about 25%of the procedures reviewed).

As of December, 1996, 783 procedures have been revised (all those for which the ITS required major or minor changes to the procedural instructions and some reference changes).Those remaining to be revised (about 590)only require a reference change from old to Improved Technical Specifications; procedural guidance is not affected.These remaining 590 are being tracked to ensure proper close-out.(Note: a cross-reference between old and Improved Technical Specifications is contained within all controlled copies of the ITS.)B.2.E.RGdkE Response to Generic Letter 96-01 During the 1996 spring outage, a team was formed (with representation from Electrical Engineering, Nuclear Safety&Licensing, Instrumentation

&Control, Results&Test, and System Engineering) in response to NRC Generic Letter (GL)96-01, Testing of Safety-Related Logic Circuits, to identify and review procedures which implemented Improved Technical Specifications (ITS)Surveillance Requirements (SR)for safety-related logic circuits.This review compared electrical schematic drawings and logic diagrams to surveillance test (ST)procedures to ensure that the logic circuitry is adequately tested and that all SRs are satisfied.

Findings identified during the review were classified as Omissions, Deficiencies, Weaknesses, or Proactive Initiatives.

Omissions or Deficiencies indicated that the failure of an untested logic component could adversely affect a required safety function;Weaknesses or Proactive Initiatives could not adversely affect a required safety function.The findings were zero Omissions, 16 Deficiencies, 21 Weaknesses, and 7 Proactive Initiatives.

ACTION Reports were initiated to track the findings to resolution.

Prior to startup from the 1996 outage and prior to the affected component having to be operable,per the ITS, the 16 deficiencies were corrected via either permanent or temporary procedure changes, and the affected components were successfully tested.None of the affected components was found to be in a failed state.Based upon PORC's review of the ACTION Reports for the 16 10CFR50.54(f)

ResPonse-Attachment 8 Final Report Page 39 2/7/97

>v v deficiencies and their resulting recommendation, RG&E reported this event to the NRC in LER 96-005.n The Generic Letter concludes that the root cause for the findings was that personnel had assumed it was adequate to use industry-accepted methods for testing of safety-related logic circuits to meet ITS SR and that the need to test parallel circuits and multiple contacts was not recognized.

The specificity of GL 96-01, including examples for individual contacts, provided the clarification needed to identify the program deficiencies.

While precipitated by a weakness in the ST program, the substantial, thorough review and subsequent upgrade of ST procedures has left our ST program stronger than before and has given us additional confidence that our ST procedures confirm that equipment will perform according to the design bases.B.3.SAMPLING PROJECTS FOR RE UIREMENTS-TO-PROCEDURES B.3.A.UFSAR Review in accordance with NEI Guidelines RG&E elected to participate in NEI s 96-05 UFSAR pilot initiative (NEI Industry Initiative to Address Licensing Basis Conformance Issues)by reviewing 5 systems for UFSAR-to-procedure and UFSAR-to-plant accuracy and sampling 18 change processes.

The assessment is intended to determine the adequacy of the administrative controls currently in use for maintaining the licensing basis in order to identify missing or incorrectly applied programmatic elements that can lead to licensing basis differences.

The assessment consists of a three-tiered sampling data-gathering (data-gathering) phase, after which results are documented, and an evaluation phase: U~PSARS ii-i f I dp ffi (ii*p i y-I d'k significant systems in revision 13-1 of the UFSAR (Service Water, Containment, Auxiliary Feedwater, Spent Fuel Pool Cooling, and Off-Site Power)by cognizant individuals from Nuclear Engineering Services and Operations/Performance Testing.to determine if the.UFSAR statements are accurate with respect to operational practices.

~Pro rammatic Sam lin-a review of a sample of completed or in process changes to determine if existing controls within the various change process programs (drawing changes, modifications, procedure changes, etc.)are adequate to maintain conformance between operational practices/configurations and the UFSAR.~Non-Pro rammatic Sam lin-a review of a sample of other items to determine if any potential changes in design basis or operational practices may occur that are not properly documented in approved change control programs.This area included such items as;10CFR50.54(f)

Rcsponsc-Attaetmtent 8 Final Report Pago 40 2/7/97 4;k'~es 4~-e~s,*e 1 operator work-arounds, equipment being operated in manual, and long-standing equipment isolations.

~Evaluation

-to determine the significance of identified differences.

A process for determining safety significance is built into the UFSAR evaluation phase.Its cornerstone is a review by two individuals with Senior Reactor Operator (SRO)experience using the following guidance for safety significance screening from NUMARC 90-12, Design Basis Program Guidelines:

0 Does the discrepancy appear to adversely impact a system or component explicitly listed in Technical Specifications?

0 Does the discrepancy appear to compromise the capability of a system or component to perform as described in the Safety Analysis Report?0 Does the discrepancy appear to adversely impact any applicable licensing commitments?

Significant findings or findings of indeterminate significance become ACTION Reports, the processing of which includes an operability review and a reportability review.Differences are being categorized in order to draw conclusions about the adequacy of particular programmatic controls for maintaining the licensing basis (for enhancement recommendations).

To date, the review has checked approximately 1260 statements and resulted in approximately 290 net identified differences (a number of these being duplicated differences).

Of the differences, 96%were of low significance and were categorized as nclarificationsn (72%), nUFSAR not updated" (14%), or nUFSAR update incomplete" (14%).The clarifications were generally a result of the recent practice of placing increased emphasis on the detail in the UFSAR and the more general nature of original UFSAR statements.

The lack of, or incomplete, updates to the UFSAR can be attributed to the number of scattered locations that items appear in various sections.The remaining 4%of the differences resulted in a more in-depth evaluation in accordance with the corrective action process (6 ACTION reports), and these were determined not to involve a condition that was outside the design basis of the plant.The review of the Programmatic and Non-Programmatic sampling involved approximately 130 individual change process packages or items from 18 change processes.

Of these, there were 13 differences, and they were determined to be of low safety significance.

The UFSAR assessment has shown that the plant and procedures are in general agreement with the plant design basis, although there are some minor inconsistencies that are of a low safety significance.

Actions to address these inconsistencies are in section ("f')of the summary report.10CFR50.54(f)

Response-Attachment 8 Final Report Pape 41 2/7i97 4~

B.3.B.UFSAR-to-Procedures Review An RG8cE Corrective Action Analyst is performing a comprehensive review of the UFSAR for UFSAR-to-procedure accuracy.The analysis of the UFSAR statements containing information which appeared to require incorporation in plant procedures is approximately 20%complete (60 of the 300 statements).

Preliminary results have shown that, to date, 100%of the statements were incorporated into appropriate procedures, but that there are no explicit tracking mechanisms that would prevent a statement or procedure from being deleted (one statement was found in a now deleted procedure).

Actions to address this process weakness are described in section ('T')of the summary report.B.3.C.'adiation Protection Group Review of UFSAR The Ginna Radiation Protection (RP)group recently completed a review of the UFSAR with specific focus on equipment configuration and procedures affecting plant RP activities.

The review identified 84 separate differences between the UFSAR text and the actual configuration and/or procedural guidance for RP-related activities at Ginna.Many of the differences identified were incorrect document references that resulted from moving off-site dose requirements from the Technical Specifications to the Off-site Dose Calculation Manual (ODCM), as a result of the recently implemented ITS.Others involved station facilities abandoned (e.g., the laundry)or added (e.g., the Resin Storage Area).However, none of the identified differences represented a significant non-conforming condition or degradation of the safe function of plant systems, and no design basis deficiencies were identified during this review.Many of the discrepancies were resolved in the December, 1996, Revision 13 to the UFSAR.The remainder are under evaluation and will be resolved by our normal UFSAR review and corrective action process.B.3.D.On-Going Commitment Sampling Programs Nuclear Safety&Licensing undertook an initiative to review a sample of on-going commitments.

The sample showed that such commitments were reflected in our procedures; however, it also showed that the commitment tracking and/or procedure control process(es) should be strengthened to ensure that procedure revisions do not inadvertently alter the links to commitments.

IOCFRSO.S4(f)

Rcaponsc-Attachment 8 Final Rcport Page 42 2/787 A g'a>*4'~I~1 I B.4.TRAINING AND TRAINING CONFIGURATION MANAGEMENT The processes for, and extent of, personnel training at Ginna is discussed in Attachment A (A.3).The Nuclear Training Department has developed and is implementing administrative configuration management processes intended to ensure training materials and modules are kept current with plant actual configuration and operation.

Ginna Station has constructed and operates a stand-alone control room simulator for the training of plant licensed operators.

RG&E has also used the Ginna simulator to assist in the validation of new procedures (e.g., the Emergency Operating Procedures).

10CFR50.54(Q Rcsponsc-Attaclnncnt 8 Final Rcport Page 43 2/787 C, J I.e lH*t Ip)Yll~'e)l e ,)(sF~~~asw IOCFR50.54(f)

RESPONSE ATTACHMENT C (c)Rationale for concluding that system, structure, and component configuration and performance are consistent with the design bases.NOTE: THIS ATTACHMENT IS SUPPORTING DOCUMENTATION THAT IS TO BE READ IN CONJUNCTION WITH ITS CORRESPONDING SECTION IN THE

SUMMARY

REPORT.IT IS NOT A STAND-ALONE DOCUMENT.This Attachment is organized as follows: C.l.ON-GOING PR RAM THAT ENS CONFI URATION AND PERFORMANCE ARE CONSISTENT WITH DESIGN BASES C.l.A.Operations Safeguards Systems Verification Program C.l.B.Surveillance Test Program C.l.C.Preventive Maintenance and Trending Program C.l.D.Safety Classification Program C.l.E.Electrical Load Growth Control Program C.l.F.Environmental Qualification Program (10CFR50.49)

C.l.G.Appendix R Fire Protection Program C.l.H.Transient Monitoring Program C.l.I.Heavy Loads Program C.l.J.Motor Operated Valve (MOV)Program C.l.K.Nuclear Fuels Reload Analyses C.l.L.Vendor Technical Manual Program C.2.PROJECT EFFORTS WHICH HAVE ENHANCED PLANT CONFIGURATION ONSISTENCY WITH DESIGN BASES C.2.A.Improved Technical Specifications (ITS)Project C.2.B.Systematic Evaluation Program (SEP)C.2.C.Instrument Setpoint Verification Project C.2.D.Piping&Instrumentation Drawing (P&ID)Upgrade Project C.2.E.Electrical Controlled Configuration Drawing (ECCD)Upgrade Project C.2.F.Station Blackout Project C.2.G.DC Fuse Coordination Study C.2.H.Seismic Upgrade Program C.2.I.Seismic Qualification Project C.2.J.T, Reduction/18 Month Fuel Cycle Accident Analysis C.2.K.Service Water (SW)System Generic Letter 89-13 Response C.2.L.Steam Generator Replacement Project (SGRP)C.2.M.Instrument Air (IA)System Review C.2.N.OF-site Power Upgrade 10CFR50.54(f)

Rcsponsc-Attachrncnt C Final Rcport Page 44 2/7/97 4 t I\l~it@0-e 4 I~I P'I"'(

C.2.0.Spent Fuel Pool (SFP)Cooling System Upgrade C.2.P;Containment Isolation System Review C.2.Q.Steam Generator Advanced Digital Feedwater Control System ADFCS Installation C.2.R.Microprocessor Rod Position Indication (MRPI)Installation C.2.S.Anticipated Transient Without SCRAM (ATWS)Mitigation System and Actuation Circuitry (AMSAC)Upgrade C.2.T.Standby Auxiliary Feedwater (SAFW)System Addition C.3.IN PE TIONS THAT ASSIST IN MAINTAINING FIELD CONFIGURATION CONSISTENT WITH DESIGN BASES C.3.A.System Engineer (SE)Walkdowns C.3.B.System Engineering Performance Monitoring Program C.3.C.Shift Technical Advisor/Staff Inspections

'.4.TRAINING AND TRAINlNG CONFIGURATION MANAGEMENT C.1.ON-GOING PROGRAMS THAT ENSURE CONFIGURATION AND PERFORMANCE ARE CONSISTENT WITH DESIGN BASES C.i.A.Operations Safeguar'ds Systems Verification Program Operations performs periodic verifications of safeguards systems configuration (via the S-30 series of procedures and 0-6.13, Daily Surveillance Log)intended to ensure that the valve, breaker, and instrumentation alignments of the major flowpaths needed for system operation are undisturbed.

C.1.B.Surveillance Test Program The surveillance test program is intended to ensure equipment operability in accordance with its design bases.Surveillances listed in Improved Technical Specifications (ITS)and the Technical Requirements Manual (TRM)are performed at specified frequencies.

Pumps and valves meeting the Inservice Testing (IST)Program selection criteria are tested as required.Pumps are monitored for degradation per ASME code commitments as reflected in IST Program requirements.

Acceptance criteria from the ITS or TRM are incorporated into the associated test procedures.

Determination of whether equipment is operable/operative is based on design basis requirements or ASME Code allowable limits, whichever is more restrictive.

As an enhancement, acceptance criteria bases are currently being incorporated directly into the test procedures, after being researched, documented, and reviewed by test supervisors and the IST 10CFR50.$4(l)Rcsponsc-Attachrncnt C Final Rcport Page 45 2/787 0 t h s',yw CI J e~o gi, l M"II-'%F,i'I~

Engineer.Test procedures are updated when plant modifications, design basis changes, or ASME code mandated changes occur.C.1.C.Preventive Maintenance and Trending Program The PM programs at Ginna use a Reliability Centered Maintenance (RCM)approach.The equipment included in the program and the PM frequencies selected are based upon input from various sources including Technical Specifications, the EQ Program, regulatory commitments, equipment operating conditions, engineering recommendations, and, maintenance history trends.The purpose of RCM is to focus resources on critical equipment by evaluating the criticality of a failure, after performing a Failure Modes and EfFects Analysis.The PM programs are established to monitor and maintain critical plant equipment such that, in-service failures are minimized and performance reliability is enhanced (run-to-failure is allowed for non-critical equipment).

Thus, equipment important to the safe operation of Ginna is better assured to be available when required.The PM programs at Ginna include rotating mechanical equipment, heating, ventilating, and air conditioning (HVAC)equipment, valves, electrical equipment, heat exchangers, environmentally qualified (EQ)equipment, and instrumentation and control equipment.

Types of maintenance performed include predictive (vibration analysis, oil analysis, thermography, acoustic monitoring, hipot testing, meggering, and surge testing), preventive time directed tasks (clean and inspect, lubricate), calibrations, surveillance tests, functional tests, and walkdown inspections.

Trending of PM data is intended to identify adverse trends in performance prior to a component not meeting its design requirements.

Trending of PM data has resulted in identifying and correcting numerous equipment problems.For example, vibration analysis helped to remedy several problems associated with pumps (safety injection, auxiliary feedwater, service water, charging)and fans (containment recirculating fans, bus duct cooler fans).Oil analysis has helped to identify problems with motors (condensate, feedwater, service water), the emergency diesel generators, the electro-hydraulic control system (high particulates), and air compressors.

Thermography has identified and permitted elimination of problems with valve seat leakage, station service transformer hot connections, equipment coupling alignment, and steam trap blow-by.Trending of.instrumentation and control equipment calibration data has resulted in replacement of instruments that have shown an adverse trend (prior to failure or loss of function).

C.1.D.Safety ClassiTication Program In 1991, RG&E initiated the Plant Equipment Safety Classification (Q-List)Project to confirm, document, and make available for easy use in implementing plant processes (e.g., maintenance and procurement) the identity and functional classification of plant components which perform safety-related design functions.

The process utilized at Ginna was similar to that described in EPRI NP-6895, Guidelines for the Safety Classification of Systems, 10CFRSO.S4(f)

Response-Attaclrrncnt C Final Report Page 46 2f187 4 5 I hj i~f f'AMO'A~a t~V I*44/ll~J s.A rt li~P 5"~'is~I'f~c>.<s Components, and Parts Used in Nuclear Power Plant Applications (NCIG-I 7), with the functional boundary and system safety criteria described in ANSVANS-51.1-1983, Nuclear Safety Criteria For The Design Of Stationary Pressurized 8'ater Reactor Plants.Specifically, plant system and structure safety classifications were based upon design functions performed while preventing or mitigating the consequences of the design basis and special events described in Chapter 15 of the UFSAR.Each system and structure was linked to the primary or auxiliary functions which they must accomplish to achieve the desired safety function.Plant systems were then examined to determine system functional boundaries.

This was intended to ensure that the devices necessary to achieve a system's nuclear safety functions were identified and accounted for.AAer the functional boundaries were established, the systems were analyzed to account for the specific contributions of the individual components.

Careful accounting of the relationship between the accidents, transients, and events detailed in the licensing basis and the plant system and component functions provides assurance that the plant configuration is managed consistent with the design basis.Review and update of safety classifications has been integrated into various plant processes including plant modifications, procurement (especially for components and parts), and maintenance planning.EP-2-P-114, Component Safety Classification, defines the process to add or change the safety classification of components.

C.1.E.Electrical Load Growth Control Program The purpose of the Electrical Load Growth Control Program is to ensure that acceptable levels of margin are'maintained on the electrical distribution system power supplies (both AC and DC).EP-3-P-504, Load Growth Control, provides instructions for monitoring the cumulative efFects of load changes on Ginna Station load centers and revising impacted design analyses when predetermined margins are reached.A Design Engineer performing a modification that impacts electrical loading provides detailed information regarding the load change including the load center impacted, the specific loads changed, the upstream power source, the type of change, magnitude of loading change, the mode in which equipment is to be operated (during ESF actuation, station blackout, etc.), and the expected in-service date of the modification.

The load coordinator reviews this information and assesses the impact.The load coordinator also,assesses,the impact, of multiple, load additions that can occur over the long term.If the cumulative load change reaches specified margins, then any applicable electrical analyses are revised.The program is also intended to ensure that appropriate actions are taken should any load center approach its design limits.The Electrical Load Growth Control Program is intended to ensure that modifications will not result in power supply loadings exceeding their design limits.This is intended to ensure that the design basis requirements of the distribution system are not degraded.The Load Growth Control Program monitors load additions on both safety-related and non-safety-related power supplies.10CFR50.54(f)

Response-Attachment C Final Rqert Page 47 2/7/97 P<0 I)r A r p rg" C.1.F.Environmental QualiTication Program (10CFR50.49)

The EQ program has been established per the requirements of 10CFR50.49.

The program is intended to ensure that a harsh environment, resulting from a postulated accident, will not be a common cause of equipment failure for electrical equipment needed to cope with that accident.The EQ program evaluated systems needed to support the Ginna accident analyses (UFSAR, Chapter 15)to identify equipment/parts of those systems which were subject to a harsh environment and were needed to mitigate those accidents.

System electrical equipment was included in the EQ Program, if failure due to harsh environmental conditions would cause loss of the safety function and if the equipment is susceptible to accelerated degradation/failure when exposed to a harsh environment.

Equipment-specific program records are maintained which demonstrate acceptable equipment performance under harsh environments.

Such records include vendor qualification files, maintenance history files, and files of spare qualified equipment for future use.EQ program requirements are documented in ND-EQP, Environmental Qualification Program, and are implemented through a group of related procedures, specifications, and a set of diagrams.These include procedural requirements for such activities as plant modifications, maintenance and work planning, and parts procurement.

C.1.G.Fire Protection Program and 10CFR50, Appendix R Requirements for the Appendix R and Fire Protection (FP)Program are documented in ND-FPP, Fire Protection Program.This program maintains configuration control of equipment necessary to mitigate the consequences of fires by ensuring that:~Installed plant FP systems are properly tested and maintained,'V~FP system impairments are reviewed and necessary compensatory measures are-implemented,~Plant fire barriers are maintained in acceptable configurations,~Existing plant FP program components, fire response plans and procedures, and designated safe shutdown systems and strategies are not adversely affected by modification activities,~Welding, burning or cutting activities are adequately controlled to minimize the potential for a fire and IOCFR50.54(f)

Response-Attachment C Final RcPert Page 4$2/7/97 4 H 4 b e.g~A r I yl 1'

~Fire protection features are provided, and that safe shutdown can be achieved and maintained, in a manner consistent with the requirements of Section III.G, J, and 0 of Appendix R.C.i.H.Transient Monitoring Program Improved Technical Specifications require a program to track reactor coolant system design transients.

This includes ITS/UFSAR design bases transients such as plant heatup and cooldown, step load changes, reactor trip, and primary hydrostatic tests, as well as fifteen: other transients of interest.The purpose of the program is intended to ensure that ASME class 1 components are operated within their cyclic design bases.A transient log is maintained on a day-to-day basis by the Reactor Engineer and:totals are tabulated and reported to=management periodically.

C.i.I.Heavy Loads Program The heavy loads program (the A-1305 series of procedures) is a program to control equipment and procedures involved in carrying loads greater than 1500 pounds over safety-related equipment.

It was developed and implemented as a result of Generic Letter 81-07.The program consists of 1)safe load paths for overhead cranes, 2)administrative requirements for jib cranes, the bridge cranes over the refueling cavity and the spent fuel pool, monorails over safety-related equipment, and special instructions when rigging to existing , building structures where overhead handling systems cannot be utilized, 3)crane and lifting equipment condition inspections (performed on a scheduled basis using controlled procedures by qualified personnel), 4)training of mechanical maintenance personnel, and 5)PORC approval of certain heavy load lifts per A-1305.5, Control of Heavy Loads in Safety-Relaled Areas.(Note: the Technical Requirements Manual (TRM)also contains some heavy load requirements for the Spent Fuel Pool.)C.1.J.Motor Operated Valve (MOV)Program In response to on-going concerns from the NRC (e.g., Bulletin 86-05, GL 89-10 and supplements, GL 95-07, GL 96-05)regarding performance of MOVs, RGB'stablished the MOV Qualification Program.This program establishes the technical, operational, periodic inspection/testing and administrative requirements needed to ensure the reliable operation of applicable MOVs.The program establishes the design basis function of each MOV based upon review of accident analyses, normal and abnormal operation, and emergency operating procedures.

With proper consideration of valve physical limits, thermal binding, pressure locking, and electrical supply degradation (reduced voltage), MOV operator setpoints for travel limits and torque switches are established to ensure performance of design basis functions.

Appropriate maintenance and functional testing are specified to ensure that actual configuration is in accordance with the design basis for each MOV in the program.Testing 10CFR50.54(Q Responso-Attachment C Final Report Pago 49 2f7/97

~ll~Wa44 g.-"Q*4i,", n~s"',~,l<,

results are fed back to Engineering for confirmation of design basis assumptions and performance trending.An NRC inspection in August, 1996, determined that RG&E did not properly incorporate relevant industry feedback into its MOV program, and thus certain'valve factors used in the program apparently were not set conservatively.

RG&E performed extensive corrective action, including completion of a Human Performance Enhancement System (HPES)investigation, recalculation of available thrust and margins for all MOVs in the program, and development of a MOV Program Manual with all necessary MOV data in accessible form, using currently acceptable methodology.

These efforts, combined with our continued active participation in industry forums related to MOVs, give us assurance that MOVs will operate when needed during normal operations and to mitigate design transients/accidents.

C.1.K.Nuclear Fuels Reload Analyses After a contract for fuel has been signed, the vendor and RG&E develop the plant-specific input data (e.g., pressurizer volume, pump flows, etc.)necessary to do the accident analysis.The most important parameters are captured in Table 1 of the COLR and the Improved Technical Specifications.

Based on core design experience, bounding cor'e parameters (e.g., moderator temperature coefficient (MTC), rod worth, peaking factors, etc.)are assumed.The range of these parameters is intended to be large enough to bound any future loading pattern specific parameters.

The accident analysis is then done using the plant-specific input and bounding core parameters.

The results of the analysis are summarized and submitted to RG&E for review and approval.This summary becomes the basis of a Safety Evaluation for the accident analysis and follows the normal RG&E review and approval process for Safety Evaluations.

For a specific reload, Ginna determines the energy required based on outage date, cycle length, and assumed capacity factor.The vendor then designs a loading pattern that produces the required energy and is bounded by the core parameters assumed in the accident analysis.The comparison of parameters is documented in the Westinghouse Reload Safety Analysis Checklist (RSAC)which is sent to RG&E for comment.A review is then made of the accidents comprising the licensing bases which could potentially be affected by the fuel reload.This is documented in the cycle specific Reload Safety Evaluation (RSE).The RSE becomes the major portion of the basis of a Safety Review/Safety Evaluation for the specific cycle.Plant procedure changes based on the Safety Review/Evaluation and specific core parameters are then initiated by the Reactor Engineer.C.i.L.Vendor Technical Manual Program Vendor Technical Manuals (VTMs)typically form a portion of the engineering bases for operating and maintaining equipment and are referenced for design changes, procurement, and modifications.

In the 1990-1993 timeframe, RG&E implemented a project to: 10CFR50.54(f)

Rcsponsc-Attachment C Final RePcrt Page 50 2/7/97 0"I E4rbQ," I I'C%I%4 1 C Pl (g I'I 1.Establish a baseline of technically correct VTMs for plant equipment 2.Develop clear and concise procedures to maintain control of the baselined VTMs and to process new and revised VTMs due to plant modifications.

3.Provide a controlled method of cross-referencing between equipment in the plant and VTMs.At the completion of the initial VTM Project, the on-going program to maintain control of VTMs was proceduralized (currently in EP-2-P-110, Vendor Technical Document Control Process).This procedure includes requirements for processing changes to the VTMs, performing engineering and technical reviews of new and revised VTMs, and cross-referencing VTMs to plant equipment (via Equipment Identification Number)in RG&E's Configuration Management Information System (CMIS).In addition, requirements for periodic (typically biennial)contact with safety-related equipment vendors is established via EP-2-S-900, Vendor Technical Manuals Periodic Vendor Contact.C.2.PROJECT EFFORTS WHICH HAVE ENHANCED PLANT CONFIGURATION CONSISTENCY WITH DESIGN BASES C.2.A.Improved Technical SpeciTications (ITS)Project The ITS Project replaced the previous Ginna Station"custom" Technical Specifications with the new industry standard.Ginna Station was the first Westinghouse plant to convert to, and actually implement, the new ITS.This was a very large project with significant multi-disciplined involvement within RG&E such that over 20,000 man hours were expended in the development and implementation of ITS.In 1995, a change to 10CFR50.36 specified four criteria for what must be contained within the Limiting Conditions for Operations (LCOs)of a licensee's Technical Specifications.

These criteria were used in the development of revised standard Technical Specifications for the industry (NUREG-1431) which, then formed the starting point for the Ginna Station ITS.The ITS contain LCOs which control the most important equipment and assumptions of the accident analysis for design basis accidents.

It was imperative that the ITS match the accident analysis assumptions.

Therefore, all NRC Safety Evaluations on the Ginna docket, a major portion of the licensing basis for Ginna, were identified and key word indexed.Also, Table 1 of the COLR was developed to identify and control the most significant equipment performance features and parameters used in the UFSAR accident analysis.NUREG-1431 and COLR Table 1 were used to identify specific equipment requirements to be placed within the ITS LCOs and bases.10CFR50.54(f)

Response-Attachment C Final Report Pat,c 51 2l7/97 "4A'J I/gal'pj" k~H t'fl4Je%V~-t,iP sa$',st t~,~L l 4f~Nl A W 1 P~$

The draft LCOs and bases were then reviewed in detail by a Shift Supervisor, Licensed Operator Instructor, and PORC member, all dedicated to the project.Additional reviewers were also used as necessary, including Westinghouse (for reactor power distribution limits and reactivity control requirements) and a NSARB subcommittee composed of three NSARB members.The final package was then presented chapter by chapter to PORC for approval.The NSARB was involved in oversight of the process, and QA performed audits intended to ensure the thoroughness of review prior to ITS implementation.

As part of ITS implementation, RG&E identified required procedure changes.In addition, an electronic search and update of the UFSAR was performed.

UFSAR deficiencies regarding nomenclature and other historical information related to the Improved Technical Specifications were identified and were corrected in the UFSAR update following the ITS implementation.

The ITS Project consolidated much of the Ginna licensing basis.Significant multi-disciplined review was performed to ensure this consolidated basis matched the actual configuration of the plant.C.2.B.Systematic Evaluation Program (SEP)The NRC undertook a major reassessment of the Ginna design and licensing basis through its SEP review.SEP was initiated by the NRC in 1977 to review the designs of early-licensed plants to reconfirm and document their safety.The SEP provided 1)an assessment of the significance of differences between the then-current NRC technical positions on safety issues and the design bases of the plant, 2)a basis for NRC decisions regarding resolution of those differences, and 3)a documented NRC evaluation of plant safety.The review spanned five years, with the final report (NUI&G-0821) being issued in 1982.SEP considered over 800 different topics for review.These were consolidated into 137 topics for more detailed review.After considering topics being reviewed under other generic programs (such as NUREG-0737 and NUIKG-0933), 92 issues were selected for detailed SEP review.These design basis reviews included such topics as seismic design criteria, high energy line breaks inside and outside containment, configuration of containment isolation valves, design basis flooding and tornadoes, safety classification, design codes, reliability of residual heat removal (RHR)and emergency core cooling system (ECCS)systems, containment design, internal flooding, systems required for safe shutdown, loading of diesel generators and batteries, spent fuel storage, and capacity of ventilation systems.All of these topical areas were reviewed against the Standard Review Plan, and a summary of differences and their safety significance were identified in the Safety Evaluation Report.Decisions on backfitting were made during the Integrated Assessment phase of the program, using the principles of 10CFR50.109, engineering judgment, and limited probabilistic risk assessment techniques.

Resultant modifications were made to hardware, procedures, and engineering programs, including seismic and tornado protection, electrical penetration circuit 10CFRSO.S4(t)

Rcsponsc-Attachment C Final Rcport Page S2 2/7/97 AC~~, V~~tv-*0>.'t~I Wl 0 k protection, inservice inspection of structures, high energy line break protection, and addition of selected items into the Technical Specifications.

C.2.C.Instrument Setpoint Verification Project The Instrument Setpoint Verification Project was intended to establish the design basis and ensure the adequacy of existing setpoints and calibration values for important plant instrument and control loops.The scope of the project included groupings of similar safety-related instrumentation and controls and safety significant instrumentation required to verify compliance with Technical Specifications.

In addition, the project also reviewed.setpoints not directly related to Technical Specifications, e.g., the EOP operator action points and recommended limits within plant operating procedures.

Findings resulting from the Setpoint Verification Project have been reviewed for immediate safety significance and potential impact on operability under the applicable corrective action program and identified for future resolution under RG&E EWR 10300.C.2.D.Piping 8t, Instrumentation Drawing (PEcID)Upgrade Project The Ginna P&ID Piping and Instrumentation Drawing Upgrade project was intended to ensure that the P&ID drawings reflected the plant system design basis, including safety class boundaries, system configuration and alignment, component identification, system functional capability, system component interaction, and procedural requirements.

The approximately 190 drawings were walked down in the field, reviewed by Engineering for consistency with intended operating and safety functions, and then sent to the original A/E (Gilbert-Commonwealth) for confirmation of original safety class boundary locations and notation of the applicable line specifications.

In addition, a mechanical equipment database with detailed component and configuration information was developed and eventually became the base mechanical information in the RG&E's Configuration Management Information System (CMIS).Over 1200 generic and specific issues were identified over the'course of the project.All but one issue has been dispositioned.

That issue has been reviewed for immediate safety significance and potential impact on operability through the corrective action program, was found to be of low safety significance, and has been identified for future resolution.

The P&IDs are maintained as Controlled Configuration Drawings.10CFR50.54(f)

Response-Attachment C Final Report Page 53 2/l/97 p EA t~~

C.2.E.Electrical Controlled Configuration Drawing (ECCD)Upgrade Project Approximately 3200 Electrical Controlled Configuration Drawings were produced and/or revised during the ECCD project.The project goals were 1)to verify the technical accuracy of the drawings via engineering review of design and function as well as field walk-downs and 2)to enhance their usefulness by changing their format.Areas walked down included the main control board, relay and instrument racks, motor control centers, and bus units.In addition, detailed field walkdown information, equipment and component data, and configuration information was compiled and eventually became the base electrical information in the RG8:E's Configuration Management Information System (CMIS).C.2.F.Station Blackout Project 10CFR50.63, Loss of All Alternating Current Power, is considered a beyond original design basis accident.This regulation (further explained in Regulatory Guide 1.155)requires that each light-water cooled nuclear power plant be able to withstand, by maintaining core cooling and appropriate containment integrity, and recover from a station blackout (SBO)of a specified duration.The term SBO refers to the complete loss of AC power to the essential and non-essential switchgear buses in a nuclear power plant.Ginna's SBO analysis, EWR 4520, documents the strategies and their bases by which the station complies with 10CFR50.63.

A summary of EWR 4520 is found in the UFSAR, section 8.4.1.4.C.2.G.DC Fuse Coordination Study The entire DC distribution system was reviewed under EWR-3341, DC System Evaluation.

Under the scope of this project the system design was validated and the process for maintaining control of the design was implemented.

The following items were developed to both verify the acceptability of the existing design and to establish controls intended to ensure the design is maintained in the future:~Engineering Specification EE-100, Fuse Requirements

~Control Configuration Drawing Series for DC System~Design Analyses to evaluate specific design attributes of the DC distribution system.The design controls implemented for the DC Fuse Coordination Study are intended to ensure that the DC distribution system maintains its design basis configuration and that it will be able to perform its design functions.

10CFR50.54(0 Response-Attachment C Final Rcport Page 54 2/7/97 e I4 IC g C.2.H.Seismic Upgrade Program Between 1979 and 1990, RG&E performed a reanalysis and modification of critical seismic piping systems.This Seismic Upgrade Program was a voluntary initiative which was a result of issues arising from NRC Bulletins 79-02 and 79-14, as well as the NRC's Systematic Evaluation Program (SEP), Topics III-6 and III-11.-The purpose of the Seismic Upgrade Program was to upgrade certain seismic piping systems at Ginna Station to more current requirements and to provide a seismic database for use with modifications, the ISI program, and NRC requests.Analytical techniques and computer models at the time of the Seismic Upgrade Program had improved considerably compared to what was available at the time of plant construction.

Floor response spectra were developed for major floor elevations in affected buildings, using then-current NRC criteria.Piping was analyzed using criteria consistent with the philosophy of the original construction code, but reflecting the concepts of ASME Section III.Pipe supports were evaluated using the requirements of ASME Section III, Subsection NF.This extensive effort brought the seismic capability of critical piping systems to a level consistent with newer plants.C.2.I.Seismic QualiTication Project The Seismic Qualification Utility Group (SQUG)initiated a program to address Unresolved Safety Issue (USI)A-46, which deals with seismic qualification of electrical and mechanical equipment.

The concern was that equipment installed in older plants had not been reviewed to the (then current)1980-81 seismic qualification licensing criteria.In-scope equipment at Ginna was walked down, inspected, and evaluated in accordance with the SQUG Generic Implementation Procedure (GIP).The resulting evaluations were entered in a database.Outliers to the GIP"rules" were documented and evaluated before the Ginna SQUG submittal went to the NRC (on February 1, 1997).Outliers will be dispositioned, in accordance with our current corrective action procedures.

A schedule for disposition has been provided in the RG&E SQUG submittal.

The intent of this project is to upgrade the seismic qualification design basis for selected equipment to the SQUG GIP.This will 1)result in a consistent qualification basis for equipment on the Ginna Safe Shutdown Equipment List and 2)provide for the use of the SQUG GIP for verification of seismic adequacy when procuring new and replacement, equipment (the Seismic Equipment Qualification program).Seismic qualifications are primarily controlled through the Change Impact Evaluation form, which screens potential modifications for seismic review.IOCFRSO.S4(f)

Response-Attaclnncnt C Final Rqert Page SS 2/7/97

~'V ll.ski~i I!~Vf~

C.2.J.T,, Reduction/18 Month Fuel Cycle Accident Analysis In order to take appropriate advantage of the improved heat transfer capability and enhanced reliability of the Ginna Replacement Steam'enerators, RG&E undertook efforts to support operation of the Reactor Coolant System at a reduced temperature (to impede corrosion mechanisms) and to support a fuel load design capable of 18 months full power operation between reloads.The T, reduction/18 month fuel cycle/UFSAR Chapter 15 reanalysis reestablished the accident analysis design basis for Ginna.The effort involved reconstituting the accident analysis input data and assumptions.

Westinghouse requested plant-specific input data.RG&E supplied the requested information based on equipment performance, Ginna configuration, drawings, and limiting operating parameters.

By contract, Westinghouse supplied copies of calculation notes, microfiche of the Loss of Coolant Accident (LOCA)computer runs, and input files to the computer code (LOFTRAN).

A review of the analysis and associated calculation notes shows how the analysis was performed, how the inputs were used, and what assumptions were made.The major inputs in the accident analysis design basis are now documented in the Core Operating Limits Report (COLR)to provide greater visibility to the inputs used.This information allows RG&E to better understand the accident design basis and assess when equipment performance or operating practices might infringe on the accident design basis.C.2.K.Service Water (SW)System Generic Letter 89-13 Response Generic Letter 89-13 specified a series of actions to ensure the acceptable performance of plant SW Systems.These included a confirmation that the SW system is capable of fulfilling its design basis function, enhanced maintenance to prevent degradation of the configuration, and testing to demonstrate performance.

In response to GL 89-13, RG&E developed the SW System Reliability Optimization Program (SWSROP).In 1991, the NRC conducted a SW System Operational Performance Inspection (SWSOPI)at Ginna.A majority of the team's findings were associated with the need for confirmatory analyses to assure conformance with the design bases of the SW system.In response, RG&E embarked upon an effort of combined analyses and testing to resolve the concerns raised.Based upon these efforts, RG&E has determined that there is reasonable assurance that the UFSAR reflects the design bases of the SW system and the current SW system configuration.

This determination is supported by RG&E's recent evaluation of the UFSAR.Specifically, RG&E selected the SW system for the NEI pilot initiative regarding UFSAR fidelity, as discussed elsewhere within this document.Although many clarifications were needed, only one potential difference resulted in the need for a more in-depth evaluation, and this was determined to not involve a condition that was outside the design bases of the plant.This potential difference, regarding the minimum required number of SW pumps, was first identified during the SWSOPI, and resolution is currently under review by the NRC.Additionally, RG&E has reviewed heat exchanger test data and performed final calculations which favorably compared performance to requirements.

lOCFR50.54(f)

Response-Attachment C Final Rcport Page 56 2/7/97

~1 v l1 I j A II l t l 4 4~4 F' C.2.L.Steam Generator Replacement Project (SGRP)In the Spring of 1996, Ginna Station replaced steam generators (S/Gs).Design and planning for this replacement began in 1992 and continued through the Spring, 1996, Outage.In the course of designing the replacement S/Gs (RS/Gs)and planning their installation, the SGRP retrieved the design bases for several aspects of the plant.Tasks of significance to design, basis verification included:~RS/G Fabrication and Safet Evaluation

-As a part of this efFort, it was necessary to retrieve the design basis for the steam generators to assure a like-in-kind replacement.

Further, aspects of the Reactor Coolant System (RCS)and overall plant performance with respect to licensing accident analysis was evaluated to assure no adverse efFect on plant safety as a result of S/G replacement.

RG&E elected to submit a supplemental UFSAR revision in July, 1996 to incorporate significant changes that resulted from the SGRP.~Installation and Construction

-In order to install the RS/Gs, it was necessary to cut large construction openings in the top of the containment dome.Many aspects of the containment design basis were retrieved to develop design criteria for the work.Following S/G replacement, a full pressure structural integrity test was performed on the restored containment.

The test acceptance criteria were met.~Emer in Outa e Issues-Vibrations from cutting the construction openings in the containment dome loosened some of the hangers supporting the Containment Spray (CS)system headers on the interior of the dome;consequently, the SGRP personnel reviewed the structural design basis of the CS system headers.In the process of repairing this damage, RG&E discovered that the header configuration (piping support welds, plates, bolts, and spacers)did not meet the configuration depicted on the system and component drawings.(The CS headers had not been accessible for detailed configuration verification prior to S/G replacement.)

This discovery led RG&E to perform a configuration walkdown of the headers and to compare the as-found configuration with that used in the structural analyses of the headers.Analyses were performed that demonstrated that the as-found configuration did meet the acceptance criteria and therefore was consistent with the headers'esign bases.C.2.M.Instrument Air (IA)System Review In response to NRC GL 88-14, RG&E retrieved the design bases for the IA system, tested the system to demonstrate critical design requirements, and conducted an IA System Functional Inspection reviewing maintenance practices, alarm response procedures, emergency procedures, and training.Through these efForts, RG&E was able to verify that the IA system was reliably delivering enough high quality air to loads to make system design consistent with the original design specifications and requirements.

10CFRSO.S4(f)

Rerponsc-Attachment C Final Report Page S7 2/787 N ,V if 4 t e l~n),p 0'p,<>i<~5w4+y A4 C.2.¹Off-site Power Upgrade Ginna Station was originally licensed based upon an off-site power supply system with a single transformer plus the ability to establish a backfeed through the auxiliary transformer.

Specifically, failure of the 12A transformer required reliance upon the diesel generators until power could be manually backfed from the 115 kV lines through the unit auxiliary transformer (811).Following.

the 1987 Refueling Outage, the off-site power supply was re-configured by splitting the 34.5 kV on-site bus and supplying off-'site power through two energized transformers (12A and 12B).As a result of these efforts, RG&E has reviewed, confirmed, and enhanced the design performance of the plant's off-site power supply system.C.2.0.Spent Fuel Pool (SFP)Cooling System Upgrade In order to increase the capacity of the original SFP cooling system to accommodate increased numbers of stored assemblies, a second permanent cooling loop (the nBn SFP loop)was installed in 1988 under EWR 1594.This cooling loop had essentially double the capacity of the original (nAn)loop.The new loop was designed to more current design standards (seismic category I, ASME section III, class 3)as compared to the original non-seismic for function system.This modification significantly upgraded the SFP cooling system with both increased capacity and the added redundancy of two permanently installed systems;hence, the design bases for the upgraded Spent Fuel Cooling System are more consistent with current regulatory and industry requirements.

C.2.P.Containment Isolation System Review As part of License Amendments 52 and 54, RG&E conducted a thorough review of the containment isolation boundaries and their design bases.Detailed schematics of each penetration were developed, verified, and incorporated into the UFSAR.Procedures were reviewed against this information to ensure periodic testing was demonstrating conformance to design function for each penetration.

As a result of these efforts, containment isolation boundaries and their bases have been clearly documented.

C.2.Q.Steam Generator Advanced Digital Feedwater Control System (ADFCS)Installation In 1991, RG&E installed an enhanced S/G water level control system.S/G water level is now controlled by a digital microprocessor-controlled automatic S/G feedwater control system termed the ADFCS.As part of S/G replacement in 1996, RG&E did additional modeling and testing to confirm operation of the ADFCS with the replacement S/Gs.As a result of this modification, the level control capability and reliability of the steam generators were enhanced as evidenced by a significant reduction in feedwater-related transients.

In addition, the Design 10CFR50.54(Q Rcsponsc-Attachment C Final Report Pa8c 58 2/787 I J'0 I 1,f Criteria developed for the modification added to the overall understanding of the system's design bases.C.2.K Microprocessor Rod Position Indication (MRPI)Installation Under EWR 3797, RG&E replaced the original analog rod position indication system with the MRPI system to improve the system's performance with respect to system resistance to temperature and noise eFects and to reduce required maintenance and potential forced outage time.As a result of this modification, the reliability of the plant was enhanced.In addition, the Design Criteria developed for the modification added to the overall understanding of the system's design bases.C.2.S.Anticipated Transient Without SCRAM (ATWS)Mitigation System and Actuation Circuitry (AMSAC)Upgrade As required by 10CFR50.62, RG&E installed an AMSAC system.The AMSAC is based on a low feedwater flow logic.It is a non-Class 1E system designed to trip the turbine and start the motor-driven (MDAFW)and turbine-driven (TDAFW)auxiliary feedwater pumps if main feedwater flow is lost with reactor power above 40%.As a result of this modification, the capability of the plant to respond to a failure of the reactor trip system was enhanced.In addition, the Design Criteria developed for the modification added to the overall understanding of the system's design bases.C.2.T.Standby Auxiliary Feedwater (SAFW)System Addition As originally designed, the auxiliary feedwater (AFW)system in the Intermediate Building (IB)could be susceptible to common mode damage by a high energy line break (HELB).(Note: HELB was not part of the original Ginna licensing basis.)RG&E, therefore, augmented the existing AFW system with an additional SAFW system which is independent of the AFW system and located remotely to preclude damage from a pipe break in the IB.As a result of this modification, the reliability of the plant's AFW systems was enhanced, in that there now exists a 600%-capacity diverse means of delivering AFW to the S/Gs.C.3.INSPECTIONS THAT ASSIST IN MAINTAINING FIELD CONFIGURATION C.3.A.CONSISTENT WITH DESIGN BASES System Engineer (SE)Walkdowns SEs conduct walkdowns of the accessible portions of their assigned systems on a periodic basis (generally quarterly).(Systems inside containment are walked down during refueling outages.)RG&E has established written guidelines and standards for these walkdowns.

The 10CFR50.54(f)

Rcsponsc-Attachment C Final Rcport Page 59 2/7/97 1 4 X~'I'~'~~,~1~t 1',>1>1*

primary purpose of these walkdowns is to verify acceptable material condition of the systems, configuration/status of temporary modifications (including installed scaffolding), and housekeeping.

The walkdowns help to ensure that the systems are being adequately maintained so that design functions are not compromised.

Because of the SE's knowledge of the design configuration of the system, these periodic walkdowns help maintain system configuration control as well.A brief review of recent walkdowns indicates the following configuration discrepancies identified for resolution:

~Cap missing from,CCW drain line, and~Inconsistencies in Emergency Lighting drawings.Such configuration discrepancies are identified and resolved via the RGB corrective action process (D.l).C.3.B.System Engineer Performance Monitoring Program In addition to predictive monitoring, thermal performance, erosion-corrosion, performance testing, and ISUIST, the Systems Engineers (SEs)condition performance monitoring in accordance with the requirements of 10CFR50.65, the Maintenance Rule (MR).The intent of the MR is to assess, on an on-going basis, the effectiveness of maintenance on key systems, structures, and components (SSCs), namely:~Safety-related (SR)SSCs~Non-SR SSCs that mitigate accidents or transients h~Non-SR SSCs that are used in the Emergency Operating Procedures

~Non-SR SSCs whose failure prevents SR SSCs from fulfilling their safety function~Non-SR SSCs whose failure causes scrams or actuates SR systems.Each of the SSCs within the MR scope is covered by a preventive maintenance (PM)program, as defined by NUMARC 93-01, Rev 0, to provide reasonable assurance that SSCs will be consistently capable of performing their intended function when required.An assessment of effective maintenance is performed by monitoring and'trending SSCs'erformance against established'performance criteria (PC)(which are based on design basis functions and/or design basis criteria)chosen to reflect good performance (which is maintained by appropriate maintenance).

Appropriate maintenance will result in a low number of functional failures and high SSC availability and/or good performance relative to desired engineering or operating parameters (condition monitoring).

Where performance due to maintenance has declined and a SSC is not meeting its PC, the SSC is placed in a degraded MR condition (category (a)(1)).Specific performance goals, increased monitoring, and/or corrective actions are then required to return the degraded SSC to a condition of acceptable performance.

10CFR50.54(f)

Response-Attachment C Final Repott Page 60 2/787 e e w c~

C.3.C.Shift Technical Advisor/Staff Inspections A-54.4, Shift Technical Advisor or Designated Plant Management Plant Tour, contains a stated objective of checking for unauthorized modifications,to the facility.To assess the value of these tours to confirm that system, structure, and component (SSC)performance remain consistent with the design basis, a sample of more than 200 tours conducted by more than 20 STAs and group managers was reviewed.Some deficiencies identified by these tours include restricted.

floor drains, scaFolds not conforming to seismic criteria, tubing support deficiencies, fire barriers not intact, instrument indication anomalies, and flexible hose bend radius deficiencies.

These tours, along with inspections per A-54.7, Fire Protection Tour, and M-1306, Ginna St'ation Material Condition Inspection Program, give RG&E confidence that deficiencies are being self-identified to assist in maintaining proper plant configuration and performance.

Findings are documented via the RG&E corrective action process and assigned to an appropriate group for resolution.

C.4.TRAINING AND TRAINING CONFIGURATION MANAGEMENT The processes for, and extent of, personnel training'at Ginna is discussed in Attachment A (A.3).This includes training which aides in keeping configuration consistent with design bases, e.g., Maintenance Rule training, training on the Improved Technical Specifications, and training associated with specific modifications and changes to the plant.The Nuclear Training Department has developed and is implementing administrative configuration management processes intended to ensure training materials, modules, and the simulator are kept current with plant actual configuration and operation.

Ginna Station has constructed and operates a stand-alone control room simulator for the training of plant licensed operators.

RG&E has also used the Ginna Simulator to assist in the validation of system modifications (e.g., ADFCS controls tuning for the Steam Generator Replacement).

10CFR50.54(f)

Rcsponre-Attachment C Final Rcport Page 61 2/7/97 e u 4.t 10CFR50.54(f)

RESPONSE ATTACHMENT D (d)Processes for identification of problems and implementation of corrective actions, including actions to determine the extent of problems, action to prevent recurrence, and reporting to NRC.NOTE: THIS ATTACHMENT IS SUPPORTING DOCUMENTATION THAT IS TO BE READ IN CONJUNCTION WITH ITS CORRESPONDING SECTION IN THE

SUMMARY

REPORT.IT IS NOT A STAND-ALONE DOCUMENT.This Attachment is organized as follows: D.l.C RRECTIVE A TION PROCESS AND PROCEDURE GINNA ACTION REPORT D.2.OPERABILITY DETERMINATIONS D.3.CONDITIONS ADVERSE TO UALITY OR NON-CONFORMING ONDITIONS D.4.ACTION REPORT DATA TRENDING D.S.REPORTING TO THE NRC D.6.NTINUOU INTERACTION AND MMUNI ATI N WITH NR PROJECT MANAGE RESIDENT INSPECTORS AND OTHER NRC STAFF D.7.TRAINING D.8.EMPL YEE N ERN PR RAM D.1.CORRECTIVE ACTION PROCESS AND PROCEDURE GINNA ACTION REPOR In 1994, RG&E implemented a new corrective action process and program focused on the RG&E Abnormal Condition Tracking Initiation or Notification (ACTION)Report.This process integrates all aspects of problem identification, evaluation, and resolution into a single process that can be tracked and trended to assist in assessing the effectiveness of various programs, processes, and organizations, and that can be readily improved through management oversight and communication of expectations.

10CFR50.54(f)

Response-Attachment D Final Report Page 62 2fl/97 t~E A~&%l~4~l e f Prior to 1994, RG&E had several, separate corrective action processes for such items as non-conforming items, potential conditions adverse to quality, engineering identified concerns and potential conditions adverse to quality, QA identified concerns, and procurement and receipt inspection deficiencies.

Based on both our internal auditing and assessments, third-party reviews, and process evaluation via safety system functional inspections (SSFIs), RG&E concluded that, although the various processes met regulatory requirements, by their very number, they posed a potential weakness to effective corrective action.As a result of RG&E's recognition of the above, RG&E implemented the'ACTION Report process which superseded the several previous corrective action processes.

ER IE F RRE TI TI NPR The ACTION Report process is currently implemented via IP-CAP-1, Abnormal Condition Tracking Initiation or Notij7cation (ACTION)Repon.The ACTION Reporting process is a single corrective action program for the idehtification and initiation of resolution of any condition event, activity, concern, or item that has the potential for affecting the safe and reliable operation of Ginna Station.The process includes requirements and provisions for:~Identification of problems and concerns~Initial screening of identified conditions for immediate safety and/or operational concerns and prioritization of the condition for resolution

~Disposition and cause determination for the condition including classification of the condition for tracking and trending~Implementation of corrective actions as appropriate for the condition, including remediation of the condition and long term actions to prevent recurrence

~Requirements for reporting appropriate conditions to the NRC, e.g., as required by 10CFR21.The following is an explanation of the RG&E ACTION Reporting process: I~AN ACTION Reports are issued per IP-CAP-l, which may be used by any individual who observes or is aware of a condition or potential condition that causes concern about the safe, efficient and reliable operation of Ginna Station, including any unusual condition, potential Technical Specification violation, or condition which may need to be reported to the NRC or to management.

ACTION Reports may also be initiated for events or conditions that are of very low risk or significance, but which would provide useful precursor information if tracked and trended for repeat occurrence.

RG&E management intentionally keeps the threshold of reporting low for the purpose of ensuring that problems are readily identified and addressed, from major individual events to minor events and conditions detected only by adverse trends and multiple occurrences.

lOCFR50.54(f)

Rcsponsc-Attachment D Final Rcport Page 63 2/7/97 I P 4\k'h-'l I'l A.ef.'>-~~0: ,p f=s@~V A I%1~t s1 q...i, t v'd4" To ensure timely communication of conditions identified via ACTION Report to the NOG staff, new ACTION Reports are typically discussed at the morning management/staff meeting and listed in the meeting notes.INITIAL SCREENINGS ACTION Reports are initially screened by Operations for potential immediate safety concerns.Operations (often with Shift Technical Advisor input)performs an operability evaluation," identifies any Technical Specifications LCOs and/or mode restrictions, determines if the identified condition requires further evaluation and processing,'and makes appropriate notifications.

For complex conditions including many design bases questions, Operations may request assistance from Engineering in evaluating operability.

The PORC Chairman or designee then assigns a priority level and a Responsible Manager (RM)for disposition and corrective action.The Chairman also determines if the ACTION Report needs to receive a PORC multi-disciplined review after disposition and/or following corrective action implementation.

DI P ITION AND CA SE DETERMINATI N The ACTION Report process directs the RM to initially determine if the condition reported represents a non-conforming item which may require immediate restrictions upon its use or potentially be reportable in accordance with 10CFR21.The RM then prepares a disposition which identifies corrective and preventive action(s), as appropriate, to address the identified condition and its cause(s)and to prevent recurrence of the abnormal condition/event.

Related procedure IP-CAP-2, Root Cause Analysis, describes the process for performing a root causes analysis.Multi-disciplined groups are used, as appropriate.

Appropriate processes are initiated to resolve the condition, e.g., modification process, procedure or document change process.The RM also ensures that the condition is classified both in terms of the cause (Cause Code), and as the condition relates to implementation of the Maintenance Rule, e.g., maintenance preventable functional failure, so that the condition is more readily tracked/trended.

The RM obtains multi-disciplinary concurrence with the disposition as appropriate or required by the process, i.e., QA, QC, RP, System Engineer, PORC, etc.ORRECTIVE ACTION IMPLEMENTATION Corrective action is implemented by the group responsible under the appropriate engineering or work process, e.g., modification, work order, procedure change.When the corrective actions are complete or scheduled via appropriate process, e.g., modification, procedure change, or work order, the RM reviews the ACTION Report documentation received from each implementing group and obtains organizational concurrence with the closure of the ACTION Report as appropriate and as required by procedure, i.e., QA, QC, etc.10CFR50.54(t)

Rcsponsc-Attachment D Final Rcport Page 64 2/7/97 REPORTABILITY RG&E is required to report certain conditions, items, and events to the NRC under a number of regulations.

Reporting associated with conditions identified via A'CTION Reports is proscribed by the ACTION Report instructions to ensure timely assessment and appropriate reporting.

RG&E's overall process for reporting such conditions to the NRC is discussed in D.S below.D.2.OPERABILITY DETERMINATIONS RG&E has established formal administrative processes (A-52.3, Safety Function Determination Program, A-52.4, Control of Limiting Conditions for Operating Equipment, and A-52.12, Inoperability of Equipment Important to Safety)for evaluating the operability of systems and equipment.

These processes are intended to ensure that inadvertent changes (e.g., due to equipment failures)or minor changes to configuration (e.g., to allow for maintenance) do not compromise the fidelity of the plant's configuration to its design bases.These processes also track inoperable equipment important to safety to assure that even the aggregate impact of multiple deficiencies in more than one system or subsystem does not place the plant outside its design bases and Improved Technical Specifications (ITS).Operations determines equipment operability when there are operating deficiencies, failure to meet test requirements, or failure to perform an intended function.Operability concerns for more complex issues are typically resolved by Systems Engineering or Nuclear Safety&Licensing under the Safety Review/Evaluation process.Procedures specify that appropriate ITS Limiting Conditions of Operability (LCOs)are invoked for equipment and systems found to be inoperable.

RG&E has also developed procedural guidance for voluntary entry into ITS LCOs for on-line maintenance/testing.

D.3.CONDITIONS ADVERSE TO UALITY OR NON-CONFORMING CONDITIONS During the initial screening of ACTION Reports for prioritization, conditions adverse to quality and non-conforming items are evaluated by the PORC Chairman for significance in accordance with IP-CAP-l, Abnormal Condition Tracking Initiation or Notification (ACTION)Report.A condition adverse to quality or non-conforming item determined by evaluation to be significant is identified as a Significant Condition Adverse to Quality (SCAQ)by the PORC Chairman.SCAQs are evaluated to determine the efFect of continuing activity.If continued activity would obscure or preclude the identification of the deficiency, increase the extent of the deficiency, or lead to an unsafe condition, stop work action is taken.D.4.ACTION REPORT DATA TRENDING The Nuclear Assessment organization is responsible for trending identified problems and corrective action report data.The corrective action trending process is described in ND-CAP, Corrective Action Program.The process is based upon data from ACTION Reports.Data 10CFR50.54(t)

Response-Attachment D Final Rcport Page 65 2/7/97 H I,~I'I I 1W..U,'Xt<<rIyy~: "I used include cause codes, system codes, component codes, equipment identification numbers and organizational codes.On a periodic basis, typically quarterly, an analysis is performed on the major cause codes entered into the ACTION Report database for the prior period, typically 12 months or more.Trending is periodically reviewed by the QA/QC Subcommittee of NSARB.Two ACTION Report major cause codes typically associated with design basis and plant configuration issues are"Change Management" and"Design Configuration/Analysis" based upon nomenclature established by the Institute for Nuclear Power Operations (INPO).During the 1996 calendar year, these two major Cause Codes represented 5%and 12%of the causes for ACTION Reports (total of 37 and 94 events respectively out of a total of approximately 1200).Note that the ACTION Reports included under these cause codes range from significant (auxiliary feedwater valves failed to throttle to the design basis flow range during testing due to inadequate selection of"equivalent" replacement parts)to minor administrative (incomplete review form in procedure change notice package/nomenclature differences in plant information).

D.5.REPORTING TO THE NRC RG&E has cr'eated a matrix (in EP-2-P-164, Receipt of and Response to NRC Correspondence) that lists applicable NRC Reporting Requirements, the time frame for reporting, and the group or individual at RG&E who is responsible for the report.Procedures exist to identify and control the process for complying with these reporting requirements, including 0-9.3, NRC Immediate Notification, A-25.6, NRC 8'ritlen Notification, A-61, 10CFR21 Screening, Evaluating, and Reporting, as well as EP-2-P-164.

For ACTION Reports, 0-9.3 is referenced, if needed, by the Shift Supervisor or Operations management to make a prompt determination of reportability, and A-25.6 is referenced, if needed, by the Shift Technical Advisor regarding written notification (e.g., a Licensee Event Report).After the prompt reportability determination, direction is provided to consult with Nuclear Safety&Licensing, if Operations requires clarification or additional information.

Further determination of reportability includes concurrence by the Plant Operations Review Committee (PORC).A review of RG&E's reports to the NRC and NRC enforcement history confirms that appropriate reports are made, including some reports that are below the threshold of NRC reportability.

Examples of such voluntary Licensee Event Reports (LERs)submitted in the past few years include: P~LER 88-009 Heat Conduction Through Conduit Supports~LER 89-007 Safety Injection Pumps Inoperable due to Flow Meter Calibration Errors~LER 91-004 Pre-planned Manual Start of Emergency Diesel Generators

~LER 91-008 Component Failure with Redundant Equipment Operable and Available~LER 91-010 Invalid Data Used for Heat Balance Calorimetric 10CFR50.54(l)

Response-Attachment D Final Report Pago 66 2/7/97 N os<Q!g I~,g~~-gC C~,I~~g,~l~~9/TT

~LER 93-003 Degradation of Valve Isolation Capability For 10CFR Part 21 reportability, the ACTION Report process directs the dispositioner to determine whether the condition reported is a non-conforming condition.

If so, the dispositioner is referred to A-61, 10CFR21 Screening, Evaluating, and Reporting.

The dispositioner is directed to perform a screening to determine if a 10CFR21 evaluation is required.If so, the dispo'sitioner performs an evaluation, as specified in A-61, to determine whether the non-conforming condition represents a Substantial Safety Hazard in accordance with,10CFR21.

Such evaluations must be completed within 60 days of the Discovery Date or an Interim Report must be issued.If the evaluation confirms that a defect or failure to comply per 10CFR21 exists, Procedure A.61 specifies responsibilities and timeframes for reporting the condition to NRC, including PORC review and concurrence with the dispositioner's evaluation Voluntary reports to the NRC Headquarters Operations Office have also been made, including several conservative applications of 10CFR21 criteria.Reports include:~3/23/92 Field Calibration Source Inaccuracy (10CFR21)~7/20/93 Heat Exchanger Design Deficiency (10CFR21)~7/14/95 Pump Performance Inadequacy (10CFR21)~9/25/95 Mismatch Between Valve Design and Installation Configuration (10CFR21)~1/20/94 Power Reduction Due to Low Circulating Water Bay Level (verbal report)D.6.CONTINUOUS INTERACTION AND COMMUNICATION WITH NRC PROJECTMANAGER RESIDENT INSPECTORS AND OTHERNRC STAFF RG&E personnel communicate with the NRC both formally and informally.

It is RG&E's management philosophy to attempt to keep the NRC informed of activities and issues at the plant.Formal communication becomes part of the Ginna docket.Incoming formal communication is typically received and distributed by the Vice President, Nuclear Operations.

With the exception of some routine reports, outgoing formal communication is normally transmitted to the NRC by the Vice President, Nuclear Operations.

These communications may be in response to NRC requests of RG&E or RG&E requests of the NRC.Such communication is typically tracked in RG&E's Commitment and Action Tracking System (CATS).Informal communication occurs at various levels of the organization.

It is primarily verbal and involves no commitments or official.position statements.

It is generally used to clarify or provide detail/background regarding on-going activities and emerging issues.Examples of how this informal interaction occurs include NRC attendance at Ginna's morning staff meeting or at PORC, and discussions with the NRC Resident Inspectors or NRC Project Manager.10CFR50.54(f)

Rcsponsc-Attachment D Final Rcport Page 67 217/97 09CCZL 0-6ZGC60 0 LOOOGK;0-9LC060 0 1 0 0 0 0 09CCZ'K 0-LVOOG'K 0-9LCV60'0 6ZGC60'0 LT O'K 0 K Z 0'K 0'K,O K Z'K'K D.7.TRAINING The processes for, and extent of, personnel training at Ginna is discussed in Attachment A (A.3).Training includes training on the implementation of the problem reporting process, root cause determination process and other associated processes described in this Attachment.

D.S EMPLOYEE CONCERNS PROGRAM RG&E has long had in place an Employee Concerns Program for confidential identification of problems, both at a corporate level and for its Nuclear Operations Group (NOG).Employees, as well as contractors, are encouraged to express their concerns with respect to safety or compliance with applicable laws.We encourage, employees to attempt to resolve their concerns by direct communication with their supervisors.

If such established lines of communication are not preferred by, or appear to be ineffective to, the employees, they are encouraged to use the"Employee Concerns Form." The program allows employees to raise concerns and receive responses to those concerns while ensuring that the privacy of the employee is protected.

We are constantly improving our problem identification processes to encourage open, self-reporting, for example, by lowering the reporting threshold for ACTION Reports.RG&E considers that the very small number of concerns requiring use of the"Employee Concerns Form" or"NRC Form 3", coupled with the large numbers of ACTION Reports generated (currently averaging about 100 per month), is evidence of our success in communicating directly with our employees the importance of identifying safety concerns.RG&E attributes this success to the close and active tie between management and working-level personnel (at least partly the result of the few layers of management present in the RG&E Nuclear Operations Group).The attitude of both our employees and management is to foster the identification of potential safety issues.Open, frank, and even heated technical discussions are accepted and encouraged.

RG&E rewards employees for identification of significant issues with monetary rewards, plaques, preferential parking spaces, etc.10CFR50.54(f)

Rcsponsc-Attachment D Final Rcport Pat,c 68 2/7/97

• t 4I'+$~I N e'*'II$PC4 t VI'.j'$t%v e-~'t It I s/~~

10CFR50.54(f)

RESPONSE ATTACHMENT E (e)The overall effectiveness of your current processes and programs in concluding that the configuration of your plant is consistent with the design bases.NOTE: THIS ATTACHMENT IS SUPPORTlNG DOCUMENTATION THAT IS TO BE READ IN CONJUNCTION WITH ITS CORRESPONDING SECTION IN THE

SUMMARY

REPORT.IT IS NOT A STAND-ALONE DOCUMENT.I This Attachment is organized as follows: , E.l.IN-LINE TI-DISCIPLINARY REVIEWS E.l.A.Design Verification E.l.B.PORC E.l.C.NSARB E.2.RG&E ASSESSMENTS E.2.A.Self-Assessments E.2.B.QA Audits and Surveillances E.2.C.Process Weaknesses Identified by QA E.2.D.Process Strengths Identified by QA E.3.THIRD PARTY REVIEWS OF R&E PROCE E E.3.A.NRC Inspections and Results E.3.B.Evaluation of NRC NOVs E.3.C.Safety System Functional Inspections E.1.IN-LINE MULTI-DISCIPLINARY REVIEWS E.l.A.Design VeriTication Safety-related and safety significant design changes under the Plant Change Process are design verified in accordance with EP-3-S-125, Design Verificalionand Technical Review.Design verification is the process for independently reviewing, confirming, or substantiating the design by one or more methods to provide assurance that the design meets the specified inputs.The design verification includes a complete technical review and is intended to fulfill the requirements of ANSI N45.2.11.The verifier must be competent and must not have been involved in developing the content of the design.The scope of the verification is scaled to the scope of the design being reviewed.The design verification process is intended to provide a 10CFR50.54(f)

Rcsponsc-Attachment E Final Rcport Page 69 2/7/97 peer review of each proposed design that could afFect the safety function of the plant and to ensure that each design has been performed correctly.

E.i.B.PORC The Plant Operations Review Committee (PORC)is described in the RG&E Quality Assurance Program for Station Operation and ND-NPD, Nuclear Policy and Directives Manual Description.

PORC's functions are to provide timely and continuing monitoring of operating activities to assist the Plant Manager in keeping abreast of general plant conditions and to verify that day-to-day operating activities are conducted safely and in accordance with applicable administrative controls.PORC also reviews facility operations to detect potential nuclear safety hazards.PORC has established several independent reviewers for Safety Reviews and 10CFR50.59 Safety Evaluations.

Each Safety Review/Evaluation must be reviewed by a designated PORC Independent Reviewer (PIR).Each Safety Evaluation must be reviewed by PORC.For Safety Reviews, the PIR may designate that PORC evaluate the Safety Review prior to the proposed change/activity proceeding.

PORC is intended to ensure that experienced, supervisory-level plant operations personnel scrutinize the day-to-day activities of the plant and proposed changes that have the potential to afFect nuclear safety.PORC provides for plant supervisory oversight of the effectiveness of the design and configuration control processes discussed within this report.E.i.C.NSARB The Nuclear Safety Audit and Review Board (NSARB)is described in the RG&E Quality Assurance Program for Station Operation and ND-NPD, Nuclear Policy and Directives Manual Description.

NSARB is an independent corporate-level audit and review group responsible for periodic review of the activities of PORC, for directing audits and evaluating their results, and for the management evaluation of the status and adequacy of the Quality Assurance Program at Ginna.The composition of the NSARB complies with ANSI Standard N-18.7 1976, Section 4.3.2.In addition, the current composition includes regular membership from outside of RG&E, both utility and consultant, with experience in nuclear operations, engineering, and engineering management.

The NSARB is intended to provide independent management oversight of the organizations and processes that review and control the safety-related activities at Ginna and to provide to management an indication of the efFectiveness of these activities in ensuring the safe operation of the plant.IOCFR50.54(Q Response-Attachment E Final Report Page 70 2/7/97 e Q~QWII-w/tr E.2.RG&E ASSESSMENTS E.2.A.Self-Assessments ND-ASU;Assessments and Surveillances, establishes and implements a program of planned and periodic independent assessments to 1)confirm that activities affecting quality comply with the Quality Assurance Program, Improved Technical Specifications, and other governing programs and plans and 2)confirm that these programs have been effectively implemented.

ND-ASU provides a recommended method for implementation of self-assessment.

Self-assessment is an evaluation of a particular task, process, practice, or functional area initiated by the area or process owner.ND-ASU define the responsibilities, process, conduct of the assessment, post-assessment activities, assessment report and records associated with performance of self-assessments.

Self-assessments may also use peers from other.organizations with specific expertise in the area under review.The following is a list of some of the self-assessments performed by RG&E during the 1995-1996 timeframe;

~Maintenance Rule Preparations

~Action Report Process~Maintenance Foreign Material Exclusion~Plant Change Process~Root Cause Process~Procurement

~Maintenance Human Performance

~Corrective Action Process~Forced Outage~Plant Change Integration Adequacy~Licensed Operators/STA/SS Program~PORC~QC Package Reviews~Procedure Adherence/Adequacy

~RCS Safety Valve Outage E.2.B.QA Audits and Surveillances Internal audits of selected aspects of quality-affecting activities are performed at a frequency commensurate with safety significance and management concerns.Each audit requires the development of an audit plan to provide information about the audit, such as characteristics and activities to be assessed, acceptance criteria, a review of previous assessment findings, a review of industry and NRC issues, names of those who will perform the audit, scheduling arrangements, and the method of reporting findings and recommendations.

Audits often include technical specialists from an area other than that being reviewed, including frequent 10CFR50.54(0 Rcsponsc-Attachment E Final Rcport Page 71 2/7/97

~'84ZT'90 0 6896'K0'0 05099'K 0-Z>8C60 0 0 0 0 0 05099T 0-TCLL'KZ'0-ZZGCTG 0 Z08C60 0 4'K 0T 0 T 8 0 T 0 T,O'Z T T use of specialists from other utilities.

Assessment results are documented in ACTION Reports and are reported to the assessor's management, the supervisor and division head having responsibility in the area assessed, and, for audits, to the Nuclear Safety Audit and Review Board.The person having supervisory responsibility in the area assessed is required to review the results, take necessary action to correct the deficiencies identified by the report, and then document and report the corrective action.QA provides follow-up action on audit responses intended to ensure that corrective action is adequate, assigned target completion dates are timely, and that corrective action is implemented for each finding requiring a response.E.2.C.Process Weaknesses Identified by QA In the course of performing their independent oversight and auditing functions, RG&E QA has cited organizational deficiencies and weaknesses.

For example, a review of Annual QA Audits for 1994-1996 (via database query)identified the following configuration control and corrective action concerns/deficiencies:

Configuration Control-The 1994 QA audit of configuration control identified a concern that responsibilities for vendor manual creation and review were not clearly defined between Engineering and Procurement.

The Change Impact Evaluation (CIE)form of IP-DES-02, Plant Change Process, now allows the Engineer to clearly indicate the responsibility for VTMs.The 1995 QA audit identified five concerns and one deficiency.

QA concerns regarding evaluation of change impact, especially for"equivalent" changes, resulted in revisions to the CIE form and associated procedures for 1)consideration of impact on ISI/IST programs and 2)the addition of microprocessor-controlled components to items to be considered for potential software change impacts.A deficiency regarding posting of temporary modifications in the Control Room lead a revision to A-1406, Control of Temporary Modifications, to indicate that labels, provided in the associated Work Package, are to be affixed to the Control Room P&IDs to reflect the temporary modifications.

Corrective Action-The 1995 QA audit identified four concerns, including one regarding the need to clarify the definition.

of non-conforming items to ensure that all such items are, reviewed in accordance with 10CFR21 and that adequate controls are placed on the use of such items while they are being dispositioned., As a result, IP-CAP-02, Abnormal Condition Tracking Initiation or Notification(ACTION)

Report, was revised to clarify the definition of nnon-conforming item" and to set a time limit for the dispositioner to determine if a non-conforming item is involved.The time limit is commensurate with 10CFR21 reporting requirements as well as the need to impose appropriate and timely controls on the use of non-conforming items.The 1996 QA audit of corrective action identified a deficiency in RG&E's ability to track and trend low level (of significance) plant equipment degradation.

Specifically, the audit found numerous Work Orders for valve leaks, including several identical valve-type groups with multiple packing leaks.As a result of this finding, RG&E has raised the awareness of Systems Engineering regarding 10CFR50.54(l)

Rcsponsc-Attachment E Final Rcport Page 72 2/7/97 h 41 Ei&M~~t%\c/x~

multiple problems within a given system, even though they are insignificant when taken separately.

Also, the ACTION Report process was revised to add a new low-level-of-significance category for trending only (Category D)to assist plant personnel in the identification and trending of low level plant equipment degradation concerns, The above QA audit findings and resulting corrective actions provide examples that RGB's constantly evaluating the effectiveness of processes and looking for methods to increase that effectiveness through self evaluations.

E.2.D PROCESS STRENGTHS IDENTIFIED BY A The following is a,sampling of the strengths cited by RG&E QA as a result of audits conducted within the last three years:~Attention to detail in the required content and review of the ASME Section XI Repair and Replacement Program documentation (GORR Forms)by the ISI organization.

~Based upon review by technical specialists from other utilities, the new plant design control process (PCR)incorporates several standard features that should improve the accuracy of change impact evaluations and the quality of documentation for plant changes.~The PORC Chairman's review and prioritization of ACTION Reports for disposition focuses organizational resources and attention on significant conditions.

/~Ginna uses ACTION Report cause code trending and not just case-by-case root cause evaluations as a means of early detection of adverse quality trends.~The level of attention paid to plant fire protection systems has resulted in most impairments to these systems being planned evolutions for maintenance/operating activities rather than being caused by equipment failures.The duration of most such impairments is short (l to 3 shifts).These efforts have minimized reliance upon fire watches.~The conduct of Significant, Infrequently Performed Evolutions (SIPEs)has been strengthened by thorough preparedness and openness during pre-SIPE briefings with Operations.

E.3.THIRD PARTY REVIEWS OF RG&E PROCESSES E.3.A.NRC Inspections and Results NRC Inspectors perform continuous inspections at Ginna.These inspections are conducted per the NRC Inspection Manual and Inspection Procedures, which define core inspections.

IOCFR50.54(f)

Rcsponsc-Attachment E Final RcPcrt Page 73 2/7/97 G008EZ 0-99ZC'KG 0 C809GT 0-CG6C60 0 0 0 0 0 C809GT 0-GOCSTZ 0-99ZC'KG 0 CG6C60 0 LT 0T 0 E 8 0 7 0'K 0 7'K E T Although configuration management is an element of all inspections by the Resident Inspectors, it is the NRC Regional Office which performs design, engineering, and programmatic configuration management inspections (at least three engineering inspections per SALP period).NRC Inspection Reports (IRs)are received and reviewed by the Vice President, Nuclear Operations, who assigns responsibility for action items and has them tracked by the Commitment and Action Tracking System (CATS)until they are completed.

The various processes and programs discussed herein upon which RG&E relies to maintain plant configuration and operation consistent with the design bases have been scrutinized by the NRC on a regular basis.As one measure of the adequacy of these processes and programs, RG&E reviewed NRC IRs for Ginna for, the past six years (1990-1996).

NRC inspections and associated reports have been valuable in focusing attention on weaknesses and deficiencies within our processes and programs;however, the reports also indicate a number of areas in which these same processes and programs are proceeding satisfactorily.

Specific recurring themes are:~Reference to consistency between the UFSAR and the plant and to adequately maintained design bases (NRC IRs 93-03, 93-09, 93-13, 93-23, 94-03, 94-07, 94-14, 95-01, 96-02, and 96-05).~Reference to an adequate modification control process (NRC IRs 90-05, 90-17, 91-02, 91-05, 92-12, 93-19, 93-22, 94-02, 94-07, 94-12, 94-14, 94-15, 95-02, 95-02, 95-15, 95-20, and 96-05).~Reference to an adequate 10CFR50.59 evaluation process (NRC IRs 90-09, 90-17, 93-16, and 94-11).~Reference to an adequate corrective action process (NRC IRs 94-09, 94-12, 94-16, 95-01, and 96-05)~Satisfactory oversight and review by Engineering, QA, the Plant Operations Review Committee (PORC), and the Nuclear Safety Audit and Review Board (NSARB)and appropriate self-assessments (NRC IRs 91-29, 92-09, 92-10, 92-12, 92-15, 93-06, 93-12, 94-07, 94-09, 94-10, 94-11, 94-26, and 94-27).The NRC has also scrutinized our procedures for compliance to regulations and design bases.A review of NRC Inspection Reports (IRs)since 1990 indicates the following strengths with respect to plant processes and procedures:

~Reference to a strong inservice inspection (ISI)program which meets regulatory requirements (NRC IRs 92-06, 90-06, 91-20, 92-11, and 93-02)lOCFRSO.S4(f)

Rcsponso-Attachment E Final Rcport Page 74 2/7/97 e 4~lj E~: 0 QBQS

~Reference to a strong and technically adequate erosion/corrosion program (NRC IRs 92-09, 90-06, 91-20, and 92-11)~Reference to processes which result in adequate and timely resolution/implementation of NRC concerns and notices including:

0 Spent fuel pool design bases acceptability (NRC Es 96-03 and 96-05)0 Pump minimum recirculation flow provisions per Bulletin 88-04 (NRC E 90-24)0 Provisions for low-loop/mid-loop operations per GL 88-17 (NRC IR 91-18)0 Responses to NRC Information Notices (INs)as indicated by sampling responses to various INs including 92-53, 91-29, 91-51 (NRC Es 93-21 and 94-26)0 Effective implementation of 10CFR21 requirements (NRC IR 93-12)0 Adequate Operator Work-Around program (NRC IR 96-005)E.3.B.Evaluation of NRC Notices of Violation (NOVs)Over the life of Ginna Station, RG&E has developed and implemented the practices, processes, and programs discussed above as part of our continuing effort to maintain plant configuration and operation consistent with the design bases.The NRC has conducted numerous inspections of Ginna and its operation.

As one measure of the effectiveness of our efforts, RG&E reviewed the NOVs received over the past 15 years.By reviewing NRC Inspection Reports beginning in 1982, RG&E identified NOVs which appear to be the result of incorrect or inadequate knowledge of the plant design bases.Additional NOVs were selected which cite plant configurations or conditions which appear to be inconsistent with the design bases.Of the latter, about half are the result of program deficiencies, and half are the result of failure to follow procedures (both represent a condition in which known design bases information was not adequately communicated for implementation in the field).RG&E's evaluation of these NOVs resulting from incorrectly or inadequately communicated design bases information indicates that, although each of these represented a problem with the associated equipment, the actual impact to public health and safety was, in each case, minimal.This is not to say that the violations were not of concern to RG&E or that vigorous corrective action was not warranted or taken.Rather, it is an indication of the robustness of the plant's defense-in-depth which adds to our confidence in the safety of the plant and its safety systems.Additionally, many of the NOVs were 1)self-identified by RG&E or 2)detected within a very short time (1 day)of the deficiency occurring.

This gives RG&E confidence that surveillances and self-checking contribute to the continued safety of the plant.1 10CFR50.54(f)

Response-Attachment E Final RePett Page 75 2/7/97 O'K 999L9C'0 L809T9 0 0 0 0 0 0 0 0 999L9C'0-L80979'0 0 LT OE 0 L 8 0'K 0'K 0 T 0T.L The NRC-cited.

violations regarding design bases problems appear to be divided into the areas of understanding our design bases, our ability to communicate design bases information, and our ability to comply with specified design bases requirements.

RG&E continues efForts to improve in each of these areas, e.g., by design bases document retrieval and development, UFSAR verification eForts, and emphasis on procedural compliance.

In summary, our review of NOVs indicates that, in those incidents in which configuration has not been satisfactory, the potential impact on public safety has been minimal, the problems have been corrected, and our processes have been improved to minimize the potential for recurrence.

E.3.C.Safety System Functional Inspections (SSFIs)RESIDUAL HEAT REMOVAL'SYSTEM The NRC conducted an SSFI of the RHR System and its supporting systems over a five-week period during November and December of 1989 (NRC IR 89-81).The six-member NRC team did not identify'any conditions that would prohibit the RHR system from performing its intended functions under normal or design basis accident conditions.

The majority of the team's findings were associat'ed with the topic of"engineering assurance", which referr'ed to items such as control of documentation, engineering design interfaces, and engineering communications with external organizations.

Concerns with engineering assurance also included lack of consistency in the implementation of approved engineering procedures among the various departments and weaknesses in the process for resolving safety concerns raised outside the modification process.-The lack of thorough design basis documentation was also noted as a generic weakness in the documentation and design process existing at the time.Both of the two violations issued as a result of the SSFI involved control of technical information.

Subsequent to the RHR SSFI, RG&E performed a comprehensive assessment of the SSFI findings.That assessment led to major process improvements to correct the weaknesses cited in the SSFI Inspection Report.Specifically:

~An improved Plant Change Process was implemented to enhance the control of modifications.

~A new computerized Configuration Management Information System (CMIS)was developed.

~A searchable list of design analyses was stored in CMIS.~A Design Document Retrieval project was initiated.

~Common procedures were developed for certain proce'sses applicable to.both Engineering and Plant personnel.

10CFR50.S4(f)

Rcsponsc-Attachment E Final Rcport Page 76 217/97 w>4 n l"~'-0T'/'KT

~Design Engineers were assigned individual system responsibilities.

This was a first step toward implementing a Systems Engineering group.~A single entry point reporting process was recommended to permit personnel within all groups supporting Ginna Station to raise issues of concern and to have those concerns tracked to resolution.

This later became the Ginna ACTION Report.~RG&E developed a test program for molded case circuit breakers.Acceptability of the program was confirmed in the 1991 NRC Electrical Distribution System Functional Inspection (EDSFI).~Engineering procedures were revised.to adequately control changes to battery and emergency diesel generator loadings.ELECTRICAL DISTRIBUTION'SYSTEM FUN TIONAL INSPECTION DSFI The NRC conducted an SSFI of the Electrical Distribution System and its supporting systems over a five-week period during May and June of 1991.The six-member NRC team concluded that the Ginna electrical distribution, system was capable of performing its intended function and the engineering organization provides adequate engineering support for the safe operation of the plant.One Notice.of Violation and one two-part Notice of Deviation were issued as a result of the EDSFI.Issues cited in the violation were resolved by additional analyses and confirmatory testing.The portion of the deviation concerning the configuration of bus tie breaker BT17-18 was resolved by changing the component configuration and revising the supporting procedures; the portion concerning control cables to the Component Cooling Water system pumps was resolved via a modification performed during the following refueling outage.Numerous aspects of the electrical distribution system and its supporting systems were reviewed by the NRC inspection team.Although a number of concerns were noted, the team judged that these were either of low significance or were not safety issues.SERVICE WATER SYSTEM OPERATIONAL PERFORMANCE INSPECTION

~SWSOP In 1991, the NRC conducted a SWSOPI at Ginna.The six-member SWSOPI spent three weeks assessing the operational performance of the SW system.A majority of the team's findings were associated with apparent errors and omissions in the design bases for the SW system.The NRC SWSOPI team concluded that a presumption of operability was warranted for the Ginna SW system while SWSOPI issues were resolved.Operability was confirmed by subsequent analyses and tests which demonstrated that the SW system was capable of performing its design basis functions.

In response to GL 89-13 and the SWSOPI, RG&E embarked upon an extensive effort of combined analyses and testing to resolve concerns raised.Based upon these efforts, RG&E believes there is reasonable assurance that the UFSAR reflects the design bases of the SW 10CFR50.54(f)

Response-Attachment E Final RcPett Page 77 2fl/97 0 0 CTT89C 0-C809T9 0 0 0 0 0 89COG6 0 CT C89C'0-C809 E9 0 0 LT O'K 0 T'0 T 0 C 0 T T T T system and that the current SW system configuration is consistent with those design bases.As discussed elsewhere within this document, RG&E selected the SW system for the pilot NEI pilot initiative regarding UFSAR fidelity.Although many clarifications were needed, only one potential difference resulted in a more in-depth evaluation, and this was'determined not to involve a condition that was outside the design bases of the plant.This potential difference, regarding the minimum required number of SW pumps, has been analyzed by RG&E, submitted to the NRC, and is currently under review.AUXILIARY FEEDWATER AF In 1988, RG&E initiated EWR 4749 to perform its first internal safety system functional inspection (SSFI).The AFW system was selected.The SSFI was conducted by a third-party consultant and represented more than 1500 man-hours of effort over a three month period.The results of that SSFI indicated that the lack of easily accessible design, operational, and maintenance information was a programmatic deficiency which was the root cause of a majority of the findings of that SSFI inspection.

The SSFI resulted in 73 observations.

Each observation was evaluated and a recommendation for resolution was made.The observations were either satisfactorily resolved or tracked long-term by RG&E QA/QC.The AFW SSFI alerted management to the need for, and initiated, many of the configuration and design bases efforts conducted by RG&E in the 1990s (described elsewhere in this report).Specific observations made during this SSFI were:~Lack of" adequate testing of system motor-operated valves (MOVs)and check valves~Need for improved document control~Need for increased detail in the work control procedures

~Need for upgrade to the maintenance history files~Need for improved design control, including checklists for uniformity of design~Need for improved work prioritization and tracking~Need for enhanced root cause tracking, trending, and analysis.INSTRUMENT AIR IA As part of the response to industry concerns as well as NRC requirements (Generic Letter 88-14)for review of IA systems, RG&E performed an Auxiliary System Functional Inspection (ASFI)of the IA systems at Ginna.This inspection was an in-depth investigation into the design adequacy and operational readiness of the IA system.The ASFI was conducted by a third-party consultant who concluded that the IA system was capable of reliably delivering high quality air to IA loads in sufficient volume to meet design requirements.

No deficiencies affecting the ability of safety-related equipment to perform design functions were discovered during the ASFI.The ASFI did recommend that RG&E perform a repair vs.replacement cost-benefit analysis for the compressors.

The"C" IA compressor was subsequently replaced with a new, screw-type compressor.

10CFRS0.54(f)

Response-Attachment E Final Rcport Page 78 2/1/97

\.t/zv