NRC CM Pilot Inspections Methodology and Results John Reddington /Bill Kline FENOC September 19, 2018 Cleveland 2005

What Are We Talking About? NRC Margin Management Pilot Inspections NRC Temporary Instruction (TI) 2515/158 Functional Review of Low Margin/Risk Significant Components and Human Actions Four Pilot Inspections Completed Vermont Yankee -- 8/9-9/3/2004 - Region I V. C. Summer -- 10/4-11/19/2004 - Region II Diablo Canyon -- 1/3-2/15/2005 - Region IV Kewaunee -- 1/24-2/18/2005 - Region III September 19, 2018 Cleveland 2005

NRC Pilot Objectives Reactor Oversight Process (ROP) Possible replacement methodology for SSFI SSFI findings often very low safety significance Extent of conditions were therefore not investigated Focus design and engineering inspection effort Areas with high safety significance Areas most susceptible to design errors Assess results of pilot inspections Determine whether changes to ROP are warranted Improve inspection effectiveness in design/engineering area September 19, 2018 Cleveland 2005

Pilot Methodology Focus on Risk and Margin Components w/ high PRA worth and low margin Include non-safety related system components Review key operator actions credited in PRA Investigate design and operating margins Impact of recent plant modifications Extended power uprate challenges (where applicable) Effect of Operating Experience (OE) Look at integrated effects from multiple areas September 19, 2018 Cleveland 2005

Pilot vs. SSFI Differences Pilot Inspection Activities Not limited to one or two plant systems Significant effort focused on relevant OE Sample not limited to mitigating system components Extent -of-condition reviews for deficiencies Inspection report includes integrated assessment of performance weaknesses More resource intensive - approx. 700 Insp. Hrs. September 19, 2018 Cleveland 2005

Pilot Scope Selection September 19, 2018 Cleveland 2005

Review - Design Configuration Calculation Adequacy Design Assumptions Analysis Boundary Conditions Models Interfaces w/ non-safety related systems Modifications Design elements verified through testing September 19, 2018 Cleveland 2005

Review - Operational Configuration Physical configuration matches Including alignments of components Procedures direct proper operation Surveillance testing adequate Use of OE to address vulnerabilities Degraded conditions addressed Effective maintenance September 19, 2018 Cleveland 2005

Review - Operator Actions Component operation not restricted by temporary configurations Procedure adequacy Operator training Action Initiators (alarms, etc.) functional Ingress/egress paths maintained September 19, 2018 Cleveland 2005

Pilot Inspection Findings 28 “GREEN” Findings across four sites 24 represent Non-Cited Violations (NCVs) All categorized very low safety significance 26 associated w/ Mitigating Systems Cornerstone General Categories/Classifications Inadequate procedures Inadequate translation of design basis Untimely corrective action for long-standing issues September 19, 2018 Cleveland 2005

Qualitative Rigor Assessment Engineering Programs Calcs, GL 91-18, IST, Configuration Mgmt. Design Bases Information Retrieval Control/Translation of Design Assumptions Maintenance Rule Compliance Procedural Adequacy CAP effectiveness in resolving problems Use of applicable Operating Experience (OE) September 19, 2018 Cleveland 2005

CM Model Functions #1 Protect the Design Basis #2 Modify the Plant #3 Design Basis Configuration #2 Modify the Plant Engineering Change Control #3 Operate the Plant Operational Configuration Control #4 Maintain the Plant Configuration of SSCs not in service #5 Test the Plant Plant Design Validation September 19, 2018 Cleveland 2005 25

Protect the Design Basis Pump low pressure trip not adequate to protect from air entrainment Inadequate relay setpoint tolerances Did not perform & control battery sizing calcs Incorrect/non-conservative voltage values Failure to establish design limit in calc Inadequate electrical coordination Had not completed “coping” analysis September 19, 2018 Cleveland 2005

Operate the Plant Failure to correct long-standing problem w/ automatic operation of a valve Poor coordination of procedure revisions Failure to verify minimum flow settings Lack of procedure to cross-tie trains Manual action timeframe not achievable Removal of critical procedural steps Increase likelihood & duration of SBO September 19, 2018 Cleveland 2005

Test the Plant Lack of proper testing methodology Procedures did not include acceptance limits Inadequate procedures for demonstrating operability Failure to perform adequate review of procedure changes - 50.59 adverse effects Failure to demonstrate load sequencing requirements September 19, 2018 Cleveland 2005

Programmatic Concerns Weak control of design products Electrical system analyses not retrievable or inadequate Operability evaluations incorrect Control of calculations Superceded calcs supplied to inspectors Resolution of long-standing issues Retrieval of design basis information (DBI) September 19, 2018 Cleveland 2005

Insights Know your design margins Basis for what is adequate Where it is eroded or challenged Be able to validate assumptions from the past Control of calculations and revision history Capitalize on existing employee knowledge Identify eroded/missing information Identify links between calcs, drawings, procedures September 19, 2018 Cleveland 2005

Conclusions DBI Integrity Issues Know where your gaps are Prioritize resolution based on risk insights Quantify extent of condition Identify and resolve programmatic issues Ensure what we are testing validates what we designed Integrate knowledge/experience derived from CAP and OE Programs September 19, 2018 Cleveland 2005

Questions/Discussion September 19, 2018 Cleveland 2005