Lessons Learned from

Early Implementation of

The Maintenance Rule at

Nine Nuclear Power Plants

u.s. Nuclear Regulatory Commission

Office of Nuclear Reactor Regulation

C. D. Petrone, R. P.Correia, s.c. Black
AVAILABILITY NOTICE

Availability of Reference Materials Cited in NRC Publications

Most documents cited in NRC publications will be available from one of the following sources:

1. The NRC Public Document Room, 2120 L Street, NW., Lower Level, Washington. DC

20555-0001

2. The Superintendent of Documents, U.S. Government Printing Office, P. O. Box 37082.

Washington, DC 20402-9328

3. The National Technical Information Service, Springfield, VA 22161-0002

Although the listing that follows represents the majority of documents cited in NRC publications, it is not intended to be exhaustive.

Referenced documents available for inspection and copying for a fee from the NRC Public

Document Room include NRC correspondence and internal NRC memoranda; NRC bulletins,

circulars. information notices, inspection and investigation notices: licensee event reports;

vendor reports and correspondence; Commission papers; and applicant and licensee documents and correspondence.

The following documents in the NUREG series are available for purchase from the Government

Printing Office: formal NRC staff and contractor reports, NRC-sponsored conference proceedings, international agreement reports, grantee reports, and NRC booklets and brochures. Also available are regulatory guides, NRC regulations in the Code of Federal Regulations. and Nuclear Regulatory Commission Issuances.

Documents avallable from the National Technical Information Service include NUREG-series

reports and technical reports prepared by other Federal agencies and reports prepared by the

Atomic Energy Commission. forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technical libraries include all open literature

items, such as books, journal articles, and transactions. Federal Register notices, Federal

and State legislation, and congressional reports can usually be obtained from these libraries.

Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference proceedings are available for purchase from the organization sponsoring the publication cited.

Single copies of NRC draft reports are available free, to the extent of supply, upon written

request to the Office of Administration, Distribution and Mail Services Section, U.S. Nuclear

Regulatory Commission, Washington DC 20555-0001.

Copies of industry codes and standards used in a substantive manner in the NRC regulatory

process are maintained at the NRC Library, Two White Flint North, 11545 Rockville Pike, Rockville. MD 20852-2738, for use by the public. Codes and standards are usually copyrighted

and may be purchased from the originating organization or, if they are American National

Standards. from the American National Standards Institute, 1430 Broadway, New York, NY

10018-3308.
Lessons 'Learned from

Early Implementation of

The Maintenance Rule at

Nine Nuclear Power Plants

Manuscript Completed: June 1995

Date Published: June 1995

C.D. Petrone, R.P. Correia, S.c. Black

Division of Technical Support

Office of Nuclear Reactor Regulation

U. S. Nuclear Regulatory Commission

Washington, DC 20555-0001

NUREG-1526

NRC FORM 335

12-891

NRCM1102. 3201.3202

2. TITLE AND SUBTITLE

U.S. NUCLEAR REGULATORY COMMISSION

BIBLIOGRAPHIC DATA SHEET

(see instructions on the reverse)

1. REPORT NUMBER

(Aulgnod by NRC. Add Vol.. Supp.• R.... II'Id Addendum Numbort.1f Inv.1

NUREG-1526

3. DATE REPORT PUBLISHED

4. FIN OR GRANT NUMBER

Lessons Learned From Early Implementation of The

Maintenance Rule at Nine Nuclear Power Plants

MONTH

June I YEAR

1995

5. AUTHOR(S)

C.D. Petrone, R.P. Correia, S.C. Black

6. TYPE OF REPORT

Final 7. PERIOD COVERED linc!u,ive Oa,e,)

NJA

B. PER FORMING ORGAN IZATION - NAME AND ADDRESS (If NRC, provide DivisiOn,Office or Region, U.S Nuclear Regula/ory CommlJSion, and mailing address; II contrector. provide

name and mailing BddlfJss.)

Division of Technical Support

Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission

Washington, DC 20555-0001

9. SPONSOR ING ORGANIZATlON - NAME AND ADDRESS III NRC, type "Same as above"; il contractor, provide NRC Dlvi,ion, Ollice or Region. U.S. Nuclear Regulatory CommlJSlon,

and mailing addre"-)

SAME AS ABOVE

10. SUPPLEME NT ARY NOTES

11. ABSTRACT 1200 word, or I8JSI

This report summarizes the lessons learned from the nine pilot site visits that were performed to

review early implementation of the maintenance rule using the draft NRC Maintenance Inspection

Procedure. Licensees followed NUMARC 93-01, "Industry Guideline for Monitoring the

Effectiveness of Maintenance at Nuclear Power Plants." In general, the licensees were thorough in

determining which structures, systems, and components (SSCs) were within the scope of the

maintenance rule at each site. The use of an expert panel was an appropriate and practical method

of determining which SSCs are risk significant. When setting goals, all licensees considered safety

but many licensees did not consider operating experience throughout the industry. Although

required to do so, licensees were not monitoring at the system or train level the performance or

condition for some systems used in standby service but not significant to risk. Most licensees had

not established adequate monitoring of structures under the rule. Licensees established reasonable

plans for doing periodic evaluations, balancing unavailability and reliability, and assessing the effect

of taking equipment out of service for maintenance. However, these plans were not evaluated

because they had not been fully implemented at the time of the site visits.

12. KE Y WORDS/DESCR:PTORS IList word, or ph"", ,he' will_I't reseerche" In locetlng the ropan.)

Maintenance Rule

Maintenance Rule Pilot Site Visits

10 CFR 50.65

NRC FORM 335 (2-891

13. AVAILABILITY STATEMENT

Unl imited 14. SECURITY CLASSIFICATION

(Thi, Pege)

Unclassified

(Thil Report)

Unclassified

15. NUMBER OF PAGES

16. PRICE

ABSTRACT

This reportsummarizes the lessons learned

from the nine pilot sitevisits that were

performed to review early implementation of

the maintenance ruleusing the draftNRC

Maintenance Inspection Procedure. Licensees

followed NUMARC 93-01, "Industry

Guideline for Monitoring theEffectiveness of

Maintenance at Nuclear PowerPlants." In

general, the licensees were thorough in

determining which structures, systems, and

components (SSCs) werewithin the scopeof

the maintenance rule at eachsite. The use of

an expert panel was an appropriate and

practical method of determining which SSCs

are risk significant. When setting goals, all

licensees considered safety but many licensees

111

did not consider operating experience

throughout the industry. Although required to

do so, licensees were not monitoring at the

system or trainlevel the performance or

condition for some systems used in standby

service but not significant to risk. Most

licensees had not established adequate

monitoring of structures underthe rule.

Licensees established reasonable plans for

doing periodic evaluations, balancing

unavailability and reliability, and assessing the

effect of taking equipment out of service for

maintenance. However, these plans were not

evaluated because they had not been fully

implemented at the time of the sitevisits.

NUREG·1526

CONTENTS

ABSTRACT , iii

EXECUTIVE Sillv1MARY vii

ACKNOWLEDGEMENTS IX

ABBREVIATIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. Xl

1 INTRODUCTION 1

1.1 Objective. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I

1.2 Need for the Maintenance Rule 1

1.3 Process-Oriented and Results-Oriented Rulemaking . . . . . . . . . . . . . . . . . . . . . . . . . 2

1.4 Description ofthe Maintenance Rule 3

1.4.1 Goals and Monitoring 3

1.4.2 Effective Preventive Maintenance 3

1.4.3 Periodic evaluation and safety assessments 4

1.4.4 Scope 4

1.5 Implementation 4

2 LESSONS LEARNED FROM PILOT SITE VISITS 7

2.1 Use ofIndustry Guideline NUMARC 93-01 7

2.2 Scoping 7

2.3 Risk Determination 12

2.4 Goal Setting, Monitoring, and Preventive Maintenance IS

2.4.1 Categorizing SSCs in Paragraph (a)(l) or (a)(2) 15

2.4.2 . Corrective Actions 18

2.4.3 Safety Consideration in Goal Setting 20

2.4.4 Industry Operating Experience in Goal Setting 21

2.4.5 Monitoring and Trending of Systems and Components 22

2.4.6 Monitoring and Trending of Structures 24

2.4.7 Functional Failures 26

2.5 Periodic Evaluations 27

2.6 Balancing Unavailability and Reliability 28

2.7 Plant Safety Assessments for Taking Equipment out of Service 29

3 CONCLUSION 33

v NUREG-1526

EXECUTIVE SUMMARY

The stafflearned several lessons while visiting

the nine pilot sitesto review early

implementation of the maintenance rule (the

rule). These siteswere visited to verify

usability and adequacy of the draftNRC

Maintenance Rule Inspection Procedureand

determine the strengths andweaknesses with

the implementation ofthe rule at each site.

This report presents the results of these site

visits to other licensees for their consideration

during theirimplementation of the rule. The

major findings for each subject area are

summarized below.

Use of Industry Guideline

Licensees implemented the rule using the

guidance inNUMARC 93-01, "Industry

Guideline for Monitoring theEffectiveness of

Maintenance at Nuclear Plants," May 1993,

which the NRCendorsed inRegulatory Guide

1.160, "Monitoring the Effectiveness of

Maintenance at Nuclear Power Plants,"

Revision 1, January 1995.

Scoping

Most licensees were thoroughin determining

which structures, systems, and components

(SSCs) are within the scope of the rule at their

sites. The licensees correctly classified most

safety-related SSCs and those non-safetyrelated SSCs whose failure could prevent

safety-related SSCsfrom fulfilling theirsafetyrelated function. Certain licensees incorrectly

missed classifying a few non-safety-related

SSCs as being within the rule. These systems

are relied upon to mitigate accidents or

transients or are used in emergency operating

procedures, or theirfailure could cause a

reactorscram or actuation of a safety-related

system. These systems included controlroom

annunciators, circulating water, reactor

coolant pump vibration monitoring, extraction

VIi

steam, condenser airremoval, screenwash

water, generator gas, and turbine lubeoil.

Risk Determination

The teamfound that each licensee had used a

well qualified expert panel to determine which

SSCswere risk significant. The use of an

expert panel that considers probabilistic risk

assessment (PRA)insights is an appropriate

and practical method of determining risk

significance. The expert panels at most sites

considered PRA insights usingrisk reduction

worth, risk achievement worth, core damage

frequency contribution, andFussell-Vesely

(FN) importance measures. However, the

expert panels at two sites did not receive the

results of all importance measures to consider

when determining risk significance.

Categorizing Structures, Systems, and

Components in Paragraph (a)(I) or (a)(2)

The process and procedures used by most

licensees for categorizing SSCsunder

paragraph (a)(l) or (a)(2) of the rule was

reasonable. However, some licensees were

reluctant to place SSCsin the paragraph (a)(I)

category because having SSCsin that category

would imply their preventive maintenance

programs were ineffective.

Corrective Actions

Licensees established effective corrective

action processes or programs. To implement

the maintenance rule, mostlicensees had

assigned primary responsibility for establishing

corrective actionto the system engineers; a

few licensees had assigned that responsibility

to an expert panel. Both approaches produced

acceptable results.

NUREG-1526
Safety Consideration in Goal Setting

Licensees established satisfactory programs for

taking safety into consideration when setting

goals.

Industry Operating Experience

Many licensees' procedures did not have

adequate guidance for ensuring that operating

experience was considered, where practical,

whenestablishing goals. In addition, licensees

had not established a systematic and consistent

method of collecting and using SSCreliability

and availability data from other licensees when

setting goals.

Monitoring and Trending of Systems and

Components

The SSCperformance or condition trending.

that was being performed by most licensees

was not well coordinated and integrated with

the goals and performance criteria established

under the rule.

Monitoring and Trending of Structures

Most licensees assigned low priority to the

monitoring of structuresunder the rule.

Several incorrectly assumed that many of their

structures are inherently reliable. The

performance criteria for monitoring some

structures were not predictive and did not give

early warning of degradation.

Periodic Evaluations

Two licensees had performed a periodic

evaluation beforethe site visit. The team

reviewed the results of these evaluations and

found that they generally met the requirements

of the rule. At the seven othersites, the team

reviewed the licensees' preliminary plans and

procedures for performing the periodic

evaluation and found them to be reasonable.

NUREG-1526 V111

Balancing Unavailability and Reliability

The preliminary plans established by all nine

licensees for balancing unavailability and

reliability were reasonable. However, the team

was unable to fully evaluate these activities

because these plans had not been implemented

at the time of the site visits.

Plant Safety Assessments Before Taking

Equipment Out of Service

Manylicensees developed matrices to define

which system combinations couldbe allowed

out ofservice at the same time. Several

licensees are planning to use real time(or

near-real-time) riskmonitors to calculate the

risk changes associated withthe planned

maintenance activities. Both the matrix

approach and the riskmonitor approach are

reasonable ways of assessing the effect on

plantsafety when taking equipment out of

service for monitoring or preventive

maintenance. However, the team did not

evaluate the effectiveness of eithermethod

because neither had been fully implemented.

Conclusion

Upon considering the observations made

during these pilot site visits, the team

concluded that the requirements of 10 CPR

50.65, "Requirements for Monitoring the

Effectiveness ofMaintenance at Nuclear

Power Plants," can be met by using NUMARC

93-01, "Industry Guidance for Monitoring the

Effectiveness of Maintenance at Nuclear

Power Plants," if the recommendations in this

report are taken into consideration. The team

also concluded that the performance-based

approach to implementing the rule is practical,

the draft inspection procedure can be used to

monitor the implementation of the rule, and the

existing PRA tools and models, used in

conjunction with an expert panel, are adequate

for purposes of taking risk into consideration

whenimplementing the rule.
ACKNOWLEDGEMENTS

The authors wish to acknowledgeMillardL.

Wohl for reviewing risk determination

methods and onlinemaintenance evaluations,

FrancisX. Talbot for evaluating plant systems

for inclusion in the scope ofthe maintenance

rule and preparingthe tables. The authors also

wish to acknowledge Jeffrey Main, who edited

this report.

NRC Team Members for the Nine Pilot Site

Visits

Thomas Foley, NRR

Ronald Frahm Jr., NRR

Wayne Scott, NRR

Francis Talbot, NRR

Dave Nelson, NRR

MelvinShannon, NRR

Jin Chung, NRR

Ed Ford, SRI, Waterford

Angel Coello, SpanishNuclear Safety Council

Steven Barr, Region I

James Stewart, Region I

Herb Williams, Region I

Tom Kenny, Region I

Tom Shedlosky, Region I

Paul 1. Kellogg, Region II

AI Walker, Region III

Wayne Shafer, Region III

Clark Vandemeit, Region III

IX

George Replogle, Region III

John Whittemore, Region IV

Licensee Representatives

Roger Murgatroyd, Florida Power

Corporation

Mark I. Forsyth, Houston Power and Light

Mark Ajluni, Georgia Power Corporation

Lewis A. Ward, Georgia Power Corporation

Keith A. Fry, Georgia Power Corporation

Thomas Bardauskas, Commonwealth Edison

Jon Anderson, Boston Edison Company

Don Hanley, Boston Edison Company

Jerry A, Kleam, Boston Edison Company

Ron J, Zula, CarolinaPower and Light

Martin Bridges, CarolinaPower and Light

Robert T. Biggerstaff, CarolinaPower and

Light

Robert Bickford, Maine Yankee Atomic

Power Company

William Drake, Maine Yankee AtomicPower

Company

Sammy Mooney, Entergy Operations Inc.

Tom H. Thurmon, Entergy Operations Inc.

NEI Representatives

Dan JRains

AdrianHeymer

RayNg

Tony Pietrangelo

NUREG-1526

1 INTRODUCTION

1.1 Objective

Thisreport summarizes the lessons learned

during the pilot sitevisits that a teamfrom the

U. S. Nuclear Regulatory Commission (NRC)

made from September 1994 to March 1995 to

review early implementation of the

maintenance rule. Themaintenance rule (the

rule), which was published on July 10, 1991,

as 10 CFR50.65, "Requirements for

Monitoring the Effectiveness of Maintenance

at Nuclear PowerPlants, It will take effect on

July 10, 1996. These reviews were performed

at nine nuclear power plant sites that had

volunteered for early review of their programs

for implementing the rule. The purpose of

these sitevisits was to verify usability and

adequacy of the draft NRCMaintenance Rule

Inspection Procedure and to determine the

strengths andweaknesses of the

implementation of the rule at each site. Other

licensees should consider thisinformation

whendeveloping programs for implementing

the rule. NRC inspectors may also use it while

evaluating licensees' implementation of the

rule.

1.2 Need for the Maintenance Rule

In the statements of consideration for the rule,

the Commission statedthat such a ruleis

needed because propermaintenance is essential

to plantsafety and because effective

maintenance is clearly linked to safety. Good

maintenance helps limit the number of

transients and challenges to safety systems by

ensuring operability, availability, and reliability

of safety equipment. Good maintenance is

important in ensuring that failures of

structures, systems, and components (SSCs)

other than safety-related SSCs that couldinitiate or adversely affect a transient or accident

are minimized. Minimizing challenges to

1

safety systems is consistent withthe

Commission's defense-in-depth philosophy.

Maintenance is also important to ensure that

design assumptions andmargins in the original

design basis are maintained or at least not

unacceptably degraded. Therefore,

maintenance at nuclear power plants is clearly

important in protecting the public health and

safety.

The results of the Commission's Maintenance

Team Inspections (MTIs) indicated that

licensees have adequate maintenance programs

and were improving implementation of their

programs. However, somecommon

maintenance-related weaknesses were found,

such asinadequate root cause analysis leading

to repetitive failures, lack of equipment

performance trending, and the need for

consideration of plant riskin the prioritization,

planning, and scheduling of maintenance.

TheCommission believes that the effectiveness

of maintenance must be assessed continually to

verify that key structures, systems, and

components are capable of performing their

intended function. Further, licensees need to

consider revising programmatic requirements

where poor assessment results indicate

ineffective maintenance.

However, despite significant industry

accomplishment in the areas of maintenance

program content and implementation, plant

events caused by the degradation or failure of

plant equipment continue to occur as a result

of instances of ineffective maintenance.

Additionally, operational events have been

exacerbated by, or resulted from, plant

equipment being unavailable because of maintenance activities. Most existing requirements

and industry maintenance initiatives do not call

for licensees to routinely assess the availability

ofsafety significant structures, systems, and

NUREG-1526
components. These eventsand circumstances

attest to the need to continually assessthe

results of maintenance effectiveness since,

together with equipment reliability, equipment

availability is an important measure of

maintenance effectiveness.

The Commission also recognizes its need to

broaden its capability to take timely

enforcement actionwhere maintenance

activities failto give reasonable assurance that

safety-significant SSCs are capable of

performing their intended function.

Additionally, the Commission concluded that it

is necessary for NRC to include requirements

for corrective action to addressinstances of

ineffective maintenance, and for licensees to

use the results of monitoring and assessment to

improve maintenance programs.

The Commission also had several other

reasons for finding the need for a rule requiring

that the effectiveness of maintenance be monitored. One of these reasonsis that the

Commission's currentregulations, regulatory

guidance, and licensing practice do not clearly

define the Commission's expectations for

ensuring the continued effectiveness of

maintenance programs at nuclear power plants.

Anotheris that industry has no guidance

regarding the monitoring of maintenance

effectiveness.

Requirements and guidance for monitoring

maintenance effectiveness and for taking

corrective action whenmaintenance is

ineffective should enhance the Commission's

capability to take timely and effective action

against licensees with inadequate or poorly

conducted maintenance to ensure prompt

resumption of effective maintenance activities.

On July 10, 1991, the Commission published

the final rule, 10 CFR 50.65, in the Federal

Register. Whenthe rule takes effecton July

10, 1996, it will require all nuclear power plant

licensees to monitor the effectiveness of mainNUREG-1526 2

tenance activities. The rule provides for

continued emphasis ofthe defense-in-depth

principle by including selectbalance-of-plant

(BOP) SSCs, integrates risk consideration into

the maintenance process, establishes an

enhanced regulatory basisfor inspection and

enforcement of BOP maintenance-related

issues, and givesa strengthened regulatory

basisfor ensuring that the progress achieved is

sustained in the future.

1.3 Process-Oriented and ResultsOriented Rulemaking

Although they do not appear to have a formal

definition, the termsprocess-oriented (or

programmatic, or prescriptive) and resultsoriented(or results-based, or performancebased) are increasingly being used to describe

various rulemaking activities. A processoriented rule, the traditional approach for most

rulemaking, includes detailed requirements or

instructions. The advantage to such rules is

that they are easierto enforce because the

requirements for implementing the rule are

delineated in greater detail than would be the

case for results-oriented rules. Using a

process-oriented rule, licenseesgenerally have

a clearerideaof what they need to do to

implement the requirements ofthe rule, and

NRC inspectors have a cleareridea of what to

inspect. The disadvantage to such rules is that

they tend to be inflexible and thus mayprevent

licensees from using the most efficient and

effective means of implementing the rule. Two

examples of process-oriented rules are

Appendices J (primary Containment Leakage

Testing) and R (Fire ProtectionProgram for

NuclearPower Facilities) to 10 CFRPart 50.1

1 Although Appendix J ruleis a good example of

a process-oriented rule, theNRC isrevising this rule

to add a results-oriented option permitting licensees

the flexibility to adjust leak rate test frequencies

basedon performance.
These rules containdetailed requirements for

test frequency, test pressures, training, and

record keeping.

A results-oriented (or results-based or

performance-based) rule describes, in general

terms, the results expected while leavingthe

details of achieving those results up to the

licensee. Such a rule has the advantage of

allowing the licensee to devise the most

effective and efficient means of achieving the

results described in the rule. It also allows

licensee to consider safety or risk significance

when developing its programs. The

disadvantage of a results-oriented rule is that it

may be difficult to enforcebecause the

requirements for compliance may be less

clearly defined than the requirements of a

process-oriented rule. The maintenance rule,

10 CFR50.65, is a results-oriented rule?

Although licensees clearly preferresultsoriented regulations over process-oriented

regulations, such regulations lack of detail as

became apparent during the development of

regulatory guidance for the rule. The Nuclear

Management andResources Council, Inc,

(NUMARC) now the NuclearEnergyInstitute

(NEI), representing the industry, asked that the

inspection procedure (which is normally

developed after the regulatory guidance has

been issued) be prepared early and giventhem

to use while preparing the industry guidance

document. Theywanted to use the inspection

procedure to addressdetails, not in the rule

itself. Results-oriented rules place a greater

2 Although the maintenance rule has been

described asa results-oriented rule, it prescribes

certain specific programmatic actions. For example,

paragraph (a)(3) requires that a periodic evaluation

beperformed and that the effect ontotal plant risk

beconsidered before removing equipment from

service for maintenance. Therefore, while the

maintenance rule ismuch more results-oriented and

less programmatic than most other existing rules, it

has certain process-oriented elements.

3

burdenon licensees to develop the supporting

details needed to implement the rule.

1.4 Description of the Maintenance

Rule

Section (a) of the rule contains most of its

detailed technical requirements; paragraph (b)

defines the scope of structures, systems, and

components within the rule; and paragraph (c)

states that the licensees shall implement the

rule no later than July 10, 1996. Section(a)

consists of paragraphs (1), (2), and (3).

1.4.1 Goals and Monitoring

Paragraph(a)(I) of the rule requires the

operator of each power reactor to set goals

andto monitor the performance or condition

of SSCs in a manner sufficient to give

reasonable assurance that those SSCs are

capable of performing their intended functions.

The rule states the goals mustbe

commensurate with safety and where practical

take into accountindustry-wide operating

experience. The rule also requires operators to

take appropriate corrective action whenthe

performance or condition of an SSC does not

meet established goals. In keeping with the

non-prescriptive intentof the rule, the licensee

establishes the goals, not the NRC.

1.4.2 Effective Preventive Maintenance

Paragraph (a)(2) ofthe rule establishes an

alternative approach to the monitoring regime

required by paragraph (a)(I) of the rule. The

NRC recognizes in this approachthat, in

certaincases, the performance or condition of

SSCs could be effectively controlled by doing

adequatepreventive maintenance rather than

bymonitoring against goals.

NUREG-1526
1.4.3 Periodic evaluation and safety

assessments

Paragraph (a)(3) of the rule requires that

performance- and condition-monitoring

activities and associated goals and preventive

maintenance activities be evaluated at least

every refueling cycle, provided the interval

between evaluations does not exceed 24

.months. Thisparagraph will require licensees

to systematically review activities under

paragraphs (a)(I) and (a)(2) of the rule and to

adjustthose activities where needed. These

evaluations are required by the rule to take

into account, wherepractical, industry-wide

operating experience.

Paragraph (a)(3) ofthe rule also requires that

adjustments be made, where necessary, to

ensure that the objective of preventing failures

of SSCsthrough maintenance is appropriately

balanced against the objective of minimizing

the time SSCsare unavailable because of

monitoring or preventive maintenance. This

requirement recognizes that performing

monitoring or preventive maintenance often

requires that the SSCs be taken out of service,

rendering themunavailable for operation. The

higher reliability gained by increased monitoring or preventive maintenance could

decrease availability, and possibly impair

safety.

Paragraph (a)(3) of the rule also states that in

performing monitoring and preventive

maintenance activities, an assessment of the

total plant equipment that is out ofservice

should be considered to determine the overall

effect on performance of safety functions. To

address this element of the rule, licensees

should continually evaluate whether voluntary

removal of equipment from service to perform

monitoring and preventive maintenance

activities may place the plant in a less safe

condition, especially if other supportive

equipment is out of service. An example of

NUREG-I526 4

this type of situation might be taking one train

of a safety system out of service while one of

the alternate sources of powersupply for the

redundant train is also out ofservice.

Although the technical specification operability

requirements address this concern, the NRC

staffrecently found vulnerabilities not

addressed bythe technical specifications. The

requirements ofthis paragraph ofthe rule

extend beyond those of the technical

specifications.

1.4.4 Scope

Paragraph (b) of the rule defines those SSCs

that mustbe included within the scope ofthe

rule. Theyinclude allsafety-related SSCs and

those non-safety-related SSCs (1) that are

relied upon to mitigate accidents or transients

or are used in emergency operating procedures

(BOPs), (2) whose failure couldprevent

safety-related SSCsfrom fulfilling their

intended functions, or (3) whose failure could

cause a scram or safety system actuation.

1.5 Implementation

To develop implementation guidance, the NRC

andNUMARC established parallel steering

and working groups. In June 1993, the NRC

published Regulatory Guide 1. 160,

"Monitoring the Effectiveness of Maintenance

at Nuclear Power Plants," which endorsed

NUMARC 93-01, "Industry Guideline for

Monitoring theEffectiveness of Maintenance

at Nuclear Power Plants," May 1993.

NUMARC sponsored two industry workshops

in August 1993 to educatethe industry on the

methods stated in NUMARC 93-01 for

implementing the rule. The NRC staff

participated in theseworkshops.

TheNRC staffdeveloped a draft inspection

procedure to verify implementation of the rule.

On March 31, 1994, NRC sponsored a public

workshop inRockville, Maryland, where
members ofthe public and the nuclear industry

could ask questions about the inspection

procedure. At the workshop, NRC explained

its expectations about implementation ofthe

rule.

Beginning in September 1994 and ending in

March 1995, the NRC staff visited nine pilot

sites to validate the draft inspection procedure.

The licensees for these plants had voluntarily

implemented most ofthe requirements ofthe

rule, which does not become effective until

July 10, 1996. NRC coordinated with NEI in

selecting the sites: Grand Gulf, Maine Yankee,

Shearon Harris, Pilgrim, Byron, Hatch, Vogtle,

5

South Texas, and Crystal River. The NRC

review teams included representatives from the

Quality Assurance and Maintenance Branch

and the Probabilistic Safety Assessment

Branch from the Office ofNuclear Reactor

Regulation (NRR), representatives from the

Trends and Patterns Analysis Branch from the

Office for Analysis and Evaluationof

Operational Data (AEOD), and regional

inspectors. This report summarizes the lessons

learned from the site visits for the benefit of all

licensees and NRC inspectors and for the staff

to use in completing the inspection guidance.

NUREG-1526

2 LESSONS LEARNED FROM PILOT SITE VISITS

The NRC staff documented their findings,

conclusions, and recommendations in letters to

the individual licensees following each site

visit. These reports addressed each of each

requirement ofthe rule, such as scoping and

risk determination, as a separate topic.

2.1 Use of Industry Guideline

NUMARC 93-01

The guidance in NUMARC 93-01 was

endorsed in Regulatory Guide 1.160 as

containing acceptable methods of

implementing the rule. All nine licensees used

NUMARC 93-01 for implementing the rule.

Eight licensees took minor exceptions that the

NRC review team reviewed and found

acceptable. One licensee took major

exceptions that the team reviewed and also

found acceptable.

2.2 Scoping

Before visiting each site, the team reviewed

the plant final safety analysis report (FSAR),

EOPs, and Individual Plant Evaluation (IPE)

insights to select sample SSCs that the team

believed were within the scope ofthe rule.

The team used this sample list to determine

whether the licensee had classified the required

SSCs as being within the scope as defined in

paragraph (b) ofthe rule.

At each site, the team reviewed the process

and procedures used by the licensee to

determine which SSCs were to be included

from the scope ofthe rule and which were

excluded.

Findings

Most licensees followed the scoping process

described in NUMARC 93-01 and included the

7

majority of SSCs the team believed should be

within scope. However, the following are

examples of excluded SSCs from various sites

that the team believed should be within the

scope ofthe rule at that particular facility:

1. Control room annunciators. The

justification for excluding control room

annunciators, which constitute a nonsafety-related system used in EOPs, from

the scope ofthe rule did not follow the

guidance in paragraph 8.2.1.3 of

NUMARC 93-01, which allows SSCs

covered by paragraph 50.65(b)(2)(i) to be

excluded if they do not add "significant

value to the mitigation function." The

licensee based its decision on the fact that

the annunciators are redundant to other

safety-related instruments such as gauges

and chart recorders, which are considered

the primary instruments used in EOPs.

However, the annunciators add significant

value to the mitigation function because

they will often give the first warning of an

out-of-tolerance condition or developing

accident. The team discussed this concern

with several ofthe licensee's control room

operators, who confirmed that control

room annunciators often gave them the

first warning of a problem. The team

concluded that those annunciators, which

are used in the EOPs, do add significant

value to the mitigation function and

therefore are within the scope ofthe rule.

2. Site grounding system. The licensee's

documentation states that the site

grounding system is a "non-safety-related

SSC whose failure causes trip/power

reduction." Therefore, the site grounding

system should be included within the scope

of paragraph 50.65(b)(2)(iii) ofthe rule.

The licensee excluded this system from the

NUREG-1526
scope of the rule because "the plant has not

experienced significant problems with

system in the past." The teambelieves that

the licensee hasmisinterpreted paragraph

(b)(2)(iii) of the rule, which states that

non-safety-related SSCs "whose failure

could cause a reactorscram or actuation of

a safety-related system" [emphasis added]

shall be included within the scope of the

rule. The licensee hasinterpreted this

requirement to meanhas caused rather

thancould cause. The teambelieves that

thisinterpretation isincorrect.

3. Circulating water system. Paragraph

(b)(2)(iii) of the rule requires that all

non-safety-related SSCs whose failure

couldcause a reactorscram or the

actuation of a safety-related system be

included within the scope of the rule. The

teambelieves that the circulating water

system falls under this provision since its

failure could cause a turbine trip and

subsequent reactorscram. The licensee's

representative stated that they had

considered including the circulating water

system under the scope but had decided

against it for several reasons. The team

members discussed each of these reasons

with the licensee's representatives and

stated the team's views on eachof these

reasons. A summary of the issues follows.

High reliability. The licensee stated that

the design of the circulating watersystem

makes it very reliable. The cooling pondis

man-made and istherefore not subject to

the causes of fouling (debris, plant, or

animal life) that plague natural sourcesof

cooling water at other reactorsites. They

stated that reliability this is evidenced by

the fact that the site has neverexperienced

a loss of circulating water that resulted in a

reactorscram or safety system actuation.

Therefore, they concluded that the

NUREG-1526 8

circulating water system did not meet the

criteria of paragraph (b)(2)(iii) of the rule.

The team disagreed with this position.

Paragraph (b)(2)(iii) of the rule states that

non-safety-related SSCswhose failure

could cause a reactorscram or safety

system actuation should be included within

the scope of the rule. Nothingin the rule

itself, the statements of consideration,

Regulatory Guide 1.160, or NUMARC 93-

01, indicates that the reliability should be

considered when determining whether a

system is underthe scope of the rule. The

phrase beginnning withwhose failure

means that the system is assumed to fail.

The onlyquestion is whetheror not the

assumed failure could causea subsequent

reactorscram or safety system actuation. 3

Redundant trains The licensee also made

the argument that since the circulating

watersystem has four trains(each

consisting ofscreens, pumps, and piping) it

would be unreasonable to assume that the

whole system couldfail. If only one train

failed, the plant could continue operation,

or take action to reduce power and avoid a

reactorscram or safety system actuation.

The teamdisagreed with this position. A

failure of the system mustbe assumed

since it would be the worst case scenario.

3 Paragraph (b)(2)(ii) of the rule requires that

non-safety-related structures andcomponents

"whose failure could prevent safety-related

structures, systems, andcomponents from fulfilling

theirsafety-related function" be included withinthe

scope of the rule. Similar to the argument for

paragraph (b)(2)(iii), thewords whose failure mean

thatthe failure is assumed. Thecriteria areonly

intended to determine if the assumed failure of the

system could prevent a safety-related system from

fulfilling itssafety-related function. Therefore-the

system is assigned a reliability of zerofor this

analysis because it is assumed to fail.
The licensee's approach of assuming a train

failure is not conservative and does not

meet the intent of paragraph (b)(2)(iii).

Operator action The licensee made the

argument that in the unlikely event that the

entire circulating water system failed, the

reactor operators would be able to

. recognize the event in sufficient time to

take mitigating actions that would prevent

a reactor scram or safety system actuation.

The team disagreed with this position.

Operator action, or the lack ofit, is not a

criterion to be considered when making a

scoping determination under 10 CFR

50.65(b). Operator actions are not

discussed as a criterion in either the rule,

the statements of consideration,

Regulatory Guide 1.160, or NUMARC 93-

01.

Directly cause. Paragraph (b)(2)(iii) ofthe

rule requires that the scope ofthe rule

include all non-safety-related SSCs whose

failure could cause a reactor scram or the

actuation of a safety-related system. The

licensee interpreted this criterion to mean

that only those SSCs that directly cause a

reactor scram should be considered.

Therefore, a loss of circulating water that

caused a turbine trip and subsequently

resulted in a reactor scram should not

come under the scope ofthe rule because it

would not be a direct trip.

The team disagreed that could cause

should be interpreted to mean directly

cause. Nothing in the rule itself, the

statements of consideration, Regulatory

Guide 1.160, or NUMARC 93-01,

indicates that only those non-safety-related

SSCs that directly cause a reactor scram or

safety system actuation should be included

within the scope ofthe rule. The licensee's

use ofdirectly cause is not a conservative

interpretation ofthe rule.

9

Hypotheticalfailures. The licensee stated

that a failure ofthe circulating water

system was a hypothetical failure because it

had not happened at their site and was not

described in the safety analysis report or

any other analysis. Therefore, they believed

that they were not required to consider

such a failure under the guidance in

paragraph 8.2.1.5 ofNUMARC 93-01.

The team disagreed with the position taken

by the licensee. Paragraph 8.2.1.5 of

NUMARC 93-01 states that "[t]he

determination of hypothetical failures that

could result from system interdependencies

but have not been previously experienced

is not required. II In the section "High

Reliability" ofNUMARC 93-01, the

authors state the fact that the circulating

water system has not failed in the past does

not make this a hypothetical failure. Ifthe

circulating water system does fail, the

interactions that could result in a reactor

scram are not hypothetical; rather they are

the normal expected sequence of operation

ofthe plant. A loss or reduction in

circulating water would require a turbine

runback or trip, which could result in a

reactor scram. The team believes that the

hypotheticalfailures described in

NUMARC 93-01 refer to two or more

events (not previously experienced or

analyzed) that occur simultaneously and

result in a reactor scram or safety

actuation.'

Other examples. Other examples of SSCs

that the team believed should have been

within the scope ofthe rule at particular

sites follow: shield walls that separate the

4 Someof these issueswerediscussed withother

licensees duringprevious site visits. This discussion

is additional guidance to all licensees. The team

willrecommend revising the implementing guidance

to further clarifythis issue.

NUREG-1526
station startup transformers, plant

computer, heat tracing and freeze

protection, reactor coolantpump vibration

monitoring, lightning protection, cathodic

protection systems, extraction steam,

condenser airremoval, screen washwater,

gland steam, gland sealwater, generator

gas, turbine lube oil, and turbine generator

seal oil.

One licensee used a different interpretation of

the guidance contained inNUMARC 93-01 for

determining which non-safety-related SSCs

are relied upon to mitigate accidents or

transients or are used in plant EOPs under

paragraph (b)(2)(i) of the rule. NUMARC 93-

01, paragraph 8.2.1.3, states that onlythose

SSCsthat "add significant value to the

mitigation function of an EOP by providing the

total or a significant fraction of the total

functional ability required to mitigate core

damage or radioactive release" should be

included within the scope of the rule. In

attempting to evaluate which nonsafety

systems should be included underthis

provision of the rule, the licensee found

"significant fraction" a difficult criterion to use

NUREG-1526 10

in practice. Instead of using this criterion, the

licensee included in the scope those

non-safety-related systems considered to be

"significant contributors to the mitigation

strategy of the procedures." The licensee

defined significant contributors as those

"systems whose failure would affect the

outcome of successful completion of the

procedureor causethe user to transition to

another procedure." The teamconcluded that

the licensee's alternative criterion for

identifying SSCs inEOPs isreasonable and

meets the intent of the rule.

Table 1 is a summary of SSCsdefined by the

licensee as being within the scope of the rule at

each site and anyadditional SSCsfound by the

team. The teamfound considerable variation

even among similar plants in the numbers of

SSCs defined for each plant and considerable

variation in the numbers of SSCsidentified as

being within the scope of the rule. The

numbers in thistable are for general

information and should not be used for judging

the acceptability of the scoping activities at

othersites.
Table 1. Structures, systems, and components under the scope ofthe Maintenance Rule)

BWR/3 BWR/4 BWR/6 WEST 3 Loop WEST 4 Loop WEST 4 Loop WEST 4 Loop CE B&W

Total number of 102 131 341 205 176 194 112 160 137

SSCs

Number of 67 86 1273 1154 1035 1006 767 1108 909

SSCs within (66%) (66%) (37%) (56%) (59%) (52%) (68%) (69%) (66%)

scope

Number of n.a." 6 16 15 6 17 23 328 79

structures

(only) within

scone"

NRC-identified None None 13 44 1~ }6 37 }8 159

SSCs requiring

reevaluation

......

......

1.

2.

3.

4.

5.

6.

7.

8.

0 9. I

...-

\Jl

N

0\

The data on this table is basedon a review ofthe licensee's documentation for rule implementation at the time ofeach NRC sib:: visit and is subject to change.

Three licensees were still evaluating structures under scope at the time ofthe NRC site visits (i.e., These include the licensees for utility data in columns one, eight a,nd nine);

therefore, the number ofstructures and the total number of SSCs under scope may change. All other licensees included structures under scope.

The licensee found 126 SSCs. The NRC recommended that control room annunciators beadded.

The licensee found 111 SSCs, The NRC recommended that the site grounding system, the plant computer, heat tracing and freeze protection and the reactor coolant pump

vibration monitor be added to the scope.

The licensee found 102 SSCs. The NRC recommended that the circulating water system be added to the scope.

The licensee found 82 out of 151 plant systems and 17 out of43 plant structures within scope. The NRC recommended that the extraction steam system beadded to the scope.

The licensee found 73 SSCs. The NRC recommended that the lighting protection, site grounding and cathodic protection be added to the scope.

The licensee found 109 SSCs under the scope ofthe rule; however, the NRC recommended that one additional structure, the shield wall around the startup transformers, beadded

to the scope.

The licensee found 7S SSCs. The NRC recommended that the circulating water, extraction steam, condenser air removal, screen wash water, gland steam, gland seal water,

generator gas, turbine lube oil, and turbine generator seal oil systems beadded to the scope. The licensee identified the reactor containment as the only structure that is under scope

and being monitored. The licensee considers the remaining structures to beinherently reliable. The NRC recommended that 6 additional structures (i.e., the auxiliary building,

control complex, emergency diesel generator building, intermediate building, NSSW intake structure, and the emergency feedwater tank enclosure) be added to the scope.

10. Utility continuing evaluation at the time ofsite visit.
Conclusion

The scoping at each site wasthorough. The

licensees correctly classified mostsafetyrelated SSCs(paragraph (b)(1) of the rule) and

those non-safety-related SSCswhose failure

could preventsafety-related SSCsfrom

fulfilling theirsafety-related function

(paragraph (b)(2)(ii) ofthe rule). The team

believes the licensees should have included

several other non-safety-related SSCswithin

the scope of rule: those relied upon to mitigate

accidents or transients, those used in EOPs

(paragraph (b)(2)(i) of the rule), and those

whose failure could cause a reactor scram or

actuation of a safety-related system (paragraph

(b)(2)(iii) of the rule). The number ofSSCs in

this category at each site follows: 0 SSCs at 2

sites, 1 SSC at each of 4 sites, 3 SSCs at 1

site, 4 SSCs at 1 site, and 15 SSCs at 1 site.

Recommendations

1. Do not use the following reasons for

excluding SSCsfrom the scope of the rule

because they do not address the criteria in

paragraph(b) of the rule.

• The SSC is very reliable, inherently

reliable, or has neverfailed at thissite.

• Redundant trains will prevent the

system from everycompletely failing.

• Operator actionswill prevent the

failure of the system from causing a

scram.

• The failure of the system will not

directly cause a scram.

2. Review scoping determinations to ensure

that no SSCs were excluded from the

scope of the rule without adequate

justification.

NUREG-1526 12

2.3 Risk Determination

The rule requires that goals be established

commensurate with safety. To implement the

rule in accordance withNUMARC 93-01, the

licensee must do a risk (or safety)

determination for all SSCswithin the scope of

the rule. This risk determination would then

be considered when settinggoals and

monitoring under paragraph (a)(I) of the rule

and when establishing performance criteria

under paragraph (a)(2). The risk

determination method recommended in

NUMARC 93-01 involves the use of an expert

panel using the Delphi method of

NUREG/CR-5424, supplemented by

probabilistic risk (or safety) assessment (PRA)

or IPE insights, to find risk-significant SSCs...

ThesePRA or IPE insights can include risk

reduction worth (RRW), risk achievement

worth (RAW), and core damage frequency

contribution (CDF).

Findings

The team found that alllicensees used an

expert panel (or a workinggroup) to

determine risk significance. These expert

panels considered PRA or IPE insights using

the methods described inNUMARC 93-01

although with variation. Not all licensees took

RRW, RAW, and CDF into consideration.

One licensee considered onlyCDF and not

RRW or RAW. Anotherlicensee considered

CDF and RAW but not RRW. Several

licensees considered the Fussell-Vesely (PN)

importance measure in addition to CDF,

RAW, andRRW.

The teamfound that licensees' PRA experts

were very knowledgeable and were aware of

the limitations of the use ofPRA insights. One

of these limitations is that allrisk-important

systems are not necessarily modeled in a PRA.

Improvements can also be madein databases,

successcriteria (which affect accident
sequence emphasis), and humanreliability

analyses. The team found an expert panelwas

necessary to compensatefor the limitations

and assumptions inherentin a PRA and to add

a perspective of experience to the risk

determination process. The team also found

that, althoughCDF, RRW, RAW, and FN all

gave usefulinsights, none was indispensable as

long as the results were reviewedand

evaluated by a qualified expert panel.

The team interviewed members of the expert

panel at each site and found that the panel

members were knowledgeable and experienced

and met the standardsrecommended in

NUMARC 93-01. The expert panelsmade

risk-significant determinations as

recommended in NUMARC 93-01. Those at

severalofthe sites participatedin other

maintenance activities such as scoping,

establishing performance criteria and goals,

determining when SSCs should be moved from

paragraph (a)(I) to (a)(2) and from paragraph

(a)(2) to (a)(1), reviewing corrective actions,

and doing the periodic evaluation required by

paragraph (a)(3) of the rule. However, some

licensees considered the expert panel to be a

temporary organizationand the performance

of the risk determinations to be a one-time

activity. Other licensees, especially those who

have decided to have their expert panel

participatein other rule activities, have made

13

.the expert panel a permanent part oftheir rule

program. The team believes that those

licensees who do not have a permanentexpert

panelwill need to reconstitute the expert panel

in the future to revise these risk determinations

as the plant is modified or when the PRA is

revised.

Six ofthe nine licensees planto update their

PRA using plant-specific reliability and

availability data to maintain a living PRA. The

intervals for these updates are tentative and

vary from one year to three years, or are

undetermined. The remaining three licensees

do not plan to update their PRAs routinely to

incorporate plant-specific reliability and

availability data. They did, however, state that

they would evaluate the effect of any major

plant modifications on PRA models, results,

and conclusions and update them if necessary.

The staff at the last few sites visited were more

aware of the value oftime-structuredPRAdetermined core damage frequency profiles.

These licensees had very strong PRA expertise

and benefitted from the,lessons learned from

the site visits. The team believes that all

licensees should share information and ideas

amongthemselves.

Table 2 summarizes the numberof SSCs that

were determined to be risk significant, and the

methods used at each site.S

S The team found considerable variation, even

for reactors ofsimilar type, inthe numbers of SSCs

defined for each plant and a considerable variation

inthe numbers of SSCs determined to berisk

significant. The numbers in this table are for

general information and should not beused for

judging theacceptability ofmaintenance rule

activities atother sites.

NUREG-1S26
9

-

VI

l'.)

0\

Table 2. Risk-significant structures, systems, and components and risk determination methods'

BWR/3 BWR/4 BWR/6 WEST 3 Loop WEST 4 Loop WEST 4 Loop WEST 4 Loop CE B&W

Number ofSSCs 67 86 127 11~ 103 100 76 110 90

wilhiDscope

Number ofrisk- 2~ (37%) 41 (48"Al) 24(19%) 44(38%) 41 (40%) 23 (23%) 22 (29%) 27(2~%) 17 (19%)

significant

systems

Risk-significan1 Utility All slructures All6trUctures Reactor Reactor Reactor Reactor 28 Reactor

structures evaluating are inhc:rentIy are inherently containment containment; all containment; containmenl containment

reliable reliable other structures utility evaluating

inherently reliable

LivingPRA Yes. Update Yes.3-year No No Yes. Update Yes. 3-year Yes, Update No Yes. Update

(yes/no) and frequency update frequency every update frequency frequency frequency

update frequency undetermined frequency refueling cycle undetermined every refueling

cycle

Risk EPDelphi EP Process IPE EPDelphi EP Process. IMs EPDelphi EP Delphi EP Process, PRT Working EPDelphi

deIennina1ion process, 1Ms RISKMAN process.IMs (RAW,CDF, process, IMs process, PRT software, IMs group, IMs process,IMs

methods' (RRW,RAW, software, IMs (RAW, contrib.) (RAW,RRW) software, IMs (RAW,RRW, (RAW,CDF (RAW,RRW)

FN,) (RAW,RRW, RRW,CDF (RAW,CDF FIV) contrib.)

CDF contrib.) contrib.) contrib.)

Online CArrA, Configuration Configuration PRa Online ORAMmatrix RMQSand PRA procedure PSAMrisk

mainLenance risk RMQSand equipment OOS matrix, RAW configuration maintenance PRA OSPRE software for taking monitor

evaluation EOOS matrix ranking matrix procedure SSCsOOS software

methods' software,

safety monitor

1. The data in this table is based on a review ofthe licensee's docwnentation for rule implementation at the time of each NRC site visit and is subject to change.

2. Acronyms for risk determination and evaluation: 1M (importance measure), ORAM (outage risk assessment and management), CAFTA (computer-aided fault tree

analysis); PSAM (probabilistic safety assessment monitor), PRT (probabilistic risk tree), RMQS (risk management query system), EOOS (equipment out of

service), OOS (out ofservice), OSPRE (operational safety predictor), FN (Fussell-Vesely importance), RAW (risk achievement worth), RRW (risk reduction

worth), CDF (core damage frequency; in accord with NUMARC 93-01, the utility defined cut sets that account for 90 percent ofthe overall CDF contribution),

and EP (expert panel).
Conclusions

1. The methods used to establish risk

significance met the intent ofthe rule and

the guidance in NUMARC 93-01.

2. The risk determination process at each site

gave reasonable results.

3. The use of an expert panel to consider

PRA or IPE insights is an appropriate and

practical method ofdetermining risk

significance.

4. The expert panel members at each site

were knowledgeable and experienced and

met the standards recommended in

NUMARC 93-01.

5. The participation ofthe expert panel in

other rule activities at certain sites is a

strength.

Recommendations

1. Use the process described in NUMARC

93-01 which makes use of an expert panel

for making risk determinations.

2. Have an expert panel evaluate CDF, RRW,

RAW, FN, and any other methods to

compensate for their limitations.

3. Consider using other calculational methods

such as Fussell-Vesely, Birnbaum, and

others in addition to CDF, RHR, and

RAW.

4. Establish the expert panel as a permanent

part ofthe licensee's organization.

5. Consider using the expert panel to assist in

making decisions on other aspects of

implementing the rule such as scoping, the

establishment of performance criteria and

goals, the determination of when SSCs

should be moved from paragraph (a)(I) to

(a)(2) and from paragraph (a)(2) to (a)(I),

the review of corrective actions, and the

15

performance ofthe periodic evaluation

required by paragraph (a)(3) ofthe rule.

6. Reevaluate risk significance determinations

whenever the plant design is modified, the

PRA is updated, or new insights become

available from configuration management

reviews,

2.4 Goal Setting, Monitoring, and

Preventive Maintenance

The team reviewed program documents and

records at each site to evaluate the process

established to set goals and monitor under

paragraph (a)(I) ofthe rule and to verify that

preventive maintenance was effective under

paragraph (a)(2) ofthe rule. The team also

discussed the program with plant staff. At

each site, the team selected a sample of

systems that were categorized under

paragraphs (a)(I) and (a)(2) for further review.

2.4.1 Categorizing SSCs in Paragraph

(a)(1) or (a)(2)

Regulatory Guide 1.160 and NUMARC 93-01

state that SSCs be subject to goal setting and

monitoring under paragraph (a)(I) ofthe rule

whenever performance criteria are exceeded or

repetitive maintenance-preventible functional

failures (MPFFs) occur.

Findings

The team reviewed a sample ofsystems at

each site that were categorized under

paragraph (a)(2) ofthe rule to determine if

they should have been categorized under

paragraph (a)(I), where they would have been

subject to goal setting and monitoring. At

eight ofthe nine sites, the team did not find

any SSCs that should have been categorized

under paragraph (a)(1) ofthe rule. At one site

where the licensee had not categorized the salt

service water system (SSW), the team

recommended that it be categorized as a

paragraph (a)(1) system.

NUREG-1526

~)
Very few SSCs were categorized under

paragraph (a)(1) at any ofthe sites. Table 3

presents the numbers of SSCs in each category

at each site." Licensees are still in the early

6 The teamfoundconsiderable variation, even

forreactors of similartype, in the numbers of SSCs

defmed for each plant and in the numbers of SSCs

placedin the (a)(1) category. The numbers in this

table are for general information and shouldnot be

used forjudging the acceptability of themaintenance

rule activities at other sites.

NUREG-1526 16

stages ofimplementing the rule and thus may

assign more SSCs to the paragraph (a)(1)

category in the future. However, licensees

may be reluctant to place SSCs in the

paragraph (a)(I) category because having

numerous SSCs in the paragraph (a)(1)

category might indicate to the NRC or licensee

management that their preventive maintenance

program is not effective.
--..J

oI

-VI

IV

0'1

Table 3. Structures, systems, and components categorized under paragraphs (a)(I) and (a)(2)1

Paragraph BWR/3 BWR/4 BWR/6 WEST 3 Loop WEST 4 Loop WEST 4 Loop WEST 4 Loop CE B&W

(a)(l) 12 13 44 65 36 17 58 59 310

(a)(2) 66 85 123 109 100 99 71 105 87

1. The data on this table is based on a review oflicensee's documentation for rule implementation at the time of each site visit and is subject to change.

2. At the time ofthe NRC site visit, the licensee was considering adding the salt service water (SSW) system to paragraph (a)(l).

3. The only SSC categorized under paragraph (a)(1) was the post-accident sampling system; however, the utility was still evaluating the performance

of SSCs to determine ifother SSCs should beplaced under the paragraph (a)( 1) category.

4. The SSCs categorized under paragraph (a)(1) include the residual heat removal system, the service water system, containment integrity and the E~F

switch gear room coolers.

5. The SSCs categorized under paragraph (a)(l) include the turbine-driven auxiliary feedwater pump, the LK-16 circuit breaker, the BIF butterfly

valves, the "B" emergency diesel generator, the reactor cavity seals, and the "A" heater drain pump motor.

6. The SSCs categorized under paragraph (a)(1) include the auxiliary feedwater system, the emergency diesel generators, and the solid state protection

system (i.e., 7300 process support system).

7. The reactor coolant system was the only system categorized under paragraph (a)( 1) ofthe rule.

8. The SSCs categorized under paragraph (a)(l) include the control rod drive system circuit cards, 4 kv circuit breakers, 125 vdc circuit breakers,

steam generator power-operated relief valves (PORVs) and pressurizer PORVs.

9. The SSCs categorized under paragraph (a)(1) include the containment control air system, the condensate system, the heater drain system, the

service water system, and the circulating water system.

10. The SSCs categorized under paragraph (a)(l) include the emergency diesel generators, the instrument air system and the demineralized water

system.
The methods described in NUMARC 93-01

assume that the performance or condition of

most SSCs at most sites is adequately

controlled through preventive maintenance and

therefore should, at least initially, be placedin

category (a)(2), where they are monitored

against performance criteria. Only those SSCs

that exceed their performance criteria, or

experienced repetitive maintenance preventible

functional failures are placed in the paragraph

(a)(I) category, where they are monitored

against goals. Therefore, usingthe NUMARC

93-01 guidance, category (a)(I) could be used

as a tool to focus attention on those SSCs that

need to be monitored more closely and does

not indicate maintenance program

effectiveness. While using paragraph (a)(l) in

this way is an acceptable approach for

implementing the rule, the teambelieves that

an approach that places most SSCs in the

paragraph(a)(I) category and places in

category (a)(2) only a few SSCs whose

performance or condition is beingeffectively

controlled through the performance of

effective preventive maintenance, would also

meet the intent of the rule.

The team assured the licensees' representatives

that the NRC staff would not considerthe

placement ofSSCs in the paragraph (a)(I)

category as an indicator of a poor maintenance

program nor would it be used in determining

the grade in the maintenance area of the

Systematic Assessment ofLicensee

Performance. The team also cautioned

licensee managers that they should not view

the number ofSSCs in the paragraph(a)(I)

categoryas an indicatorof performance, since

it might inhibit their staffmembers from

placing an SSC under paragraph(a)(l) when a

performance criterion was exceeded or a

repetitive maintenance preventible functional

failure had occurred. If a licensee is not certain

whetheror not an SSC should be categorized

in paragraph(a)(I) or (a)(2), the conservative

approach is to place the SSC in the paragraph

NUREG-1526

'I

18

(a)(l). Failure to placethe SSC under

paragraph (a)(I) when preventive maintenance

has been shown to be ineffective would be a

violation of the rule.

Several licensees' procedures did not clearly

explain the intended use of paragraph(a)(l) of

the rule. The team recommended to these

licensees that they review, and if necessary

revise, their proceduresto clarify the intent of

paragraph(a)(l) of the rule and to ensure that

SSCs are placedin that categorywhenever

adequate preventive maintenance can no

longer be demonstrated.

Conclusion

The process and proceduresfor categorizing

SSCs in paragraph(a)(l) or (a)(2) of the rule

were reasonable. However, some licensees

were reluctant to place SSCs in the (a)(1)

category.

Recommendations

1. Review, and if necessary, revise

proceduresto clarify the criteria for

determining when goal setting under

paragraph (a)(1) is required and to

emphasize that the conservative approach

to implementing the rule would be to

categorizean SSC under paragraph (a)(1)

whenever there was any doubt if the

performance criteriahad been met or a

repetitive maintenance preventible

functional failure had occurred.

2. The number of SSCs in the paragraph

(a)(l) category should not be used as an

indicator of a poor maintenance program.

2.4.2 Corrective Actions

Paragraph (a)(I) of the rule states that

appropriate correctiveaction shall be taken

when the performance or condition of an SSC

does not meet established goals.
Findings

Many licensees have assigned the task of

determining the root causeand developing

corrective action to the responsible system

engineer at each site. At some sites, the

licensee's expertpanel participates in this

process.

At one site, the teamreviewed corrective

. actions for sixparagraph (a)(1)systems and

found certain corrective actions were

ineffective. For example, the turbine-driven

auxiliary feedwater pump experienced an overspeed trip that was attributed to a faulty logic

card, which wasreplaced. Threemonths later,

two more over-speed trips occurred: the first

was again attributed to a faulty logic card,

which was also replaced, and the second was

attributed to a faulty seal on the servo unit.

Two months later, a fourth overspeed trip

occurred, which was again attributed to a

faulty logic card. The team concluded that a

more thorough evaluation of the first failure

might have enabled the licensee to find the

root cause of the logic card failure and avoid

the subsequent failures. To enhance its

corrective action process, the licensee began

requiring that all proposed corrective actions

be reviewed and approved by the expert panel.

The corrective actions will alsoinclude a

review of the corrective, predictive, and

preventive maintenance activities. The

licensee's improved process for establishing

corrective actions is very rigorous and

methodical.

The teamreviewed the actions taken by one

licensee to resolve problems with its postaccident sampling system (PASS). This

system had beenveryunreliable in the past and

wasfound to be inoperable when needed

during the two most recent emergency drills.

The teamreviewed the corrective actions

taken for PASS since the licensee began

implementing the rule and noted that the

19

system engineer had thoroughly reviewed past

performance and industry operating experience

to determine appropriate corrective actions.

These corrective actions included unclogging

lines, replacing leaking valves, revising

procedures, and training PASS system

operators. Long-term actions include the

establishment of goals and a monitoring

program. The team alsointerviewed the

system engineer and found her to be very

knowledgeable of the PASS system and the

rule. The teambelieves that actions to

implement the rule caused licensees to focus

more attention to establishing appropriate

corrective actions for PASS and other

non-safety-related systems.

The teamreviewed the corrective actions

takenby another licensee to repaira faulty

pressurizer pressure transmitter. The system

engineer had performed extensive reviews,

considered industry-wide operating

experience, and trendedthe performance of

similar transmitters to determine the causeof

the faulty transmitter. The corrective actions

established in this process correctedthe

problem.

The licensees for most of the other sitesvisited

by the team had established effective corrective

action programs. At these sites, the system

engineer was generally assigned responsibility

for determining corrective actions.

Conclusions

Licensees established effective corrective

action programs. Someof those programs

improved significantly after the licensees acted

to the implement the rule, while others appear

to have been effective beforethe rule.

Although most licensees assigned the system

engineers primary responsibility for

establishing corrective action, a few assigned

that responsibility to an expert panel. Both

approaches produced acceptable results.

NUREG-1526
Recommendation

None.

2.4.3 Safety Consideration in Goal Setting

Paragraph (a)(I) of the rule requires that safety

(risk) be considered whenestablishing goals

and monitoring.

Findings

Each licensee performed risk determinations

for all SSCs within the scope ofthe rule at its

site. These risk determinations formed the

basis for considering safety when setting goals

under paragraph (a)(I) and performance

criteria under (a)(2) of the rule. Alllicensees

used the results of these initial risk

determinations to decide if goals and

performance criteria would be set at the

system level or the plantlevel. System or train

level goals or performance criteria were set for

risk-significant SSCs and for non-risksignificant SSCsthat were used in standby

service. Plant level goals were set for the

remaining non-risk-significant SSCs.

Therefore, all licensees had taken safety into

consideration throughthe process of

determining whetherto set system- or plantlevel. goals.

Someof the licensees had taken safety into

consideration in other ways in addition to the

steps described above. For example, the

expert panel at one site received the

information from the risk determination

process to use in establishing goalsfor those

SSCs assigned to categories under paragraph

(a)(1) ofthe rule and in establishing

performance criteriaunder paragraph (a}(2) of

the rule. The expert panel decided to establish

functional failures and hours unavailable as

goalsfor mostsystems. To determine what

would be appropriate unavailability values, the

expert panel reviewed historical system

performance for the risk-significant and

NUREG-1526 20

standby systems within the scope of the rule.

Since precise system unavailability data was

not readily retrievable from plantrecords, the

expert panel relied on their collective judgment

to estimate system unavailability data from the

monthly operating reports. To validate this

unavailability data, the licensee recalculated

the PRA using the newunavailability values

and confirmed that the results were consistent

withthe original PRA calculation. Thisis

another example of how safety has been

considered when setting goals and

performance criteria.

At another site, the licensee selected goals and

performance criteria based on unavailability or

reliability data assumed in the licensee's PRA.

The team reviewed the goals set for the

emergency diesel generator, the demineralized

water system, and the instrument air system,

and verified that information from the PRA

had beenconsidered. The team concluded that

this was an acceptable method of taking safety

into consideration when setting goals under'

paragraph (a}(I) of the rule.

Conclusions

1. All licensees had considered safety as part

of the processof determining if an sse

should be categorized as risk-significant or

non-risk-significant.

2. Certain licensees considered safety by

using the samevalues for system reliability

and availability for goalsas were assumed

in the PRA. Otherlicensees used the PRA

to checkthe validity of availability goals.

Recommendation

Ensure that procedures and processes

adequately address safety when settinggoals.
2.4.4 Industry Operating Experience in

Goal Setting

Paragraph (a)(I) ofthe rule requires that

industry-wide operating experience (OE) be

taken into account, where practical, when

establishing goals.

Findings

The degree to which OE was considered when

setting goals varied considerably among the

sites. At one site, the team verified that OE

information from the Institute for Nuclear

Power Operations, and industry codes and

standards had been considered when setting

goals for some SSCs under paragraph (a)(l) of

the rule but not for others. The team reviewed

the licensee's procedures and noted that they

only required that relevant industry NPRDS

operating experience be reviewed and

considered as part ofthe goal setting process.

The licensee agreed to revise their procedure

to clarify that their review should not be

limited to NPRDS data.

At another site, the team reviewed the goals

set for several systems and verified, through

discussion with the licensee's system engineers,

that OE had been considered when setting

goals. However, the team reviewed the

licensee's procedures and found no explicit

requirement to consider OE as part ofthe goal

setting process. The licensee's representative

stated that consideration ofOE was part ofthe

root cause analysis process that would be

required whenever goals were established.

However, the representative agreed to add the

requirement to consider all relevant

information from their OE program as part of

their goal setting procedure.

Several licensees had considered OE when

establishing goals for some oftheir paragraph

(a)(l) systems but not for others. These

licensees agreed to revise existing procedures

or issue a new procedure to clarify that OE

21

must be taken into account whenever goals are

established. At several other sites, the

licensees had considered OE when establishing

goals for all their paragraph (a)(l) systems and

their procedures were adequate.

At some sites, the OE database was available

to each engineer on his or her computer

terminal, which could be used at any time to

research for information on system or

component problems. The team believes that

such an online capability would facilitate the

process of considering industry operating

experience when setting goals. At other sites,

the process for obtaining information from the

OE database required individual engineers to

complete request forms, which were sent to

the OE database manager who did the actual

search. This process is more cumbersome than

having an online capability and could inhibit

the use of OE for goal setting.

During the site visits, the team did not mention

its concern that licensees had not established a

systematic and consistent method of collecting

and using SSC reliability and availability data.

from other licensees when setting goals. The

team came to this conclusion during internal

NRC meetings to discuss the results ofthe

nine site visits. The team understands that

goals for some SSCs are based on PRA

reliability and availability data which, to some

extent, may have been developed from generic

industry data. Therefore, industry-wide.

reliability and availability data may have been

considered when setting goals for a limited

number of SSCs. However, after considering

this issue in the light ofthe results of all nine

pilot inspections, the team concluded that a

more direct use ofindustry-wide reliability and

availability data should be considered by

licensees. Existing OE programs at most sites

focus on anecdotal data such as descriptions of

specific equipment failures and do not

generally give reliability and availability data.

Therefore, the team recommends that licensees

NUREG-1526
consider expanding theirprograms for

collecting DEinformation to ensure that

industry-wide SSCreliability and availability

data is collected and considered in setting

goals in a systematic and consistent manner.

Conclusions

1. Most licensees had considered OE in

varying degrees when setting goals.

2. Many licensees' procedures do not have

adequate guidance for ensuring that DEis

considered, where practical, when

establishing goals.

3. Those responsible for establishing goals at

some siteshad easy access to the DE

database; at other sitesthe access was

limited or cumbersome and could inhibit

the use of the database.

4. Licensees had not established a systematic

and consistent method of collecting and

using SSCreliability and availability data

from otherlicensees when setting goals.

Recommendations

1. Review procedures to ensure that the

guidance is adequate for considering OE

when establishing goals.

2. Ensure that OE data isreadily accessible

for plant staffto use when setting goals.

3. Consider expanding programs for

collecting OE information to ensure that

industry-wide SSCreliability and

availability data is collected and considered

systematically and consistently when

setting goals

2.4.5 Monitoring and Trending of

Systems and Components

In the statements of consideration for the rule,

the Commission statesthat where failures are

NUREG-1526 22

likely to cause loss of an intended function,

monitoring under paragraph (a)(I) should be

predictive, giving early warning of

degradation. NUMARC 93-01 gives guidance

for using predictive maintenance, inspection,

testing, and performance trending for

monitoring performance or condition under

paragraph (a)(2) of the rule.

Findings

The teamreviewed the monitoring and

trending for selected systems and components

at each site and found the following issues.

Coordination of trending and goals. The

teamfound great variance among the licensees

in the quality and quantity of trending that was

being performed. One licensee was doing very

little trending of SSCs performance or

condition. Two otherlicensees had established

trending programs that werewell integrated

into theirrule programs. The remaining

licensees had trending programs that were not

well integrated into their rule programs. Many

of these trending programs generated

equipment performance data that would be

very useful whenestablishing goals and

performance criteria underthe rule; however,

in many cases, licensees did not consider this

data when selecting goals and performance

criteria and establishing a monitoring program

underthe rule. Theteambelieves that goal

setting and trending activities should be

coordinated and integrated as much as possible

so that the improvements in performance can

be monitored against established goals. Goals

should use existing trending activities where

appropriate, and licensees should consider

establishing newmonitoring and trending

activities that directly address the problem

whenever new goals are established.

Trending for all goals not required.

Although trending ofall goalsshould always

be considered, it may not be practical. For

example, one licensee had established a
predictive maintenance program that included

periodic monitoring, diagnosis, and trending of

system performance and condition so that

needed maintenance could be performed

before failure. Predictive maintenance actions

included the use of diagnostic test equipment

to perform vibration analysis, thermography,

flow measurements, and ultrasonic

measurement of pipe wall thickness. The team

reviewed the documentation for five paragraph

(a)(l) systems at that site and noted that

comprehensive trending was being performed

for at least two ofthese systems. The team

concluded that trending was not necessarily

required for the other three systems. The team

believes that trending should be used where

practical and appropriate, but not necessarily

for all SSCs under the scope ofthe rule.

Therefore, the level oftrending being

performed was reasonable.

Monitoring of redundant trains. The NRC

staff endorsed the position in NUMARC 93-01

that systems with redundant trains must be

monitored at the train level to ensure that the

good performance of one train does not mask

the poor performance ofthe redundant train in

a system. This train-level monitoring would be

required for all those SSCs that were

determined to be risk-significant and all

non-risk-significant SSCs that were used in

standby service. Monitoring at the train level

would not be required for normally operating

non-risk-significant SSCs, which can be

monitored using plant level goals.

The team noted several instances where

redundant trains were not being monitored at

the train level.

I. The fuel oil system for the emergency

diesel generators at one site consisted of

two redundant fuel oil pump trains, either

of which can be used to transfer fuel oil

from the large storage tanks to the diesel

day tanks. The licensee had not

23

established individual performance criteria

and monitoring for each fuel oil pump train

under the rule. The team was concerned

that the redundant pump could degrade

significantlywithout being detected

because one pump could supply the

necessary volume offuel during routine

surveillance tests. The high reliability of

one pump could mask the unreliability of

the redundant pump.

2. One licensee used multiple redundant air

compressors to supply site compressed air

and to act as an alternate supply for the

instrument air system. The licensee's

representatives stated that one ofthe

reasons for the many compressors was that

some ofthem were very unreliable.

However, the licensee was monitoring this

system using plant-level performance

criteria instead oftrain-level performance

criteria. The licensee's representative

stated that they considered the extra

compressors to be installed spares rather

than redundant loops and therefore did not

require train level goals for each

compressor. The team disagreed with this

position, noting that the intent ofthe rule

as explained in NUMARC 93-01 is to

monitor any system with redundant trains

at the train level. The intent ofthe rule is

also to monitor all standby systems at the

system level rather than at the plant level.

In this case, the air compressors constitute

a system with multiple redundant

compressor trains, some ofwhich are used

in standby service. Therefore, this system

should not be monitored at the plant level

both because it contains redundant trains

and because some ofthose trains are used

in standby service. Rather, each train,

including the motor, compressor, and

valves, should be monitored individually.

At another site, the containment spray

system, which contains redundant trains,

NUREG-1526
was being monitored at the system level

rather than the train level, which could

allow unreliable components to go

undetected.

Trending of zero failures. At many of the

sitesvisited, licensees had established zero

:MPFFs or 1DO-percent reliability as a goal or

performance criterion for many ofthe SSCs

under the scope of the rule. The rule intends

that licensees be afforded maximum flexibility

in establishing goals and performance criteria.

However, the rule alsointends that where

failures are likely to cause loss of an intended

function, monitoring should be predictive,

giving early warning of degradation. The team

was concerned that it would be difficult to use

trending to help predict or anticipate failures

when failure data is the onlyinformation being

monitored.

Conclusions

Coordination of trending and goals. Most

licensees had established trending programs.

Trending was not required for all SSCs under

the rule although it should be considered. The

trending being performed by most licensees

was not well coordinated and integrated with

the goals and performance criteria established

under the rule.

Monitoring of standby systems or systems

with redundant trains. Certain non-risksignificant systems used in standby service

were being monitored at the plantlevel rather

than at the system or train level as required.

Trending of zero failures. Reliance on the

use of zero :MPFFs or 1DO-percent reliability as

a goal or performance criterion may preclude

predictive trending.

Recommendations

Coordination of trending and goals.

Coordinate and integrategoals and

NUREG-I526 24

performance criteria with equipment trending

wherever possible.

Monitoring ofstandby systems or systems

with redundant trains. Ensure that one train

does not maskthe poor performance ofa

redundant or standby train. Accomplish this

task bymonitoring at the following levels.

1. Monitorsingle train risk-significant

systems at the system level.

2. Monitormultiple train risk-significant

systems at the train level.

3. Monitorsingle train non-risk-significant

systems used in standby at the system level.

4. Monitormultiple train non-risk-significant

systems that are used in standby service at

the train level.

5. Monitor normally operating, non-risksignificant systems at the plant level.

Trending of zero failures. Where reliance on

the use of zero MPFFs or 1DO-percent

reliability as a goal or performance criterion

may preclude predictive trending, consider

establishing additional goals and performance

criteriathat can be trended.

2.4.6 Monitoring and Trending of

Structures

The rule requires that the performance or

condition of structuresbe monitored in a

manner sufficient to give reasonable assurance

that those structuresare capable of fulfilling

theirintended function. The statements of

consideration for the rule states "[w]here

failures are likely to cause loss of an intended

function, monitoring should be predictive in

nature, providing earlywarning of

degradation." NUMARC 93-01, paragraph

9.4.2.4 lists examples of structural monitoring

activities including nondestructive
examination, visual inspection, vibration

analysis, and measurement of deflection.

Findings

The team reviewed the monitoring and

trending of structuresat the nine pilot sites and

found that most licensees considered

monitoring of structuresunder the rule to be a

low priority. Some licensees had not

established goals or performance criteriafor

monitoring most structures at theirsites.

Manylicensees considered most structuresto

be inherently reliable. Some licensees believed

that as long as a structure such as a building

did not fall down and damage the equipment

inside, the structure itselfneed not be

monitored. At some sites, the onsite personnel

were not aware of existing preventive

maintenance and monitoring activities that

were being performed on these structuresby

offsite structural or civil engineering groups.

One licensee took the position that their

structures had performed acceptably for the

past 20 years, not causing a loss offunction of

the systems contained in or supportedby the

these structures, and were not expected to

begin a more rapid degradation from aging in

the future. Therefore, believing these

structures "very reliable," they found it

unnecessary to establish goals or performance

criteria to monitor them. However, they also

stated that inspection and maintenance is

necessary to ensuredegradation of these

structures does not cause a loss of function.

The structures are monitored during the

normal operator rounds, management

walkaround inspections, and inspection by

other plant departments in the course of

normal work activities. Deficiency cards and

maintenance work orders are generated when

conditions adverse to quality are found. The

teambelieves that the existence of these

longstanding monitoring activities contradicts

the licensee's position that no monitoring is

25

needed. The team believes that the licensee

should establish performance criteriaand goals

underthe rule which take creditfor the

existing monitoring activities and build upon

them.

One licensee had established performance

criteria for most structuresunder the scope of

the rule. However, the performance criteria

for many of these structureswas that the

structurewould not degrade to the point

where it caused a loss of function of systems

contained in the structure or supportedby it.

For example, the roof of a building that was

leaking would meet the performance criteria

until the water leaking into the building caused

the system inside the building to fail. However,

such performance criteriaare not acceptable

because they are not predictive and do not give

early warning of degradation. The team

believes that a more appropriate performance

criterion would havebeen "no water leaks. "

Anotherlicensee had determined that all

structureswithin scope of the rule, except the

primary containment, were inherently reliable

and therefore did not require goal setting

under paragraph (a)(l) of the rule or

monitoring against performance criteriaunder

paragraph (a)(2) of the rule. The licensee's

representative stated that these structures are

routinely examined by plant personnel during

their walkdown inspections of the plant. They

believe that this monitoring activity issufficient

to verify that preventive maintenance is

adequate. The teambelieves that although

condition-monitoring is an appropriate method

of monitoring structures, the lack of specific

criteriato monitor against would make it

difficult to detect degradation of these

structures.

Conclusions

Most licensees considered the monitoring of

structures under the rule to be a low priority.

Some licensees incorrectly assumed that many

NUREG-1526
of theirstructures are inherently reliable. The

performance criteria for monitoring the

performance or condition of some structures

are not predictive and do not give early

warning of degradation.

Certain structures such as the primary

containment can be monitored by fulfilling

established testing requirements such as those

in 10 CFRPart 50, Appendix 1. However,

otherstructures suchas reactor buildings,

auxiliary buildings, and cooling towers may be

more amenable to condition-monitoring.

Some licensees are developing programs for

monitoring structures that will include doing

plant walkdown inspections and engineering

evaluations to establish condition-monitoring

criteria. This program should include the

establishment of specific criteria for

monitoring.

Recommendations

1. Reevaluate the monitoring of structures

and determine, using the methods

described inNUMARC 93-01, paragraph

9.3.2, to determine whether performance

criteria or goals are needed to monitor the

performance or condition of individual

structures.

2. Review the existing structural monitoring

activities and use them, with enhancements

as necessary, as a basis for establishing a

monitoring program under the rule.

3. Do not use very reliable or inherently

reliable to describe structures that require

preventive maintenance or monitoring.

4. Establish performance criteria or goalsthat

are predictive and giveearlywarning of

failure.

5. Take creditfor existing plant walkdown

inspections or otherstructural inspection

activities under the rule.

NUREG-1526 26

2.4.7 Functional Failures

The statements of consideration for the rule

state that where one or moremaintenance

preventible failures occur on SSCsunder

paragraph (a)(2) of the rule, the effectiveness

of preventive maintenance is no longer

demonstrated; and the SSC must then be

treated under paragraph (a)(I) of the rule. This

term was changed inNUMARC 93-01 to

maintenance preventible functionalfailures to

emphasize that only a failure in which the item

actually failed the function should be counted

as a failure that would require goalsetting and

monitoring under paragraph (a)(l).

Findings

Two licensees focused onfunctionalfailures

rather thanjust maintenance preventible

functionalfailures as described in NUMARC

93-01. These licensees did so because it was

easierto process both types of failures

(maintenance-related or not) in the same

manner because theywould not know if the

failure was maintenance-preventible until after

the root cause evaluation had been performed.

The teamreviewed this approach and noted

that allfunctional failures would be evaluated

and dispositioned inthe same manner as

maintenance-preventible functional failures.

Conclusion

The use offunctionalfailures in stead of

maintenance-preventible functionalfailures is

acceptable. Approaches other than those

described in NUMARC 93-01 are acceptable if

the licensee can demonstrate that the

alternative givesthe same level of assurance

that the requirements of the rule will be

satisfied.
Recommendation

None

2.5 . Periodic Evaluations

Paragraph (a)(3) ofthe rule requires that

performance- and condition-monitoring

activities and associated goals and preventive

maintenance activities be evaluated at least

every refueling cycle ifthe interval between

evaluations does not exceed 24 months. The

evaluation isrequired to consider, where

practical, industry-wide operating experience.

At each site, the teamreviewed the licensee's

plans and procedures for performing the

evaluations.

Findings

One licensee planned to do the periodic

evaluation eachyear to coincide with other

existing maintenance evaluation activities.

Since the licensee's refueling cycle islonger

than one year, performing the periodic

evaluation annually would result in it being

evaluated more frequently than required by the

rule. At the remaining sites, the licensees

planned to perform the evaluation once each

refueling cycle.

At one of the two unit siteswhere a periodic

evaluation is planned once each refueling

cycle, the licensee plans to evaluate both units

at the site at the same time. The licensee will

periodically evaluate each unit at a different

time during each unit's refueling cycle because

the refueling outages for each unit at that site

are not scheduled at the same time.

Another licensee plans to perform most of the

required evaluations on a continuing schedule

throughout the refueling cycle. System

engineers would continuously assess the

appropriateness of the performance criteria for

their assigned systems and update performance

27

data eachmonth. In addition, a bimonthly

system status report would be issued which

would include an assessment of actual

performance against the performance criteria

for all systems within the scope of the rule, an

evaluation of maintenance effectiveness, an

evaluation of the balance of unavailability and

reliability, and an evaluation of the continued

applicability of the established performance

criteria. These continuing activities wouldbe

followed by a high-level periodic evaluation to

verify allrule requirements havebeenmet. The

evaluation would include a sampling of actual

implementation. Thesehigh-level periodic

evaluations would be performed each refueling

cycle, not to exceed24 months between

evaluations.

Two licensees had already done periodic

evaluations eventhough the first evaluation

would not be due until after the rule takes

effect on July 10, 1996. The licensees

performed these evaluations to gain experience

and to evaluate their progressin implementing

the other requirements of the rule. The team

reviewed these preliminary evaluations and

found that both generally met the requirements

of the rule.

Conclusions

1. Performing the periodic evaluation each

yearmeets the intent of the rule if the

refueling cycle is longerthan one year.

2. The periodic evaluation does not haveto

be performed at any particular time during

the refueling cycle as long it is performed

at least one timeduring the cycle, and the

interval between evaluations does not

exceed 24 months. Thisrequirement

would permit the licensee for a multiple

unit siteto perform the periodic

evaluations of all units at the sametime

eventhough the refueling cycles for the

units are staggered.

NUREG-1526
3. The requirement for performing the

periodic evaluation can be satisfied by

using continuing evaluations, with a higher

level summary evaluation performed at

least once each refueling cycle.

4. The early periodic evaluations performed

by two ofthe licensees were generally

satisfactory.

5. The other seven licensees had reasonable

preliminary plans and procedures for

performing the periodic evaluation,

although their implementation could not be

reviewed at the time of the site visit.

Recommendations

None.

2.6 Balancing Unavailability and

Reliability

Paragraph (a)(3) of the rule states that

adjustments shall be made where necessary to

ensure that the objective of preventing failures

of structures, systems, and components

through maintenance is appropriately balanced

against the objective of minimizing the effect

of monitoring or preventive maintenance on

the availability of structures, systems, and

components.

At each of the sites, the teamreviewed the

plans, processes, and procedures established

for doing this activity.

Findings

The teamfound that although all licensees had

established preliminary plans for accomplishing

this activity, none of them had fully developed

and implemented these plans. However, five

of the licensees had procedures for

accomplishing this activity, which were

reviewed by the team.

NUREG-1526 28

Two licensees plan to continually balance

unavailability and reliability as an integral part

of monitoring against performance criteria

under the rule. Performance history,

preventive maintenance activities, and

out-of-service time are considered when

developing the performance criteria. The

licensees believe that meeting these

performance criteria will ensure that a

satisfactory balance of reliability and

unavailability has been achieved. The team

found that guidance, acceptance criteria, or

both needed to be addedto the licensees'

procedures.

At one site, unavailability and reliability were

initially balanced by the licensee's expert panel.

The licensee will maintain this balance by

trending and evaluating SSCsrendered

unavailable because ofpreventive maintenance

and by making adjustments where necessary to

achieve the appropriate balance. The licensee's

Performance Monitoring Group will perform

this activity as part of theirsemi-annual

evaluation of maintenance program activities.

One licensee plans to accomplish this balancing

by calculating the risk contribution associated

with unavailability of the system caused by

preventive maintenance activities and the risk

contribution causing the reliability of the sse.

The licensee would then attemptto balance the

contribution to risk from each sourceto ensure

consistency withPRA or IPE evaluations.

Anotherlicensee's PRA was used to determine

values for unavailability and reliability which, if

met, would ensure that certainthreshold eDP

values would not be exceeded. The

performance criteria were established in

accordance with these unavailability and

reliability values. The licensee believes that

meeting these performance criteria will ensure

a reasonable balance ofunavailability and

reliability is attained.
Conclusions

Each ofthe nine licensees established

reasonable preliminary plans for balancing

unavailability and reliability, and the

procedures developed by five ofthose

licensees were reasonable. However, the team

was unable to evaluate these activities because

these plans had not been implemented at the

time ofthe site visits.

Recommendation

Focus attention on establishing and

implementing processes and procedures for

balancing unavailability and reliability as

required by paragraph (a)(3) ofthe rule.

2.7 Plant Safety Assessments for

Taking Equipment out of

Service

Paragraph (a)(3) ofthe rule states that, when

performing monitoring and preventive

maintenance activities, an assessment ofthe

total plant equipment that is out ofservice

should be considered to determine the overall

effect on performance ofsafety functions.

NRC issued Temporary Instruction (TI)

2515/126, "Evaluation of On-Line

Maintenance," to aid inspectors in evaluating

the effect on safety oflicensee procedures and

practices for removing equipment from service

for online maintenance. This instruction

details the NRC's expectations regarding safety

assessments to be performed before taking

equipment out ofservice. The instruction

recommends inspectors consider three factors

when evaluating the overall risk oftaking

equipment out ofservice for online

maintenance: (1) the probability of an initiating

event such asa loss-of-coolant accident,

turbine trip, or loss of offsite power; (2) the

probability of being able to mitigate the event

using core damage prevention; and (3) the

29

probability of being able to mitigate the

consequences by preserving containment

integrity.

Findings

One licensee elected to use a matrix approach,

which involved listing preanalyzed

configurations to supplement their existing

procedural guidance for voluntary online

maintenance. This list of preanalyzed

configurations was developed using risk

achievement worth (RAW) to rank

configurations according to risk. The

licensee's existing work planning processes

established a preventive maintenance (PM)

schedule, which allows work on only one

division (train) of certain systems to help limit

the risk of placing multiple trains ofthe same

system out ofservice at one time.

One licensee makes use of a 12-week rolling

window cycle to schedule preventive

maintenance activities. At the time ofthe site

visit, the licensee was developing a procedure

to establish PRA-based priorities for taking

certain combinations ofsystems out ofservice

for maintenance at the same time.

One licensee's plant operations staff maintained

an equipment out-of-service (EOOS) status

board to assess the total plant equipment that

is out ofservice. To control risk in the

schedule for the upcoming maintenance

activities, the licensee will use the plant IPE to

evaluate the increases in core damage

frequency (CDF) resulting from multiple

equipment outages. The licensee will adjust the

schedule to minimize significant spikes in the

CDF envelope ofthe schedule. The licensee

has also established administrative controls

that forbid certain equipment out-of-service

configurations under specified conditions. In

addition, the licensee is considering the

purchase of a real-time safety (risk) monitor.

NUREG-1526
One licensee plans to incorporate a matrix of

risk-significant combinations of equipment into

their 12-week work planning schedule. This

matrix, which was developed from the

licensee's PRA, lists combinations of

equipment that would increase risk

unacceptably if taken out of service at the

same time. Procedures to implement this

process had not been developed at the timeof

the site visit.

One licensee is planning to design a rolling

windows (12-week) maintenance schedule

with the matrix formulation of the Operational

Safety Predictor(OSPRE) methodology to

controlthe risk resulting multiple equipment

outages. The licensee will adjust thisschedule

withthe OSPREmatrix to minimize risk. In

addition, the licensee drafted a policy

statement that requires the establishment of an

effective risk management program to

determine the relative amount of risk involved

inmaking systems or components unavailable

and to evaluate the effect of multiple

concurrent outages of systems important to

safety. This policy statement addresses the

need to (1) assess the confidence in the

redundant equipment beforetakingequipment

out of service for maintenance, (2) minimize

challenges to that redundant equipment, and

(3) establish contingency plans in case the

redundant train is also rendered inoperable.

One licensee's online maintenance work

philosophy is based on "ensuring plantsafety,

maximizing availability, and maintaining

adequate reliability." The plant operations

staffmaintains a "plan ofthe day" that

describes all work authorized to be performed

on or around operating plant equipment during

the 24-hourperiod. Specific procedures for

establishing a preventive maintenance

equipment out-of-service matrix were still

being developed at the timeofthe site visit.

NUREG-1526 30

One licensee plans to evaluate the total effect

on plantsafety by using an IPE tool and hand

calculations. This IPE tool will be used for

evaluating the risk significance of online

maintenance strategies as an interim approach

until more sophisticated calculational aids are

developed. The IPE tool gives risk evaluations

for the 500 highest contributing core damage .

sequences, which account for about 93 percent

of the total CDF. The licensee is considering a

more accurate tool for the longerterm, suchas

a risk monitor (nearreal-time), which would

be used for preventive maintenance planning

and other applications. The licensee is

preparing the procedures to implement this

requirement. In addition, thislicensee plans to

design a rolling windows preventive

maintenance schedule with a matrix

formulation methodology to control the risk

resulting multiple equipment outages in the

various schedular weeks. The licensee will

adjustthisschedule with the matrix to

minimize risk.

One licensee implemented a program that

generates risk profiles for planned maintenance

activities each week. Theseprofiles are

discussed at a weekly scheduling meeting.

Changes are made to the schedule to improve

safety whenundesirable equipment outage

configuration changes are anticipated. The

licensee also plans to establish a rolling

window (12-week) maintenance schedule that

will use PRA methodology to controlthe risk

resulting from multiple equipment outages.

Theyalso planto use the outage risk

assessment andmanagement (ORAM) tool to

controlshutdown risk associated with

maintenance activities during outages.

One licensee is using probabilistic safety

assessment monitor (PSAM) software to

improve the reliability and safety ofthe plant

by enhanced online riskmonitoring of risksignificant systems included in the plantPRA.

A weekly draft online maintenance schedule is
produced on Thursday of each week and is

analyzed usingthe risk monitor software

before noon on Fridayof the sameweek. On

Mondayof the following week, before

equipment is taken out of service for

maintenance, a final risk analysis is performed

and any necessary schedular adjustments are

made. The licensee also reduces the

occurrenceof initiating events by paying

heightened attention to main feedwater system

operability before performing maintenance on

emergency feedwater pumpsand by ensuring

that no switchyard work is performed when an

emergency diesel generator is out of service.

The licensee analyzes plant conditions each

day, including reviewing operational logs to

ensure that redundant train equipment or

support equipment is not degraded during the

online maintenance; The licensee uses a

software programcalled CAFTA(Computer

Aided Fault Tree Analysis) to aid in controlling

shutdown risk.

Conclusions

Certainlicensees were using a variety of

approaches for assessing the overall effect on

the performance of safety functions of taking

plant equipment out of service for monitoring

or preventive maintenance, while others were

planning to do so. .

Some licensees plans and proceduresfor

performing safety assessments appear to be

well thought out and comprehensive although

they had not been fully implemented. The plans

at other sites were preliminary, and the

procedures had not yet been developed or

implemented.

Manylicensees approached the problem by

developing a matrix that defines which system

combinations could be allowed out of service

at the sametime. Although the matrix is simple

to use, it defines a limited number of

combinations that maynot address all

31

operational situations and mayunnecessarily

limit operational flexibility.

Several licensees are planning to use real time

(or nearly real time) risk monitors that can

calculate the risk changesassociated with the

planned maintenance activities. Although risk

monitors can analyze a greater number of

possible combinations of out of service

systems, they may require specially trained

personnel to operate them or to interpretthe

results.

Both the matrix and the risk monitorwere

reasonable ways of assessing the effect on

plantsafety when taking equipment out of

service for monitoring or preventive

maintenance. However, the team could not

evaluate the effectiveness of either of these

methods becausethey had not been fully

implemented at the time of the site visits.

Manyof the licensees had not established

programs and proceduresthat prescribed

giving consideration to initiating events,

mitigating capability, and containment integrity

beforetaking equipment out of service for

monitoring or preventive maintenance.

Recommendations

1. Develop and implement processes and

proceduresfor considering plant safety

before taking equipment out of service for

maintenance.

2. Include a programrequirement to consider

initiating events, mitigating capability, and

containment integrity before taking

equipment out of service for monitoring or

preventive maintenance.

3. Pay increased attention to reducing

initiating eventfrequencies, with particular

emphasis on enhanced safetyoversightof

switchyard activities.

NUREG-1526

3 CONCLUSION

Theteamconsidered the observations made

during these pilot sitevisits and concluded that

the requirements of 10CFR50.65 canbe met

by using NUMARC 93-01 if the

recommendations inthis report are taken into

consideration.

33

The teamalso concluded that the performancebased approach to implementing the ruleis

practical; the draft inspection procedure canbe

used to monitor the implementation of the rule;

and the existing PRAtools andmodels, used in

conjunction withan expert panel, are adequate

fortaking risk into consideration when

implementing the rule.

NUREG-lS26