Basis

The design configuration of DOE nuclear facilities must be established and controlled to ensure that the plant mission can be accomplished reliably and safely. DOE 5480.23, Nuclear Safety Analysis Reports, defines configuration management as "The systematic evaluation, coordination, approval (or disapproval), documentation, implementation, and audit of all approved changes in the configuration of a product after formal establishment of its configuration identification." Configuration management requires control of changes over plant life, ensuring that the facilities continue to conform to required design and satisfy technical requirements.

Nuclear safety can only be ensured if adequate controls exist for ensuring the continuation of the safety intent of the validated design basis during the performance of modifications and updates over the life of the plant. Therefore, DOE is attempting to integrate design control with other long-term functions such as operations and maintenance, ensuring continuous coordination of the design features and changing functional requirements. Maintaining the original design intent can be a safety culture issue, as it requires additional circumspectness and initiative to investigate and to understand a system thoroughly, including how each component can reliably perform its intended function within that system, even in the absence of specific documented information. Personnel may assume that, if equipment is maintained according to established procedures or vendor requirements, then the long-term objectives of maintenance activities will be met automatically. Little thought or regard may be given to design intent at the technician or maintenance foreman level because such considerations are often expected to be handled by maintenance or test procedure authors.

Maintenance procedure writers often do not have the feel for proper operation of equipment that maintenance technicians and maintenance foremen have. There are times when equipment could be judged as within specification according to maintenance and testing criteria, but the ability of the equipment to conform to design intent remains dubious. Nevertheless, a valid effort can not be made to resolve these uncertainties if personnel are unaware of the equipment's functional design intent.

Symptoms

Functional Area Coordination

EA1: The assessor reviewing examples of design change documentation should determine whether maintenance-related guidance is provided and whether this guidance is adequate to ensure that the modified equipment will meet the design intent over the rest of the life of the plant.

EA2: The assessor reviewing the status of as-built drawings should determine whether the information in the drawings is sufficiently accurate and detailed for use in maintaining plant systems and equipment. For example, the drawings should contain accurate information regarding the manufacturer and model numbers, interfacing systems, and enough system detail for effective mechanical and electrical isolation.

EA6: The assessor reviewing the Engineering Organization interfaces with other organizations can help determine whether the configuration management program is implemented within the design organization in a manner that vigorously maintains the plant safety basis. All line organizations should understand the importance of configuration management, and they should offer timely feedback to the design organization on systems and equipment becoming obsolete or difficult to operate and maintain. This feedback should result in a clear and timely response that addresses the concern in a proactive manner.

EA8: The assessor reviewing engineering documentation and reference libraries should help determine whether there is adequate information available to support equipment and system maintenance, testing, and troubleshooting over the life of the plant.

MA2: The assessor reviewing the facility's procurement and storage procedures can assist in assessing whether controlled documentation is used to maintain the safety system design intent over the life of the plant, allowing better control of design changes under the configuration management program. Procurements should be based on validated and controlled materials lists, and storage facilities and procedures should reflect the appropriate classes of cleanliness and environmental requirements. The procedures for procuring and storing safety related materials and parts should be accessible to maintenance personnel in order for them to be able to protect the materials after receipt and during installation.

MA3: The assessor reviewing the M&TE and calibration history can help determine whether the configuration control program is effective over the life of the plant. Proper configuration management and ability to fulfill design intent over facility or system life depends not only on the use of the right materials and components, but also on the proper calibration relative to the intended design limits and operating requirements. For assurance that parameters are in range, calibrated M&TE must be used during maintenance and surveillance activities, but the basis of the calibrations should go all the way back to the original functional design intent relative to the original safety margins.

MA4: The assessor reviewing documentation for maintenance work orders can help ensure that controlled documentation is used for plant maintenance by determining whether the work package documents reflect the as-built plant. Either the planning group or the maintenance personnel may be routinely compensating for drawing and other documentation deficiencies.

MA5/MA9: During interviews with personnel, the assessor should inquire regarding the general attitudes that prevail regarding the availability of useful documentation to support the maintenance program.

MA6: The assessor reviewing the work order system should determine whether plant safety equipment and system configuration management documentation is available and used to identify and maintain the design intent of equipment over the life of the plant. The assessor should evaluate whether the system documentation is used effectively to determine system isolations and needed replacement parts listed.

MA7: Assessors reviewing preventive maintenance procedures in progress can assist in verifying that configuration management documentation is effective in supporting maintenance by determining whether the technician understands the relationship of the preventive maintenance actions to ensuring the functional adequacy of the equipment relative to the design intent of the system and plant safety margins. Similarly, during corrective maintenance activities such as post-maintenance testing, assessors should verify that the actual results reflect the specific requirements of the original design intent. For example, although centrifugal pumps can pump significantly more fluid than originally intended for normal operation, they should normally be operated primarily near the intended flow rate in order to meet reliability intentions of the designers. If the system flow requirements are excessive, there may be other problems in the system. The assessor should note whether the trending of information recorded in the material history records is used to help maintain the equipment within the design intent.

MA8: The assessor observing the central work control center can help to determine whether plant safety equipment and system configuration management documentation is available and used to identify and maintain the design intent of equipment over the life of the plant. In planning, prioritizing, and scheduling work, work control center should frequently refer to system documentation.

MA10: The assessor reviewing the maintenance history on a major component can help to determine whether the overall maintenance program is based on adequate technical documentation within the configuration management program. This can be addressed during the documentation review or during the interview with the cognizant engineer.

MA11: The assessor reviewing occurrence reports can assist in assessing the adequacy of the technical documentation to support the maintenance program by identifying any occurrences that resulted from inadequate design documentation.

Management Cause Analysis

2A.1.1: If there are significant deficiencies in the configuration management program, line managers can not be assured that they are aware of the as-built facility design. The inaccurate or untimely information resulting from the deficiencies should result in symptoms that managers recognize as related to documentation control or other aspects of configuration management. In organizations where line managers are not technically involved, deficiencies in the configuration management program will not be noticed. For example, managers may be signing approvals for work packages or design changes without assessing the accuracy or clarity of the supporting documentation.

2A.2: Deficiencies the use of accurate and current plant information to maintain the design intent over the life of the plant may be due to the unavailability of that information to managers. In order for maintenance management and staff to routinely use safety and configuration management documentation, current controlled copies must be widely distributed or conveniently available. The documentation should be organized and in good order. It should be easy to determine whether a document in hand is current. Assessments of the configuration management program may result in findings that indicate the managers do not have ready access to controlled design documents, or that they are using working copies that are out of date and should have been destroyed. For line managers, this type of problem is most often associated with drawings of major systems or system description documents that have collected over a period of time, possibly due to the difficulty in obtaining up-to-date copies.

2B.3.8: Training and retraining programs for maintenance personnel should teach the importance of design intent and engender sufficient inquisitiveness to review safety and configuration management documentation to identify the design intent. When deficiencies are found in the maintenance staff's ability to keep equipment within the original operating expectations, a potential root cause might be a failure to conduct training in this regard.

2D.3: Deficiencies in the design documentation on which the maintenance program is based could be due to the failure of the contractor to develop or update safety analysis reports and supporting documentation for new or modified equipment.

2F.1.2: Failure to maintain equipment in a manner that ensures conformance with the original design intent could be the result of the failure of managers to convey the importance of this to workers and supervisors. The philosophy of using safety documentation and maintaining the design intent over facility design life must be established by higher management and must be made a fundamental expectation throughout the Maintenance Organization as a routine expectation. The need to control the specific design of all aspects of safety related equipment is particularly important. For example, a welder may independently decide to use a different type of weld than is authorized in making a repair unless this type of action has been clearly defined as a design violation.

2F.2.2: Maintenance personnel should have a working knowledge of their roles in the maintenance of plant safety margins described in the safety documentation and should be motivated to perform their tasks in a conscientious manner. It is management's responsibility to ensure that the proper design documentation is available and that the plant safety culture ensures its consistent use in all of the facility maintenance and testing programs.

2F.2.3: Maintenance personnel should be generally familiar with the intended operational capabilities of the equipment on which they perform maintenance and testing and should be circumspect in applying their best judgment as to whether maintenance and test procedures actually accomplish intended equipment repairs that will ensure safe and reliable operation. Management should convey to maintenance and test personnel that working without an inquisitive and circumspect attitude can lead to problems even when procedures are followed.

References

Basis

Management controls for maintenance activities are needed by the Operations Organization to ensure that the facility configuration is maintained in accordance with design requirements and that the operators know the status of equipment and systems. These controls should extend to all facility, contractor, or subcontractor personnel involved in maintenance activities. Controls should identify plans, provisions, and compensatory actions to prevent the limitations of maintenance and repair from degrading safety. These controls also should include adequate lockout/tagout procedures and system verification methods.

Facility configuration changes may result from maintenance, modification, and testing activities. Guidance on configuration changes should include instructions for system alignments, locking of components, verification of technical safety requirements prior to facility operating-mode changes, authorization prior to removing or restoring equipment to service, and identification and documentation of equipment deficiencies.

The operations supervisor should authorize all maintenance activities on equipment which is important to safety, affects operations, or changes control indications or alarms. This authorization should be in writing on the document controlling the maintenance work. Documentation of maintenance work in progress should be available in the control area for review by operating personnel. Any testing following maintenance should be specified on the maintenance work order or accompanying documentation.

Additionally, operators must communicate changes in equipment and system configuration from shift to shift by using a thorough turnover process. Turnover checklists and equipment status boards are often used as aids for identifying status information efficiently and accurately. Operations logs should contain a history of key maintenance activities.

Maintenance personnel must report changes in the status of facility equipment and systems to the appropriate operator control station. Maintenance supervisors should routinely monitor work in progress to help ensure that maintenance activities are conducted in accordance with applicable policies and procedures. Maintenance supervisors also should review completed work requests for the adequacy of repair, complete documentation, and identification of rework.

Overall, rigorous control of maintenance activities should be directed toward achieving high-quality work performance, personnel safety, radiological safety, equipment and system protection, and facility safety and reliability.

Symptoms

Functional Area Coordination

EA2: The assessor reviewing the status of as-built drawings and documentation can help ensure that the Operations Organization watchstanders have control over maintenance activities by verifying that the drawings and documentation used by operators are current. If a drawing or document is not maintained current, operations may authorize a maintenance activity without full knowledge of system isolation or an interface with another system, thus jeopardizing facility safety.

FA2: The assessor reviewing selected policies and procedures in the fire protection program can help determine whether plant operations personnel have control of plant maintenance activities. Since fire protection personnel may be performing maintenance on firemain and alarm systems that affect plant safety, the Fire Protection Organization should have clear procedures regarding obtaining authorization from the Operations Organization to perform this maintenance and providing periodic status reports.

MA4: The assessor reviewing documentation for maintenance work orders can help to ensure that operations has control of plant maintenance by determining whether the work package documents reflect the as-built plant, allowing the operators to obtain a clear understanding of the effects of the work package on plant systems and to issue proper tagouts. Either the operations supervisor, planning group, or the maintenance personnel may be routinely compensating for drawing deficiencies.

MA6: The assessor reviewing the maintenance work order system can assist in determining whether maintenance activities are controlled adequately by the Operations Organization. This can be done by checking to see whether maintenance work orders are maintained in the operations control area and completed maintenance work orders are completed filled out with no missing information or signatures.

MA7/MA8: Assessors reviewing a preventive or corrective maintenance activities and management of active work packages can assist in verifying that operations has continuous control of maintenance activities. This can be done by verifying that maintenance work requests are submitted to operations for approval, lockouts/tagouts are properly controlled, maintenance personnel request permission from operations to change equipment or system status, and maintenance personnel promptly notify operations when a maintenance activity is complete. Some maintenance personnel will not communicate with operations personnel during the entire performance of a maintenance activity.

MA11: The assessor reviewing plant occurrences should identify problems that resulted from maintenance being performed without the knowledge or control of the operators.

OA1: Assessors observing shift turnover can help to ensure that the operators have control of maintenance activities by determining whether the status of all ongoing maintenance activities is explained adequately from one shift to the next. Frequently, an operator will be aware that a maintenance activity is ongoing but will not know the impact of the maintenance activity on facility operations. Oncoming operators should make thorough facility tours, ask maintenance personnel questions, review status boards, and ensure that off-going operators and maintenance personnel explain the various work being performed at the facility.

OA4: Assessors observing operation of the tagout program can help verify that the operators have control of maintenance activities. This can be accomplished by ensuring that tagouts related to maintenance adequately isolate the equipment or systems affected, tagouts are properly hung and verified, facility status boards are updated to show tagout requirements, and tagouts are promptly removed upon completion of a maintenance activity. Often, more than one maintenance activity can affect a single system or component. When this is the case, assessors should verify that a component is not cleared when only one of several maintenance activities affecting the component is completed.

OA6: Assessors attending briefings of upcoming maintenance activities can help determine whether the operators will have adequate control of maintenance activities. In these briefings, maintenance personnel should describe exactly what they are doing, how long it will take to complete each activity, and any post-maintenance testing requirements. Assessors should verify that operators understand the impact of each maintenance activity, the specific restrictions placed on the plant, and how to perform the post-maintenance tests. In many cases, only the oncoming operating shift will attend these briefings, although a maintenance activity will last for multiple shifts. Therefore, the operating shift personnel attending a briefing must understand each maintenance activity thoroughly so that they can adequately explain the activities to the following operations shift.

OA11: Assessors determining whether system status displays are current and used can help verify that the operators have control of maintenance activities. This can be done by comparing the system status displays to the maintenance work requests/job orders and the lockouts/tagouts. If the system status displays do not reflect the work requests/job orders and lockouts/tagouts, the assessor should determine the correct system status. In most cases, the system status displays are not updated when a maintenance activity has been completed and the tagout has been cleared.

TA3: Assessors observing certified operator training can help determine whether operations personnel will develop the proper tools to control maintenance activities. Some of the needed tools are a questioning attitude, an understanding of system interrelationships, knowledge of conduct of operations, strong communication skills, and the ability to judge whether adequate compensatory actions are being taken to prevent the maintenance activity from degrading safety.

TA6: The assessor observing maintenance on-the-job training can assist in verifying that operations has control of maintenance activities. If qualified maintenance personnel and their trainees do not keep operations informed about what they are doing and do not request permission to perform an activity when required, this is an indication that operations personnel may not be aware of what is going on in the facility.

Management Cause Analysis

2A.1.2: If there are significant deficiencies in the control of plant maintenance by the Operating organization, documentation of the plant design requirements and the current operating and material conditions may be a problem. Regardless of procedures and notifications regarding maintenance activities, plant operators and managers cannot be assured that they are aware of system and equipment status without this comprehensive and up-to-date information.

2A.2.2: Deficiencies or unusual events related to the performance of special maintenance activities may occur due to a lack of availability of information to managers. In order for maintenance and operations management and staff to understand the impact of maintenance activities on facility operations on a routine basis, current documentation describing ongoing and upcoming facility activities must be widely distributed or conveniently available and must be reviewed and understood. The documentation should be organized and in good order. It should also be easy to determine whether a document in hand is current. Maintenance and operations line managers should be able to use these documents to plan work in a manner that minimizes impacts on the operations of the plant safety systems, ensures compliance with operational safety requirements, and maximizes facility safety.

2A.3.5: If line managers do not routinely review safety-significant facility events and activities, they may not fully understand the impacts of performing a maintenance activity or installing a modification. Also, they may not be aware of recent changes to the facility. Thus, when line managers are requested to approve the performance of maintenance or modification work, they may not have the knowledge do so in an effective manner. Processes to ensure that line managers are kept informed of facility status should be in place so that they can make informed decisions regarding maintenance work planned for their facilities.

2D.3.4.49/2D.3.4.54: If maintenance activities are being conducted without the knowledge of the operators, this could be due to operations supervisors not establishing control of the facility. Operations supervisors must have continuous control of plant equipment, and each person conducting work in the plant must keep operators informed regarding the status of their work.

2D.3.4.57: The failure of operators to keep positive control of plant maintenance could be caused by inadequate administrative controls. Problems often occur when these administrative controls are not in place or when they are not set up to ensure full closure of the process. For example, maintaining records on which electrical leads have been lifted or where jumpers have been installed to allow maintenance will not prevent problems unless the administrative process ensures that the systems are systematically returned to the design condition at the completion of the work and the systems tested for proper operation, even when they were not directly involved in the maintenance activity.

2F.2: Maintenance personnel should have a working knowledge of their roles in the maintenance of plant safety margins described in the safety documentation and should be motivated to perform their tasks in a conscientious manner. This includes adequately researching the problems associated with various maintenance activities and keeping operations informed about the status of maintenance activities. Operations personnel should be inquisitive and prudent in approving and tracking maintenance activities. Management must convey to operations personnel that they bear the responsibility for maintaining the facility safe and that they should be cautious in determining when to allow the performance of various maintenance activities.

References

Basis

An effective preventive maintenance program plays an important role in ensuring safe and reliable operation of nuclear facilities. Preventive maintenance programs are established at DOE nuclear facilities to maintain equipment within design operating conditions and to extend equipment life. Experience has shown that better operating facilities have well-defined, effectively administered policies and programs to govern preventive maintenance activities. DOE Order 4330.4A, Maintenance Management Program, defines preventive maintenance as, "All those systematically planned and scheduled actions performed for the purpose of preventing equipment, system, or facility failure."

The preventive maintenance program should be implemented in a manner that promotes operational safety, worker health, and environmental protection while at the same time achieving the facility mission. Additionally, the program should strive to reduce facility and equipment downtime, minimize unplanned challenges to systems important to safety, and reduce radiological exposure. Preventive maintenance should be performed on equipment whose failure can limit safe or reliable operation or result in forced outages. The bases for preventive maintenance actions should be documented and understood by operations, engineering, and maintenance personnel.

A key to implementing an effective preventive maintenance program is long-range planning. An effective system for planning, scheduling, and coordinating maintenance activities should be implemented in order to accomplish maintenance in a timely manner, improve maintenance efficiency, reduce radiation exposure, and increase equipment reliability. Each preventive maintenance item should be scheduled in a manner that allows consideration for performing other related maintenance at the same time. The preventive maintenance program should define the required activities and the frequency at which they should be performed. Selection of required preventive maintenance actions should be based on vendor recommendations, plant experience, and good engineering practice.

Experience has shown that deficient procedures and failure to follow procedures are major contributors to many significant, undesirable events. Defining the work to be performed and providing appropriate procedures or instructions can reduce maintenance errors. Assigning work priorities that reflect the relative importance of each job to facility operation maximizes the effect of maintenance in upgrading safety and reliability. Planning also reduces delays in accomplishing work by ensuring that support items, such as special tools, other equipment, and repair parts and materials required to accomplish the work, are available when needed.

Symptoms

Functional Area Coordination

EA1: The assessor reviewing design change documentation and assessing the level of configuration management control can help determine whether the preventive maintenance program is comprehensive. This can be done by assessing whether design changes are coordinated with maintenance personnel and plant configuration change documentation is appropriately distributed to the Maintenance Organization. If design and configuration changes are not being communicated to maintenance personnel, preventive maintenance procedures may not reflect as-built equipment and systems.

FA5: The assessor reviewing the plant fire hazards analysis information relative to equipment can help assess the preventive maintenance program. This can be done by determining whether fire protection equipment is included in the master equipment list and whether related preventive maintenance activities are accomplished, either by the Fire Protection Organization or by the Maintenance Organization. If updated fire protection equipment does not have updated preventive maintenance activities, this could be due to a lack of communications and coordination between fire protection personnel and the associated maintenance personnel.

MA1: If the assessor conducting assessments of the material condition of the plant finds excessive corrosion, this condition might be due to an inadequate preventive maintenance program. One of the most frequent failures of Maintenance Organizations is to predict the effect of corrosion on equipment failures and to take action to correct the corrosion before a system or component is degraded below its design basis. This is due to inexperience and failure to assess the impact of material conditions in the field on the current preventive maintenance program.

MA2: The assessor reviewing the procedures for procuring and storing safety-related materials and parts can help assess the preventive maintenance program. This can be done by determining the ease with which preventive maintenance personnel can acquire materials and parts and whether procurement procedures guide personnel to procure materials and parts for upcoming preventive maintenance items. In many cases, preventive maintenance items are not completed as scheduled because the maintenance personnel are waiting to receive material and parts support.

MA3: The assessor reviewing the calibration history of the measuring and test equipment should be sensitive to the possibility that out-of-calibration measuring and test equipment was used to perform preventive maintenance. The assessor can review some preventive maintenance items requiring measuring and test equipment and determine whether the equipment was in calibration. The assessor also can determine whether personnel that perform measuring and test equipment calibrations consider upcoming preventive maintenance items. The completion of preventive maintenance items is sometimes delayed in order to calibrate measuring and test equipment.

MA4: The assessor reviewing documentation for maintenance work orders can help evaluate the preventive maintenance program. An effective preventive maintenance program will train maintenance personnel on how to complete work orders correctly. Also, if maintenance work orders do not reflect the as-built facility, the preventive maintenance program may not be keeping up with facility configuration changes.

MA5/MA9: Assessors interviewing maintenance personnel should be able to identify problems with the preventive maintenance program. Of particular interest is whether these personnel believe that the preventive maintenance program is comprehensive and well implemented.

MA7: Assessors reviewing a preventive maintenance activity in progress can help verify the adequacy of and support for the preventive maintenance program. This can be done by determining whether the maintenance personnel are well trained, whether operations personnel support the accomplishment of the maintenance activity, whether the maintenance personnel have adequate material and parts support, and whether the preventive maintenance procedure adequately describes how to accomplish the maintenance activity.

MA8: The assessor observing the work control center can help determine the adequacy of the preventive maintenance program. This can be done by reviewing preventive maintenance schedules and determining accomplishment rates, reviewing maintenance procedures to ensure vendor recommendations have been incorporated, determining the level of control of preventive maintenance activities, and verifying that post-maintenance testing requirements are established for certain preventive maintenance items.

MA10: The assessor reviewing the details of the maintenance history on a selected major component should review all of the periodic maintenance and predictive maintenance activities associated with that equipment.

MA11: The assessor reviewing occurrence reports should note whether any equipment failures could have been caused by lack of adequate preventive maintenance and whether this condition has been corrected.

MA13: The assessor conducting the evaluation of maintenance backlogs and trends can help to determine whether the preventive maintenance program is effective. If the backlog is overloaded with corrective maintenance requests for a specific system or component, this may be an indication that the preventive maintenance program for the system or component needs revision.

TA6: The assessor observing maintenance on-the-job training can help verify the adequacy of the preventive maintenance program. If the qualified maintenance person assisting the trainee shows strong skills and knowledge of preventive maintenance, this can indicate a good preventive maintenance program.

Management Cause Analysis

2A.1.1: If there are significant discrepancies in facility technical manuals and as-built drawings, maintenance line managers cannot be assured that their preventive maintenance program is adequate. These discrepancies should result in symptoms that managers recognize as related to documentation control or other aspects of configuration management.

2A.1.3: If there are deficiencies or unusual events related to the performance of preventive maintenance activities, this may be due to the lack of availability of information to managers. In order for maintenance and operations management and staff to understand the impact of preventive maintenance activities on facility operations, current documentation describing ongoing and upcoming facility activities must be widely distributed or conveniently available. The documentation should be organized and in good order. It should be easy to determine whether a document in hand is current. Maintenance and operations line managers should be able to use these documents to plan work in a manner that minimizes impacts to facility safety.

2B.3.1: If deficiencies are identified or unusual events frequently occur during the performance or preventive maintenance activities, it may be due to the adequacy of the maintenance training program. An approved, documented training program establishes the correct methods for performing maintenance and should include a periodic training program that demonstrates proficiency in performing maintenance.

2C: Responsibilities and authorities for preventive maintenance must be formally defined through official documents and should be consistently reflected across all of the related documents. The approved preventive maintenance program should be consistent with other similar facilities and industry standards. Accountability for preventive maintenance also should be clearly defined.

2D.1.2/2D.2.2/2D.3.2: An effective preventive maintenance program depends on the PSO, MFO, and contractor implementing programs to ensure that DOE nuclear facilities are maintained at a level consistent with long term program goals. Often, PSO, MFO, and contractor managers assume that cost reductions on the short term are desirable, but the supporting facilities gradually degrade in safety, operational reliability, and in productivity.

2F.1.2: A strong preventive maintenance program requires the commitment and initiative of line managers to be involved and know what is going on by frequently touring the facility. Personnel perform at a higher level when their activities are observed, appropriately recognized, and supported. Line managers need to establish preventive maintenance standards as measures to review program effectiveness.

2F.2.2: Preventive maintenance personnel should have a working knowledge of their roles in the maintenance of plant safety margins described in the safety documentation and should be motivated to perform their tasks in a conscientious manner. This includes adequately researching the problems associated with preventive maintenance activities and keeping operations informed about the status of maintenance activities. Operations personnel should be inquisitive and prudent in approving and tracking maintenance activities.

2F.2.3: Preventive maintenance personnel should be familiar with the intended operational capabilities of the equipment on which they perform maintenance and testing and should use their best judgment as to whether maintenance and test procedures actually accomplish intended equipment repairs to ensure safe and reliable operations. Managers should convey the expectation to maintenance and test personnel the philosophy that working without an inquisitive and circumspect attitude can lead to problems even when procedures are followed.

References

Nuclear safety related calculations are based on operating envelope assumptions that form the initial conditions for entering a transient or emergency situation. Plant instrumentation and controls are relied on to ensure that operators and automatic protective systems are able to keep the plant parameters (primarily pressures, temperatures, and plant-specific parameters such as reactor power level) within the ranges that form the basis of the safety envelope. Measuring and test equipment (M&TE) is relied on for calibration of instruments and controls and also needs to be calibrated, often against national standards. Once calibrated, a piece of equipment will eventually drift out of calibration and will require another adjustment. Therefore, it is important to recheck periodically the accuracy of instrumentation and controls at a frequency that ensures that the design operating bands are not exceeded. The periodicity needed depends on the rate of drift experienced with a particular instrument or device. Also, any changes made in instrumentation, M&TE, or calibration frequencies that might impact the design intent or safe operating envelope need to be reassessed by the Engineering Organization or other responsible organization to ensure that the plant safety analyses are still supported.

Systems in a nuclear facility must continuously operate within a well-defined, safe domain of operating parameters. To ensure that they are, systems must be monitored through instrumentation and controlled as needed to maintain safety. Additionally, protective devices such as alarms and relief valves usually are used to protect against hazardous conditions. However, these protective devices are considered to be backup protection, often referred to as defense in depth. Therefore, it can be generally stated that whenever an alarm or automatic protection device is activated, the operators have lost control of the associated system.

Additional instrumentation and control complexity results from sensor physical limitations, electrical circuit phenomena, transient pressure and temperature conditions, physical design factors such as differences in static head for pressure gages, and even visual parallax changes between gage readings. These complexities must be understood and controlled for every instrument, controller, and automatic safety device in the nuclear facility.

Continuing communication is required between the Engineering Organization (or other organization performing plant and system design work within the safety envelope) and the M&TE organization. The assumptions made in safety envelope calculations for system operating bands and instrumentation and control accuracy over the entire range of operating conditions need to be used as the bases for calibrations. These bases can be compromised when the M&TE organization tries to implement design calibration requirements (1) with available instrumentation, (2) with the least costly instrumentation, (3) on the least imposing frequency, or (4) on the least amount of instrumentation. Although each of these implementation decisions can be justified, each can lead to independent decisions on the part of the M&TE organization that conflict with design assumptions or requirements.

EA1: The assessor reviewing design change documentation involving instrumentation, controls, or protective devices should note any changes in accuracy specifications, including those for the associated M&TE used in testing and calibration. Design changes frequently require changes in instrumentation, often involving the replacement of obsolete equipment or increases in performance. Configuration management control can be compromised if the new instrumentation fails to meet intended design operating range requirements or if M&TE personnel are not provided appropriate calibration procedures.

EA7: The assessor attending a design change review committee meeting should note references to instrumentation and controls, considering how thoroughly the review addresses maintaining safety margins.

MA3: The assessor reviewing the calibration support area will provide the majority of the input required to address this question and should (at a minimum) address the specific issues indicted here. Plant instrumentation and controls (I&C) that respond properly to conditions outside the plant safety envelope require periodic calibration. The measuring and test equipment used to calibrate plant I&C should itself be calibrated. Assessors should review the calibration history of M&TE at the facility to see whether this is done regularly and documented. The calibration frequency of M&TE should be based on the manufacturer's recommendations (per national standard), usage, and historical reliability. The Maintenance Organization should keep current records on M&TE calibration history, under a document control program which conforms to accepted quality assurance practices. Failure to perform or keep records of M&TE calibrations could directly affect the plant safety envelope and facility safety.

MA4: The assessor reviewing maintenance work orders should determine whether tools and instruments used in the maintenance and test activities are clearly indicated and calibration requirements specified.

MA5: The assessor interviewing maintenance personnel should specifically inquire about problems in the calibration area, including instrumentation, controls, and M&TE.

MA7: The assessor observing work activities should inspect any test equipment for calibration and general condition. Also, it should be determined whether the test equipment has been returned to M&TE control for inspection and storage between jobs.

MA10: The assessor reviewing the maintenance history for a major component should be aware of any calibration requirements for the associated instrumentation, alarms, and controls. To the extent feasible, the effectiveness of the calibration program should be assessed in terms of the operational reliability and control of this component.

MA11: The assessor reviewing the facility occurrence reports should identify any problems caused by the calibration program.

MA13: The assessor reviewing the maintenance backlog and trends should particularly note information regarding the calibration status of plant instrumentation and controls.

OA2: The assessor observing control room formality should note the extent to which operators are distracted or limited by instrumentation and control problems that may be due to inadequate calibration and testing.

OA9: The assessor touring the plant with operators should note the status of instrumentation calibrations and discuss the impacts of problems with the operators.

OA11: The assessor reviewing the system status displays should note the methods used to indicate calibration problems. Also, if there are excessive numbers of out-of-calibration entries, this information should be included in the assessment of the calibration program.

OA15: Assessors reviewing operating logs should note any excessive alarm indications or safety system actuations recorded in the logs for possible problems related to the instrumentation and control systems. The assessor should consider whether recorded readings are consistent with each other and whether any problems noted in the log reflect inadequate maintenance and calibration of indication, alarms, control devices, or protective equipment. The current status of corrective actions should also be identified, as feasible.

Management Cause Analysis

2A.1.1: The lack of accurate, complete, and compatible technical documentation and records can prevent the instrumentation and protective device needs of a system from being recognized and addressed. Also, nuclear facility design changes implemented over many years can lead to inconsistencies in the as-built condition of the plant as compared with the original design intent. Older plants are particularly vulnerable to the introduction of these inconsistencies because the original design intent may not have been recorded. This results in engineers not understanding why a particular feature was included in the design. Thus they may design the feature out during a modification.

2A.1.2: The original plant operating parameters may have changed due to changes in design or in facility mission. The failure to document current operating conditions correctly can result in inadequate assessment of needs in instrumentation and protective devices. This includes needs for accuracy and frequency of maintenance.

2D.3.4.11: Operators may not believe instrument readings and treat them as accurate unless there is a strong calibration program. This problem can be due to the contractor not having management processes and programs to implement requirements related to conduct of operations.

2E.1: Maintaining the accuracy of instrumentation and controls requires a significant resource commitment, especially for older nuclear facilities having fewer self-calibration capabilities. Given the importance of maintaining nuclear plant parameters within design limits, this resource commitment is fundamental to ensuring continued operational safety. Also, the calibration program either is maintaining plant parameter control or it is not. Therefore, any failure discovered in the calibration program implies the presence of multiple failures. Adequate corrective actions for a single failure may include a major overhaul of the calibration program. Management may be reluctant to fund such an overhaul and additional resources on the basis of a few calibration program deficiencies.

2F.1: It is essential for line management to foster the development of a good safety culture in order to maintain the plant within the nuclear safety envelope. Line management should endorse the nuclear safety culture by promoting communication among the different site organizations. A common management deficiency having real nuclear safety implications is a lack of continuing communication between the Engineering Organization (or other organization performing plant and system design work within the safety envelope) and the Maintenance Organization. The assumptions made in safety envelope calculations for system operating bands and instrumentation and control accuracy over the entire range of operating conditions needs to be used as the basis for calibrations. This basis can be compromised when the Maintenance Organization tries to implement M&TE calibration changes without consulting with the Engineering Organization or when the Engineering Organization makes design changes without informing maintenance managers. Without management's commitment to effective cross-departmental communication, there may be a compromise in the facility operating safety envelope.