1. Configuration Management Fundamentals including Margin Management
Bill Kline
FirstEnergy Nuclear Operating Company (FENOC)
June 11-14, Richmond, VA

2. CM Fundamentals CM Equilibrium Objective of Configuration Management
Margins Using CM to protect Design and Operating Margins
CM Process Model Restoring CM Equilibrium
Functional Areas Five Functional Areas of CM
CM Equilibrium
This module describes a well established, widely accepted model of the equilibrium state of Configuration Management in nuclear power plants.
CM Process Model
This module describes the processes that are used to return a plant to the equilibrium state.
Design and Operating Margins
This module describes how CM is used to protect design and Operating Margins
Functional Areas
This module demonstrates how Configuration Management applies to the normal everyday functions performed by most organizations across the site.

3. What is CM Equilibrium?
In its simplest terms Configuration Management is what we do to assure ourselves and our regulators that we are doing everything we said we would do.
The objective of Configuration Management is the conformance of the three elements represented by the CM Equilibrium Model
This same figure is used in the following standards to represent the objective of nuclear power plant Configuration Management. It has been alternatively called the “CM Triangle” and “Three-Ball Model”
ANSI / NIRMA CM
“Configuration Management of Nuclear Facilities”
In 2000, the American National Standards Institute (ANSI) adopted this standard on Configuration Management, which was based on TG-19, a technical guideline from the Nuclear Information and Records Management Association (NIRMA).
IAEA TECDOC-1335
“Configuration Management Guideline” issued Jan 2003
In 2003, the International Atomic Energy Agency (IAEA) adopted this guideline document, which contains many of the same features as the ANSI standard.

4. CM Equilibrium
Design Require- ments
Design Requirements technical requirements, derived from the design process, that are reflected in the final design.
What Needs to be there
Design characteristics and bounding parameters needed for the design to work
Must be verified or monitored to confirm that design is valid
Examples of Design Requirements
Pump performance parameters
In the design process a pump is selected with certain performance characteristics (pump curve). In order for the design to be valid, the pump must continue to meet those performance characteristics. We do periodic testing to verify that the pump performance meets the pump curve (doesn't matter if pump is safety related or not)
Lake Level
In the design process, a minimum lake level is assumed that would provide adequate suction head (NPSH) to a safety related pump. This value (with margin) is recorded as a Tech Spec limit. If we have a drought and the lake level falls below the limit, we invalidate the design and have to shut the plant down. (Even if it wasn't a nuclear plant the example applies – except for the tech specs)

5. CM Equilibrium Facility Configuration Information (FCI)
documentation that defines how the plant is designed and how we operate it.
What we say is there
Design Output Documents
Operational Configuration Documents
Other Operating, Maintenance, Training and Procurement Information
Facility Config Info
Examples of Facility Configuration Information
Design Output Documents
engineering drawings, design specifications
describes how the plant is designed This would include the pump curve from the manufacturer.
Operational Configuration Documents
technical procedures used to manipulate components, equivalent replacements
describes how the plant is operated in different configurations while staying with design envelope
Other Operating, Maintenance, Training and Procurement Information
maintenance procedures, training lesson plans, procurement specs, testing, retest manual
plant documents that allow components to be worked on while they’re out of service or are used to train personnel.
This would include the completed periodic test that verified the pump performance meets the pump curve

6. Physical Configuration
CM Equilibrium
Physical Configuration
actual physical location, arrangement and material condition of SSCs
What is actually there
SSCs installed (design configuration)
component position (operating configuration)
Physical Config
An example would be the actual pump performance that is verified to meet the pump curve from the manufacturer

7. Work Processes must assure that:
CM Equilibrium
Work Processes must assure that:
Elements conform all the time processes in place to restore CM Equilibrium if it is lost
All Changes are Authorized people are trained and qualified
Conformance can be verified determine what configuration is and prove it was done correctly
Design Require- ments
Physical Config
Facility Config Info
Elements conform all the time When a non-conformance exists, processes are in place that will assure that the CM Equilibrium is reestablished.
All Changes are Authorized This assures that changes are acceptable from the standpoint of safety and design and assures that people are trained and qualified.
Conformance can be verified You have to document what’s there before you do anything, document what you plan to do, and document what you did after you did it.

8. CM Equilibrium Upsets
Upsets Between Design Requirements & Facility Configuration Information
errors in analysis, design inputs
errors in licensing documents
Operating procedure invalidates design calculation (response time)
desired changes, such as power uprating
Design Require- ments
Facility Config Info
These are examples of where the Design Requirements change or the Facility Configuration Information is found out of compliance with the Design Requirements.

9. CM Equilibrium Upsets
Upsets Between Physical Configuration & Facility Configuration Information
drawing / plant discrepancies
components in wrong position
maintenance errors that affect plant configuration
desired changes: modifications, manipulating plant components
Physical Config
Facility Config Info
Most common occurrence of an upset in CM Equilibrium.
When the plant and the documents don’t match, people in the design organization are likely to say “The plant doesn’t look like the drawing” and people in operations are likely to say “The drawing doesn’t look like the plant” The first thing to do is to find out which one meets the Design Requirements.
For example, valve “A” is installed but equipment database says that valve “B” is installed. You must first perform an evaluation to determine if valve “A” or valve “B” or both meet the Design Requirements.
If “A” doesn't meet Design Requirements, it must be replaced.
If “A” is okay it may be more cost effective to revise database.
Similar process is used to evaluate a component that is found out of its expected position.
For new plants, many errors are uncovered during start-up when the Architect Engineer turns over documents to the Owner.

10. CM Equilibrium Upsets
Upsets Between Physical Configuration and Design Requirements
failure of SSC to meet performance criteria as designed
equipment out of tolerance
unexpected degradation in performance of SSCs
Design Require- ments
Physical Config
As plant components age or break they may not meet the performance requirements that were assumed in the original design.
This is why we constantly monitor their condition and performance using established programs, such as:
field walkdowns, including operator rounds
component testing & performance monitoring
erosion & corrosion monitoring

11. CM EquilibriumMargins
NSD 106.7
Figure 106-3
Design Basis
Design Configuration
Operational Configuration
Protect the Design Basis
Design Configuration conforms to Design Basis
Operational Configuration conforms to Design Configuration
Operational configuration is conservatively maintained within the design configuration, while the design configuration is maintained within the design bases.
This is the way we use Configuration Management to protect the design basis
Source: INPO AP-929
Each boundary has margins to protect these limits

12. INPO Margin Model Let’s view this cross-section Analyzed Design Limit
Operating Limit
Normal Operations
Operating Margin
Design Margin
Unanalyzed Margin
Range of Normal
Operation
Equipment /Function Failure
Source INPO model developed in 2005 to illustrate what is meant by Margin
Here is the fully developed model we have been building with the key elements of margin which we must manage:
We have the range of normal operations which we should not allow to become too tight for our operators
Operating margin which addresses normal events and events of moderate frequency
And Design margin which provides additional conservatism for some degradation issues and unanticipated conditions.

13. Margins Failure Point Undetermined depends on many variables
Documented in engineering calculation
Ultimate Capability
Analytical Margin
unanalyzed region
Analyzed Design Limit
Design Margin
controlled by Engineering
Operating Limit
Operating Margin
controlled by Operations
This is the model that appears in INPO AP-929, Rev 1, which was issued in 2005 Stress that
Operations controls the Operating Margin
Design Authority (Engineering) control Design Margin
Failure is not necessarily imminent in the Unanalyzed Region … only unanalyzed
Range of Normal Operation
Documented on design documents

14. describes one parameter only; different parameters may be interrelated
Margins
Failure Point Undetermined depends on many variables
Notes on Model
describes one parameter only; different parameters may be interrelated
direction may be positive or negative
doesn’t represent all possible limits and setpoints
gaps not intended to represent relative size of margins – may be zero
Documented in engineering calculation
Ultimate Capability
Analytical Margin
unanalyzed region
Analyzed Design Limit
Design Margin
controlled by Engineering
Operating Limit
Operating Margin
controlled by Operations
Model is limited to one parameter only because analysis is based on inputs and assumptions from several interrelated parameters.
For example the analysis assumes
Pressure = P0 Temperature = T0
If P0 is exceeded but T0 is not, the resultant stress may not exceed the allowable limit for stress.
Range of Normal Operation
Documented on design documents

15. Other Limits and Setpoints
Margins
Other Limits and Setpoints
Failure Point Undetermined depends on many variables
Documented in engineering calculation
Ultimate Capability
Regulatory Limit
Analytical Margin
unanalyzed region
Analyzed Design Limit
Design Margin
controlled by Engineering
Operating Limit
Operating Margin
controlled by Operations
Tech Spec Limit
This slide demonstrates how many limits and setpoints may be built into the design to ensure that margins are protected
Range of Normal Operation
Operator Alarm (HI-HI)
Documented on design documents
Operator Alarm (HI)

16. Margins Elevator Example
Failure Point – undetermined depends on many variables
Ultimate Capability
Analytical Margin
Analyzed & tested to 4650 lbs
Analyzed Design Limit
Design Margin
Dept of Labor - design for 25% passenger overload 4375 lbs
Operating Limit
Operating Margin
25% margin based on NC Department of Labor
Analytical margin includes large conservatisms built into cable design and manufacturing
Range of Normal Operation
Rated Load posted in elevator = 3500 lbs
100 – 600 lbs

17. Margins HVAC Example Original analysis:
Room temperature must be kept under 90° F to protect computers Note: vendor’s Operating Limit = utility’s Ultimate Capability
Analyzed Design Limit = 84° F, calculated for worst case conditions
Operating Limit =78° F to give operators time to take action (analysis assumption)
High Alarm is set at 75° F (warning of abnormal condition)
90° F
Analytical Margin
84° F
Design Margin
78° F
Operating Margin
Air conditioning unit on the roof of the Aux Bldg cools the room with the Operator Aid Computer
manufacturer says that computers must be kept at less than 90 degrees F
Our analysis shows a maximum room temperature of 84 degrees under worst case conditions (Analyzed Design Limit)
Operating Limit is 78 degrees - Operations has to take action (High Alarm goes off at 75 to give them time to take action
Normal operating range is less than 72 degrees
75° F
72° F
Normal Operation
OAC Room Temperature

18. Margins
HVAC Example
Over time margin is lost due to one or more of these causes:
heat loads added to room
lake temperature higher than analyzed
poor heat exchanger performance due to fouling
Normal Operation
Operating Margin
Analytical Margin
88° F
82° F
74° F
78° F
90° F
Design Margin
New Analyzed Design Limit (88°F) reduces Analytical Margin and
affects Operating Limit (78° to 82°)
affects Operating Margin
affects Alarm Setpoint (75° to 78°)
Over time things happen that impact the margin
Has your plant every experienced these?
other heat loads are added to room
we experience lake temperatures higher than we assumed in original analysis
raw water is hurting performance of heat exchanges more that we had assumed.
Normal operating range goes to 74 degrees
We run the calculations again using new inputs and the Analyzed Design Limit goes up to 88 degree
We get frequent nuisance alarms at 75 degrees, so we raise the Alarm Setpoint to 78
We raise the Operating Limit to 82 to allow time for operator action
Analytical Margin is now only 2 degrees = Vendors Limit (90F) – Analyzed Design Limit (88)
A new larger Air Conditioning Unit will provide greater cooling capacity
OAC Room Temperature

19. Roof Structural Analysis
Margins
HVAC Example
Larger air conditioning unit can restore room temperature margin but will
require more electrical power
increase weight on Aux Bldg roof
Normal Operation
Operating Margin
Design Margin
Analytical Margin
OAC Room Temperature
84° F
78° F
72° F
75° F
90° F
Voltage Analysis
Roof Structural Analysis
Normal Operation
Operating Margin
Design Margin
Analytical Margin
Bigger air conditioning unit results in
more power, which reduces available margin on breaker
increased weight on roof decreases available structural margin of roof.
…resulting in other margin losses

20. CM Process Model high level model
integrated processes used to return CM Equilibrium
developed in early 2002 by CMBG task force.
influenced content of industry guidance documents:
NEI Standard Nuclear Performance Model
INPO Operation Excellence Outcomes enablers
used by CMBG to develop CM Performance Indicators
This is a high-level model that describes the process for returning to CM Equilibrium.
Each site has detailed processes for:
changes in design configuration (modifications)
manipulation of operation configuration (operating procedures)
Evaluating and resolving discovered errors in Design Requirements, Facility Configuration Information or Physical Configuration (corrective action systems)

21. CM Process Model Evaluate Identified Problem or Desired Change
Change Design Requirements ?
Change Physical Configuration ?
Change Facility Configuration Information ?
Evaluate Identified Problem or Desired Change
Do Nothing More No No No
CM Equilibrium
CM001
Yes
Yes
Yes
Design Requirements Change Process
Physical Configuration Change Authorization Process
Facility
Configuration Information Change Process
This step is identified in the NEI Standard Nuclear Performance Model as CM001.
Identify and evaluate the upset in the equilibrium.
discovered error (plant/drawing mismatch or mispositioned component)
desired change (modification or operational configuration change) .
At a high level the process is the same whether it’s a discovered error or a desired change.
First evaluate the problem or desired change. Usually this is done through the Corrective Action Program and/or the modification process.
Evaluate Identified Problem or Desired Change
apparent discrepancy (discovered error)
desired change (modification, manipulating plant components)

22. CM Process Model Change Design Requirements?
Change Physical Configuration ?
Change Facility Configuration Information ?
Evaluate Identified Problem or Desired Change
Do Nothing More No No No
CM Equilibrium
Yes
Yes
Yes
Design Requirements Change Process
Physical Configuration Change Authorization Process
Facility
Configuration Information Change Process
CM002
This step is identified in the NEI Standard Nuclear Performance Model as CM002.
Next step: Evaluate problem or desired change.
What are the Design Requirements?
Does this error or change affect the Design Requirements?
Are the Design Requirements correct or do they need to be changed?
If Design Requirement must be changed, use plant processes for changing Design Requirements.
This part of the process is what is described in INPO-929 for modifications “Configuration Control Process Description”
Change Design Requirements?
What are Design Requirements?
Does change affect Design Requirements?
Use Design Requirements change process

23. CM Process Model Change Physical Configuration?
Change Design Requirements ?
Change Physical Configuration ?
Change Facility Configuration Information ?
Evaluate Identified Problem or Desired Change
Do Nothing More No No No
CM Equilibrium
Yes
Yes
Yes
Design Requirements Change Process
Physical Configuration Change Authorization Process
Facility
Configuration Information Change Process
CM003
This step is identified in the NEI Standard Nuclear Performance Model as CM003.
Do I need to make a physical change?
If so, use normal change authorization process to implement physical change
Use work orders to replace a component within the modification process.
Use work orders to replace equivalent parts.
Use operating procedures to change the position of a component.
Change Physical Configuration?
Modify components or change position of components?
Use mod process to change design Configuration
Use operating procedures to change component position

24. CM Process Model Change Facility Configuration Information?
Change Design Requirements ?
Change Physical Configuration ?
Change Facility Configuration Information ?
Evaluate Identified Problem or Desired Change
Do Nothing More No No No
CM Equilibrium
Yes
Yes
Yes
Design Requirements Change Process
Physical Configuration Change Authorization Process
Facility
Configuration Information Change Process
CM004
This step is identified in the NEI Standard Nuclear Performance Model as CM004.
“The job is not complete until the paperwork is done”
Update documents (including databases) that need to be updated to match the physical configuration and file them as records.
For changes in operational configuration changes, file the documentation of completed procedure.
Any of these may be in electronic format.
Change Facility Configuration Information?
Design Output documents (drawings & specs)
Operational Configuration Documents
Other operating, maintenance, training, etc.

25. CM Process Model Do Nothing More
Change Design Requirements ?
Change Physical Configuration ?
Change Facility Configuration Information ?
Evaluate Identified Problem or Desired Change
Do Nothing More No No No
CM Equilibrium
Yes
Yes
Yes
Design Requirements Change Process
Physical Configuration Change Authorization Process
Facility
Configuration Information Change Process
In some cases no changes are needed and the most cost effective solution is to do nothing more.
Examples:
a misunderstood Design Requirement
faulty test equipment
a set point that can operate within it’s documented range.
Document your decision to no nothing more.
Do Nothing More
If cost effective, do nothing more…except
Document your conclusion

26. Functional Areas of CM #1 Protect the Design Basis
Design Basis Configuration
#2 Modify the Plant
Engineering Change Control
#3 Operate the Plant
Operational Configuration Control
#4 Maintain the Plant
Configuration of SSCs not in service
#5 Test the Plant
Plant Design Validation
This is one way to break down the normal functions in a nuclear plant to identify people who have a part in Configuration Management processes and show how they contribute.
This model does not necessarily match the organizational structure. For example, operational configuration may be maintained by Operations, Chemistry, Radiation Protection or others.
We use this model to tell people how CM applies to their job function and to help build performance measures.

27. Functional Areas of CM Protect the Design Basis
Objective: Understand and maintain design basis consistent with licensing basis design
Major processes
control of licensing and design basis documents (such as & UFSAR)
engineering calculations
Causes for upsets in CM Equilibrium
new or revised Design Requirements
inadequate original review
Many site organizations are responsible for understanding and maintaining the design basis:
Licensing negotiates regulatory commitments.
Design organization translates Design Requirements into plant design.
Operations must maintain awareness of Design Basis.

28. Functional Areas of CM Modify the Plant
Objective: Assure that changes to design configuration conform to Design Requirements and are accurately reflected on Facility Configuration Information
Major processes
modification process
Causes for upsets in CM Equilibrium
desired change (modification)
undocumented plant changes
Plant modifications usually change the Physical Configuration and may require changes to the Design Requirements
Design modification organization revises design to conform with Design Requirements,
Other organizations participate in the modification process
Operations revises operating procedures to conform with design.
Maintenance revises maintenance procedures to conform with design.
Training revises lesson plans.

29. Functional Areas of CM Operate the Plant
Objective: Assure that alignment of in-service equipment is consistent with approved design through use of approved technical procedures.
Major processes
operating procedures
tag out process
Causes for upsets in CM Equilibrium
failure to follow operating procedures
human errors due to workarounds, abandoned equipment, temp mods, etc.
Groups which operate plant systems and components may include:
Operations
Chemistry
Radiation Protection
Security
Maintenance

30. Functional Areas of CM Maintain the Plant
Objective: Assure that SSCs are procured and maintained in accordance with approved design
Major processes
maintenance procedures
procurement procedures
Causes for upsets in CM Equilibrium
failure to follow procedures
inadequate procurement QA
Groups which are responsible for configuration of SSCs that are not currently in operation:
Maintenance
Procurement (Supply Chain)
When a component is put in service or when it is returned to service it must conform to the documented design and the expected condition.

31. Functional Areas of CM Test the Plant
Objective: Assure the performance of SSCs meets Design Requirements
Major processes
performance testing
plant walkdowns
Causes for upsets in CM Equilibrium
inadequate performance testing programs
inadequate plant aging programs
Testing is used to assure that SSCs still meet the design requirements that were assumed in the current design

32. When you don’t have to do anything When it’s too late to do anything
“It’s what you do now
When you don’t have to do anything
That lets you be
What you want to be
When it’s too late to do anything
about it.”
Warren Owen, former Exec. VP Duke Power