ML20195E280
| ML20195E280 | |
| Person / Time | |
|---|---|
| Issue date: | 11/16/1998 |
| From: | Bill Rogers NRC (Affiliation Not Assigned) |
| To: | Rich Smith NRC (Affiliation Not Assigned) |
| References | |
| REF-QA-99901310 99901310, NUDOCS 9811180289 | |
| Download: ML20195E280 (1) | |
Text
MEMORANDUM TO:
Richard Smith, OClO/IMD/ISB 85W A/4/fr*
FROM:
Bill Rogers, NRR/DRCH/HOMB
SUBJECT:
Westinghouse Docket Number The NRC Inspection Report of Westinghouse dated December 31,1996, and the related correspondence from Westinghouse dated March 18,1997, both incorrectly
. refer to the Westinghouse docket number as 99901307. The correct Westinghouse docket number is 99901310.
Contact:
Bill Rogers, NRR/DRCH/HOMB MS OWFN 9-A-1 301-415-2945 I }Vi 0
9811100289 981116 PDR GA999 E!'NWEST 99901310 PDR
- * * =
- EnergySystems Nuclear Sermes Omsson
' t eC fric ColporaTIon Box 355 Prrisbutgn Pennsylvania 15230 0355 PUDUC CCCUMENf n0Gy March 18,1997
- Sr/ yygmf q' g7 ---
U.S. Nuclear Regulatory Comm,ission TTN: Document Control Desk Washington, DC 20555-0001 Attention: Mr. Robert M. Gallo, Chief Special Inspection Branch Division of Inspection and Support Programs Office of Nuclear Reactor Regulation
Dear Mr. Gallo:
Subject:
Response to NRC Inspection Report 99901307/96-01 dated December 31.1996 Westinghouse is in receipt of your letter of December 31,1996 (Inspection Report 99901307/96-01.
Docket No. 99901307). The purpose of this letter is to provide the requested Westinghouse response to the unresolved item identified in Section 3.1.b.3 of the subject report, and designated by the NRC as Unresolved item 99901307/96-01-01.
Unresolved item 99901307/96-01-01 concerns the adequacy of the justification for closeout of two Correction Action Requests (CARS) from the Westinghouse Process Control Division (PCD). It should be noted that the inspection report incorrectly listed Corrective Action Report. CAR 93-064 as CAR 92-064 of the Process Control Division (PCD). The CARS in question are CAR 93-002 and CAR 93-064.
CAR 93-002 was concerned with Eagle 21 components meeting test requirements. During the course of the NRC inspection, the inspector requested additional information related to several Eagle 21 components from a table attached to CAR 93-002 to verify claims made in the table answering the Description of Finding, Observation, or Concern, item #2. Item 2, from the original audit finding that generated the CAR, states that ".if the Commercial Dedication Instruction (CDI) requires that a survey be performed, the survey is performed but it reflects current supplier conditions, not what was in place when the item was procured. " The individual items requested by your inspector.
]
demonstrating the necessary justification for CAR eloseout, are addressed below in their order of occurrence in the table attached to CAR 93-002.
1.
Astee America, Power Supply. P/N PS20000H01. CDI # 4A07767 I
i A previous source evaluation was conducted on the supplier Astee America by Westinghouse before the January 1992 date in question, and was shown to be acceptable.
PCD QA pe#ormed surveys on the supplier Ast *e America in January 1992 md a tbllow-.
s
{ d Q l Q 3 up suney was performed in January 1993. These surveys / evaluations show that the
{v ~3 I
9 rO3;itS0047 970318 IREpppgig
~PDR GA999 EMVWEST
_99V0139Plc PDR
[
- g V
' NSD-NRC 97-5025 March I8.1997 supplier's manufacturing processes before, during and after the transition period from January 1992 to January 1993 were accepted by Westinghouse QA.
2, Astee America, Power Supply, P/N PS2000lH01, CDI # 4A07767 This is the same type of Power Supply as described in the response to the justification in No. I above,
~ ~
i 3,
Burr-Brown, D/A Board NP8316, P/N PS20109H01, CDI # 4A07812 A previous source evaluation was conducted on the supplier Burr-Brown Intelligent l
Instrumentation, Inc. by Westinghouse before the January 1992 date in question and was shown to be acceptable'. PCD QA performed a survey on the supplier Burr-Brown in 1
September 1992 and a follow-up survey was performed by Westinghouse Energy Systems Business Uni:(ESBU) QA in April 1994. These surveys show that the supplier's manufacturing processes before, during and after the transition period from January 199' to January 1993 were accepted by Westinghouse QA.
- 4.
Datel, Board ST-71601, P/N PS20110H01, CD1 # 4A07819
'A previous source evaluation was conducted on the supplier Datel, Inc. by the Westinghouse Nuclear and Advanced Technology Division (NATD) prior to the January 1992 date in question and shown to be acceptable, PCD QA performed a survey of the supplier Datel in August 1992 and a follow-up survey was performed by PCD QA in August 1993. These surveys show that the supplier's manufacturing processes before, during and after the transition period from January 1992 to January 1993 were accepted by h
' Westinghouse.
In light of this information, it is clear that the suppliers had been surveyed and deemed acceptable by Westinghouse when the items were procured, I
CAR 93-064 is related to an Instrument Calibration Discrepaney. Specifically, on March I.1993, a l
Gould Medium Gain Amplifier, Model No. 13-4615-00, was thund to be out of calibration. The
(
Calibration Discrepancy Report associated with this item indicates that the instrument tailed live different parts of the calibration:
1 Zero Offset Common Mode Rejection Accuracy of 5 Volt Output Accuracy of -5 Volt Output Frequeney Response
. All of the inaccuracies were thund to be insignificant in the amplifier applications. A detailed Lanalysis of the failures and an explanation of the effect that each of these inaccuracies would have on the effectiveness of the test, demonstrating the necessary justification tbr closeout, is provided below:
)
)
23T.V450 2 038FM
p a.
'O Y
=.
' NSD-NRC-97-5025 March 18,1997 Zero Offset 1
Calibration of the offset is accomplished by shorting the input terminals of the amplifier i
together to create an input signal of 0 VDC. The output voltage of the amplitier in an ideal case would be 0 VDC. An adjustment potentiometer is provided on the amplifier to allow the technician performing the calibration to adjust the output to 0 V i 2 mVDC. The instrument in question was found to have an output of 3.58 mVDC.
1 During the operation of this amplifier with a chart recorder, this offset would have been accounted for by the adjustment of the pen position. Therefore, the discrepancy would have no adverse effect on the accuracy of the test.
Common Mode Rejection Common mode rejection is monitored by measuring the oatpot of the amplitier with both inputs tied to 100 VDC. This voltage is compared to the output when both inputs are tied to common. An input balance potentiometer is provided to allow a technician to set the output with 100 VDC applied to be within t5mV of the output with common applied. The instrument in question was found to have an output with 100 VDC applied which was 12.74 mV above the output with common applied, j
The application of this instrument during test does not require high common mode rejection.
All signals charted are measured with respect to the common of the board which is generally l
within ISO mV of ground. Therefore, the discrepancy would have no adverse effects on the accuracy of the test.
Accuracy of i5 V Output Accuracy at + 5 V is monitored by applying +0.05 V to the amplifier input with the " Volts Full Scale" of the amplifier set to 0.05 V and the multiplier set to XI. The output is adjusted l
by a potentiometer to be within 5 mV of 5 V. The procedure is repeated for an input of-5 V l
with an expected output of -5 V 5 mV. The instrument in question had a positive out9ut j
whieti was 12.6 mV below 5 V and a negative output which was 8.2 mV below 5 V.
L l
During the operation of this instrument with a chart recorder, the 12.6 mV error on +5 V would correspond to a pin position within 98.7% of ideal position. The 8.2 mV error on -5 V would correspond to a pin position on 99.2% of ideal position. Both inaccuracies are insignificant during testing.
Frequency Response Frequency response is determined by measuring the amplifier output when a 5 V 100 Hz signal is applied as an input and then again when a 5 V 3 kHz signal is applied. At 100 Hz the output is expected to be within i25 mV of 5 V. At 3 kHz the output is expected to be above 3.5 V which is equivalent to requiring the amplifier gain to be down less than 3 dB. The instrument in question passt.1 the 100 Hz test but was found to have m output of only 2.14 mV at 3 kHz.
- memww
,ry p\\
l
)
t i
O
'w )
e
' NSD-NRC-97-5025 March 18.1997 Accurate frequency response up to 100 Hz is sufficient for applications of the instrument during testing. Response to a 5 V 100 Hz signal corresponds to a slew rate for DC signals of 3142 V/S. As an example, the amplifier would react to a 10 V spike within 3.18 ms. This rate of ehange is adequate for the signals being charted.
The information provided above on the two CARS in question indicates that there was indeed sufficient justification to closeout these issues and that they did not represent deviations or failures to comply. As such, no additional evaluation was necessary pursuant to the requirements of 10 CFR Part 21.
In addition to Unresolved item 99901307/96-01-01, the NRC Inspection Report indicated that the Westinghouse procedures adopted pursuant to 10 CFR Part 21 contained minor weaknesses and inconsistencies. The Energy Systems Business Unit (ESBU)is currently reviewing procedures concerning the implementation of the requirements of 10 CFR Part 21 and will make the changes acce.,sary to ensure continued compliance with the regulations.
If you should have any questions concerning the information provided herein please contact Mr. H. A. Sepp, Manager. Regulatory an>J Licensing Engineering. He may be reached at (412) 374-5282.
Very truly yours, Yb' N. J. Liparulo. Manager Equipment Design and Regulatory Engineering i
3770 ASO-4 WIN 7
~.
gg :sr t
UNITED STATES y
g j
NUCLEAR REGULATO%C@!$$)S$ggon WASHINGTON, D.C. 20066-0001
'97 JM 21 P2 :53 December 31, 1996
(
M Ms. F.J. Harvey, Acting President Energy Systems Business Unit Westinghouse Electric Corporation eP20rBor 355 -------,
i Pittsburgh, PA 15230' i
SUBJECT:
NRC INSPECTION REPORT 99901307/96-01 r-
Dear Ms. Harvey:
On October 4, 1996, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection of Westinghouse Energy Systems Business Unit (ESBU) facilities in Monroeville and Cheswick, Pennsylvania. The enclosed inspection report presents the results of that inspection.
The inspection reviewed the implementation of your quality assurance program in supplying safety-related equipment, software, and services to NRC-licensed facilities, and reviewed your program (and its implemer.tation) established pursuant to Part 21, " Reporting Defects and Noncompliance," of Title 10 of the Code of Federal Reaulations (10 CFR Part 21).
During this inspection, the NRC inspector found that one of your activities appeared to be in violation of NRC requirements. Specifically, your system of procedures adopted pursuant to 10 CFR Part 21 contained minor weaknesses and i
inconsistencies, that, taken in the aggregate, may render them inadequate to meet the requirements of $21.21(a) of 10 CFR Part 21.
In accordance with the NRC Enforcement Policy as promulgated in NUREG-1600, this is considered a minor violation and therefore, no Notice of Violation will be issued.
Although the NRC expects that ESBU will take prompt and appropriate corrective action, no response to this item is required.
The NRC inspector found no instances in which ESBU failed to comply with other requirements of 10 CFR Part 21. However, one unresolved item was identified involving Corrective Action Reports of the ESBU Process Control Division. The question of adequacy of the justification for closeout of the reports and hence, the potential existence of deviations or failures to comply requiring evaluation in accordance with 10 CFR Part 21 remained unresolved at the end of the inspection. You are requested to respond to the unresolved item identified in Section 3.1.b.3 of the enclosed report.
In accordance with 10 CFR 2.790 of the NRC's Rules of Practice," a copy of this letter and its enclosures will be placed in the NRC's Public Document Room (POR).
(/']Of m RE MFi M i
970003 i
i
- +70107G0;; 761231 PDR GA999 ENVWEST 9990134210 PDR
,,Q : p - 1 1 v ' ~. I <,,
.s.
L 9 fi '
, !, L 90s a
s V
Ms. Harvey We appreciate the cooperation of your staff during this inspection.
If you have any questions, please contact Mr. Stephen Alexander at (301) 415-2995.
Sincerely, 66TLFbh: fiP, Mief Special Inspection Branch Division of Inspection and Support Programs Office of Nuclear Reactor Regulation cc/wenc1:
Mr. Nicholas Liparulo, Manager Regulatory and Engineering Networks Docket Number: 99901307 Distribution:
PSIB R/F PDR
/CentralCFilas/ Docket File No. 99901307/ RIDS IE:09
- See previous concurrence DOCUMENT NAME: G:\\ALEXANDE\\ESBU9601.RG1 Ta receive e copy of this doouenent, indcete in the box: "C" = Copy without enclosures *E* = Copy with enclosures *N* = No copy 0FFICE PSIB: DISP l E SC:PSIB: DISP l BC AP5tBWISP l d.
ABC:SRXB:DSSA l NAME SAlexander:smp GCwalina RG M'o' TCollins(F0rr for)
DATE 12/30/96*
12/30/96*
12/'3\\/96 12/31/96*
0FFICIAL RECORD COPY
l U.S. NUCLEAR REGULATORY COMISSION OFFICE OF NUCLEAR REACTOR REGULATION Report No.
99901
/96-01 Organization:
Westinghouse Electric Corporation Energy Systems Business Unit P.O. Box 355 Pittsburgh, PA 15230
]
l
Contact:
H.A. Sepp, Nanager, Regulatory and Licensing Initiatives Nuclear Industry Nuclear Safety-Related Equipment, Components, Activity:
Replacement Components and Parts, Software, and Services for the Commercial Nuclear Power Industry Dates:
September 23 through October 4, 1996 Inspectors:
Stephen D. Alexander, Reactor Engineer Ralph R. Landry, Senior Reactor Engineer Approved By:
Gregory C. Cwalina, Chief Vendor Inspection Section Special Inspection Branch Division of Inspection and Support Programs
$&bT P
V 99901 M I PDR
s 4
1 INSPECTION SulWARY During this inspection, the NRC inspectors reviewed the implementation of selected portions of the quality assurance program of Westinghouse Energy 4
Systems Business Unit (ESBU) for supplying safety-related equipment, software, and services to NRC-licensed facilities. The review focused on the ESBU program (and its implementation) established pursuant to Part 21, " Reporting of Defects and Noncompliance," of Title 10 of the Code of Federal Reaulations (10 CFR Part 21).
The inspectors also reviewed specific technical concerns with regard to certain considerations in the design of some safety analysis computer models that may be deficient and that may lead to nonconservative results, that were not identified in software error reports. Compliance with 10 CFR 50.46 reporting requirements were also within the scope of this inspection.
The inspection bases were:
_ Appendix B, " Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants," to 10 CFR Part 50 1
10 CFR Part 21, " Reporting of Defects and Noncompliance"
=
10 CFR Part 50, Appendix K, "ECCS Evaluation Models" 10 CFR 50.46, " Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors" The NRC inspectors found that the ESBU system of procedures (including those of its major divisions) adopted pursuant to 10 CFR Part 21 contained various weaknesses and inconsistencies that, taken in the aggregate, may render them inadequate to meet the requirements of 621.21(a).
In accordance with the NRC Enforcement Policy as promulgated in NUREG-1600, this was considered a minor violation and no Notice of Violation was issued.
Although the NRC inspector found no conclusive evidence of instances in which ESBU failed to comply with other requirements of 10 CFR Part 21, two instances were identified involving Corrective Action Reports of the ESBU Process control Division. The question of adequacy of the justification for closeout of the reports and hence, the potential for the existence of deviations or failures to comply requiring evaluation in accordance with 10 CFR Part 21 remained unresolved at the end of the inspection. This unresolved item is discussed in Paragraph 3.1.b.3 of this report.
-The inspectors found no instances in which ESBU was not in compliance with 10 CFR 50.46 or 10 CFR Part 21 with regard to its system of tracking changes in predicted reactor core parameters (e.g., peak cladding temperature (PCT))
under modelled design basis accident conditions and reporting them to affected licensees.
2
- 4 w-1 r-w"---
- re-m T--
7 r-"
(m p\\
V)
V
\\
2 STATUS OF PREVIOUS INSPECTION FIM)INGS No previous findings were reviewed during this inspection.
3 INSPECTION FINDINSS AND OTHER CONMENTS 3.1 10 CFR Part 21 Procram a.
Part 21 Program Review Scope The inspector reviewed the procedures adopted pursuant to 10 CFR Part 21 by ESBU (ESBU-21.0 and its predecessors, ESBU-19.0 and OPR-19.0) and those of selected major ESBU divisions (called Level II procedures, level I being the ESBU Quality Systems Manual) including the:
Nuclear Services Division (NSD), Monroeville, PA Process Control Division (PCD), Ohara Township, PA Electro-Mechanical Division (EMD), Cheswick, PA Systems and Major Projects Division (SMPD), Monroeville, PA Commercial Nuclear Fuels Division (CNFD), Columbia, SC The inspector noted that the Part 21-related procedures of the Advanced Technology Business Area, Operating Plant Business Area, and the Westinghouse Pensacola, Florida, Division (steam generators and pressurizers) feed into ESBU-21.0 as well.
The inspector also reviewed lower tier (called Level III) Part 21-related procedures for selected departments within the major divisions including those of Replacement Component Services (RCS) of NSD and Nuclear Safety Analysis (NSA) Department of SMPD.
In addition, the inspector reviewed Level II and Level III procedures used by the various ESBU divisions and departments for implementation of Criterion XV,
" Control of Nonconforming Material," and Criterion XVI, " Corrective Action,"
of 10 CFR Part 50, Appendix B, to determine how effective those procedures are and how well they are implemented to identify those nonconformances that constitute deviations or failures to comply in basic components that have been supplied or offered for use at NRC-licensed facilities, thus' requiring evaluation under Part 21 using the ESBU-21.0 process.
To assess implementation, the inspector reviewed the records of Part 21 evaluations (called Potential Issue (PI) evaluations by ESBU-21.0) performed by the ESBU Safety Review Committee for 1991-1995, with emphasis on those that did not result in NRC notification. Then the inspector reviewed selected Material Review Reports and Corrective Action Reports (CARS) of EMD; Defective Ites Notices (DINS), Design Engineering Orders and Design Engineering Order Notifications (DE0s and DE0Ns), and CARS of PCD; and Software Error Reports of 3
O O
U U
the Nuclear Safety Analysis (NSA) Department of SMPD. These records were reviewed to determine which material nonconformances and computer software L
errors constituted deviations or failures to comply as defined in 621.3, which of these were identified as such and which were evaluated (or should have been 3
i evaluated) in accordance with 10 CFR Part 21.
b.
Part 21 Program Review Observations b.1 Part 21 Program Procedures I
ESBU has implemented 10 CFR Part 21 requirements, and the related criteria of 10 CFR Part 50, Appendix B, by a hierarchy of procedures on three levels:
Level I: The ESBU Quality Systems Manual (QSM)
Level II: ESBU and major division QA implementing procedures for 10 CFR Part 21 and 10 CFR Part 50, Appendix B, Criteria XV and XVI Level III: Departmental level implementing procedures that would aid in recognition and identification of conditions adverse to s:fety as defined in ESBU-21.0 The principal Level II procedure for overall ESBU Part 21 compliance is ESBU-21.0, " Identification and Reporting of Conditions Adverse to Safety."
ESBU 21.0 (as well as its predecessors, ESBU-19.0, and OPR-19.0) is applicable to, and is used directly by most ESBU divisions, including PCD, NSD, SMPD, and EMD.
b.2 Part 21 Program Adequacy During the review of the Level II and III procedures mentioned above (except for those of CNFD) of ESBU and selected divisions and departments with emphasis on the various revisions and versions of ESBU-21.0 back to 1993, the inspector determined that Revision 1 of ESBU-21.0, dated September 20, 1996, (as well as previous revisions reviewed), could not be fully relied upon to ensure that all deviations and failures t-comply would be evaluated and reported in accordance with f21.21 because of the following weaknesses and inconsistencies:
(1) The Westinghouse-coined combined category of " conditions adverse to safety" (CASs), while useful and complete (including both deviations and failures to comply as well as departures from Westinghouse specifications or requirements) was not used consistently throughout the procedure such that failures to comply and some deviations could be excluded from consideration.
(2) The director or responsible officer designated by the procedure to receive reports of defects or failures to comply associated with substantial safety hazards per 621.21(a)(3) was not consistent throughout the procedure.
Section V of ESBU-21.0, unter "ESBU Safety Review Committee Chairman Responsibilities," required that " recommendations" [the committees findings]
be reported to the "ESBU Vice President and General Manager, or his representative," a position that no longer existed at the time of the 4
/
inspection. However, the procedure designated the ESBU President as the officer responsible for reporting of defects or failures to comply associated with substantial: safety hazards to the NRC pursuant to 121.21(c). The position.of ESBU President was not permanently filled at the time of the inspection, although the Chief Operating Officer of the Westinghouse -
Industries and Technology Group was act Ng as ESBU President. The Acting ESBU President, in a September 9, 1996, memorandum (WIN: 272-4914), had delegated the responsibility for receiving (21.21(a)(3) notifications to the General Manager of ESBU Operations.
Other observations regarding ESBU-21.0 were as follows:
The description of Part 21 on Page 1 of 13 of ESBU-21.0, in listing those things with which a basic component may fail to comply, omitted the Atomic Energy Act of 1954, as amended, and licenses of the NRC.
Among the definitions of Section II, on page 4 of 13, in Paragraph 2 under " Basic Component," the list of things with which a basic component may fail to comply omitted the Atomic Energy Act of 1954, as amended, and rules of the NRC.
Discovery was not defined as in 621.3, i.e., the completion of documentation of a deviation or failure to comply with the potential for creating a substantial safety hazard. Rather, the procedure simply describes discovery as when a PI is opened. The procedure starts the 60-day evaluation period when a PI is opened as opposed to clearly requiring the evaluation to be completed within 60 days of Part 21-defined discovery as required by $21.21(a)(1) or an interim report to be submitted to the NRC within 60 days of Part 21-defined discovery as required by 121.21(a)(2).
e ESBU-21.0 provided the vague requirement to the ESBU Safety Review Committee (SRC) to " review referred items relative to the requirements of NRC regulations" instead of delineating the specific review requirements of Part 21, i.e., to determine if the deviation (CAS) being evaluated is a defect (that is, could it (a) create a substantial hazard, or (b) lead to exceeding a technical specification safety limit); or if the failure to comply (CAS) being evaluated could be associated with a substantial safety hazard.
The requirement for interim reporting on Page 11 of 13,Section VI, Paragraph 2(b) under " Notification Guidelines," cites 10 CFR 21.21(b) which is. incorrect.
Interim reports are required by $21.21(a)(2).
Appendix A to this report lists other Level 11 and III divisional and departmental procedures reviewed that were pertinent to the recognition and identification of deficiencies as deviations or failures to comply (i.e.,
conditions adverse to safety as defined in ESBU-21.0) that should be submitted to the ESBU SRC for evaluation /further evaluation per 621.21(a)(1). Some specific comments are included.
5
~
n e
~
b.3 Part 21 Program Implementation / Compliance The inspector reviewed selected records of evaluations of documented deviations and failures to comply, called " potential issues" (PIs) by ESBU-21.0, with emphasis on those that did not result in NRC notification per 621.21(c) because the ESBU SRC had determined that the deviations were not defects or the failures to comply were not associated with substantial safety hazards. The inspector found only one PI that required additional information (which was provided) beyond that in the file to determine its acceptability.
None were identified that should have been reported to the NRC.
The inspector reviewed selected records of the various divisions and departments within ESBU to assess the effectiveness of their procedures and programs in the recognition and identification (among the various types of deficiencies, error reports, and nonconformances, that are tracked) of deviations and failures to comply as defined by 621.3 that would need to be i
evaluated per the ESBU-21.0 process in compliance with f 21.21(a)(1).
PCD Defective Item Notices (DINS): The inspector identified no DINS that should have been recognized as deviations or failures to comply as defined in 621.3 (or CASs as defined in ESBU-21.0) in delivered basic components, but were not.
J PCD Corrective Action Requests (CARS): The inspector identified two CARS,92-064 and 93-002, with questionable justification for closeout.
The CARS oealt with the failure of certain purchased components to meet all test requirements. The components had been used in equipment supplied by PCD as basic components. PCD's disposition of the CARS was that the components were satisfactory as shipped. However, there was insufficient evidence in the records available for review for the inspector to reach that conclusion.
PCD agreed to follow up on the CARS in question and provide additional information. Should the justification ultimately be deemed inadequate, the potential exists for unrecognized (undiscovered), and hence unevaluated, deviations or failures to comply. This item will require review of additional information being developed by the vendor. Designated Unresolved Item 99901307/96-01-01 PCD Development Engineering Order Notices (DE0Ns): The inspector identified no DE0Ns that should have been recognized as deviations or failures to comply in delivered basic components and were not.
EMD Material Review Reports (MRRs): The inspector identified no MRRs at EMD that should have been recognized as deviations or failures to comply in delivered basic components and were not.
NSA Software Error Reports: The NSA Department of SMPD handles errors in software codes in accordance with NSA's procedure WP-4.19.3, Revision 0, August 31, 1996, formerly DP-3.7.4 (Revision 3, January, 31, 1993, reviewed) and then WP-3.7.4 (Revision 5, August 14, 1995, reviewed),
" Software Error Reporting and Resolution."
In a few cases, some of the safety analysis computer codes are used by certain utilities directly 6
-~.
~
)
l (e.g. the LOCBART and NOTRUMP loss-of-coolant-accident (LOCA) codes are used by Virginia Power (formerly VEPCO)).
In these instances, the code itself, and not the analysis, is the delivered basic component.
In accordance with ESBU procedures, (and as evidenced in the records) NSA notifies these utilities promptly of the error as soon as an error report is opened because they are direct users of the codes. Therefore, the user notification meets the requirements of 521.21(b) with regard to identified code errors regardless of the results of further analysis of the impact of those errors (and their correction and reanalysis) on predicted core accident parameters.
The inspector found that although it had taken Westinghouse as long as l
13 months (one instance in 1992) to close out an error report, the determination of the error /cause, correction of the error (writing new code), verification and validation, and rerunning all affected plant analyses using the ccrrected code to determine the impact of the error (i.e., nonconservatisms) quantitatively (or qualitatively) are legitimate discovery activities. That is, it is part of the discovery i
process, for which Part 21 has no prescribed time limit, to conduct these activities to determine if the existing analyses (which are the delivered basic components in most cases, not the codes themselves, fail to comply (e.g., with 10 CFR 50.46, 10 CFR Part 50, Appendix K, or technical specifications) or contain a deviation (departure from a l
technical procurement specification). Note that the inspector reviewed selected licensee procurement documents (contracts with ESBU for l
analytic services) and found none in which' any of the software errors reviewed by the inspector could be construed as a deviation from the largely non-technically prescriptive language in the contracts.
Either an actual deviation (i.e., an analyzed negative impact of a software error) or failure to comply, should they have the potential to create a substantial safety hazard or contribute to exceeding a safety limit, must be evaluated per 10 CFR 21.21(a)(1) or must be reported to affected licensees or purchasers per 621.21(b). For example, if an error in the NOTRUMP code, used in conjunction with LOCBART, should be identified, ESBU would need to determine what effect or impact such an error, when corrected, would have on, for example, pak cladding temperature (PCT). Only then could ESBU reasonably determine whether any existing plant nuclear safety analyses, that may have been performed using the hypothetically faulty or nonconservative codes or computer models, constitute or contain deviations or failures to comply as defined in 921.3.
In addition, the inspector noted a few instances in which the changes in PCT resulting from a code error (determined after correcting the error and running preliminary analyses to asses the potential error magnitude) were large enough for ESBU to open a PI, and evaluate it under
$21.21(a)(1) per ESBU-21.0 or its predecessors.
l The inspector also found that there have been improvements in the interface between the error reporting and resolution procedures and the Part 21 procedure. Also, there was an improving trend in closing out 7
I 4
.~.
~
V V
error reports promptly due to increased management attention and followup. The inspector identified no software error reports that should have been treated as deviations or failures to comply in delivered basic components and were not.
c.
Part 21 Program Review Conclusions The NRC inspector concluded that the ESBU system of procedures (including those of its major divisions) adopted pursuant to 10 CFR Part 21,621.21(a),
contained various weaknesses and inconsistencies that, taken in the aggregate, may render them inadequate to meet the requirements of 621.21(a). That is the procedures could not be relied upon to ensure that (1) all deviations and failures to comply would be adequately evaluated to identify defects and failures to comply associated with substantial safety hazards (621.21(a)(1)],
or that defects or failures to comply associated with substantial safety hazards would in all cases be reported within five working days to a person who qualifies as a director or responsible officer as defined in 621.3
[f21.21(a)(3)]. The weaknesses were discussed with the cognizant vendor staff during the inspection and summarized at the exit meetings.
In accordance with the NRC Enforcement Policy as promulgated in NUREG-1600, this was considered a minor violation and hence no Notice of Violation was issued. This violation notwithstanding, however, the inspector did not identify any instances in which 10 CFR Part 21 was not otherwise complied with.
The inspector further concluded that the NSA practices regarding handling of software error reports met the requirements of 621.21 whether the error is reported to users immediately or is determined to be (at least potentially) a deviation or failure to comply requiring evaluation per 621.21(a)(1).
3.2 The LOCA Enaineerina Review Council a.
Scope of LERC Review The inspectors reviewed the function and operation of the LOCA Engineering Review Council (LERC), and the consistency in modelling among analysts to assure that model changes are applied uniformly. The function of the LERC was examined through review of the minutes of LERC meetings and the resolution of issues brought before the LERC with followup interviews of cognizant staff.
The LOCA code guidelines review was to cover the manner in which the codes are used and applied to insure that a consistent modelling procedure was used from plant-to-plant. The inspector reviewed the vendor-to-licensee reporting procedures for model changes, and resulting PCT changes, to ensure that ESBU procedures and practices supported licensees in meeting the 10 CFR 50.46 annual and 30-day reporting requirements.
b.
LERC Observations In July 1992, NSA formed the LERC to examine perceived errors and proposals for application of new methodologies, design techniques, and analysis procedures to assure that they are reasonable, appropriate and in conformance with NRC regulations. The LERC was made up of senior technical staff members with sufficient background and knowledge of the history of code development 8
p (a) 4 and applications. The LERC was intended to review the technical aspects of proposed changes and improvements, while also considering licensing, customer relations, and regulatory concerns. The LERC was not intended to be a replacement for the quality assurance technical review requirement of 10 CFR Part 50, Appendix B.
After review of LERC meeting minutes file, the inspector examined the following selected issues in detail:
At the March 27, 1996, meeting, the LERC considered two issues. The first was a concern regarding handling the integral fuel burnable absorber (IFBA) rod design. A large number of analytical calculations were being performed when IFBA rods were to be used.
Four possible solutions were discussed to either maintain the status quo, or to seek relief from the NRC from the results of certain previously submitted analyses. The methods of lessening the analytic load would require NRC approval. The decision was to continue with the current procedures, in spite of the large demand on analysts' time.
The second issue the LERC considered in the March 27, 1996, meeting was a concern regarding the enthalpy transfer methodology used between the SATAN and LOCTA computer codes. At the time of this LERC meeting (and also at the time of the inspection), ESBU used the' node-centered method. The recommendation being considered by the LERC was to use a more modern, so-called " donor-cell" enthalpy transfer methodology. Coding the donor-cell method and using it with SATAN would result in a reduction in PCT of 50 to 200*F. SATAN, as then configured, used only four core nodes. While'use of the less restrictive enthalpy transfer would lower the PCT, a new core nodalization sensitivity with more core nodes would negate any PCT margin gains. Again, the status quo was decided to be maintained. The donor-cell methodology that was coded for the study was installed in SATAN as an option, with the default being the node-centered enthalpy transfer method. Related to the concern over the enthalpy trcnsfer was the documentation provided to the NRC. The pertinent ESBU WCAPs (histinghouse document designation) refer to the node-centered methodology, while some unofficial presentation materials discuss donor-cell methods. The conclusion was that the information of record was consistent with the methodology in standard use.
The decision to maintain the status quo with regard to fuel rod analysis procedures does not raise a safety concern and is at the discretion of the i
vendor. The enthalpy transfer methodology and core nodalization used in the current analyses are consistent with those reviewed and approved by the NRC.
Use of the donor-cell methodology would require review and approval by the NRC. At that time, core nodalization would be reconsidered.
During the August 17, 1996, meeting, the LERC considered the way in which the LOCBART code models the fuel assembly grids; specifically, whether or not the code was correctly solving the heat conduction / mass balance for conditions of insufficient liquid droplets. A new solution technique for the model was prepared, and one computer run indicated a change in PCT of +20*F for a plant in which PCT occurs late in the LOCA sequence.
In that case there was more than 200*F margin to the 2,200*F limit of 10 CFR 50.46. The LERC concluded that this constituted a model improvement rather than a code error since it reflected a newer approach to problem solution rather than incorrect modelling. The LERC recommended that implementation of this solution 9
j
^
V V
technique be discretionary until further model changes, such as axial offset, were implemented as a code update.
The inspector determined that the LERC disposition of this issue was reat onable and justifiable in the case of implementation of solution update techniques.
It was shown during the inspector's discussions with the cognizant ESBU staff that implementation of the updated model would not always result in an increase in PCT.
In the case of early PCT plants, a reduction in PCT could occur.
In the case of some of the plants in which PCT occurs late in the LOCA sequence, an increase in PCT of as much as 20*F could occur. No cases were found that violated the limits of 10 CFR 50.46.
In the May 26, 1995, meeting, the LERC considered questions regarding the l
issue of safety injection versus spill in the broken loop for 4-loop plants.
The concern was that the downcomer delivery was dependent on the break location, i.e., bottom, top, or side of the pipe. The discussion resulted in a 4-to-3 LERC vote split and a dissenting opinion. The opinions of the LERC minority were appropriately addressed, and resulted in a revision of the accepted analysis process.
Ultimately, analyses were performed with injection locations at the top, side, bottom, and 45-degree angle. The bottom location was found to be the limiting case. The dissenting opinion was withdrawn.
The analysis approach was submitted to the NRC for review and approval as part of the submittal dealing with condensation effects credit during safety injection (the so-called "COSI" submittal). The pertinent WCAPs are:
WCAP-11767, "COSI SI/ Steam Condensation Experiment Analysis," March 1988.
WCAP-10054-P, Addendum 2, Revision 1, " Addendum to the Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code: Safety Injection into the Broken Loop and COSI Condensation Model," October 1995. Use of the methodology was reviewed and approved by the NRC.
c.
Conclusions Regarding the LERC The inspector concluded that, for the activities reviewed, the LERC functioned well as a sounding board for issues, concerns and questions regarding code models and methods of application.
In the limited number of issues reviewed by the inspector, concerns were described, discussed, and a satisfactory solution or resolution adopted.
3.3 LOCA Code Use Guidelines Use of the current generation of Westinghouse LOCA codes is defined by the company's code guidelines. The analyst uses a preprocessor (SPADES) to access a plant database (IMP) from which a steady state input deck emerges specific to the applicable code, such as NOTRUMP, LOCTA, SATAN, plus a template deck.
t Very limited freedom is accorded the analyst in modifying the input stream.
Specific data sets, such as a pumped flow table, can be altered to permit use 10 l
I
I i
of new data, or to examine possible effects of plant changes. Changes made in the plant input model are reviewed by an independent analyst as part of the i
quality' assurance program. The code guidelines contain notification of code errors and work-arounds until final approved corrections have been made and incorporated. The inspector determined that the method of ensuring continuity 4
and consistency in code use was reasonable and acceptable.
l 3.4 10 CFR 50.46 Renortine a.
Scope I
The inspectors reviewed ESBU loss-of-coolant accident (LOCA) analysis computer i
code procedures.
Licensee reporting requirements for LOCA analyses must be in accordance with 10 CFR 50.46, and 10 CFR Part 50, Appendix K.
Specifically, j
changes in an analysis, whether due to code model changes, error corrections, or plant input changes, resulting in a total change in calculated peak cladding temperature (PCT) of 50*F (using the absolute value of the changes) or more must be reported to the NRC within thirty (30) days. Changes resulting in less than a 50*F total calculated PCT change are to be reported annually.
b.
Observations ESBU requires the assigned analysts for the various plants for which ESBU performs analyses to keep a running tally of changes in PCT, for example, to know the margin to 2200*F PCT, to know when the absolute value of PCT changes accumulates to >50*F for 30-day reports pursuant to 10 CFR 50.46, and to compile all changes for the 50.46 annual reports.
Since there are approximately forty (40) analysts working on the different Westinghouse NSSS equipped plants, the inspector reviewed the manner in which changes involving PCT are controlled and applied. The inspector determined-that NSA consistently prepared quality assurance documents and PCT summary sheets for each plant. Changes made in analyses affecting more than one plant resulted in QA PCT tabulations listing all affected plants and their respective results. Then NSA piepares reports summarizing PCT, change in PCT, and final PCT for both large-break and small-break LOCAs for each individual customer.
In addition, NSA reports all changes immediately to any customer who uses Westinghouse analysis codes for licensing-basis analyses.
The inspector determined that ESBU transmits code changes resulting in PCT changes of tens of degrees Fahrenheit to customers promptly in case the customer has made changes ESBU is not aware of that would result in a total change in PCT of 50*F or more; in which case, the 30-day reporting requirement would be imposed. Also, NSA reviews the database used to track PCT margin for all affected plants (called the "lMP" database) prior to each use to be sure plant changes have been properly applied and that there are no errors in the database.
Finally, NSA prepares a closeout record for resultant PCT changes providing root cause for the changes, potential nonconformance, corrective action, and conclusions.
11
O r
r
(
c.
Conclusions The procedures used to insure timely reporting of PCT changes resulting from analyses of small and large break LOCAs are sufficient to permit compliance with the reporting requirements of 10 CFR 50.46.
Procedures have been effectively implemented to ensure accuracy and quality assurance in the reporting.
PARTIAL LIST OF PERSONS CONTACTED Jerry Malley, Engineer, AID, SMPD Larry Walker, Manager Aux. Equip Engr., SMPD Larry Kamenicky, Manager, ESBU Quality Systems-I R.0. Kechner, Manager, ESBU Quality Systems-II Rocco A. Asselta, EMD Principal Engr (QA)
Gene R. Strussion, Sr. Engr., NSD, RCS Norm Mueller, SMPD, Mgr. I&C Tech & Analysis Richard B. Miller, NSD, RLI, Fellow Engr.
Steve Tritch, NSD General Mgr.
Philip T. McManus, Process Control Division, T.Q. Engr.
David N. Alsing, ESBU Quality Systems III Curt F. Ciocca, Sr. Engr., SMPD, NSA Sumit Ray, CNFD-CE John S. Galenbush, NSD, REN, Senior Engr.
Al Casadei, CNFD-CE Meena Mutyala, Director, ESBU Quality Systems David K. Allison, CNFD, Dev. Prog.
Aldo R. Govi, ESBU/QS, Supervising Engineer Nick Liparulo, Manager, REN, NSD H.A. Sepp, Manager, RLI, REN, NSD William McElroy, Qual & Reliability Engr., PCD Frank Rizzi, QA Eng., RCS, NSD Tom Cornale, Manager of Quality & Safety Engineering, EMD Tim Dunn, Principle Engineer, RCP Engineering Dan Garner, NSD, NA Mark Kachmar, NSD, NA Steve Rupprecht, NSD, NA B.J. Metro, Sr. Engineer, SMPD/SE/ICAT R.J. Sero, General Manager, SMPD ITEMS OPENED, CLOSED, AND DISCUSSED Discussed:
99901307/$J-01-01 URI Questionable Justification for Closeout of OCD CARS92-064 and 93-002 12
,O
[
i
^
(.
i APPENDIX A ESBU Level II QA Procedures of Interest Applicable to NSD, SMPD, ABTA:
Implementing Criterion XV:
ESBU-13.1, " Field Deviation' Report (FDR)," Revision 1, August 31, 1996 WP-13.2, " Control of Nonconformances," Revision 0, August 31, 1996 WP-13.3. " Deviation Notices," Revision 0, August 31, 1996 Implementing Criterion XVI:
ESBU-14.1, "ESBU-Significant Quality Issues,' Revision 3, September 20, 1996 ESBU-14.2, " Corrective and Preventive Action," Revision 1, September 20, 1996 PCD Level II QA Procedures of Interest:
i Implementing Criterion XV:
DP 13-001, " Control of Nonconformances," Revision 0, April 1, 1996, Duplicates, but does not refer to DP 13-003.
Does not refer to 13-002 for a DIN tag.
General: " Reference and follow ESBU-19.0."
In addition, Paragraph 2.d states: " Determine if the nonconformance is a condition adverse to safety per ESBU procedure entitled " Identification and Reporting of Conditions Adverse to Safety."
DP 13-002, " DIN Tags," Revision 0, April 1, 1996 DP 13-003, " Nonconforming Material Review and Disposition," Revision 0, April 1, 1996 DP 13-004, " Deviation Notices," Revision 0, April 1, 1996 2.a., refers deviation notice DN to ESBU SRC per ESBU-19.0 Implementing Criterion XVI:
DP 14-001, " Corrective Action Requests / Reports," under No. 4 Review condition (subject of CAR) directed the reviewer to determine if the issue represents a
" potential substantial safety hazard." It then referred the reviewer to ESBU-19.0 if the CAR issue is " reportable" instead of referring the reviewer to ESBU-21.0 if the CAR issue could be a condition adverse to safety.
The special PCD QA procedure for implementing Part 21 and Criteria XV and XVI for the type of software (mostly for EPROM) applicable to the type of equipment produced by PCD was DP 04-105, " Software Error Reporting and Resolution." The inspector reviewed the current revision of DP 04-105, Revision 0, April 1, 1996.
The PCD procedure that covers how errors and deficiencies are corrected and j
initiates engineering review and design drawing changes that prompt referral 13 i
i
to ESBU-21.0 when required is DP 04-004, "DE0N." The inspector reviewed the current revision of the DEON (Development Engineering Order Notification) procedure, Revision 0, dated April 1, 1996.
EMD Level II QA Procedures of Interest:
Implementing Criterion XV:
IDP-Ql, Revision 4, March 15, 1996, did not refer to ESBU-21.0 nor did it provide for determining if any of identified nonconformances ever have been or could be conditions adverse to safety. Although, among the records reviewed at EMD, the inspector found none that should have been treated as conditions adverse to safety.
IDP-Q1 also does not refer to PAI-403 or IDP-Q17 Implementing Criterion XVI:
PAI-403, "Significant Quality Problems," Revision 6, March 31, 1994.
Items are to be processed per IDP-Q2.
IDP-Q2, revision dated February 2,1990, out of date, says process per OPR-19.0
)
i IDP-Q17, Revision 0, August 6, 1996, SQP Log J
NSD Level III QA/Part 21 Procedures of Interest:
The Engineering Technology Department was formerly a part of NSD.
Engineering Technology Instruction Manuals ET-A-1.0, " Glossary" (Revision 1, October 1, 1993), and ET-B-1.0, " Identification, Evaluation and Closeout of Safety Concerns" (Revision 1, October 1, 1993), discuss deviations, but not fafaures to comply. The organization (s) to which these two procedures were meant to be applicable have long since changed, and other procedures now perform their functions, but they remained effective at the time of the inspection.
The Level III, departmental procedure in use by the Replacement Component Services Department of NSD for QA/ Criterion XV implementation at the time of the inspection was RCS-415, " Control of Material Deficiency Reports," Revision 3, June 30, 1994.
RCS-415 did not provide for determination of whether the deficiency described in the material deficiency report (MDR) has ever, or could ever have, constituted a condition adverse to safety, as defined in ESBU-21.0 in a BC delivered to NRC-licensed facility. RCS-415 used the term
" substantial safety hazard" regarding reporting, but this term effectively excludes those deviations from evaluation which are potential defects by virtue of potentially causing the exceeding of a technical specification safety limit.
RCS uses the ESBU Level II QA procedures applicable to NSD for implementation of Criterion XVI (i.e., ESBU 14.1 and 14.2) i 14 i
n i
4 t
SMPD Level III QA/Part 21 Procedures of Interest:
NSA's procedure WP-4.19.3, Revision 0, August 31, 1996, formerly DP-3.7.4 (Revision 3, January, 31, 1993, reviewed) and then WP-3.7.4 (Revision 5, August 14, 1995, reviewed), " Software Error Reporting and Resolution." This procedure did not allow error report closeout to be scheduled more that six months hence, but did allow extensions. Without close management' attention, this has the potential for allowing excessive amounts of time for discovery.
In cases in which the error could have a significant negative impact on PCT, for example, that is, a large PCT penalty relative to existing licensing-basis analyses, it-could delay the timely opening of a PI and commencement of the 521.21(a)(1) evaluation.
I I
l 1-l l
15 l
l I.
. _.,