ML20217A140

Forwards Addl Info That South Texas Project Wishes to Submit for Further Consideration Re Recent Maintenance Rule Baseline Insp Held at Site Week of 980323.Commitments Listed,Within Ltr

ML20217A140
Person / Time
Site:	South Texas
Issue date:	04/14/1998
From:	Jordan T HOUSTON LIGHTING & POWER CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
50-498-98-01, 50-498-98-1, 50-499-98-01, 50-499-98-1, STI:30591902, NUDOCS 9804220174
Download: ML20217A140 (11)

Text

1 Nuclear Operat ng ompany MC swa twse eatuwceautysuam ra aarzas mirarth, rc us77183 n

m April 14,1998 NOC-AE-000132 File No.: G02.04.02 10CFR2.201 1

STI: 30591902 f

i U. S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, DC 20555 South Texas Project Units 1 and 2 Docket Nos. STN 50-498; STN 50-499 Additional Information to Mainjenance Rule Baseline Inspection _9801 Please find attached additional information that South Texas Project wishes to submit for further consideration regarding the recent Maintenance Rule Baseline Inspection held at our site the week of March 23 of this year. South Texas Project appreciates the opportunity to submit this information for your review during the evaluation of the inspection results. The only commitments in j

this correspondence are located in the Action Taken sections of the Attachments.

I l

If there are any questions regarding this information, please contact Mr. S. M. Head at (512) 972-7136 or me at (512) 972-7902.

l l

\\-

4#~

ordan Manager Systems Engineering WEM/wem i

Attachments:

1. Failure to Identify Maintenance Rule Functional Failures

\\

.}

2. Systems Not Included in Initial Program Scope

3. Program Scoping issues 6

4. Unavailability Tracking Issues

5. Unavailability Tracking for the Solid State Protection and Eng Features Actuation Systems 9804220174 980414 PDR ADOCK 05000498 P

PDR e \\wp\\nhnn:-sp\\me98

4 ST-NOC-AE-000132 File No.: G02.04.02 Page 2 Ellis W. Merschoff Jon C. Wood Regional Administrator, Region IV Matthews & Branscomb U. S. Nuclear Regulatory Commission One Alamo Center 611 Ryan Plaza Drive, Suite 400 106 S. St. Mary's Street, Suite 700 Arlington, TX 76011-8064 San Antonio,TX 78205-3692 Thomas W. Alexion Institute of Nuclear Power Project Manager, Mail Code 13H3 Operations - Records Center j

U. S. Nuclear Regulatory Commission 700 Galleria Parkway Washington, DC 20555-0001 Atlanta, GA 30339-5957 David P. Loveless Richard A. Ratliff Sr. Resident inspector Bureau of Radiation Control j

c/o U. S. Nuclear Regulatory Commission Texas Department of Health

)

P. O. Box 910 1100 West 49th Street Bay City, TX 77404-0910 Austin, TX 78756-3189 J. R. Newman, Esquire D. G. Tees /R. L. Balcom Morgan, Lewis & Bockius Houston Lighting & Power Co.

1800 M. Street, N.W.

P. O. Box 1700 Washington, DC 20036-5869 Houston,TX 77251 M. T. Hardt/W. C. Gunst Central Power and Light Company City Public Service ATTN: G. E. Vaughn/C. A. Johnson P. O. Box 1771 P. O. Box 289, Mail Code: N5012 San Antonio,TX 78296 Wadsworth,TX 77483

.A. Ramirez/C. M. Canady U.S. Nuclear Regulatory Commission City of Austin Attention: Document Control Desk Electric Utility Department Washington, DC 20555-0001 721 Barton Springs Road

, Austin,TX 78704

NOC-AE-000132 Page1of1 FAILURE TO IDENTIFY MAINTENANCE RULE FUNCTIONAL FAILURES I.

Statement of Potential Violaiutt During the Exit Meeting for Inspection 9801, Maintenance Rule Baseline Inspection, at South Texas Project a Potential Violation was presented since several Maintenance Rule Functional Failures were not identified until the Inspector questioned them.

II.

South Texas Project's Position:

South Texas Project concurs with the potential violation and submits the following additional information for consideration.

Ill.

Additional Informati_om Although NRC Inspectors identified four events at South Texas Project that should have been identified as Maintenance Rule Functional Failures (MRFF), we believe that our programmatic approach to identifying MRFFs is effective and thorough.

Research of the individual events has established that all were associated with the historical reviews of past maintenance conducted to provide initial input for determination of MRFF performance criteria or as a result of new SSCs being added to the scope of the Maintenance Rule Program. It should also be noted that the identification of these missed MRFFs did not result in any of the associated systems exceeding an established performance criteria and being classified as an (a)(1) system.

South Texas Project believes that the identification of these missed MRFFs provides us with improved and enhanced insights to apply during periodic evaluations and self assessments. They will also serve as part of our lessons learned review process.

Individual Condition Reports have been initiated under our Corrective Action Program for each of the missed MRFFs and a thorough evaluation will be completed for each event. Additionally, we are evaluating our oversight of the MRFF identification process.

IV.

AcJons Takeln

1. Condition Adverse to Quality Condition Reports were written for each missed MRFF condition.

Investigations for these events will be completed and corrective actions required by the insestigations will be determined by May 31,1998.

e WpWinn;-ap\\mw9N

i NOC-AE-000132 Page1of1

)

SYSTEMS NOT INCLUDED IN INITIAL PROGRAM SCOPE 1.

S_tatement of Potential Violation _;

During the Exit Meeting for Inspection 9801, Maintenance Rule Baseline Inspection, at South Texas Project a Potential Violation was presented since several systems were added to the Maintenance Rule scope after July 10,1996.

II.

Sguth Texas Project's Position:

South Texas Project concurs with the potential violation and submits the following additional information for consideration.

III.

MditionalInformation; Because of a proactive approach in monitoring industry events and NRC inspection results, South Texas Project recognized the need to include several new systems or functions into the Maintenance Rule Program. As these systems / functions were identified by the South Texas Project Staff, they were added to the program and had appropriate monitoring goals or performance criteria set. Not withstanding the two systems discussed in Attachment 3, we have not found any other systems that should be au

• w the scope of our Maintenance Rule Program. We will continue to monitor industry events and NRC guidance in the area of scoping and evaluate any conditions that may point to required additions to our program.

4 Ib% M %MM"N

NOC-AE-000132 Page 1 of 2 4

PROGRAM SCOPING ISSUES 1.

Statement of Potential Violatioin During the Exit Meeting for Inspection 9801, Maintenance Rule Baseline Inspection, at South Texas Project a Potential Violation was presented dealing with program scoping since the Rod Position Indication System (RI) and Control Room Ventilation Smoke Purge Actuation System are not scoped in the Maintenance Rule Program.

II.

South Texas _ Project's Position:

South Texas Project does not concur with the potential violation regarding the RI system and submits the additional information below for consideration.

The South Texas Project position regarding the Control Room Ventilation Smoke Purge Actuation System was established using NUMARC 93-01 Revision 1 as guidance. Based on our review of Revision 2 to NUMARC 93-01, South Texas Project concurs with the potential violation and presents the following information for consideration.

III.

Additismal Information:

l Although the Rod Position Indication (RI) System is used in Emergency Operating Procedures to determine whether the rods are fully inserted, this is considered by South Texas Project to be an

)

assessment function and not an accident mitigation function. Section 8.2.1.3 of NUMARC 93-01 states in part that for an SSC to be important enough to be added to the scope of the Maintenance Rule "...it must add significant value to the mitigation function of an Emergency Operating Procedure by providing the total or a significant fraction of the total functional ability required to mitigate core damage or radioactive release." If the RI System is not available for assessing whether l

the rods are fully inserted, then the Emergency Operating Procedures direct the operator to borate the Reactor Coolant System to a specific concentration. Thus, the accident is mitigated by the boration, not by assessing whether the rods are bottomed. Although we feel that we are in compliance with the scoping requirements of NUMARC 93-01 for the RI System, South Texas Project intends to add the rod bottom function of the RI System to the scope of the Maintenance Rule Program due to its importance as an assessment tool for operators.

i The South Texas Project's position on the Control Room Ventilation Smoke Purge Actuation System was developed using Revision I to NUMARC 93-01 when the Maintenance Rule Program was initially implemented. This version had some conflict within it concerning actuation of a safety system between the definition and an example given in section 8.2.1.5. Revision 2 to NUMARC 93-l 01 made a subtle change to this portion of the document (changed the wording for the example from "an example of a Safety System Actuation" to "an example of the actuation of a safety system") that was not recognized until after the inspection was cver. After consideration of the changes in i

ewptni\\nn:-aphas i

+

s NOC-AE-000132 Page 2 of 2

{

NUMARC 93-01 and other industry documentation South Texas Project agrees with the inspection team position that this function should be scoped in the Maintenance Rule Program.

IV.

Actions Taken:

{

l. South Texas Project will add the rod bottom function of the R1 System to the scope of the Maintenance Rule Program by May 31,1998.

2. South Texas Project will add the Control Room Ventilation Smoke Purge Actuation function to

{

the Maintenance Rule Program by May 31,1998.

3. South Texas Project will review the actuation functions in other systems to determine if they I

should be added to the Maintenance Rule Program by June 30,1998.

4 i

NOC-AE-000132 Page1ofl UNAVAILABILITY TRACKING ISSUES I.

Statement of Potential Violati9n; During the Exit Meeting for Inspection 9801, Maintenance Rule Baseline Inspection, at South Texas Project a Potential Violation was presented caused by the failure to track unavailability hours on the Solid State Protection System (SP) and the Engineered Safety Features Actuation System (SF).

II.

South Texas Project Positieft; South Texas Project does not concur with the potential violation and submits the following additional information for consideration.

III.

Md_itional Information; South Texas Project believes the plant level and reliability performance criteria effectively monitors system health and preventive maintenance effectiveness because unavailability performance criteria does not provide a meaningful measure of performance for these systems. In addition, an unavailability sensitivity study demonstrates train unavailability has negligible impact on plant risk (i.e., core damage frequency). For the solid state protection system, the maximum unavailability associated with surveillance testing was requantified in the PRA with negligible impact to overall risk. For the engineered safety features actuation system, the unavailability assumed in the PRA was doubled and requantified. Like the results from the solid state protection study, the engineered safety features actuation system demonstrated negligible impact to the overall core damage frequency. From a risk standpoint, South Texas Project effectively monitors system performance using existing performance criteria.

In addition, South Texas Project believes that this is not an issue with respect to optimizing availability and reliability for SSCs based on NUMARC 93-01, which states,"This optimization could be achieved by any of the following..." Then provides a list of five recommended approaches to balancing availability and reliability. For most risk significant systems, South Texas Project uses all five of the recommended techniques. is a white paper providing more detail on the sensitivity studies and justification for plant level and reliability performance criteria monitoring.

e \\wpwinn:-apsmme-va

NOC-AE-000132 Page 1 of 4 UNAVAILABILITY TRACKING FOR TIIE SOLID STATE PROTECTION AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEMS During the recent NRC Baseline Inspection of the South Texas Project's implementation of the Maintenance Rule (10CFR50.65) a potential violation was discovered with respect to tracking unavailability for the Solid State Protection (SP) and Engineered Safety Features Actuation (SF) system. This baseline inspection was held at the South Texas Project from March 23 through March 27,1998.

The justification for not tracking unavailability performance criteria for the SP and SF systems is based on Revision 2 of NUMARC 93-01, Industry Guidelinefor Monitoring the Effectiveness of Maintenance at Nuclear Power Plants. The definition for the word " performance" in Appendix B states in part "To the maximum extent possible both availability and reliability should be used since that provides the maximum assurance that performance is being monitored. There are instances (i.e., reactor coolant system, electrical load centers, certain standby equipment, etc.)

where availability does not provide a meaningful measure of performance and should not be captured." South Texas Project does not use unavailability performance criteria for SP and SF because it does not provide a meaningful measure of performance and other performance criteria provide adequate monitoring of the SSCs performance.

Although most safety related mechanical systems have easily defined trains that lend themselves to the tracking of unavailability, most electrical and I&C systems do not. NUMARC 93-01 (Appendix B, definition of" performance") lists electrical load centers as one example of an instance where unavailability performance criteria should not be captured. Most electrical and I&C systems do not have easily defined trains due to system design and complexity.

Plant level performance criteria (Capability Factor, Unplanned Capability Loss Factor, reactor trips and safety system actuation) provides adequate monitoring for both reliability and availability for systems that are normally needed for power operations (i.e., not standby systems). If any of the plant level performance criteria are exceeded, then the cause is evaluated and corrective actions are taken for the systems that were the main contributors to the exceedance.

For the solid state protection system, preventative maintenance activities that would take a train out-of-service are not performed on-line. Corrective maintenance would require a maintenance rule functional failure which is tracked under system level reliability performance criteria.

Surveillance testing for solid state protection that takes a train out-of-service is required by Technical Specification. Surveillance tests never take the whole system out-of-service, only one logic or actuation train is removed from service at a time.

It was found during review of corrective maintenance activities that some actions could potentially impact system availability. This is due to the fact that some corrective maintenance actions may not qualify as maintenance rule functional failures if the conditions being fixed did not impact any of the maintenance rule scoped functions when discovered. On further review, South Texas Project has decided to track these types of maintenance activities as maintenance rule failures. This is a conservative call that supports South Texas Project position that all corrective maintenance unavailability is monitored via the reliability performance criteria.

.wan.e.a

~4 3

NOC-AE-000132 Page 2 of 4 To assist in p'roviding further information, evaluations were performed with respect to an analyzed increase in unavailability for the SP and SF systems. The evaluation is based on the impact to

. plant risk (i.e., core damage frequency) for increased unavailability in the two systems. For the SP analysis, the maximum allowable unavailability for surveillance testing, as defined by the Technical Specifications, is reanalyzed in the PRA. For the SF analysis, the unavailability assumed in the PRA is doubled and the core damage frequency is recalculated in the PRA.

The South Texas Project PRA is a state-of-the-art document that estimates the safety levels associated with the operation of the South Texas Project units based on the design and operation of the plant. Key elements in the PRA such as component reliability and availability are based on both plant-specific and industry data. Since the PRA is a "living" document, the updating of the PRA is procedurally controlled in accordance with the Probabilistic Risk Assessment Program I

procedure, OPGPO4-ZA-0604. The PRA provides the valid tool for analyzing the impact a SSC has on plant safety.

1 Solid State Protection For the Solid State Protection system there are five surveillance procedures performed at-power that impact either the reactor trip breakers, actuation trains (A, B, and C) or logic trains (R and i

S). These are:

QPSP03-SP-0005R(S). SSPS Logic Train R(S) Functional Test verines the train R(S) solid state protection system automatic trip and automatic actuation logic output functions by simulating input combinations in conjunction with each possible interlock. The operation of the shunt trip device is tested on bypass breaker R(S). These procedures are normally performed quarterly in plant operating modes 1 through 4. Closing a reactor trip bypass breaker in modes 1 and 2 causes entry into a 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Technical Specification Action Statement. Although this test is Snished sooner,2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> are conservatively assumed in order to demonstrate the maximum unavailability duration.

Quarterly converted to hours

• Duration

• Evaluation period

• Number of trains (4/yr)(lyr/8760 hrs)*(2 hrs)*(13140 hrs in eighteen months)*(2 trains in SP)

= 24 hrs 1

0_P_SP03-SP-0006R(S) Train R (S) Reactor Trip Breaker TADOT verifies reactor trip breaker R (S) solid state protection system by simulating input trip logic and verifying operation of reactor trip R (S). These procedures are performed quarterly in plant operating modes 1 through 4.

Testing a reactor trip breaker in modes 1 and 2 causes entry into a 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Technical SpeciGeation Action Statement. Although this test is Gnished sooner,2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> are conservatively assumed in order to demonstrate the maximum unavailability duration.

Quarterly converted to hours

• Duration

• Evalunion period

• Number of trains (4/yr)(lyr/8760 hrs)*(2 hrs)*(13140 hrs in eighteen months)*(2 trains in SP)

= 24 hrs

,%#,a

[ -

i l

NOC-AE-000132 Page 3 of 4 I

i QPSP03-SP-0007A(BD. SSPS Actuation Train A(B.C) Master Relav Test verifies actuation l

train A(B,C) master relay output continuity and operability as required by Technical l

Specifications. These procedures are performed quarterly in plant operating modes 1 through 4.

j Technical Specincation action statement limit time a protection train can be bypassed for testing to a maximum of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> at a time. Although this test is Gnished sooner,2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> is conservatively assumed in order to demonstrate the maximum unavailability duration.

Quarterly converted to hours

• Duration

• Evaluation period

• Number of trains l

(4/yr)(lyr/8760 hrs)*(2 hrs)*(13140 hrs in eighteen months)*(3 trains in SP) i l

= 36 hrs OPSP03-SP-0008A@D,_SSPS Train A (B.C) Slave ILelay Test (Oulput Blocked) partially verifies actuation train A (B,C) slave relay output contact continuity and operability as required by Technical Specifications. These procedures are normally performed quarterly in plant operating modes 1 through 4. This surveillance effects various functions of the SP train and does not take the whole train out-of-service during the test. Conservatively for modeling this surveillance, an I

assumption is made that the train will be removed from service for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

I I

i Quarterly converted to hours

• Duration

• Evaluation period

• Number of trains 4

(4/yr)(lyr/8760 hrs)*(2 hrs)*(13140 hrs in eighteen months)*(3 trains in SP) l

= 36 hrs j

OESP03-SP-0009A (B.C). SSPS Actuation Train A (B.C) Slave Relay Test partially verifies actuation train A (B,C) slave relay output continuity and operability as required by the Technical Specifications. These procedures are performed quarterly and can be performed at operating modes I through 4. This surveillance effects various functions of the SP train and does not take the whole train out-of-service during the test. Conservatively for modeling this surveillance, an assumption is made that the train will be removed from service for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

Quarterly converted to hours

• Duration

• Evaluation period

• Number of trains (4/yr)(1yr/8760 hrs)*(2 hrs)*(13140 hrs in eighteen months)*(3 trains in SP)

= 36 hrs The total maximum unavailability hours for the above procedures is 156 hours0.00181 days <br />0.0433 hours <br />2.579365e-4 weeks <br />5.9358e-5 months <br /> during an eighteen month evaluation period. As a sensitivity study 156 hours0.00181 days <br />0.0433 hours <br />2.579365e-4 weeks <br />5.9358e-5 months <br /> of unavailability was reanalyzed in the plant specine PRA (PSA-98-006). The South Texas Project base case core damage frequency is 9.08E-6 events per reactor year. When the unavailability for the solid state protection system is increased to 156 hours0.00181 days <br />0.0433 hours <br />2.579365e-4 weeks <br />5.9358e-5 months <br />, the increase in core damage frequency results in a less than 1% impact.

The South Texas Project endorses the use of EPRI PSA Applications Guide (TR-105396) which identifies the threshold of acceptable risk increase given changes to the plant. Figure 4-1 of the "SA Applications guide, provides the quantitative screening criteria for permanent changes n yacting the core damage frequency. According to the graph, at South Texas Project any wange resulting in an increase of < 33% is considered acceptable. This study demonstrates that the increase unavailability is non-risk signincant when the unavailability for the solid state protection is set to 156 hours0.00181 days <br />0.0433 hours <br />2.579365e-4 weeks <br />5.9358e-5 months <br />.

l ewpsannn-pune9s

f f

l NOC-AE-000132 l

Page 4 of 4 i

Engineered Safety Features Actuation System 1

l The PRA model analyzes maintenance and surveillance testing unavailability of the SF system for l

the sequencers and logic trains. For this reason the impact to plant risk (i.e., core damage frequency) was evaluated by doubling the SF unavailability in the plant specific PRA model. This is consistent with how unavailability performance criteria for other systems are set commensurate l

with safety. A sensitivity study (PSA-98-005) was performed on the SF system to determine the l

impact to plant risk (i.e., core damage frequency). The PRA assumes 11.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> of unavailabili.y i

during an 18 month period. Therefore, for this study the SF unavailability is set at 23 hours2.662037e-4 days <br />0.00639 hours <br />3.80291e-5 weeks <br />8.7515e-6 months <br />.

The South Texas Project base case core damage frequency is 9.08E-6 events per reactor year.

When the unavailability for the SF system is doubled, the increase in core damage frequency results in a less than 1% impact. The EPRI PSA Applications Guide (TR-105396) identifies the threshold of acceptable risk increase given changes to the plant. Figure 4-1 of the guide, provides the quantitative screening criteria for permanent changes impacting the core damage frequency.

According to the graph, at South Texas Project any change resulting in an increase of < 33% is considered acceptable. This study demonstrates that the increase unavailabdity is non-risk significant when doubling of the unavailability for the SF system.

Conclusion In conclusion, South Texas Project does not use unavailability performance criteria for SP and SF because it does not provide a meaningful measure of performance, and other performance criteria l

used at South Texas Project provide adequate monitoring of the SSCs performance.

I Furthermore, the above unavailability sensitivity studies demonstrate that train unavailability for the SP and SF systems have negligible impact on plant risk (i.e., core damage frequency). For the solid state protection system, the maximum unavailability associated with surveillance testing was requantined in the PRA with negligible impact to overril risk. For the engineered safety features actuatian system, the unavailability assumed in the PRA was doubled and requantined.

Like the results from the solid state protection study, the engineered safety features actuation system demonstrated little impact to the overall core damage frequency. From a risk informed standpoint, no safety benefit is gained by tracking SP and SF system unavailability during surveillance testing. South Texas Project effectively monitors system performance using existing performance criteria.

l In addition, South Texas Project believes that this is not an issue with respect to optimizing availability and reliability for SSCs based on NUMARC 93-01, which states, "This optimization could be achieved by any of the following...", then provides a list of five recommended approaches to balancing availability and reliability. For most risk significant systems, South l

Texas Project uses all five of the recommended techniques. Ilowever for SP and SF, South Texas Project believes the plant level and reliability performance criteria effectively monitors system health because unavailability performance criteria does not provide a meaningful measure of performance.

ewpwnneapww9a