IR 05000498/1997016
| ML20148R041 | |
| Person / Time | |
|---|---|
| Site: | South Texas  |
| Issue date: | 06/27/1997 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV) |
| To: | |
| Shared Package | |
| ML20148R031 | List: |
| References | |
| 50-498-97-16, 50-499-97-16, NUDOCS 9707070279 | |
| Download: ML20148R041 (10) | |
Text
!
ENCLOSURE U.S. NUCLEAR REGULATORY COMMISSION
REGION IV
Docket Nos.:
50-498 50-499 License Nos.:
NPF-76 NPF-80 Report No.:
50-498/97-16 f
50-499/97-16 j
Licensee:
Houston Lighting & Power Company Facility:
South Texas Project Electric Generating Station, Units 1 and 2 Location:
FM 521 - 8 miles west of Wadsworth Wadsworth, Texas
Dates:
May 19 22, with in-office inspection through June 12,1997
-
l Inspector:
Dyle G. Acker, Project Engineer, Projects Branch F l
Division of Reactor Projects i
'
Approved By:
Dr. Dale A. Powers, Chief, Maintenance Branch l
Division of Reactor Safety ATTACHMENT:
Supplemental Information l
l l
l
!
,
l
4
{
9707070279 970627 PDR ADOCK 05000498
,
!
)
.
<
.
-2-EXECUTIVE SUMMARY South Texas Project, Units 1 and 2 NRC Inspection Report 50-498/97-16:50-499/97-16 This inspection consisted of reviews of (a) past and current licensee actions associated with setpoint calculations and associated programs, and (b) prior NRC inspection findings related to discrepancies in the setpoint program. The inspection report covers a 4-day period of onsite inspection with in-office followup of inspection-related material received after the onsite visit. The inspection was performed by one field office project engineer.
Enaineerina Engineering management deferred actions to correct design control problems related
to instrument setpoints identified in a self assessment in 1992, and a consultant's report in 1994. This decision was not based on sound engineering principles, in that, no review was accomplished to address the safety implications of this decision. Additionally, the setpoint program problems identified in 1992,1995,and 1997 indicated that calculation control problems may exist in other technical disciplines. An unresolved item was opened for NRC review of these areas (Section E3.1).
While a number of setpoint calculation problems were identified, as a result of the
licensee's and NRC's review, there was no impact on the operability of safety-related equipment. However, the inspector identified that there was no documented review performed by the licensee following the identification of these problems in 1992 and rgain in 1995. As a result, the licensee had no basis for deferring correctivr. actions to review existing setpoint calculations. In addition, even after the issu.s was raised in NRC inspection Report 50-498;-499/96-09, the licensee had not performed an operability evaluation of all the calculations listed in 1995 as havint, major problems until operability was questioned during this inspection (Sect.on E8.1).
-3-Report Details Ill. Enaineerina E3 Engineering Procedures and Documentation (37551)
E3.1 Proaram for Control of Safetv-Related Instrument Setooints a.
Insoection Scoce The inspector reviewed licensee program documents for the control of instrument setpoint calculations and related self assessments. Specific technical issues associated with the setpoint program are also discussed in Section E.8.1.
b.
Observations and Findinas Backaround/ Previous Self Assessments Engineering Assurance Assessment 92-01, " Instrument Setpoint Methodology,"
dated May 27,1992, identified technical and program problems with the determination of proper setpoints for safety-related instrumentation. The licensee l
contracted with Hurst Consulting, Inc., to perform an independent review of l
setpoint issues at South Texas Project. Hurst Consulting, Inc., provided setpoint program findings and recommendations to the licensee in two reports, " Independent Assessment of the South Texas Project Setpoint Control Program," dated January 21,1994, and " Recommendation Report fc. Updating the South Texas
!
Project Instrument Setpoint List," dated February 20,1994.
Current inspection / Latest Self Assessment
!
After the NRC raised issues corcerning setpoint calculations, as discussed in NRC Inspection Report 50-498;-499/96-09, dated January 17,1997, the licensee performed an additional self assessment of the setpoint program, " Engineering Self-
)
Assessment of Setpoint Calculations, Methodology and Control, CR 96-16020,"
dated February 21,1997.
!
The inspector reviewed the various self assessments and noted that the February 21,1997, assessment identified that program problems existed, which were essentially the same as noted in the 1992 and 1994 assessments. Program problems included: the failure of design changes to update required technical calculations or the setpoint list; design changes, which updated the setpoint list, but not the associated calculations (seven of seven reviewed); a deficient calculational control procedure, which was last revised in 1986; and lack of classification as to which instrument setpoints were safety related. in addition, the self assessment determined that the South Texas Project design control program did not require a formal internal interface control or interdisciplinary review of design documents, m
--
-
.-
.
.
.
-
_ -.
.
-.
-.
..
.
.
The inspector reviewed the licensee's procedures for design changes, calculations, and instrument scaling, and reached the same conclusions as the licensee's self assessments. Although the design change procedure required personnel to update reference and affected technical documents, there was little specific guidance. Based on the 1997 self assessment, the inspector concluded that this j
guidance was not effective. The inspector noted that the calculational procedure
'
provided little guidance on calculation control and how to deal with interface issues.
The inspector noted that licensee quality control personnel closed setpoint I
program-related items from the 1992 audit based on an engineering plan to address those items. However, licensee engineering management later stopped action on this plan. The inspector discussed this issue with licensee engineering management. Management personnel indicated that they considered that they had other, more safety-significant work, and that they could defer setpoint program issues without affecting plant safety. However, the licensee could not identify any specific review they had done at the time of deferring the actions which addressed the safety implications of not accomplishing the planned program _ corrective actions.
The licensee issued condition reports to address the findings of the 1997 self assessment. Planned actions on these condition reports included requiring interdisciplinary review of selected design documents; revising the design change procedure to integrate setpoint issues; revising the calculational procedure; training personnel; and resolving differences between the sotpoint list, scaling documents, and design calculations.
The inspector considered that the licensee's planned corrective actions were adequate to resolve the setpoint program problems noted. However, since previously planned actions for similar issues had not been implemented, the NRC will followup on completion of these actions as part of review of Inspection Followup Item 50-498;-499/9609-01, as discussed in Section E.8.1.
in addition, the inspector considered that the setpoint program problems identified by the licensee in 1992,1994 and 1997, indicated that calculation control problems may exist in other technical disciplines. The NRC will review the adequacy of pr.st and present licensee calculation control programs in a future inspection report as part of Unresolved item 50-498;-499/9716-01. The review will also address the acceptability of the' licensee's decision to defer corrective actions for program findings from the 1992 and 1994 assessments, including review for safety impact _
.
,
.
<
A-5-
.
.
c.
Conclusions
Engineering management deferred actions to correct design control problems
,
related to instrument setpoints identified in 1992 and 1994. The inspector concluded this decision was not based on sound engineering principles, in that no review was accomplished to address the safety impacts of this decision. The safety impact of the decision will be reviewed by the NRC as part of Unresolved Item 50-498;-499/9716-01.
E8 Miscellaneous Engineering Issues (92903)
E8.1 (Ocen) Insoection Followuo item 50-498:-499/9609-01: Review of the licensee's self assessment and followup actions taken to evaluate the apparent discrepancies in the setpoint program.
Backaround in addition to the letters discussed in Section E.3.1, Hurst Consulting,
)
Inc., reviewed selected licensee calculations and setpoints and identified 35 calculations requiring revisions. These findings were documented in Letters ST-5W-HS-090229, dated April 18,1995, and ST-5W-HS-090237, dated June 2,1995. Hurst Consulting, Inc., also identified numerous instrument setpoints for which they were unable to identify technical bases.' Hurst Consulting, Inc.,
noted that 29 of the 35 calculations requiring revisions had " Major" problems.
Major problems identified included invalid assumptions, nonretrievable references, no methodology specified, no instrument uncertainties considered, no calibration or process effects considered, and/or outdated references. The consultant's letters only provided a generic definition of " Major" (as listed above) and did not specifically identify what the problems were with each individual calculation.
NRC Inspection Report 50-498;-499/96-09 identified that the licensee had not documented any corrective actions associated with the calculational problems noted by Hurst Consulting, Inc.
Licensina Bases for Setooint Calculations The Updated Final Safety Analysis Report, Table 3.12-1, states that South Texas conforms to the intent of Regulatory Guide 1.105, " Instrument Setpoints for Safety-Related Systems." Regulatory Guide 1.105, Revision 2, endorses Instrument Society of America Standard ISA-S67.04-1982, "Setpoints for Nuclear Safety-Related instrumentation Used in Nuclear Power Plants," for ensuring instrument setpoints remain within Technical Specification limits. The Instrument Society of America Standard was updated in 199 _
_
_ _
- -.
.
-
,
l
'
-6-i Many of the safety-related instrument setpoints at South Texas were provided by Westinghouse and utilized methods similar to those of the Instrument Society of America Standard, The general Westinghouse methods have been reviewed and accepted by the NRC staff. Although the inspector did not review any of the Westinghouse determined setpoints, the inspector noted that Westinghouse had provided the licensee with the setpoints and general results, but not the details.
Review The inspector followed up on the open item by requesting details on the specific problems with each of the 35 calculations identified by Hurst Consulting, Inc., in i
1995 as requiring revision. The licensee representative stated that Hurst i
Consulting, Inc., had not provided any specific information outside the cited letters.
In response to the inspector's question, Hurst Consulting, Inc., stated in Letter hcl-HLP-128, dated May 20,1997, that they did not have any details about what the specific problems were with the 35 identified calculations.
The inspector then asked the licensee if they had performed operability assessments to ensure that the problem calculations did not affect plant safety. The licensee representative stated that they had performed an operability evaluation for the calculations listed as " Major" by Hurst Consulting, Inc., and provided the inspector with a copy of Condition Record 97-3741, Action 1, dated March 31,1997. The licensee had reviewed 21 of the calculations with major problems and found no operability concerns. The inspector asked about the other calculations with major problems. The licensee representetive determined that they had previously reviewed five of the eight remaini,1g calculations during related work and found no immediate operability concerns, but had not reviewed the other three. During the inspection, the licensee provided the inspector with a letter stating that the licensee had reviewed the remaining calculations and had not identified any immediate
,
operability concerns.
The inspector then performed a brief review of the 35 calculations identified by Hurst Consulting, Inc., as requiring revisions. The inspector identified generic problems similar to those noted by Hurst Consulting, Inc., but did not identify any immediate safety concerns. The inspector then selected three of these calculations for more detailed review.
The first calculation the inspector reviewed, Calculation SR289MC5946,
" Plant Computer Analog 1/0 List Essential Cooling Water System 'EW,'"
included the setpoint for a low-level alarm for the essential cooling water pond which is the safety-related ultimate heat sink. The inspector reviewed the alarm setpoint and noted that it did not include any uncertainties. The
.
-
_
_
.
-
__
_
,
'
l
!
-7-inspector noted that 'he alarm was set within 4 inches of the Technical j
Specification-required minimum level (capacity). The inspector noted that typical uncertainties for the alarm would be greater than the 4 inches, so the alarm might not always ensure that operators were alerted to a low pond level prior to going below the Technical Specification limit.
The inspector discussed the alarm setpoint with the licensee personnel. The licensee representative stated that the alarm had been disabled by a design change, and that operator rounds were used to ensure Techn! cal Specification limits for water inventory in the essential cooling water pond.
The licensee representative stated that this alarm was not required by their license. The inspector briefly reviewed the Technical Specification and Updated Final Safety Analysis Report requirements for the essential cooling water pond and did twt identify a requirement for this low-level alarm.
The second calculation the inspector reviewed, Calculation 3Q159MC6038,
"SDBY [ standby] DG [ diesel generatorl FOST [ fuel oil storage tank) Level Setting Calculation," included setpoints for emergency diesel generator fuel oil storage level alarms. The Technical Specification required a minimum volume for emergency diesel generator fuel of 60,500 gallons. The calculation set the low-level alarm at 61,000 gallons. The inspector noted that the calculation did not include any uncertainty for changes in fuel specific gravity, differences in temperatures, height measurements, instrument loop, and test instruments. The inspector noted that typical uncertainties for this installation would be greater than the 500 gallons that the Technical Specification limit aurm was set above. Therefore, the alarm setpoint might not ensure that operators were alerted to a low-level condition prior to exceeding the Technical Specification limit.
The inspector discussed the alarm setpoint with licensee personnel. The licensee representative stated that, due to spurious high-level alarms, they had initiated action to replace the level indicating instrument loop with a more accurate design in accordance with Action item 96-1619-21. The licensee representative stated that they planned to set the low-level alarm to ensure that the alarm occurred prior to going below the Technical Specification limit. The inspector considered this action acceptable.
The third calculation the inspector reviewed, Calculation SN129MC5968,
" Plant Computer Analot /O Setpoints, Safety injection System," included a
setpoint for a residual heat removal system low-pressure alarm. This alarm was set to alert operators to the potential for system voiding, and to bound a calculation, which was performed to demonstrate acceptability of the system design to withstand a water hammer upon starting a pump with a predetermined volume of air in the system. The calculation indicated that, if the alarm was set at 14 pounds per square inch gage, the amount of air in the system would be bounded by the water hamrner calculation. The
. _ _ _
.
_
_
_
_
.
.
-8-
,
calculation set the alarm at 20 pounds per square inch (gage) to account for instrument error; however, no calculation of instrument error was included.
The inspector noted that the alarm used the same detector that was used for high-pressure information. Thus, the span of the detector and resulting
'
instrument uncertainties would be greater than the 6 pounds per square inch (gage) established by the calculation for instrument error. As a result, the alarm setpoint might not ensure that operators were alerted to a low-
pressure condition prior to exceeding the extent of system voiding that was calculated as acceptable without damaging the system upon a pump start.
The inspector discussed the alarm setpoints with licensee personnel. The
'
licensee representative stated that, due to spurious low-pressure alarms, they were in the process of revising the calculation and planned to reset the alarms. The licensee representative stated that a preliminary calculation had established an instrument loop uncertainty of 15 pounds per square inch
.
(gage). The inspector discussed the method that the licensee had used to determine the loop uncertainty of 15 pounds per square inch (gage) and concluded that the methodology was consistent with Instrument Society of
'
America guidance. The inspector considered the licensee's planned actions to be acceptable.
The inspector noted that even though the instrument setpoints discussed above provided the operators with important information on the status of safety-related equipment, they were not setpoints that were required to be established in accordance with Regulatory Guide 1.105.
The inspector selected eight instrument setpoints, which Hurst Consulting, Inc.,
indicated by letter that they could not identify a technical bases for the settings, for a more detailed review. The inspector determined that none of the eight instruments were currently installed in the units and that there was no requirement in the Updated Final Safety Analysis Report or Technical Specifications for the instruments or the associated setpoints. The licensee representative stated that these instruments had never been installed. The numbers indicated the instruments were identified by an architectural engineering firm that began designs for the site, but was later replaced by the licensee with another firm.
As part of the corrective actions from the 1997 self assr ssment discussed above in Section E.3.1, the licensee initiated actions to review previously issued calculations to ensure that calculations which involved safety-related instruments included acceptable instrument uncertainties. The licensee representative stated that part of the planned actions would include reviewing the setpoints that Hurst Consulting, Inc., identified as having no technical bases. The inspector noted that a similar planned review, specified as corrective action from a 1992 self assessment, was later deferred by engineering management; therefore, the inspection followup item will remain open for review of these actions, and will include the review of the program improvements discussed in Section E. c.
Conclusions While a number of setpoint calculation problems were identified, ar a result of the licensee's and NRC's review, there was no impact en the operability of safety-related equipment. However, the inspector identified that there was no documented review performed by the licensee following the identification of these problems in 1992 and again in 1995. As a result, the licensee had no basis for deferring corrective actions to review existing setpoint calculations, in addition, even after the issue was raised in NRC inspection Report 50-498;-499/96-09, the licensee had
not performed an operability evaluation of all the calculations listed in 1995 as having major problems until operability was questioned during this inspection.
- V. Manaaement Meetinas X1 Exit Meeting Summary The inspector presented the inspection results to members of licensee management at the conclusion of the onsite portion of this inspection on May 22,1997. The licensee personnel acknowledged the findings presented. Certain material requested for review prior to the inspection was not received until June 5,1997. The results of the review of this material were the subject of a supplemental telephonic exit held on June 12,1997.
.
The inspector asked licensee personne! whether any materials provided to the inspector were proprietary. The licensee personnel identified a number of Westinghouse safety-related calculations, which were provided for potential inspector review, that were proprietary. However, the impector did not keep, or make a copy of, any of the proprietary information.
.
.
- -
- -.
.
.
.
.
ATTACHMENT SUPPLEMENTAL INFORMATION PARTIAL LIST OF PERSONS CONTACTED Licensee J. Carbone, Senior Engineer T. Cloninger, Vice President, Nuclear Engineering W. Cottle, Executive Vice President and General Manager Nuclear A. Granger, Administrator, Nuclear Safety Evaluation T. Koser, Licensing Engineer M. Lachley, Manager, Reliability Engineering D. Leazar, Director, Nuclear Fuels and Analysis L. Martin, General Manager, Nuclear Assurance and Licensing R. Masse, Unit 2 Plant Manager M. McBurnett, Director, Nuclear Licensing R. Pretor, Quality Engineer D. Rencurrel, Manager, Electrical / Instrumentation and Control S. Rosen, Manager, Risk Assessment S. Thomas, Manager, Design Engineering NRC R. Kopriva, Senior Project Engineer itLSPECTION PROCEDURES USED IP 37551 Onsite Engineering IP 92903 Followup - Engineering ITEMS OPENED AND DISCUSSED Opened 50-498;-499/9716-01 URI Review of the safety impact of the licensee's decision to defer planned setpoint program improvements and review of overall calculation control program (Section E3.1).
Discussed 50-498;-499/9609-01 IFl Review of the licensee's self-assessment und followup of the actions taken to evaluate the apparent discrepancies in the setpoint program (Section E8.1).
,