Issue Date: 1/17/02

NRC Inspection Manual IIPB

# Inspection Procedure 71111.20

Table Of Contents

- 71111.20-01 Inspection Objective
- 71111.20-02 Inspection Requirements
- 71111.20-03 Inspection Guidance
- 71111.20-04 Resource Estimate
- 71111.20-05 References
- 71111.20-06 References

INSPECTABLE AREA: | Refueling and Other Outage Activities

CORNERSTONE: | Initiating Events (20%) Mitigating Systems (70%) Barrier Integrity (10%)

INSPECTION BASIS: | Shutdown risk can be high for deficiencies that occur when vital SSCs are not available. Due to potentially high number of out-of-service SSCs during the fuel handling period of a refueling outage and the potential off-normal plant configurations during non-fuel handling outage periods, the risk of deficiencies can be high. Times of reduced inventory are the most critical.

LEVEL OF EFFORT: | The inspection is performed on an outage basis, whether the outage is for refueling or other activities. The inspection should focus on potential deficiencies with: RHR, containment isolation during reduced water inventory, mid-loop operations (PWR), cool down/heatup/startup, availability of alternate power sources/switchyard, and refueling operations.

### 71111.20-01 Inspection Objective

Evaluate licensee outage activities to ensure that licensees consider risk in developing outage schedules; adhere to administrative risk reduction methodologies they develop to control plant configuration; have developed mitigation strategies for losses of key safety functions; and adhere to operating license and technical specification requirements that ensure defense-in-depth.

### 71111.20-02 Inspection Requirements

02.01 | Review of Outage Plan. Prior to the outage, review the licensee's outage risk control plan and verify that the licensee has appropriately considered risk, industry experience and previous site specific problems. Confirm the licensee has mitigation/response strategies for losses of key safety functions.
02.02 | Monitoring of Shutdown Activities. Observe portions of the cooldown process to verify that technical specification cooldown restrictions are followed.
02.03 | Licensee Control of Outage Activities
| Verify that the licensee maintains defense-in-depth commensurate with the outage risk control plan for key safety functions and applicable technical specifications when taking equipment out of service. Verify that configuration changes due to emergent work and unexpected conditions are controlled in accordance with the outage risk control plan. For plants that use remote work centers, verify that control room operators are kept cognizant of plant configuration.
| Pick several items per week in the following areas based on risk. Reviewing risk significant items or activities should take precedence over completion of the list.
| a.Clearance Activities. Verify that tags are properly hung and/or removed, and that associated equipment is appropriately configured to support the function of the clearance.
| b. Reactor Coolant System Instrumentation. Verify that reactor coolant system (RCS) pressure, level, and temperature instruments are installed and configured to provide accurate indication; and that instrumentation error was accounted for.
| c. Electrical Power. Verify that the status and configurations of electrical systems meet technical specifications requirements and the licensee's outage risk control plan. Verify that switchyard activities are controlled commensurate with safety and are consistent with the licensee's outage risk control plan assumptions.
| d. Decay Heat Removal (DHR) System Monitoring. Observe DHR parameters to verify that the system is properly functioning. For PWRs, when the licensee is relying on the steam generators to provide a backup means of DHR by single-phase natural circulation, verify that the licensee has confirmed the viability of this method of cooling.
| e. Spent Fuel Pool Cooling System Operation. Verify that outage work is not impacting the ability of the operations staff to operate the spent fuel pool cooling system during and after core offload.
| f. Inventory Control. Verify that the flow paths, configurations, and alternative means for inventory addition are consistent with the outage risk plan. For activities which have the potential to cause a loss of inventory, verify that there are adequate controls in place to prevent inventory loss.
| g. Reactivity Control. Verify that the licensee is controlling reactivity in accordance with the technical specifications. Verify that activities or SSCs which could cause unexpected reactivity changes are identified in the outage risk plan and are controlled accordingly.
| h. Containment Closure. For PWRs, verify that licensees control containment penetrations in accordance with the refueling operations technical specifications and can achieve containment closure(1) at all times. For BWRs, verify that licensees maintains secondary containment as required by technical specifications.
02.04 | Reduced Inventory and Mid-Loop Conditions. Review the licensee's commitments from GL 88-17 and confirm by sampling that they are still in place and adequate. Periodically during the reduced inventory and mid-loop conditions, verify that the configuration of the plant systems are in accordance with those commitments. During mid-loop operations, observe the effect of distractions from unexpected conditions or emergent activities on operator ability to maintain required reactor vessel level.
02.05 | Refueling Activities. Verify that fuel handling operations (removal, inspection, sipping, reconstitution, and insertion) and other ongoing activities are being performed in accordance with technical specifications and approved procedures. Verify that the location of the fuel assemblies is tracked, including new fuel, from core offload through core reload.
02.06 | Monitoring of Heatup and Startup Activities. Verify on a sampling basis that technical specifications, license conditions, and other requirements, commitments, and administrative procedure prerequisites for mode changes are met prior to changing modes or plant configurations. The inspector should review the establishment of the barriers by reviewing RCS boundary leakage and the setting of containment integrity. The inspector should walkdown containment prior to reactor startup to verify that debris has not been left which could affect performance of the containment sumps. Review reactor physics testing results to verify that core operating limit parameters are consistent with the design.
02.07 | Identification and Resolution of Problems. Verify that the licensee is identifying problems related to refueling outage activities at an appropriate threshold and entering them in the corrective action program. For a sample of significant problems documented in the corrective action program, verify that the licensee has identified and implemented appropriate corrective actions. See Inspection Procedure 71152, "Identification and Resolution of Problems," for additional guidance.

### 71111.20-03 Inspection Guidance

General Guidance

This activity is also addressed in other inspectable areas (i.e. maintenance work prioritization and control). In a refueling or other outage this procedure should take precedence in relation to outage planning and configuration management reviews.

IMC 0609, Appendix G, "Shutdown Operations Significance Determination Process", is a SDP for shutdown operations based on maintaining adequate mitigation capability. The checklists were developed for different plant operational states defined by: mode, time to boiling, reactor coolant system level, and reactor coolant system configuration. They are grouped by the five shutdown safety functions identified by NUMARC 91-06: decay heat removal, inventory control, power availability, reactivity control, and containment. If plant conditions during the time period of an inspection finding (i.e. a licensee performance deficiency) meet the checklist threshold for Phase 2 analysis, then more detailed risk analysis is needed to determine if the finding is risk significant.

Certain plant configurations have higher risks than others. For these configurations, the checklists have more guidelines for each safety function. The following are examples of high risk configurations for PWRs: (1) RCS boundary is breached and the steam generators cannot be used for DHR; and (2) during mid-loop conditions, it is more likely that DHR can be lost due to poor RCS level control or poor DHR flow control. Examples for BWRs are: (1) technical specifications allow for more equipment to be inoperable in cold shutdown than in hot shutdown; and (2) technical specifications allow SRVs to be inoperable, but they are needed to provide an alternate decay heat removal path and pressure control if the DHR system is lost.

Additional general guidance is provided in the following table.

CORNERSTONE | RISK PRIORITY | EXAMPLES
INITIATING EVENTS | Equipment or actions that could cause a loss of decay heat removal. Actions that could affect reactor vessel level. Activities that contribute to loss of off-site power or station blackout. | Inadvertent lowering of reactor vessel level in mid-loop due to operator inattention. Improper hanging or restoration of clearance tags that could affect reactor vessel level, DHR, or electrical power availability. Actions that could cause reactor vessel level indication to be inaccurate.
MITIGATING SYSTEMS | Equipment used to mitigate a loss of decay heat removal. Equipment used to mitigate a loss of reactor vessel level. | Activities that affect the ability of pumps designated in the shutdown risk analysis to add water to the reactor vessel. Activities that affect the water source for any of the pumps designated in the shutdown risk analysis. Activities that affect the electrical power sources designated in the shutdown risk analysis. Failure to verify refueling interlocks.
BARRIER INTEGRITY | Actions that affect the fuel cladding barrier, reactor vessel/reactor coolant system integrity, or affect containment integrity. | Exceeding the required heatup or cooldown rates. Failure to establish containment integrity during fuel movement.

Specific Guidance

03.01 | Review of Outage Plan. Defense-in-depth should be maintained; Backup SSCs should be identified for those taken out of service when removal of the SSC from service affects a key safety function. Risk of overlap or potential overlap of activities should be considered. Consider the risks associated with handling of heavy loads, scaffolding erection and the increased potential for a fire or internal flood.
03.02 | Monitoring of Shutdown Activities. Cooldown rates should be spot checked to ensure they meet technical specification requirements, thus avoiding overcooling which can challenge the reactor coolant system boundary. The period during transfer to shutdown cooling can be a time when risk of overcooling is the greatest.
03.03 | Licensee Control of Outage Activities
| IP 71111.13, " Maintenance Risk Assessments and Emergent Work Evaluation," indicates that IMC 0609, Appendix G checklists are to be used by inspectors to evaluate whether licensee risk assessments (performed in accordance with 10 CFR 50.65(a)(4)) addressed SSCs necessary to support the shutdown key safety functions. Outage configuration management is an important issue related to shutdown risk. The adequacy of the methods used and the operators' understanding of plant configuration are key to controlling shutdown risk. When equipment is taken out of service for maintenance, declaring an SSC available should be consistent with the SSC's functional requirements. Operators and outage control personnel should be aware of which equipment is relied on for the key safety functions. This extends to the containment sump (PWRs) or the suppression pool (BWRs), and associated water flow paths. Equipment designated to perform a key safety function should not be adversely affected by outage activities. Contingency plans for restoring key safety functions should be available. Contingency plans should include a prioritization of equipment to use. Emergent work (maintenance, surveillance, etc.) or planned work which exceeds scheduled time windows should be controlled to prevent overlap with other activities when such overlap can potentially perturb the plant or affect a key safety function. Risk assessments should be maintained current with respect to emergent work and schedule changes. Licensees should assess overlapping or potentially overlapping activities and the effects of these activities on the key safety functions. Other baseline inspection procedures address observation of some activities during an outage. The following areas should focus on only those functions or components related to shutdown risk. The sampling of the activities should be
| a. Clearance Activities. Improper performance of clearance activities can increase risk by causing internal flooding, causing increased ignition sources, and affecting defense-in-depth. Clearance tags for boundaries associated with risk significant maintenance or modifications should be hung on the proper equipment and equipment configured such they do not increase the risk associated with the relied upon remaining equipment. Examples of risk significant clearance activities include: 1) boundaries for a water system that will be open for maintenance in areas that are in close proximity to risk important equipment; 2) clearance removal where return of electrical power to particular motor-operated valves could cause the valves to reposition due to locked in signals, in particular those that have direct interaction with the reactor coolant system, decay heat removal, or spent fuel pool cooling. At multi-unit sites, be aware of wrong unit and common unit tagging/clearance issues.
| b. Reactor Coolant System Instrumentation. Instrumentation plays a key role in risk reduction during shutdown conditions. In particular, level instrumentation is a key factor during reduced inventory and mid-loop, and pressure indication during loss of decay heat removal. RCS pressure, level and temperature instruments and associated components (including piping, RCS and connected system vents, etc.) should be installed and configured to provide accurate indication. Independent instrumentation for each parameter should be provided to minimize the potential for common cause failure. For level instruments, tubing runs should not have elevation changes that could trap either liquid or vapor/gas in the instrument lines (i.e., loop seals). If normal operating level instrumentation is used, the effects of changes in water density (due to lower temperature) should be considered. Operators should be aware of the effect of loss of DHR on the plant's level instrumentation due to heatup and pressurization. For temperature instruments, operators should be aware of the effect of loss of DHR on the plant's temperature indication and the potential for discrepancies between the temperature indications and the actual plant state. Temperature may be measured in the DHR loop in which case interruption, bypass, or partial bypass of DHR flow could lead to incorrect and non-conservative temperature indications.
| c. Electrical Power. Loss of offsite power and station black out are major factors in shutdown risk. Control of electrical power to components is critical to risk during outages since components are deenergized and reenergized with systems in unusual/disassembled configuration. This can cause unexpected drops or increases in RCS level, internal flooding, false protective system actuations, as well as significant personnel hazards. The most important are those that would contribute to loss of decay heat removal. In addition, the defense-in-depth called for in the outage risk control plan should be maintained.
| d. DHR System Monitoring. Loss of decay heat removal is a primary contributor to shutdown risk at PWRs. An important attribute to look at when decay heat removal is lost is RCS pressure relief due to the pressure increase with temperature. When the licensee is relying on the steam generators to provide a backup means of DHR by single-phase natural circulation, verify 1) procedures for these methods are derived from analyses and the required equipment is available: 2) RCS pressure boundary is closed; 3) steam generator tubes are full; 4) pressure control capability in the RCS is maintained to ensure subcooling margin; 5) capability to feed the steam generators; and 6) capability to remove steam from the steam generators (e.g., atmospheric relief valves, condenser with steam dump capability, etc.). Perform walkdown/inspection when the reactor inventory is lowest and soon after shutdown, i.e., when the time-to-boil is lowest.
| e. Spent Fuel Pool Cooling System Operation. Spent Fuel Pool Cooling recovery procedures based on current/bounding heat loads should exist for situations involving loss of spent fuel pool cooling. Operators should be trained on backup equipment and procedures for loss of spent fuel cooling. Equipment designated in the recovery procedures should be readily available, dedicated, not obstructed by outage activities, and compatible with equipment that it must be connected to. Instrumentation, alarms, equipment, instructions, and training should be provided to alert operators for the need and enable them to add water to the spent fuel pool if it becomes necessary.
| f. Inventory Control. Problems with the RCS pressure boundary have been found to be significant in analyzing shutdown risk insights. Examples of loss of inventory paths include DHR to suppression pool on BWRs; main steam line paths including SRV removal, automatic depressurization system testing, main steam isolation valve maintenance, etc. on BWRs; DHR system cross tie valves, thimble tube seals, and steam generator nozzle dams for PWRs; and maintenance activities on connected piping or components that are at an elevation lower than the vessel flange on all plants. For BWRs, automatic isolation on low level should not be disabled. This signal can mitigate a loss of inventory from the DHR system to the suppression pool. Maintaining this signal operational is required by some technical specifications. In addition, main steam line plugs should be considered for work activities on the main steam system. Reactor cavity seal should be inspected and maintained to preclude potential seal failure. Systems required for proper operation of the reactor cavity seal (e.g., instrument air) should also be maintained to prevent failure of the seal. Adequate vents should be provided to accomplish gravity feed and low pressure makeup when relied upon. Also paths for inter-system LOCA such as maintenance and testing on the non-operating loop Low Pressure Injection (LPI) train or LPI testing on return back to RWST.
| g. Reactivity Control. For PWRs, the licensee should identify and implement appropriate administrative controls on potential boron dilution paths. Uniform RCS boron concentration is important, therefore, addition of water with a lesser boron concentration or starting of reactor coolant pumps which could inject water with a lesser boron concentration into the core should be controlled. The licensee should have adequate controls during refueling to preclude improper sequencing of control rods or fuel assemblies, which can allow core regions to approach criticality without early detection by a source range monitor.
| h. Containment Closure. Verify proper containment configuration during risk-significant evolutions (e.g., PWR mid-loop operations, BWR cavity drain down, etc,) including provisions for achieving containment closure in a timely manner during periods when containment is permitted to be open.
03.04 | Reduced Inventory and Mid-Loop Conditions. The period of reduced inventory and mid-loop are the times of greatest risk during shutdown. The inspector should review the planned activities during those conditions and consider the risk effect of those activities on the critical parameters that affect time to boil. Review unit/outage specific time-to-boil curves. The inspector should:
| a. Review licensee commitments to GL 88-17.
| b. Ensure the licensee has reviewed their controls and administrative procedures governing mid-loop operation, and have conducted training for mid-loop operation.
| c. Ensure that procedures are in use for:
| Containment closure capability for mitigation of radioactive releases. RCS temperature--at least 2 independent, continuous indications of core exit conditions are operable. RCS level--at least 2 independent, continuous indications of water level are operable and calibrated. RCS perturbations should be avoided. RCS inventory addition--at least 2 additional means of adding inventory must be available, in addition to RHR pumps. Identifying unexpected RCS inventory changes and verifying an adequate RCS vent path during RCS draining to mid-loop. Nozzle dams--reasonable assurance is obtained that not all hot legs are blocked simultaneously unless the upper plenum is vented. Electrical power--contingency plans exist to repower vital busses from alternate source if primary source is lost. Emergency/abnormal operating procedures that address reduced inventory operation.
| Time to boil can be less than 30 minutes when decay heat removal is lost in mid-loop conditions. During mid-loop operations the operator provides the only prevention/mitigating function for a loss of reactor vessel level prior to the loss of decay heat removal. There generally are no alarms that provide indication of loss of level in the mid-loop condition. Operator attention to plant conditions is the key prevention aspect for a loss of decay heat removal event. The inspector should observe operator performance during drain down and mid-loop conditions in relation to how distractions such as unexpected conditions and emergent work affect operator focus.
03.05 | Refueling Activities. Verify that refueling seals have been properly installed and tested. Observe that foreign material exclusion is being maintained in the refueling area, spent fuel area, and suppression pool area. Fuel loading should be performed in a manner to maintain coupling between the instruments used for monitoring reactivity and fuel loaded in any location within the vessel. To ensure that the fuel cladding barrier will not be challenged, verify that fuel assembles were loaded in the reactor core locations specified by the design. This may be accomplished by reviewing licensee videotape and other records of the core loading. Another method is to review physics testing to ensure the testing was adequately conducted and that core operating limit parameters are as predicted by the design.
03.06 | Monitoring of Restart Activities. This activity should focus on the licensee having the required equipment available for mode changes to ensure that risk is kept to a minimum. The activity can be conducted by direct observation of system/equipment operation, documentation reviews, or a combination of both. The sampling should be adequate to provide reasonable assurance that the licensee is following the administrative program laid out to ensure that risk is maintained at a minimum level. The inspector should observe that technical specifications RCS boundary leakage requirements are met prior to the applicable mode changes and that containment integrity is established prior to entering the applicable technical specifications mode.
03.07 | Identification and Resolution of Problems. No guidance

### 71111.20-04 Resource Estimate

Inspection resources are affected by the length of the outage, amount of risk significant work and the plant configuration. The inspection resources for performing this procedure at each reactor unit is estimated at 70 to 100 hours each refueling outage. Inspection resources are estimated at 20-30 hours for non-refueling and forced outages, where some of the above inspection requirements may not be applicable. Some testing activities normally occur during refueling outages. These include physics testing, emergency diesel generator time response testing, RCS hydrostatic testing, control rod scram time testing, rod drop time testing, reactor trip breaker testing, and containment sump valve testing. Inspection of these activities that is not related to shutdown risk should be charged to IPs for post-maintenance and surveillance testing (IP 71111.19 and IP 71111.22).

### 71111.20-05 References

Inspection of the minimum sample size will constitute completion of this procedure in the Reactor Programs Systems (RPS). That minimum sample size will consist of 20 post-maintenance testing activities in a year regardless of the number of reactor units at the given site.

### 71111.20-06 References

GL 87-12, "Loss of Residual Heat Removal (RHR) While the Reactor Coolant System (RCS) is Partially Filled," July 9, 1987.

NUREG-1269, "Loss of Residual Heat Removal System, Diablo Canyon, Unit 2, April 10, 1987," June 1987.

GL 88-17, "Loss of Decay Heat Removal, 10 CFR 50.54(f)," October 17,1988.

NUREG-1410, "Loss of Vital AC Power and the Residual Heat Removal System During Mid-Loop Operations at Vogtle Unit 1 on March 20, 1990," June 1990.

NUREG-1449, "Shutdown and Low-Power Operation at Commercial Nuclear Power Plants in the United States," September 1993.

IN 93-72, "Observations from Recent Shutdown Risk and Outage Management Pilot Team Inspections," September 14, 1993.

NUREG-0700, REV.1, "Human System Interface Design Review Guideline," June, 1996

Generic Letter 98-02, "Loss of Reactor Coolant Inventory and Associated Potential for Loss of Emergency Mitigation Functions while in a Shutdown Condition," May 28, 1998

Information Notice 95-03, Loss of Coolant Inventory and Associated Potential Loss of Emergency Mitigation Functions while in a Shutdown Condition," January 12, 1995

Inspection Procedure 71152, "Identification and Resolution of Problems"

END

1. For PWRs, containment closure is met if all containment penetrations (including temporary penetrations, the equipment hatch, and the personnel hatch) have a differential capability equal to ultimate pressure or would be expected to remain intact following an accident. Leakage requirements as described in Appendix J are not a concern. Results from the RES Surry shutdown PRA show that containment pressure (in a sub-atmospheric containment) following a core damage event at shutdown can be high.(2)

2. At 13MW (approximately 2 days), a severe accident at mid-loop resulted in peak pressures of approximately 50 psi w/o containment sprays. At 7MW (approximately 12 days), a severe accident at mid-loop resulted in peak pressures of approximately 32 psi w/o containment sprays.