ML18153A595
| ML18153A595 | |
| Person / Time | |
|---|---|
| Site: | Surry, North Anna  |
| Issue date: | 02/22/1996 |
| From: | Bowling M VIRGINIA POWER (VIRGINIA ELECTRIC & POWER CO.) |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| References | |
| 95-418A, NUDOCS 9602280264 | |
| Download: ML18153A595 (8) | |
Text
(
VIRGINIA ELECTRIC AND POWER COMPANY RICHMOND, VIRGINIA 23261 February 22, 1996 United States Nuclear Regulatory Commission Attention: Document Control Desk Washington, D. C. 20555 Gentlemen:
VIRGINIA ELECTRIC AND POWER COMPANY SURRY POWER STATION UNITS 1 AND 2 Serial No.
NL&OS/GDM Docket Nos.
License Nos.
NORTH ANNA POWER STATION UNITS 1 AND 2 REQUEST FOR INFORMATION - COMPUTER SOFTWARE 95-418A R1 50-280 50-281 50-338 50-339 DPR-32 DPR-37 NPF-4 NPF-7 In your letter, dated July 28, 1995, you requested information regarding the use of certain computer software at our nuclear facilities. We responded to your request for information in our letter dated October 6, 1995 (Serial No.95-418). In our response, we stated that the information we were providing was proprietary and exempt from public disclosure in accordance with Title 1 O of the Code of Federal Regulations, Part 2.790(a).
However, pursuant to a request by the NRC in a telephone conversation on this date, we have re-evaluated our response regarding its proprietary nature.
We have determined that the information in our October 6, 1995, response is not proprietary, and that the provisions of 10 CFR 2.790(a) do not apply. Consequently, we are resubmitting herein our previous response to your request for information as non-proprietary.
If you require additional information, please contact us.
Very truly yours,
- I-a~
M. L. Bowling, Jr.
- Manager, Nuclear Licensing and Operations Support 9602280264 960222 PDR ADOCK 05000280 P
PDR 280013
Enclos.ure cc:
U. S. Nuclear Regulatory Commission Region II 101 Marietta Street, N.*W.
Suite 2900 Atlanta, Georgia 30323 Mr. M. W. Branch NRC Senior Resident Inspector Surry Power Station Mr. R. D. McWhorter NRC Senior Resident Inspector North Anna Power Station
Enclosure Response to NRC Request for Information Computer Software
Reguest for Information Regarding Computer Software Referential Integrity The following information is provided in response to the five NRC questions related to the use of the Passport software program at Surry and North Anna Power Stations as provided in the NRC's letter dated July 28, 1995. Although we believe our application of the Passport program does not result in an extensive referential integrity concern, we-have identified some difficulties in referential integrity and certain data errors/inconsistencies in the application of the Passport product. These specific integrity issues and data inconsistencies have not individually resulted in an operational safety concern.
We are currently evaluating these findings and will implement appropriate corrective actions upon completion of our evaluation.
NRC Question #1 Is the "Passport" software program utilized at your nuclear power station?
Response
The Passport software program is used at both Surry and North Anna Power Stations, as well as by corporate support groups.
NRC Question #2 Is the "Passport" software utilized for safety-related applications?
Response
The Passport software program used by Virginia Electric and Power Company (Virginia Power) is not considered a safety related system, however, it is used to support safety related work activities. The specific Passport system applications used are the Maintenance Management Application which facilitates the work control process, and the Document Management Application, which manages controlled and uncontrolled document information (e.g., procedures, drawings, technical manuals, etc.). These applications include the following modules:
Equipment Data and Bill of Material modules of the Maintenance Management Application - These modules contain equipment qualification data that is used as the reference data for the preparation of procedures and the performance of equipment maintenance.
Plant Work Control module of the Maintenance Management Application -
This module displays equipment qualification data as the reference data for the maintenance planning and implementation process.
Document Control and Records Management modules of the Document Management Application - These modules contain both controlled and uncontrolled document references as the reference data for maintenance planning and equipment maintenance implementation.
NRC Question #3 Do controls exist to preclude inconsistent data within the "Passport" databases?
Response
Passport uses IBM's DB2 data structure. Referential integrity was incorporated into the Passport application by specifying the business rules into the database design with the application software written to enforce this integrity. This was the method used by the vendor, Indus, to customize the Passport system for Virginia Power.
Also, controls exist within the application software to preclude inconsistent data. For the on-line Passport system, the controls are built into the application codes based upon the business rules specified in the design of the application. Virginia Power uses a mainframe security program to grant proper authority to each user of the "Passport" system. In addition, the Passport system includes its own internal security features to grant each user's authority at the function, screen or field level.
Authorization approval for using the Passport system is required by the user's departmental management, and each user is evaluated to determine the required level of access necessary for their job function.
A "Quality Class Change Report" is also issued every two weeks noting equipment classification changes (e.g., safety related, non-safety related - qualified, or non-safety related) that have been made in the Passport system. This report is distributed to the station superintendents.
NRC Question #4 Do referential integrity problems exist in "Passport" that could affect safety-related applications?
Response
We have not identified referential integrity problems within Passport that could affect safety related applications.
However, we have identified some problems with referential integrity and certain data errors/inconsistencies in the application of the Passport product.
These specific problems have not individually resulted in an operational safety concern as discussed below.
Referential Integrity Virginia Power's interpretation of referential integrity refers to the row (or record) level of the data structure and not the individual field edits. 082 and application code methods of referential integrity ensure that the "parent and child" relationship of records from one table to another are kept consistent. However, two specific types of referential integrity problems have been identified as follows:
- 1.
When a work order task is deleted (removed) from a foreman's schedule, the Passport on-line processing may not clear the schedule record from the table:
- 2.
When a mark number is deleted, the mark number is not deleted from a corresponding mark number list table.
Neither problem represents a safety concern. In both examples, a work order could not be issued to a foreman to work, regardless of whether it is based on his schedule table, or on the mark number list table. Consequently, since work is not actually
. performed in these two instances, a safety concern does not exist. They are a recordkeeping problem, however, and require resolution. We are currently evaluating these two issues to correct the problems noted.
Erroneous or Inconsistent Data
- In-addition to our review of referential integrity concerns, we have identified four instances where data are, or have the potential to be, inconsistent. They are as follows:
- 1.
The equipment quality class is maintained in two tables in the Plant Work Control module of Passport. The quality class used in the work process is automatically updated from the Equipment Data module of Passport. Through the normal work flow process, the quality class is continually refreshed from the Equipment Data module. However, a manual refresh is required for one of the quality class fields in the Plant Work Control module. The quality class in the Plant Work Control and Equipment Data modules are intended to be kept consistent throughout the work process. For historical purposes, the quality class field on the work order is locked from update in order to retain the equipment classification at the time the work is performed.
Therefore, it is possible to update the quality class in the Equipment
- Data module without updating the quality class in the Plant Work
- Control module.
Under certain initial conditions, work could be performed on a safety related system using non-safety related procedures or materials. Consequently, we reviewed historical work order data to determine if this has occurred in the past. We identified one example where a non-safety related component was used in a safety related system. However, it did not result in an operational safety concern, since this component had been previously dedicated for safety related applications.
L_
- 2.
In the Equipment Data module, the equipment quality class is maintained on both the Equipment Data table and the Qualified List (Qlist) Parameter Set table and could potentially be inconsistent between the two tables. This potential exists due to the business decision to store the equipment quality class together with the justification for the quality class through administrative controls. This condition is not considered safety significant, since the Qlist Parameter Set table field is not the quality class field typically referenced for work and is redundant to the Equipment Data quality class field.
Furthermore, no actual work concerns have been identified relative to this potential problem.
Nevertheless, this problem has been corrected to prevent a future inconsistency.
- 3.
Under certain conditions, the equipment quality class field was erased from the Plant Work Control module for closed or completed work orders.
This represents a concern from a historical record perspective only, and is, therefore, not safety significant. Furthermore, this item has been corrected.
- 4.
The wait code sequence on the Work Order Status table and the Work Order Task table of the Plant Work Control module has been identified as occasionally being inconsistent. The possibility exists that the status of a work order may be different on these two separate tables. (e.g., The status of a work order may indicate "active" on the Work Order Status table and "complete" on the Work Order Task table.) This condition has occurred only a few times in the past year and is not considered safety significant. This problem only concerns consistency in recordkeeping and does not affect actual work activities in the stations.
NRC Question #5 Describe any corrective actions implemented as a result of your review.
Response
The following actions have been completed, or are being implemented, to address the discrepancies discussed in item 4 above.
Referential Integrity The two referential integrity issues do not detrimentally affect safety related equipment as discussed above.
However, to ensure the appropriate update of information regarding foremen work schedules and mark number deletions, Virginia Power is reviewing these aspects of the system software applications and will make the necessary modifications to correct these two concerns.
Erroneous or Inconsistent Data
- 1.
We have determined that maintaining the equipment quality class in multiple tables in the Plant Work Control module is not necessary, since this information is appropriately provided in the Equipment Data module. Consequently, the redundant equipment quality class in the Work Order Detail table will be eliminated to avoid future inconsistencies. We are continuing to evaluate this issue for any additional corrective actions that may be warranted. As an interim corrective measure, we are reviewing open work orders on a daily basis to ensure the equipment quality class information is consistent between the Equipment Data module and the Plant Work Control module. This review will continue until permanent corrective actions have been implemented.
- 2.
The necessity of maintaining the equipment quality class in the Qlist Parameter Set table has been reviewed and determined to be unnecessary. Therefore, We have eliminated the quality class from the Qlist Parameter Set table.
- 3.
The error that caused the equipment quality class to be erased for closed or completed work orders has been corrected. A review of the records affected by this error in the code is underway to ensure consistency between the affected tables.
- 4.
The inconsistency identified in the Work Order Status table and the Work Order Task table is under evaluation. Appropriate corrective actions will be implemented to resolve this condition upon completion of our review.