ML20133M232
Text
s m eu31A;Es j
/'- M
.. 34 ' I
[
- g NIJCLEAR REGULATORY COMMISSIOF' .
WASHINGTON, D. C. 20555
- f. r~
.s - ~ ~ . . : . ".. . u .s- J*M
. -** ~~ ~ ~~'J
%,,, eg/
4....
March 28, 1979 8 OPFICE OF THE ComeMisssONER Memorandum for Lee V. Gossick
_ Executive Director for Operations From: Richard T. Kennedy f['
Subject:
QUALITY ASSURANCE PROGRAMS FOR NUCLEAR POWER PLANTS Events related to the recent shutdown of five nuclear
. power plants for seismic-related concerns and the recent chain of events related to North Anna Unit 1 suggest that the quality assurance programs for nuclear power plants may require additional staff attention. In particular, errors associated with such a simple matter as the weight of a check valve raise doubts regarding the adequacy of such programs.
I would appreciate receiving staff's views on this subject, including any additional actions which staff may recomend.
cc: Chairman Hendrie Commissioner Gilinsky Commissioner Bradford Commissioner Ahearne S. Chilk, SECY A. Kenneke, OPE L. Bickwit, OGC L'
t 8508130052 850703 PDR FDIA yll "
HERRMAN85-301 PDR -
=*
b
.,. c. - g .-: .. . .- -
-+ ..;... . . %.em. . u ..
b
. . ..> n ..-. :. ; .
..~*..... -. - - . . ..
- :. . . : . ., ,,). .
o a,'. :
~
...rL.'.
c.. . _;;;
. ~-
.. ,;. " G. ,. .. ' ,.,*.' .V. n .) -, . . * :). . . .~,;. ' ";;; ' .' .
- ... a .., .,:
- 9.,.r. y ;- g.. .. ..s._ . . v:
~
.. . 4 .3 ~=~
,.; ;, . '.. . . :. . . -py'.~,.. ., l ovild:ng.14ency/rost) , .
- .. .. 7.-y
.c. .. ~. '......m ; ;u . v
. ~'
Richard T. Kennedy
% . z r.m..y. mV
- 3. ..-
. . :.,. .n. .
.-,. :. c - .
y.
-;5
- m. ' :- -c..::v. 2. . -
.a
.-9 -o :-c
^
cc: V. Gi1insky -
L
. ~.
p u ._ ., ...-k.:.
- p. ,
+ ,... -. -- --
P. Bradford .
e.tN?.!
J4'Jfg '.
.: r 3 ~r... .y .
- 3. .J. Ahearne - . Y.V .e.c;; i . . . .
.* / 5 . . w W , .... ~ '
J. Hendrie _
w".',p.i.s c
L. Gossick g,,.e +: .;g;g;.
4.
'O ' . ..'J ce: ..j. .'v. . y .. .. w~ i.
.a .
y a : -y:;f:
. 4 u . . . ..-
..~.,,.'...,a~t;....-
.a g,'
$ 7,9,9 I
.c*Jon Fife Note and Return
- . . . ,. 2 .... ' ;; ,
..s.- <
gi-d
? ' # Ed - :..
Approval For Clearance Fcr Convers tion Q -j' ~.h
- yJ'il.,. .' s
l '* dN.I84 As Requested For Correction Prepare Repfy
.m-, , ' . .-r' .*'.f +'~-
- ". m see Me
' '- a ,-. , '
- . y. . . :.R._ . . . ; -
Circulate For Your Information m ~
- .. ~ . y.-
-.r -
.. .x' Comment InvestiEate. . s.ignature
. ' . ,'f'g' ./.4,*? - [.-#, : Coordination Justify .
't Q. ..h . .
,7;) ,.. i C . ?.. ..c..Q' REMARKS . . , r';,
7- d.
p-: . . 'f q
-7.- ;. ,
. c.: -.v,i-.a xc.. 9.i:,,., .
.w.,c .. - .
.-~* ' - . ~ 7 ?}. _-
I'.N,... .f,.D... -S.N.kb. ;; .~. L:\ . N*;L.,
~
nclosed are responses, as complete as are pos-
- h. ,'. .<.9
?"-
.y, _ . e . -y%.. , . .
. .c.' 4. . . ~,, w..
c*
sible m. thin the deadline specified.,to the s . . .
Z,M?.W .;pf.py'
cMg $yj. '"~
w G ,. 5Le . 4 -
1.<.m 7 W. .
M; March 14,1979 Kennedy to Denton memo and
- _. M>;W.T 4 ,
- r.
4..W questions 5, 6,j and 7 of the March 14, 1979 ,
+4< :.7 :
s w( fM' memo from S. Chilk to L. Gossick.
- -x..?_s.
b5 4 m.w
- -f LG..
g..-hM . f,-=M 1:i;
,. ;..g %-
~ - - ~
C "V.fr.v.
- 7.h $
w.kn% MG cs i
.b. , :k~NM h'h.a,7dk. ,,
- h. h,.'*.d
. $w m?. *- . ...
- < _ z.. %,w.,9p-.
.o..;u.u p. ..:-. ,. n: ,s.t.;.a.g;;. ~ .
, c.
u,.
- o. m. . . .
. .. ..... . w.= + - ,e_, ..g,, ;
y== :g.*w; y.e . ;
a
- a,, g's.
- c,.* . . ,;-:-ip'.c.~.;*
w' .N
..-l:. - '
- . ., y .w .w r;a
.a .,
1~ .,
.-.- . , ,b*= A
. -- 7 *.Z *;q * ' 'W 00 NoT use this form as a RECORD of approvals. concurrences, disposals .. @? ..
. . e-g,.;;
. tT : *E E *L.P. 4 .:
g,.;h ~
clearances. and,similar actions
~'
$esh ,.s h.. - h.:r N.u g bk<
FROM:(Name, org sy Ag c /P t) " - Room No.-Blds.' g: % w[ $.
-g. P-428
. .s. .-
- d. a-xcess. .s/ggc.
.n*.* -
.u-r.e Qf.
..sg
-a., s.g ai Haro en -
Phone No. r
-" . 49-27691 h. .
'W.hsy.3F$$r.lh:yJ."
dN4.E'/ Urk' N %,^
5041-1o2 OFTioNAl. FORM 41 (Rev. 7-76) k. ^ -.
.8 # U.S. G.P.O.1977-241-530/3090 M M W CSA * .-'
r -;=;ps
..%;7--:s, 'd.
- ~ VJ M..- $ thy [Q* M*is j"'
pf . % e. - . . . T.: -
rratR H1 CfRJ 101-11.206 A .=.d:% h' -sp.
- ,) %'.' -Q(~
2, . *: C
.'" . . -M v . .ar n .MMMd we TSMWWM64fM8%% "-
memn ~
M.
& n d L tk%%%>%+i$@#R6 R&
M u i5 % % 2 B &
$# w%WJ
~
duestion SpecificallyShatwasreviewedandonwhatbasiswasit approved in the CP/0L reviews of these five plants?
Answer The safety analysis reports for these plants, as amended, formed the basis for staff conclusions on their licensability. The .
material that was provided in the SARs for the structures, systems and i
~
components for these plants consisted of a general description of the dynamicanalysismethods,theload[whichwerecombined,theallowable '
stress and deformation limits applicable to the combined loads, the structural damping values used in the dynamic analyses and representative results'of the analyses. .
l The reviewers measured the seismic designs in these safety analysis reports j against staff positions contained in a " Reactor Technology Memorandum "
I f wa: cus+m q<k M fu rfrs % .4.~.4',sahnne.va:. ,
developed about 1968.p TMs-memoran_dum;and others--l-ike=it, wc. c trar.smitted
- to individual applicants in the course of specific case reviews to inform them of acceptable methods of complying with regulatory requirements.
The Reactor Technology Memorandum on seismic design requirements contained detailed guidance on acceptable load combination methodology, stress limits, defonnation limits and damping values. It did not treat the subject of intramod 1 response combinations and thus contained no guidance on acceptable methods of combination. Generally accepted engineering practice at that time was the so-called SRSS methodology which is acceptable ;
p.'. Je g . '
under today's requirements. This i..for ation has subsequently been further
developed and incorporat'ed into Regulatory Guides, Standard Review Plans and the ASME Boiler and Pressure Vessel Code.
The staff position at the time of licensing of the 5 plants was that a dynamic analysis be performed for all structures, systems and components bded for plah safety?< Acceptable analysis methods were widely avail-able and understood well before these plants were licensed. The staff i did not question applicants on their dynamic analysis methods to the depth or in the detail that would have been necessary to reveal the problem that has now been found for these five- plantsf ke architectural q'~ engineering finns employed qualified dynamic analysts anI-the staff---
.~. . _ _ _ _
.. accepted-that-technically-correct--theory-was-ttsed--irrwrii.ing the-dypgmic analysis-computer programs.
O
Question:(.,;,ecifically what was reviewed and on what basis was it approved in the CP/0L reviews of these five plants?
Answer: The material that was reviewed for the structures, systems and compone.its for these plants consisted of a general description of the dynamic analysis methods, the load combinations used, the allowable -
stress and defomation limits applicable to the load combinations, ,
the structural damping values used in the dynamic analyses and representative results of the analyses.
The reviewers measured the seismic designs in these safety analysis
),
reports against specific staff positions contained in a " Reactor Technology Memorandum." This memorandum and otherslike it, were c.~ . -w
- a. .. a v . a - w w transmitted to applicantsIo infom them of thd most acceptable method
^ l c.v, ofcomplyingwitpthe_GeneralDmignCriteria.,
dt.p L-1 q (Q,y x J The Reactor Technology Memorandum on seismic design requirements contained detailed guidance on acceptable load combination methodology, stress limits, defomation limits and damping values. This infomation hv % h tepe.auA has subsequently beenuincorporated into Regulatory Guides, Standard Review Plans and the ASME Boiler and Pressure ' Vessel Code.
The staff position was that a dynamic analysis be perfomed for all structures, systems and components needed for plant safety. Accept-able analysis' methods were widely available and understood well before these plants were licensed. The staff did not question applicants on
- j .
- ~
3
..their dynamic analysis r.ethods to the depth that would have been necessary to reveal the problem that has surfaced on these five plants.
The architectural engineering finns employed qualified dynamic analysts and the staff accepted that technically correct theory was used in writing the dynamic analysis computer programs.
In the early years, 1963 to 1967, no particular procedure was specified by the staff for combining the seismic responses due to horizontal and vertical earthquake components. The most co= mon method of combining the effects due to multi-component earthquakes was the use of the " square-root-of-the-sum-of-squares" procedure.
The method was used till 1971. During the period from 1971 to 1973, a more conservative procedure, requiring use of the sum of the abso-lute values of the largest horizontal and vertical co ponents became the accepted method for response combination.
Recent studies indicate that the design spectra defined previously have an equal probability of occurrence in any horizontal direction, and the records show that earthquake motions occur in all three directions simultaneously, without consistent relations among the .
motions in the various directions. Hence, since November 1972, the staff has required that three components of earthquake motion (two horizontal and one vertical) should be considered in the seismic analysis by taking the square root of the sum of the squares of the maximum responses of each of the three components.
O e
9 e
r i i CHRON0 LOGY l
ST Pipe Stress Analysis Issue i i
Note: This chronology epresents information available to the NRC as l of March 15, 1979. It does not necessarily fully or accurately ~l reflect the actual sequence of events which occurred prior to the !
March 8, 1979 meeting.
10/26/78 Prompt report LER 78-053/0lP to NRC Region I via telecon from Duquesne Light Company. Report said that hand calculation errors resulted in stress levels ab.ove ANSIB 31.1, 1967 but only in one case of six flow paths. -
10/27/78 Daily Report by Region I to 18E headquarters included as a reportable occurrence - inadequate piping supports during review of safety injection pipe stress analysis by the A/E (S&W), several points on the 6-inch and smaller piping were found to be inadequately supported. In the event of safety injection system operation during a DBE, 5 points could exceed the code allowable stress. A design change for safety injection piping supports will be accomplished prior to unit startup in mid-November.
The unit has been shutdown since July 28, 1978
- for replacement of a failed main transfonner.
10/27/78 Written interim LER submitted by Duquesne Light Company. DLC reported the problem was not a design error.
10/31-11/3/78 IE Inspection 50-334/78 Region I followup on 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> report. Inspector raised a number of questions including: What assurance can be given to show that the calculational error applies only to the six points in question? To only the Safety Injection system? To only the Beaver Valley facility?
11/9/78 Second interim LER submitted by Duquesne Light Company indicates conditions reported on 10/26 were subsequently found to be acceptable.
. ?
o ll/lk-17/78 IE Inspection 50-334/78 Region I inspectors followup but no information available onsite.
11/16/78 Region I Daily Report indicated a rereview by A/E found that the previously reported condition was 'i erroneous and that no inadequately supported piping existed, a full report of the situation is being pre;arred by the A/E and a followup to the LER will be submitted by the Licensee to NRC. !
11/30/78 Followup calls to site by the IE inspector attempting to seek additional information.
12/01/78 Followup calls to site by the IE inspector attempting to seek additional information.
12/04/78 Followup calls to site by the IE inspector attempting to seek additional information.
12/05/78 Followup calls to site by the IE inspector attempting to seek additional information.
12/06/78 LER 78-53/0lT-0 was submitted to NRC by licensee.
Conclusion was that " corrective action has been '
! reviewed, approved and satisfactorily canpleted".
The report attributes the pipe overstress to diff-erences between stresses analyzed by PSTRESS code and those done by the chart method. IE mentions differences between PSTRESS and NUPIPE codes in force summation but does not elaborate on them.
It concludes that PSDRESS used methods acceptable for Beaver Valley Unit 1 generation plants. It states that Reg. Guide 1.92 issued in December I 1974 established for facilities docketed after April'1975 more conservative techniques for intra-modal combinations of generalized loadings. The report states that analysis showed that only one safety injection systen pipe required modification -
the addition of one snubber and the redesign of one support. The attachment to this LER provided (
additional historical information as follows. ,.
P e
3 9
. i
, -_- = -- - .__ . - . . _ . - . . - _ . .-. . _ .
l t
I j
Duquesne Light Company reported in an attachment to the December 6,1978 LER 78-53/0lT-0 that to !
generate data needed for installation of a net positive suction head modification to the Beaver i, Valley Unit 1 safety injection system, they (Stone '
and Webster) decided to " code in" the six inch SI lines into a currently used computer program (NUPIPE). DLC indicated original design used the PSTRESS code. No results of an analysis at this stage were reported by OLC to NRC.
Subsequent to the above activity the attachment states the Beaver Valley Power Station was notified by ,
a vendor that check valves in SI system were actually heavier than used in design at construction stage.
This increased weight was used as input to the above NUPIPE model and found not to "' affect" the piping design. The Architect Engineer (Stone and '
Webster) also concluded that the hanger designs need not be changed as a result of using the correct (heavier) weight for these valves. However errors were said to have been discovered in the hand calcu- :
lation method. It was determined that piping analysis showed local overstress at several anchors but no overstress in "the pipe" alone.
I Per attachment to LER 78-53/01T-0, a more thorough evaluation was initiated to determine if "any other f -
annulus piping" originally designed by the chart (hand calculation) method was overstressed.
Per attachment to LER 78-53/0lT-0, licensee found that SI lines had been "as-built" reviewed in 1974 and that two of the six lines had been (at that time) coded into PSTRESS (not just hand calculation method).
The PSTRESS code was re-run using the correct value weights and resulted in acceptable pipe stresses.
Also per attachment to LER-78-53/0lT-0, licensee acknowledges that PSTRESS and NUPIPE are different with NUPIPE being more conservative but a'sserts PSTRESS methods were accepted for Beaver Valley 1 and is the basis for all computerized Category I pipe stress analyses performed.
o
l
/
i (It is NRC understanding that results were unsatisfac-- f on two of three lines, but snubber and support modifications on one line reduced the overstress -
on the second line such that no modifications on that line were necessary.)
The pre December 6,1978 review of annulus seismic piping was limited to lines that had been previously analyzed using the hand calculation method (2-1/2 inch to 6 inch lines). 103 lines were identified, 55 were reviewed and found acceptable. Licensee noted that PSTRESS results were still available for 48 of the 103 lines from the 1974 as built
' - review and were " acceptable".
Licensee notes its-Engineering Department is "continuf ;
a review of the architect-engineer findings".
12/1/78 Followup calls to site by the IE inspector to seek additional information.
Region I IE inspector telephoned NRR Licensing Projec-Manager to obtain a contact for informal discussion c#
technical questions.
12/12/78 Region I Daily Report - Further review of in-containren:
SI system piping supports identified one line requiri.n; support modification, attributed to an error in original design calculations.
12/14/78 Regional inspector was telephoned by NRR individual who was designated as contact. Preliminary technical discu,ssion was held about potential problems.
12/18-20/78 IE Inspection 50-334/78 Region I followup on 12/6 LER. During this inspection, the inspector reviewed the detailed report submitted to the licenses by A/E and discussed the results of that review with representatives of the licensee and A/E.
12/22/78 Region I inspector discussed with NRR individuals via telephone questions he had as a result of discussions he had with S&W on 12/18-20/78. The NRC individual s involved determined that there was a possible probler.
e t
1/18/79 Menorandum mailed to IE Headquarters requesting that information be forwarded to NRR for review.
The memo defined concerns to include:
- 1. Reconciliation of the differing analysis results to assure that the design methods used are neither incorrect nor unconservative.
- 2. The need for further licensee review of piping potentially affected by any incorrect or nonconservative calculation.
1/23/79 The IE Inspector provided copy of the 01/18/79 memorandum to Licensing Project Manager.
About ~
2/2/79 Discussion between IE inspector and NRR project manager determined that a formal transfer had not been made of the 01/18/79 memorandum to NRR.
2/2/79 A formal request for DOR's Engineering Branch support (TAC form) was prepared by the project manager.
2/5/79 IE inspector was informed by IE:HQ that telephone discussion had established that NRR was working on the problem and that a fonnal transmittal would be made.
3/1/79 During a conference call to DLC and S&W, a computer run was requested for D0R review. Since S&W corporate policy was not to provide such runs, a meeting was set up for S&W to bring in a computer run for D0R review at Bethesda.
3/8/79 A tec'hnical meeting was held between DLC, S&W, and the NRC staff to discuss and review the PIPESTRESS and NUPIPE codes. The NRC approached the review with the belief that the two codes were acceptable and that some modeling or input problem created the results in question. It was revealed that the PIPESTRESS code used an algebraic summation of seismic loads which in the absence of a detailed time history analysis, gave unconservative results in the seismic stresses. Management was immediately informed and a managenent level meeting arranged with DLC and S&W.
/
3/8/79 A management level meeting was held with DLC and S&W te arrange for immediate review of the Beaver Valley pipe stress analyses. Commitments were requested of ,
S&W to identify the systems and plants involved, the inadequacies expected and the reanalysis to confirm safe operation. No definitive infomation was available at that time.
3/9/79 Numerous staff meetings were held at Bethesda to scope the problem, quantify the effects if a seismic event were to occur. Telecons were made to S&W on the schedule of commitments for further infomation on Beaver Valley. The utilities were notified.
The Chairman was advised. Three staff members were sent to Boston to provide immediate review and analysis of results. DLC sent eight people to Boston to assist in expediting the' review.
3/10/79 Daily Report - Part 21 report from Duquesne Light Company advising that seismic analysis of outside recirculation spray pump was invalid in that actual mounting is different from analyzed. A new analysis is in progress. Procedures for pipe hanger calculatiors are also being re-examined, with no conclusions drawn yet.
3/10/79 Staff meetings continued as pieces of information were fed back from Boston. The I&E Duty Officers were advised of actions. The NSSS vendors for the plants were contacted to assure no other codes for pipe stress during that period used the same algebraic approach. A DDR Assistant Director was sent to Boston to provide management review and oversight.
S&W's computer was dedicated full time to these stress calculations and extended work hours for data reduction was instituted for S&W staff. NRC options were explored and draft materials developed to support appropriate action based on the technical results becoming available on Beaver Valley.
N
4
/
- 7- !
3/11/79 Early S&W reanalysis results on Beaver Valley runs !
indicated problems with pipes as well (originally J thought only supports). Licensees' top management :
was contacted to assure action underway by all l plants to identify inadequacies and obtain reanalyses i of stresses in all affected safety systems. ;
3/12/79 Additional information from D0R staff in Boston confirmed pipe stresses abo te allowable and unaccept- [
abl e. j In view of the safety significance of this matter as discussed above, the Director of the Office of :
Nuclear Reactor Regulation has concluded that the '
public health and safety requires that the present suspension of operation of the facility should be !
continued: (1) until such time as the piping systens ;
for all safety systems have been reanalyzed for earthquake events to demonstrate conformance with ;
General Design Criterion No. 2 using a piping analysis computer code which does not contain the error discussed above, and (2) if such reanalysis indicates that there are components which deviate from applicable ASME Code requirements, until such deviations are rectified.
Arrangements were then made to brief the Commission on this matter. All the licensees were notified of the Director's decision.
3/13/79 The Commission was briefed and concurred in the NRR Director's decision.
3/14/79 The Ticensees confirmed by telecon that the Orders were received and provided times when each facility would be in cold shutdown. All facilities will be at or below 200'F by 10:40 p.m. on March 15, 1979 in conformance with the Order.
Subsequently all affected licensees were notified by telephone that the Orders were executed and that a copy would be transmitted by facsimile.
'.' l 2
Questions:
- 6. This particular matter should be carefully reviewed to determine potential generic irplications for the treatment of seismic loadings in other plant designs;
- 8. A review of the circumstances through which the problem, its nature, and its origin were made known to the staff, and the implications ,
for future technical review procedures of these circumstances.
l Response: ,
Questions 6 and 8 are similar in nature; therefore a single response ggy is mrorided which includes discussion of the following:
e v \
- 1. review and investigation of the Stone and Webster pipe stress problems;
- 2. planned followup actions to determine potential generic implications s
of the problem; ,
0
- 3. current review and inspection practices; and l
- 4. future actions.
L
- 1. view andInvestigation of the Stone and Webster Spe8 tress oblem.
An investigation will be conducted by I&E to determine the pertinent facts associated with the methods used by Stone and Hebster to calculate stresses on safety-related piping and piping supports in the event of an eathquake at the Beaver Valley plant. This investigation will ,
I
1 investigation will be coordinated with inspection of Duquesne Light Company's activities regarding this problem as well as the ongoing NRR review of the detailed technical data.
p g g g _The pup' ose of the investigation is to determine:
F
- l. How the improper calculational technique came to be used;
- 2. When and how the error was detected;
- 3. What was done to identify and correct all of the erroneous
- effects; and
- 4. Whether 10 CFR 21 was involved.
W As a part of the investigation the following specific points or
[ questions will be addressed.
- 1. Develop a chronology of each method used in analysing pipe stresses For each method describe its specific uses and use limitations. For each change in methodology describe what motivated it the change.
Determine on what facilities and specific systems each method was used. specifically include subroutines such as the SHOCK sub-routines of PSTRESS. Also include hand calculation and/or use of charts or tables.
- 2. For Beaver Valley what specifically precipitated a review of pipe stresses? When was the first recalculation done? What method was used? Did the results identiff a method problem? How was it handled?
I
+
e
- . .s )
- - 3-l
- 3. When did anyone in S&W first know that PSTRESS contained erroneous stress summation? How was the error detected? What actions were taken (and when) to assess the effect on analyses already done? Who (including organizational level) knew of these problems?
- 4. DeterminewhatStoneandWebstersystem(s) exist (s)toinvestigate the generic implications of any deficiency or error which is identified.
Consider both for an active individual plant and for a plant which has passed through the stage where the deficiency or error is encountered.
- 5. Confirm that the five plants identified as potentially effected are in fact all that are effected.
- 2. Planned N110wup NRCdctions to Metermine fotential [genericfmplications of_tleyrob.lem.
l ... .
The staff is also preparing an Information Bulletin to the industry informing them of the problem and requesting them to review selected aspects of the methods they used to calculated stresses in safety-related piping during seismic events.
The results of the Stone & Webster investigation,b the Information Bulleti and respon t will be reviewed to determine (1) whether detailed investigations at other Architect Engineering and Nuclear Steam Suppliers are indicated and (2) the scope and extent of such investigations.
. . . . . . . . . . . . . ...__..____e_
.e e e. e .O e . e . .
.Oe g
. .~ 7 e
4-The results of all investigations performed in connection with this matter will be reviewed to determine whether NRC technical review and inspections techniques and strategies should be reviewed and revised based on the information obtained.
- 2. C a ent % : e ara rns pec h 9 a ces.
L
~
' St# Neb of dhei y ass <<%ceT%me
~
The NPC Staff reviews and evaluates the description of the quality assurance (QA) program for the design and construction phases in each application for a construction permit (CP), a manufacturing license, or a standardized design approval in accordance with applicable portions of Standard Review Plan Section 17.1 The applicant (and its principal contractors such as the NSSS vendor, A/E, constructor and construction manager) must establish a QA program for the design and construction phases in accordance with Appendix B ,
to 10 CFR Part 50, " Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants." The applicant's QA program (including its principal contractors) must describe in the PSAR or SSAR how each criterion of Appendix B will be met. The acceptance criteria used by the staff to evaluate this QA program as listed in the following eighteen subsections. The acceptance criteria include a conmitment to comply with the regulatory positions stated in specified Regulatory Guides of industry standards including the requirements of ANSI Standard N45.2.12.
Thus, the commitment constitutes an integral part of the QA program description and requirements. Exceptions and alternatives to these acceptance criteria may be adopted by applicants provided adequate l
justification is given; the staff review allows for consideraable flexibility in defining methods and controls while still satisfying pertinent regulations. When the QA program description meets the applicable acceptance criteria of this subsection or provides acceptable exceptions or alternatives, the program is considered to be in compliance
[
with pertinent NRC regulations.
. .. . ,? . .
e I
With regard to the acceptance criteria for Design Control the !
activities related to Design Control are acceptable if:
- i
( The secpe of the design control program includes design activities associated with the preparation and revle.t of design documents including the correct translation of ;
applicable regulatory require:ents and design bases into design, procurement and f procedural documents. Included in the scope are such activities as field design ,
engineering; physics, seismic, stress, thereal, hydraulic, radiation, and the !
SAR accident analyses; associated computer programs; compatibility of materials; accessibility for Inservice irspection, c.aintenance, and repair; and quality standards. j l
Organizational responsibilities are described for preparing, reviewing, approving, and verifying design docurents such as system descriptions, design input and cri-teria, design drawings, design analyses, co. puter progra-s, specifications, and a procedures. -
i Errors and deficiencies in approved design docc ents, including design methods
- (such as cocputer codes), that could adversely affect structures, systems, and components important to safety are documented; and action is taken to assure that all errors and deficiencies are corrected.
- I Deviations from specified quality standards are identified and procedures are
- cstablished to ensure their centrol.
Internal and external design interface controls, procedures, and ifnes of corauni-cation among participating design organizations and across technical disciplines are established and described for the review, approval, release, distribution, and revision of docu:ents involving desian interfaces.
( cuidelines or criteria are established and described for determining the method of design verification (design review, alternate calculations, or test).
l Procedures are established and described for design verification activities which assure the following:
- a. The verifier is qualified and is not directly responsible for the design (i.e., neither the perforeser or his irrediate supervisor). In exceptional circumstances, the designer's letediate supervisor can perform the verifica-tion provided:
(1) The supervisor is the only technically qualified Individual.
(2) The need is individually documented and approved in advance by the super-visor's ranagerent.
(3) QA audits cover frequency and ef fectiveness of use of supervisors as design serifiers to guard against abuse.
.. _j
. . _ _ . _ . _ _ . _ _ _ . _ _ . . . . - 1 ._ . ..i
. b. Design verification, if other than by qualification testirg of a pictotype or s
lead production unit, is cc pleted prior to release for procurer..ent, nanu-
/
facturing, con.struction or to ar.other organization for use in other design activities. In those cases where this timing cannot be ret, the design seri-fication may be deferred, providing that the justification for this action is documented and the unverified portion of the design output document and all design output docu ents, based on the unverified data, are appropriately identified and controlled. Construction site activities associated with a design or design change should not proceed without verification past the point where the installation would beco e irreversible (i.e., require extensive demolition and re.ork). In all cases, the design verification should be cc.mplete prior to fuel load for a plant under construction, or in the case of an operating plant, prior to relying upon the corponent, system, or structure to perform its function. .
- c. Procedural control is established for design docueents that reflect the com- {
mitments of the SAR; this control differentiat" between documents that receive formal design verification by interdisciplinary or multi-organizational teams and those which can be revie-ed by a sggle individual (a sigr.ature and date is acceptable documentation for personnel certification). Design docu::.cnts subject to procedural control include, but are not limited to, specifications, calculations, co puter programs, system descriptions, SAR when used as a design docu ent, and drawings including flow diagrams, piping and instrument diagrams, control logic diagrams, electrical single line diagrams, structural systems for zajor facilities, site arrang2 cents, and equipcent locations.
Specialized reviess should be used when uniqueness or special design considerations warrant.
- d. The responsibilities of the verifier, the areas and features to be verified, the pertinent considerations to be verified, and the extent of documentation are identified in procedures.
~
The following provisions are included if the verification method is only by test:
- a. Procedures provide criteria that specify when verification should be by test.
- b. Prototype, component or feature testing is performed as early as possible prior to installation of plant equipment, or prior to the point when the ,
installation would beco=e irreversible.
- c. Verification by test is performed under conditions that simulate the most-adverse design conditions as determined by analysis.
Procedures are established to assure that verified computer codes are certified for
- use and that their use is specified.
Design and specification changes, including fields changes, are subject to the same design controls that were applicable to the original design.
The description of the design control provisions satisfies the criteria of Regulatory .
{* Cuide_1,64.
. ..'y -h-With iegard to these' acceptance criteria, the staff has taken steps to clarify this Standard Review Plan section as to controls that apply to the development and use of computer codes. The specific changes to the acceptance criteria listed above are indicated below: ,.
The scope of the design control program includes design
, activities associated with the preparation and review of design documents including the correct translation
~
of applicable regulator,y' requirements and design bases ,
into design, procurement and procedural documents.
Included in the scope are such Ectivities as field design engineering; physics, seismic, stress, thermal, hydraulic, ,
'~
radiation, and the SAR accident analyses; associated computer programs; compatibility of materials; accessibility for inservice inspection, maintenance, arid repair; and quality standards. ,
h 4 Organizational, responsibilities are described for preparing, reviewing, approving, and verifying design documents such as system descriptions, design input and criteria, design drawings, design analyses, _ computer programs, specifications, and procedures.
f 3h L
Errors and deficiencies in approved design documents, including design methods (such as computer codes) that could adversely
- l
. .+ . :) . .
I affect structu'es, systems, and components idportant
~
to safety; are documented; and action is tahen to assure that all errors and deficiencies are corrected.
[fd Procedures are established and described for design
./ verification. activities which assure the following: -
- c. Procedural control-i,s established for design docu-ments that reflect the commitments of the SAR; this control differentiates between documents that receiv formal design verification by interdisciplinary or multi-organizational t'eams and th'ose which can be reviewed by a single individual (a signature and date is acceptab Design .
documentation for personnel certification).
documents subject to procedural control include, but are not limited to, specifications, calculations,coinputer_
programs, system descriptions, SAR when used as a des document, and drawh,ngs including flow diagrams, piping and instrument diagrams, control logic diagrams, electric single line diagrams, structural systems .for major facilities, site arrangements, and equipment locations.
Specialized reviews should be used when uniqueness or special design considerations warrant.
Procedures are established to assure that verified comput d
codes are certified for use and that their use is specified. .
i l
- hr @ h d Oi y O/- N CykiC D a%ysth M b k OW1A '
a -
The staff review at the Construction permit sta'ge of'the nathods e
of anclysis for seisnic Category I components includes a review of the descriptions of all computer programs which will be used in !
the analyses. The acceptance criteria utilized by the staff for this review are provided in Standard Review Plan Section 3.9.1. They j are follows:
i A list of corputer prograis that will, be used in dynamic and static analyses to determine the structural and functional integrity of seismic Category I Code and non-Code items and the ar,alyses to determine ~ stresses shall be provided, including a brief description of each prcgram and the extent of its application. The design j control measures, as required by Appendix B of 10 CFR Part 50, that will be employed {
to demonstrate the applicability and validity of these computer programs should meet one of the following criteria:
- a. The corrputer prograi is recognized and widely used, with a sufficient history of successful use to justify its applicability and validity without further !
demonstration by the applicant. The dated program version that will be used, the software or operating system, and the hardware configuration r.ust be .
specified to be accepted by virtue of its history of use.
I
- b. The corputer progran solutions to a series of test problems with accepted results have been demonstrated to be substantially identical to those obtained by a similar progra.1 which ceets the criteria of (a) above. The test problems j shall be dec.onstrated to be similar to or within the range of applicability {
for the problems analyzed by the cortputer program to justify acceptance of the ;
program.
+
- c. The program solutions to a series of test problems are substantially identical y to those obtained by hand calculations or from accepted emperimental f ests or
~ '
analytical results published in technical literature. The test problems shall ~
be demonstrated to te similar to the problems analyzed to justify acceptance of the program. ,
t A summary comparison of the results obtained from the use of each coriputer program ,
under options (b) or (c) above with either the results derived from a similar program meeting option (a), or a previously approved coeputer program, or results ;
from the test problems of option (c) shall be provided. They should include repre- j sentative comparisons of resp:nses due to static and/or dynamic loading, preferably ;
in graphical form. -
i h "- '
ll 9
~
o f ('
, .) -
l :
1 The specific review procedures described in Standard Review Plan i Section 3.9.1 used in applying these acceptance criteria are ,
as follows: f
'F '
The information pertaining to cceputer programs which is presented in the applicant's 5AR is reviewed as fo11 css: l
- a. The IIst of programs is e.aluated to determine that the applicant has ade- ;
quately described each pregram with respect to the type of analysis that is 6 perfortred and the specific corper.ents to which the program is applied.
- b. The design control ceasures, which are required by 10 CFR Part 50, Appendix B, are reviewed for each program. The procedures outlined in subsection II.2.a. l t b, or c must be cet for each program. Verification by the applicant that he has met the require:ents of at least one of the above paragraphs is acceptable. !
i i'
- c. The sunary cocparison of the results obtained from the use of each prograe which is not recognized and widely used (See subsection II.2) with either the results derived from a sicilar recognized and widely used program, a previously I approved corputer prograi, or results from test problems is reviewed and -
cvaluated. Numerir:1 results so derived should compare favorably enough to provide confidence in the validity of the program.
Any deviations that have not been justified to the satisfaction of the staff are identified and the finding is transmitted to the applicant with a request that, unless conformance with the F.EB acceptance criteria is agreed upon, additional technical justification be submitted.
I
> - l 2-e Inspectir,n_ P_ractices Vendor Inspections The determination that vendors are properly implementing their quality assurance procedures is the responsibility of IE. The Region IV office of IE has the responsibility of performing the vendor inspection program. Thisprogramisdesignedto_(1) provide assurance that the' vendors are properly implementing their quality assurance procedures, and (2) determine if the vendor quality l l
assurance procedures properly implement the requirements and commit- j l
ments of their approved quality assurance program.
Code Quality. Control Inspections. !
It was the purpose of the vendor inspections performed for this s
task to provide an assessment of not only items (1) and (2) l above, but of the following as well (with regard to thermal- j 1
hydraulic code development)-
- 1) Are the design control procedures being appropriately ,
i interpreted for code development?
l
- 2) Were previously discovered errors the result of deft-i ciencies in the Quality Assurance procedures and could they have been avoided with better procedures?
- 3) . Are there any critical areas in the code development i I
process in which procedures presently do not exist and are needed? -
l
(
. 1 m3-I Scope Of Inspection _
The vendor quality controls are applicable to computer code development in ger.eral, and not to any one particular type of computer code, f *? L . . c ., .. uv.muused L., J.u ,
fr " in the Division o om G N y , f!PC . .. a schet only to those codes thin the branch's cogni7 e, namel thermal-hydrau transient and ECCS s cy analysis odes.
The codes ,nspected at each orga 'mation are lis d in Table 3.1. n addition to inspe ng code files, le staff examine
. ample project calc etional files at me vendor organiz. cions.
Also examined re the causes of me previously repor' >d code errors. ese are listed in able 3.2. A detaile discussion o_ ~ ^ ~. .. ;;c k QuuJ L Ge trip reports or appendia ,^ . _ .
(;
e e
. , Future Actions
. There gre several staff actions ongoing or planned that are related to the general topic of design code verification. One, the clarification of the Standard Review Plan in the area of Quality Assurance requirements related to Design Control as it applies to computer code was discussed above.
Other actions include the initiation of a program by the Office of Nuclear Regulatory Research to provide assistance to the HRR staff in the evaluation and verification of various structural computer programs presently used in the design of nuclear piping systems and components. !
NRR transmitted a user request to RES on January 5,1979 which requests assistance in the following areas: (1) Development of Benchmark
! solutions for piping structures (2) Evaluation of the application .
of solutions to Benchmark problems and, (3) Related Technical consulting services.
This request has been initiated to provide the NRR staff with an independent confirmatory capability to evaluate or verify claims made by applicants with respect to the quality and capability of these computer programs.
..:. -lO~
,2
- In a separate action, the staff recently undertook a review of the nucledr industry quality assurance controls for computer code development and use. A draft report prepared by the Analysis Branch, DSS, NRR documents the results of this review. The review focuses prinarily on thermal-hydraulic safety analysis computer codes. The review was limited to the four major Nuclear Steam Supply System (NSSS) vendors and one reioad fuel supplier. While the review did not include other types of computer codes (e.g., stress analysis) the cor.clusions reached are considered generally applicable to all aspects of NSSS vendor and fuel reload supplier safety analysis code development and control The applicability of tfie conclusions to other types of safety analysis code users in the nuclear industry (e.g., architect engineers and applicant) is not established in this report.
1 -
Etport Need Sumary Conclusion A'
L j
, . . . _ . . . - . . _ _ - . - y _. ,