ML20217H355

Quality Assurance on Design Certification Testing Programs, Presented at Apr 1997 5th Intl Meeting on Nuclear Thermal Hydraulics,Operation & Safety in Beijing,China

ML20217H355
Person / Time
Issue date:	04/30/1997
From:	Levin A NRC
To:
References
NUDOCS 9804290350
Download: ML20217H355 (6)

Text

, ,

5th International Meeting on Nuclear Thermal Hydraulics, Operation & Safety Beijing, China, April 1997 QUALITY ASSURANCE ON DESIGN CERTIFICATION TESTING PROGRAMS Alan E. Levia U.S. Nuclear Regulatory ca===mi==iam Washington, D.C. 20555 j Phoes. (301)415-2890 Fax: (301)415-3577 {

E-mail: AELONRC. GOV  !

ABSTRACT the QA programs b;'--- ^:3 by the vendors and their contractors for design certificaham testing; the As part of its review of desaga certificebos testang evalustaans included a series of on-site inapections, to progresas for abe AP600 and the Samplified Boahng ascertaan whether abooe programs met i+14cny Water na=ceae (SBWR), the U. S. Nuclear * ; ' - -y i --; establiebed by the NRC. 'Ibe QA reviews Cm=====a= (NRC) randucead QA inspectaoms of the were complicated significantly by the fact that many of vendors' major test facabanes, both in the U.S. and the test programs for both plant designs were conducted overases, to deserumme if the testang programas were by orgmanana== outande of the United States. "Ihe being conducted is accordance with a QA program that compbcations included simple logistics (e.g.,

satisfied the NRC's raparessants, as described in Tide anter==e-1 travel, language, etc.), and issues related 10 of the Code of Federal *:; ' ^%, Part 50 (10 to the vanations in QA requim s,e =*==dards, and CFR 50), Appendix B. N NRC's expensoces is practices in other countries. This paper discuanes the assemeng QA ' ,' ^ = on abe AP600 and SBWR NRC's QA i:;i - ^1 the taeans by which those test programas are miswed. Both positive and negative requirements were addressed by the vendors and aspects of the QA psogramas of the vandars and their contractors, and tamanna learned by both the NRC and partmars or contractors are covered, as well as tan =ama the vendors dunng the review, learned by both the vendors and the NRC.

a% go, gA > ; ---  % is future test l

U.S. NRC QA REQUIREMENTS  ;

pragmas are also w .  !

N NRC's regulations include specific  !

INTRODUCTION rapuremsats for QA programs manaciated with nuclear power plant designs and related *=cli=ical activities.

"Ibo U.S. Nuclear

• 7' ^ -y C- (NRC) is M basic requiressants are enmannaad in Part 50.34 of miswing W- ^f - _'s ,," ="h= to have its 10 CFR, and a maore complete discussion of those advanced passive plant design, the AP600, certified  ;- ;- - ^- is in 10 CFR 50, Appendix B, ' Quality under Part 52 of Title 10 of the Code of Federal Assurance Critens for Nuclear Power Plants and Fuel Baguietname (10 CFR 52). A significant aspect of the Reprocessing Plants," which addresses 18 criteria review involves an ovat==ana= of W ^ -f - 's testang (pic,r - ' activities) that amat be covered by an psogram for the AP600. la additaos, betwesa 1991 and -= , " QA program As imiplied by the title of the 1996, the NRC conducted a maalar review of General Appendix, the general attributes of = ,:-W QA Elecenc's (GE's) test psogramas as part of the recently. programs are discumand without identifying specific QA canceled dreign certificateca mesw of the Samplified programas or standards that unset those attributes.

Bonhag Water Reactor (SBWR). However, the NRC also issues Regulatory Guides, which provide examples of how lic====== (or apphcants ,

A significant issus lhet asons during the misw . for hosesse) can satisfy NRC r.c'M Regulatory g )

process for both of thsee programs was that of quality Guide (RG) 1.28, ' Quality Assurance Program assurance (QA). Specifically, the NRC staff evaluated Requirements (Design and Construction)," discusses ,

.y nn 9804290350 970430 MISC QS-1 T)i O 5

PDR 9804290350 PDR

, e andustry QA standards that satisfy Appendix B conducted for the SBWR in Italy, Switzerland, and requanuments, and speci5cally endorses the Amencan Japan, and for the AP600, in Italy. While most National Standards lastitute and American Society of organizations outside the U.S. had QA programs that Mhc=I Engineers Nuclear Quality Assurance conformed essentially to the NQA-1 standard, it was Standard ANS!/ASME NQA-t-1983. still naca==ry to evaluate thana programs to determine if they satis 6ed the provisions of Appendix B.

Westmghouse and GE have filed topacal reports with the NRC describing their overall QA programs, QA INSPECTIONS PERFORMED AND OVERALL wiuch cover a broad range of activities. bee reports RESULTS describe how the vendor meets the requirements of 10 CFR 50, Appendar B, generally by reference to one or 'the NRC staff began QA inspections of passive more accepted sadustry standards, such as ANSI /ASME plant test programs in the summer of 1993, and NQA-1. At =anc===ively greater levels of detail, coecluded them in early 1996. Every major reactor and i ;'--- ^ ; pv =" w have also been developed that cant =>a-8 safety system thermal-bydraulic test i translate the overall QA program into specific program was reviewed for both the AP600 and SBWR requiremesets related to the vanous activities conducted (see Refs.1-4 for descriptacas of the design certification under the program la addition, development of the test programs and overall NRC evaluations of those AP600 and SBWR designs were partaally supported by prograses). Table I is an example of some of the the U.S. I' , ^ ^ of Emergy (DOE). Accordingly, documentation reviewed by the NRC in a typical testieg in their contracts with DOE, both GE and Westinghouse QA inspection. h results of the inspections are comsmatted to sment the requiresssets of NQA-1 for those summarized, for the AP606, in the Draft Safety activities requiring QA ";' ^% 'Ihese QA Evalustaan Report issued by the NRC. Although the cossmatments were also generally extended by GE and design certincation application for the SBWR has been Westanghouse to cover contractors or partner withdrawn by GE, results of the SBWR QA inspections ors ====*==, both withis and outande the U.S. are cone =naal in individual inspection reports issued to GE, and are also discua=ad in the NRC staff's N NRC's QA i==paca- were structured to evaluatson of GE's SBWR Test and Analysis Program a===== test program controls, conduct, and Description (TAPD) report (Ref. 5).

dac====amana= is a nuesbar of key areas, including test facility design, scalang, and construction; procuressent h design certification rule, as detailed in Part and speci6cahoes; inste====*=sia= calibrahan and data 52.47 of 10 CFR, requires applicants for certification of 5 "^b; test matrix developeset and emperinnental passive plant designs to be able to demonstrate (a) ca=hace data collectaan, processing, conversson, and =e-; ?' perfonnance of the passive safety systems, reportang; and overall records retentaos procedures and and (b) that their safety analysis codes are validated practaces. N NRC staff used abs Jac====ameia= over a sufficiently broad database Both vendors psovided by the vendor and/or its contractor to caaducent exploratory test programs that are best deterumme the degree to whack the test program anst the described as "fundamesetal" research related to the basic ,

QA regnaresasets establashed in the overall QA program design and characteristics of passive safety systems. i!

and in the d=*=al-t , ' - - <- pv-: ' . It is Data fross these programs were used to help determane  !

l important to note that the NRC's baass for evalustag the design of more complex test facilities, for instance, QA, in gameral, are the critana contained in 10 CFR but were not used directly in the design or analysis of j 50, Appendia B. However, when specific comaniements the plant itself. hee types of basic programs were are made by the vendors, through the overall QA not included in the NRC's QA inspections However,  ;:

progress or is i-;'- ^% procedures, those test programs that were deter =ua=1 by the NRC to have ',

comasatamata also hana- part of the evalustaan basis. been perfonned to satisfy requirements in 10 CFR {

Thus, the QA i== pace- had two c-- ;'-- y 52.47, i.e., to demonstrate the performance of a passive goals: to establish whether the v==dars' testang-rat a-I safety system or to help validate a code used for safety QA programes as designed seat Appendix B analysis, were deemed to require fonnal QA ,

regiassommets, and to desenmaae if the test programa implementation to satisfy 10 CFR 50, Appendix B ll dac====*=*=a= ro6ected proper executson of the requirements in order to have assurance with respect to [

vandars' own detailed QA i=f- ^ ^6 procedures. the integrity and validity of test results that would The first of abase goals was especially important in ultimately be used in a licensing decision.

evalustang the test programs of the vendors' non-U.S. ,

camaractors or inter ==taa==l partners Testag was

[

QS-2

, =

The NRC's exponences in performing the QA was withdrawn, GE helped to implement a formal QA maspections were somewhat mixed. In general, QA program under which additional testing was performed.

perfonmance was ' ; ' ^ on a number of factors, A follow-up QA inspection by the NRC determined that including the experience, nature, and locataan (i.e., in the program as implemented by GE and its partner was or outade of the U.S.) of the o, . 4-% perfonning accapaahle, and that the data from the later tests were the testing; specificataans in contracts between the therefore acceptable for use in the design certification vandar and testang organaansaan (where appbcable); danahame.

requiremsats is other testang-related dacu==as, such as test specifications; and recognition by the vendor that OBSERVATIONS AND LESSONS LEARNED QA oversight was required for a particular activity. In some cases, the testang ors ==nna a= bad sufficient Over the course of the QA inspections, the NRC unternal QA controls, pr-- 'm, and exponence such staff observed several different approaches to test that ===al dired oversight by the vendor was ==adad program QA, some of which were =ucca=ful, and some la other instances, however, the vendors were required that ==caumaared significant difficulties. This section a====a ally to assues direct . ,

• Sy for QA outlines the benefits of establialung fonnal QA

^M As an estasple of the former SIET ovenught, and some of the pittalls encountered in QA LaImoratones, in Pancensa, lealy, conducted testing for 1 -f - -% in the design certificataos test programs.

both the AP600 and the SBWR. SIET has a

-- ; ' "ve QA program ha==d on the internataonal A fonnal QA program does not guarantee that a test 15 0-9001 standard. SIET auguesated this program to program will run smoothly, or that there will be no meet the NQA-1 requiremmets of GE and problems with the facility, instruments, data, and so W"f :- SIET's program was inspected and forth. Test facility hardware, matts-ants, and data found to satanfy the r ;- - of the NRC's 10 CFR acquisition systems can malfunction or fail regardless of 50, Appendix B for the testing programs. On the other whether they have a QA pedigree, and human errors head, organi=a- that wwe more =cada==c or can occur even with detailed written procedures for research. homed had little expensace is developing and every step of a testas program. What proper QA saa "f- <=- dessem certificataan testang QA programs, do, however, is help establish a logical, well-and the va-dars assussed much anose active roles in dacu===aad promes for design, constructica, and oversseeng QA ';'-- ^6 for those test pengrams, operataan of a test facility, and for data acquisition, psocessing, and analysis. Indarand aa reviews are j However, even when the vendors th==aalves were required throughout the vanous phases of a test  :!

, " for QA M '--

N, the a=aca== were program, which aid in discovering and correcting errors  !

somewhat uneven. NRC inspectors found immanca= in and y,s's before testing begins. When pd,.'c.c ; do whach both W ^ - f __ and GE appasually failed to occur during testing, QA ig'-- ^=% can help to follow their own established QA p--- '- _, which ensure that they are .,,, y,,s.tdy docu= anted, and that uhi==aaly resulted in findaags requanag corrective proper corrective actacas are formulated, approved, and acean=. Sosas of theos issues will be danc====d is the --f - - - 4 QA also helps to maintaan a complete anat secteos. written record of a test program, wiuch is an essential elemsat that facilitates use of the test data in plant Although ahmost all of the QA i==paca- os design and analysis. While these pros r--- ^6 AP600 and SBWR testang resuked in findaags of non- as a= can be accomplished without a formal QA comformances, the vendors (or their contractors) were, program, the esistence of such a program and its in unost cases, able to satsadactarily address the i=-;'-4 g procedures help to focus the matamana= of 7, deficasacasa. la the came of the SBWR, though, GE testing i d. on those ele ==ts and increase the  ! i elected, prior to = __ ' ^4 of the NRC's inspection, to probability of a successful outcome.

withdrew the data freen one test prograan from the design certificaama= database because of an inability to The NRC staff discovered unstances in which documsat the enastance of any formaal QA oversight for fonnal QA procedures were overlooked, ignored, or that progress. This test psogress was conducted by one circumvented, neuking in problems in use of the data of GE's internataanal partmars is the SBWR for .lesign certification-related purposes. Specific developeset program, and the lack of QA examples include:

i' - % was apparently due, at least in part, to

--aaaa= betwena the two ca=p==nas It is worth notang that, after the data fross the early testang QS-3 l

1. For one test program, the NRC was unable to find geometnes, and some critical dimensional aspects where as4udt drawings of the led facility, wiuch was a tolerances would be important.

regeressant in the QA procedures of the testing orgn==a==. la a= =====g ^- , i code val-I=ena=

la contrast to the above abortcomungs in testag QA, activities that used duas frams this program, the NRC the NRC staN also found many inaa==cas of proper QA deterssised that the facility da- had not been i-( ~^ ^%, wiuch contributed substantially to use properly ..,- ' in the imput parasseters to the of the test data. Specific examples include:

code. N errors included elevations of a passive safety ispection system operating by gravity-drain, which had a 1. Documentation on test facility design for one direct impact on the results of the aanlyses. While the particular integral systems facility was found to be NRC could not estabbeh an explicit laakage between the complete and relatively easy to follow, Design lack of as4uait drawings and the coding errors, it seems calculataons were ' ' ;- " y verified using a l likely shet, had 'ae4udes* beam avadahie, the errors different method than that used by the original designer.

could have been more emaily discovered and corrected. This provided confidence in the facility design.

2. la ==anhar test program, the pnamary obpective was 2. ladividual propect engineers for the vendors took the to acquire data on she ebenmal4ydraulac r - ',.

• of initiative in ===*=i==g extensive design record files a passive asisty synessa. A =na=dary obpective was to (DRFs). la one case, the project engineer had included test the p'n,.-- = of a prototype instrumsat proposed in the DRP memorands documenting every meeting that for use in that systema. The testang organiastaon's QA had been held to discuss the design of the test facility program requered the developssant of fonmal test and the test program. This made it particularly easy to p= " for each at=====a of the test program; track the evolution of the facility design and testing however, while i=- ' m were wnsen for the philosophy, selection of instrumentation, development thenmal-bydraulac esses, nome were developed for the of the test matrix, etc.

instnumsat tests. AAer she program was completed, the

- ^'-

NRC i==p=cenas teams leerend that the group . 3. A contractor testing organization ===8=>aad an on-for eval ==*== of the instrummet's p'- m had not site instrument calibrataan shop, with cr:f:", easily base consulted in developing the east g= '- _, and, reinovable calibrataca records for virtually all in fact, would have liked addiaia==I dass fross the instrumments used in its test programs. This, again, insenameset under ca= diana == differmet from tha=a provides a high level of confidence in the facility established for abs therssel4ydraubc test. Had this instr ==arismaion and the test data. j group eenb ca=== land and test procedures generased l

specifically for testing the prototype instnamnet, the One final observation is worthwhile with regard to j psogami could have amore complessly fulfilled its dual QA i=-;'--- '% both good and poor. A key '

06pectives. (This wee not cited as a non-confonmence element in QA is .v. - .

Testing programs as l by the NRC, since wnesso p--: ' - __ were in place for complex as those perfonmed for passive plant design I the teses.) certification involve y different arramiraeu==

darecdy ==dar the control of the vendors, as well as ,

3. la a third test progress, aAer e ,' ^% of the ousade contractors. Good QA it -- ^% was  !

fonaal test g= '- _ , several tests were continued always E-:-:- g --" by good ca===aication between sofonamily to observe how the syssess would respond the vanous groups involved, while poor QA almost whom conditacas wese changed The additional test always was a result of a breakdown in co====> cation.

---- ' _ and data acqiuantaan were not well-Contractors were not always made aware of the dae=ae==aad, and the senn was unshie to ascertaan the vendors' QA requirements la some cases, guadance intent of the "extsaded' teses. Although the systess was provided that was incomplete; in other cases, little behavior was of ==han=a=1 interest, the qinality of the or no gwdence was provided. The NRC found one does was c- , ' ' thraingh indere to fully nestance in wiuch a vandar sent a letter to its documsat the addaana==l t est ;--- '- = with respect to en=aractors requestang confirmation that the contractors' ,

aspens such as initial condataans and system QA programs met the intent of NQA-1, but apparently j

-i N chmages made dunag the test. never followed up to ensure that these requir====aa were, in fact, satisfied--or to provide suggestsons for 4 la some of the test programs, == ^y in or lack remmedial action if a contractor's program did not meet of as4mda test facility reconis en=aribused to expectations. Even within an organization, uncertaastaes about the actual test configurahans, coaunuaication was sometimes inadequate. In one QS-4

estance, the NRC found that individual project provided valuable co=====r= and insights. & author angemsers took the instantive is developing QA-related also thanks Dr. G. Donald McPherson, of the Division psonedures, such as for ahtaamanF as-budt facility of Systems Safety and Analysis, for his review of the

-a, but that other propect engmeers withis paper.

the same orgn====taa= were unaware of the emissance of such p+:-- - L and did not i==pl=====# them at all. REFERENCES

SUMMARY

AND CONCLUSIONS 1. E. J. Piplica, et al., 'N Westinghouse AP600 Test Program - Moving Toward Commercializataca of the As part of its review of the design certi6cahon Next Generataos of Advanced Reactors," Proc. ASME

,,"d= for the AP600 and the SBWR, the U.S. Joint Int. Power Conference (1991).

NRC has perfonned a series o(QA inspectaans on the denen osetinceham test programs performed by and for 2. A. S. Rao, et al., ' Safety Research for the SBWR,'

she passive plant vendose. Akhough a ammber of Proc. 20th Wasa, n_.o e.r-,y u :..,-

h in QA ' - , ' - '= were documssmead by NUREG/CP-0126 (1993).

the NRC is its inspection esports, most of the danceamcase were found to be capable of correcteos, 3. 'DraA Safety Evaluatson Report Relased to the and, with one exceptaos, the test programs were 'Certincahon of the AP600 Design,' USNRC Report, doesnmined to be +-- f " with regard to quality DrmA NUREG-1512 (1994); and Supplement 1 (1996).

assurance.

4. "Evalustaan of the General Electne Company's h NRC is also ruviewing the testang prograses on (GE's) Test Program so Support Design Certincahon technical beams, to detonaise whosher the they ful6tl the for the Simplified Boiling Water Reactor (SBWR),"

requerements established for passive plant testing U.S. Nuclear Regulatory Commission SECY-92-339 programas in 10 CFR 52.47. Associated with the teshag (1992).

review is an evaluntaos of the validahos of the analytical cad == used for safety analyses for these 5. *SBWR Test and Analysis Program Description, pismes. It aboedd be noted that, while the QA Rev. C,' General ELetric Nuclear Energy Report f  % can anect the stafra eval ==aia= of the NEDC-32391 (1995).

dass from a techmecal senadpoemt, += , "- QA should t

not be ' ^ , ' as a determannanos that the testang 6. A. E. Levin, ' Review of Passive Plant Design programas have achieved theirn ach=ac=1 objectives. & Certificahon Test Programs: Results and I m==a==

staffs *=ch=ac=8 review of the test prograans is discussed Laarmed," NUTHOS-5 paper Q4 (1997).

is a esperase paper (Ref. 6).

h Ap600 and, useilits recent withdrawal, the l SSWR, wese the nest passive plant damages to be

[

c====d===d by the NRC moder 10 CFR 52. Is its s review of the design certincehas sessang programs, and is ev=hastaa= of QA ' ,'  % on those programs, the NRC staff has gained vahashie exponence that will comenhues to fueme design certific=ana= testing reviews.

la particular, appsopnese QA program development and 4

,- w will be - ,w as an essenhal part of the establishasset of desage certificaham testing {+

p% rams.

ACKNOWLEDGEMENTS 4

The ==shar woenid like to express his apprecanhos to seveal ="g_ at the NRC. Mr. Rahert Gramum and Mr. Juan Peralta, of the Quality Assurance and Maassamance Branch, and Mr. Richard Mclatyre, of the I Special '- , e = Branch, reviewed this paper and QS-5

Table I Documsstahon Reviewed During Testing QA Inspection TantFacahty Test Analysis

1. Design specinceham and drawings. 1. Drawing (s) of computer code input model and 3 As-built facility and n - ' drawings. correspondence of input data to facility

3. Compilation of as-built facility nii-=== and physical parameters masennis, with appropnate thennophysical 2. C-: , -i of cosaputer code analyses to test propsetime. data, including lac =*= of facility instruments

4. Senhas aaniysis of as-bak f cibey, showing io be companus to analytical n.ulis and

m. , - ' = to test specincetica. w. , ' ; code calent=8-1

5. Complete nastr====a tia= apacincation and modes /volusses.

instruenset list as i== nata =d. 3. Detenmanhos of orror h=ad=/uncertaanhes, l

6. Instnuamatataca drawings, showing lac = hoes cc- " +;=g both experimental data and code and types of instrummets. uncertamties.

7. Data =- ; ' 'N system desenpanos.

8. Process and control systems instr ==a=*=ta and Overall speci5cahoes, including =ce-a= canditions for si==Imaad anfety systeams. 1. Daman=eration that test program as conducted complies with requirenunts of vendor's and Test Pronram DOE's quality assurance and quality control programs. i-

1. Detaded test program plan, including cold and hot p , ^ -- ' testag and test sentrix.

2. Dotaded test procedmes, including loop char *a=#, ==*=h===* of initial conditions, and transient sunulataan.

3. Insta====*=a- cabbrabou procedmes.

4. Data acqmmhan procedmes.

5. Data redachos, analysis, and handling pr-: '

Tant Ramuks and Data

1. Madaws/c =d ==1 test data, including facahey characten=a= (e.g., pressure drop vs.

Aow, heat losses, steady state heat bat = aces, etc.).

2. Cahbraham recosds and traceability for instrensets

3. List of insanaments recorded for each test.

4. Timehas of events for each test, e.g.,

==*=hhah===a of initial condetsons, I

wahh h===e of ===1=aad accident, ac ==e e .

of passive safety systems, etc.

5. Smaples of raw instmaset data. F

6. Samples of converted (engineenag units) data.

7. Data plots for each test.

8. Deter ===*== of error bands /uncera=ine== in test data, including insinuaset and DAS errors. \L Qs.6