ML20209D930

Discusses Encl LER 86-039-00 Re Nuclear Data,Inc Computer Software Deficiency.Condition Reportable Per Part 21,per 870402 Discussion.Data General,Inc Will Notify Affected Licensees.Issuance of Info Notice Unnecessary

ML20209D930
Person / Time
Site:	Callaway
Issue date:	04/24/1987
From:	Liza Cunningham Office of Nuclear Reactor Regulation
To:	Ault M CANBERRA NUCLEAR (FORMERLY NUCLEAR DATA, INC.)
References
REF-PT21-87 IEIN-85-052, IEIN-85-52, NUDOCS 8704290391
Download: ML20209D930 (2)

Text

D 4 'o,, UNITED STATES 8' g NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20665 O. E

? ,

% , , , , , #g APRg i 1907 Mr. Michael Ault Technical Manager Nuclear Power Division Nuclear Data Incorporated 2734 S. Cobb Indiana Boulevard Smyrna, Georgia 30080

Dear Mr. Ault:

The Nuclear Regulatory Commission has received a nuclear power reactor (Callaway) licensee event report (LER) that describes a computer software deficiency relating to control of radioactive liquid releases. The software package, " Waste Editor Program" (WEP), is supplied by your company (ND) and is run on the ND 6685 computer. As stated in detail in the enclosed copy of the LER, in some instances the WEP calculated non-conservative values for the alarm / isolation setpoint function required by the facility's technical speci-fications. This isolation function automatically terminates the liquid release when the calculated alarm level is reached. These setpoints values were non-conservative (too high) by approximately three orders of magnitude. The Callaway plant's review of the affected releases showed no actual abnomal levels of radioactivity were released and no regulatory requirements were violated as a result of the software defect.

As Mr. Wigginton of my Branch discussed with you on April 2,1987, computer code deficiences that could cause or lead to a major reduction in the degree of protection provided to the public is reportable under 10 CFR Part 21 (for clarification, see enclosed IE Information Notice, IN 85-52). After discussions with the licensee and a review of the events and circumstances at Callaway plant, we believe the WEP problem was reportable under 10 CFR Part 21. From our review of a ND memorandum (Kujawa - Scheckel, March 13,1987) which clarifies ND's customer problem notification policy, we understand that your company will notify all affected NRC licensees when a product problem such as WEP deficiency arises.

One of the responsibilities of my Branch is to identify and help resolve generic industry problems. When appropriate, this responsibility also includes notify-ing industry. We would appreciate a copy of the end-user notification, written sumary of corrective actions, and a list of all affected HRC licensees. In cases such as this, when vendor's problem resolution is reasonable and thorough, we typically do not issue an information notice to industry, thus avoiding dupli-cation of efforts.

H 7 0 4 2 Y 0 7) 9 1 0704P4 I' UR ADOCK 03000403

$ VUH

Mr. Michael Ault APR2 41987 Ifyouhaveanyquestionsaboutthismatter,pleasecontactme(301)492-4734 or James Wigginton (301) 492-4663.

Sincerely.

l LeMoine J. Cunningham, Acting Chief Radiation Protection Branch Radiation Protection and Emergency Preparedness Division

Enclosure:

As stated cc: R. E. Kujawa, Nuclear Data DISTR b i b PDR Central Files DRPEP File RPB File JRosenthal, AE00 RStarostecki EMerschoff CGill, Rill RGreger, Rlli FCongel LCunningham DMatthews RBarrett JWigginton Olynch I

l 7

RPD:DRPEP*

• 9 ,DRPEP JWigginton:mec LdCdgingham 4/ g /87 4/gtf/87

• See previous concurrence

l

=

Casaway Aant n January 14, 1987 1

U. S. Nuclear Regulatory Commission Docunant Control Desk Washington, DC 20555 ULNRC-1431 Y

s Gentlement DOCKET NL7BER 50-483 I CALLAWAY PLANT UNIT 1 FACILITY OPERATING LICENSE NPF-30 LICENSEE EVENT REPORT 86-039-00 ACTION STATEMENT NOT ENTERED WHEN LESS CONSERVATIVE RADIATION MONITOR SETPOINT CALCULATED DUE TO COMPUTER SOFTUARE ERROR f

The enclosed Licensee Event Report is submitted pursuant to 10 CFR 50.73(a)(2)(1) concerning a f ailure to enter Action Statement (a) i for Technical Specification 3.3.3.9, Radioactive Liquid Effluent Monitoring instrunentation, when a less conservative alarm / trip setpoict was calculated for Fadiation Monitor H3-RE-18 due to computer software error.

i h

G. L. Randolph

Manager, Callaway Plant I S/S dre Enclosure cct Distribution attached i

j k* **~

epa,

_ m mwww

e es#C p e MS U S 81UCL5 M meoutafo47 Consa.em,OM APPe0vt3 0 e Is0 39e6490s LICENSEE EVENT REPORT (LER) ' "'"

• 8' 8t =

OOCElf peWaaggt us .agg f y, f&COLITY 884 G ill Callaway Plant Unit 1 __

ol5logojol3lgl3 i joplg g virtt i accton statement act c.nterea wnen Less Lonservative naurat wa Monitor Setpoint Calculated Due to Computer Software Error tyssef 0478 tes Lee asuesten 444 AGPont OATS 179 OTMtm f ACitlTitt Isevotyto ses

.eg ia. e. e 04v H A9 NW WH NU MMU WO4?M 04v vtan vtan , ews$ womtm 015lologo; ; i

~ ~

1l0 1 !9 8 6 8!6 O!3 l 9 0l0 0 l1 1l4 8!7 .. , m.

0 1 5 ioioioi l i e... .. ., . .ue .n t o .v u.., ,o . .. .. v. .. t . o, ,. C . i ,C, . .,

=** i n .=m n ... . ,..a l. .

n. ..

w .mui

.m _

. n la. .. _

n.,, ..

7,,.,, . 0 9n . ..mm = =i. a. . ni.,a, .

_ o; ..g ,g,..;

n . m .. . n,.ia . . nwa,. .. .,

_ 2 _

m .sei.imi . ee nwaii w nwaii iei M .IStellili.9 99,3mimlin, te fl..itallel Lect 8e848 C04f ACT FOR TMIS 48 A 1986 44w8 Titt#MO%tNowete Ronald R. Roselius - Superintendent. Health Physics aata Coot 31114 617 1 61-1 8111211 Cowstn o=e ting non tac = Cowo e=, enitual oene. .o m vais aseoat ein, Cault tvittw C0we0%t%f "Qgl'4 "$'O .'a N ' CAule tvsttw C0wPONt 8ef "($g'O '

"k'O ' N8 1 I I I I I I I I I I I l t i l I I I I I I I I I I l l SUPPtta.44f AL AGP0mt S n*0 CTto 11 6 WON t es 04, vtae

-] vto tie, . autene svew,wo, e4n,

-] =0 l l l

.mi .C , , s . , w w ... . , ,,, . , . . . . , ii .,

On 12/15/86, a utility Health Physicist discovered that a liquid radioactive release from Discharge Monitor Tank 'B' on 10/19/86 at 2304 CDT to 10/20/86 at 0521 CDT. was performed with the Liquid Radwaste Discharge Monitor. HB-RE-18, set at a trip setpoint less conservative than that required by Technical Specification (T/S) 3.3.3.9.

Accordingly, Action Statement (a) of this T/S was not met. Upon subsequent review, it was discovered that 7 similar events have occurred since initial criticality (10/2/84). The plant was in Mede 1 - Power Operation at 98% power at the time of discovery.

A Health Physics Nuclear Data. Inc. ND6685 computer software deficiency (Waste Editor Progran [WEP)) caused the non-gamma enitter value to be sunmed with the ganma emitters resulting in a less conservative setpoint calculation.

Technicians were instructed to check non-gamma emitter designators on permits and in the interim, a procedure was revised. A',1 liquid release pernits were reviewed. Software has been temporarily modified and the WEP will be permanently revised to permit editing non-gamma emitters.

Technicians will receive additionni training.

l There was no threat to the health and safety of the public. Actual post release data shows that T/S limits were not exceeded. Sampling and analysis, release calculations, permit approvals, and discharge line valving were performed ,in accordance with approved procedures.

esetC ,eean mea U S seuCttaa at1Utf.10Av (Desesissio% :

,' "" LICENSEE EVENT REPORT (LEZ) TEXT CONTINUATION ....ov o ove o 3 o.oio.

IJIP'#ts tr31 m

,aCitity asaast sie ooCmai s.ue.sta en L8 A seuteetR its s #aos 13 oaa '" 5.R." V.W Callaway Plant Unit 1 o l5 lo j o l o 14 I 813 d6 --

Ol3l9 --

n10 0l2 0' 0 l6 ;

rixtw . w mic, ma.nin l

l This LER covers eight similar reportable events. The events are I summarized in Table 1. Evaluation of Post-Release Data.

Plant conditions at the time of each event are summarized in Table 2 Plant Conditions at Time of Events.

Description and Innediate Corrective Actions Event Eight referenced in Table 1 was discovered ~on 12/15/86 at 1310 CST by a utility nonlicensed Health Physicist while obtaining data from liquid release permits for reasons unrelated to this event. The plant was in Mode 1 - Power Operation at 98% Reactor Power at the time of discovery. Tha tritium (H-3) concentration was erroneously used in the sum of g Monityg)ggyaemitterstocalculatetheLiquidRadwasteDischarge HB-RE-18, alarm / trip setpoint for a Discharge Monitor Tank (DMT) 'B' release perforned on 10/19/86 at 2304 CDT to 10/20/86 at 0521 CDT. The calculated setpoint, 2.81 E-2 uCi/m1, was less conservative than the correct Technical Specification (T/S) setpoint of 2.9E-5 uCi/mi and therefore, the requirements of T/S 3.3.3.9, Radioactive Liquid Effluent Monitoring Instrumentation, Action (a) were not met.

In response to this event, utility personnel began an immediate investigation into the circunstances of Event Eight. They found that the Offsite Dose Calculation Manual (ODCM) and procedures governing sampling and analysis, release calculations, release permit generation andapproval,anddischargelinevalvinghadbeenpropt5)Y' "*d- ^

Health Physics (HP) Nuclear Data. Inc. ND6685 computer software error was suspected due to the fact that the non-gamma emitter designator for H-3 had not appeared on the permit printout. On 12/15/86, the on-shift HP technicians were instructed to ensure upon permit review that the non-gamma emitter designators were present. A thorough review of all liquid release permits generated at the Callaway Plant since initial criticality (10/2/94) was initiated. As a result of this review, it was discovered that a total of eight of the 1225 permite exhibited the name error. Extensive tenting and review of the computer software was ineediately initiated to determine the exact cause.

The post-release data in Table 1 shows that all releases were well within the linits of T/S 3.11.1.1, Liquid Effluents, and T/S 3.11.1.2, Done. Thin evaluation is based on actual grab sample analynis, actual start /stop times, dilution and waste flow rates, and discharge line valving. This data is documented in each release pernit package.

These events are being reported pursuant to 10 CFR $0.73(a)(2)(1) as operation prohibited by the plant's T/S's and are being submitted 30 days from the discovery date (12/1$/86) of Event Eight.

1 1

~

seeC fete atta U S 8eWCLEan REGULivon 7 Consanassion LICENSEE EVENT REPORT (LEZ) TEXT C^NTINUATIO] a ..ove2 ev ~o me.oio. ,

inPintS 0 31/88

.acitetv Isaast os oocult Nuessan age g g , ,,y,,,, , ,,, , ,,,,,3,

"** " t O ." "'X*.O {

Callaway Plant Unit 1 o l5 j o j o j o 1418 l 3 8l6 --

01319 --

Ol0 013 OF O l6 rarrw . w nwwe-muwon Root Cause The root cause was determined to be the use of the Nuclear Data, Inc.,

ND6685 computer's Waste Editor Program (WEP) to edit the H-3 concentration value. The software used to generate release permits allowed use of the WEP to correct any erroneous data. When used to edit a non-gamma emitter such as H-3, the non-gamma designator was removed and the value for H-3 would be summed with the gamma emittcrs resulting in a less conservative setpoint calculation. This deficiency was not described in the software operator's manual. The software vendor has been notified of this problem.

Correettve Actions and Actions Taken to Prevent Recurrence

1. On 12/17/86 and 12/31/86 during routine meetings, HP technicians were again instructed to ensure non-gamma emitter designators were present during their release permit reviews.

2. In the interim, HP technical procedure HTP-ZZ-02014. "LRW/GRW(

Release Permit Generation," was revised on 12/31/86 to require that the non-gamma emitter designators be checked on each liquid release permit and that the wasta editor not be used to edit a non-gamma emitter until the WEP in upgraded.

3. The review of all liquid release permits generated since 10/2/84 was completed on 1/6/87.

4. The computer software was extensively evaluated and tested to determine the cause of t'.;e problem. Testing was completed on 12/31/86. The sequence of programs used for release pernit generation was temporarily modified on 12/31/86 such that the WEP cannot be used to edit a non-gamma emitter. The WEP will be revised to permit editing a non-gamma emitter and setting the proper designators. The new software will also produce a report showing designator status and if a value has been edited. Although the Nuclear Data, Inc. KD6685 computer sof tware was initially tested to verify calculation accuracies, this testing would not havn revealed the WEP edit problem.

5. Additional training will be developed and presented to the appropriate Rad / Chem personnel regarding the review of release pe rmit s .

.. ,1

=ac e ai asea v s muetssa asIutcroav co.wissic= l LICENSEE EVENT REPORT (LER) TEXT CENTINUATION a..novia aos =o vio . .

exaats e,n es Pacitety =aase ti, o0Castasuestsaav g g g g,yg,gg n gg, , ,ggg ,3, "a" "R'O" -

,'Ja'.D Callaway Plant Unit 1 o l5 lo joloI4la h aI6 -

01 , 1 9 -

oIo oi 4 o' 0 16 rant u - . % w mac w assawini Safety Significance These events posed no threat to the public health and safety. Sampling and analysis, relear.e calculations, permit approvals, and discharge line valving for all eight events were performed in accordance with approved procedures and the ODCM. Additionally. T/S limits were not exceeded during these events.

Previous occurrences cone <

Footnotes The system and conponent codes listed below for items 1, 2, and 3 are from IEEE Standards 805-1983 and 803A-1983, respectively.

(I System - IL, Component - MON System - WD, Component - TK

( } System - code not available Component - CPU LRW/GRW - Liquid Radioactive Waste / Gaseous Radioactive Waste i

8

8 e TABLE 1 O

3 -

8i .,

EVAltfATION OF POST-RE11ASE DATA

{j ,E 8? -

o Post Cumulat Ive Cumulative g g8 Dilu-o  %

y%j $1 Calcu- tion  %  %

Organ Limit Limit 2j= h 25' Event Tank No. Stop lated Correct g Limit Total 1.init Limit T/S 3. T/S 3.

$ $I g No. Permit No. Start Setpoint Setpoint Ratio T/S 3. Body T/S 3. T/S 3. Dose E** 11.1.1 Dose 11.1.2 11.1.2 (arem3 11.1.2 11.1.2 I

• (pct /ml) (pC1/ml) Annual

$ . [g 2 (2) (ares) Qtr. Armual Ctr.

(2) (23 (?) (2) l 1

Q {

2'

=

o

• I z e 2.99E-3 1.80E-4 1.14E-2 1.14 1.30E-7 2.4E-3 9.9E-4 1.80E-7 9.5E-4 3.4E-3 o .

CAL-85-L-303 TS1Jeff B 4/9/85 4/9/85 p a g 1 (1) 0001 CST 0135 CST 4

U m 6.28E-2 1.39E-5 1.62E-1 16.2 2.52E-6 5.4E-3 1.2E-2 2.52E-6 2.CE-3 3.9E-3 E E 2 CAL-85-L-381 SLWMT A 5/5/85 5/5/85

>=

I ~

(1) 0706 CUT 0910 CDT 44 2 o - 3.86E-7 ft.8E-3 1.CE-2 7/3d/85 7/30/85 2.90E-3 1.53E-5 1.27E-3 0.127 8.95E-8 5.2E-3 2.1E-2 F 5 E 3 CAL-85-L-479 DMT B X 0711 GT 1252 GT w

f? o 1.18E-6 3.1E-3 1.5E-3 1.18E-6 7.1E-3 1.1E-3 CAL-86-L-33 DMT A 7/7/86 2/7/86 2.84E-3 4.17E-5 2.68E-2 2.68 h *;

" [- 4 0750 CST 1401 CST

S 5

> 1.22E-3 4.46E-4 4.07E-4 4.07E-2 1.24E-8 3.IE-3 1.5E-3 8.36E-8 2.1E-3 1.

E CAL-86-L-34 DMT B 2/8/86 2/9/86 O 5

" 2122 CST 0010 CST w

K 1.22E-3 9.38E-7 2.68E-2 2.68 7.13E-8 1.9E-4 4.7E-3 2.38E-6 1.CE-2 6.1E-3 6 CAL-86-L-63 DMT A 4/7/86 4/7/86 g 0512 CST 0825 CST W g y

W 1.81E-3 1.65E-7 5.62E-2 5.62 8.18E-7 3.3E-4 4.?E-3 9.61E-7 1.0E-2 6.2E-3 W 7 CAL-86-L-68 DMT B 4/13/86 4/13/86 w c 88 z

R f 0045 CST 0352 CST 6.2cE-6 0.64 0.51

• c $ 5.75E-2 5.75 2.34E-6 1.6 1.2 5 '8i CAL-86-L-264 DMT B 10/19/86 10/20/86 2.81E-2 2.9E-5 A 2304 CUT 0521 CDT .c h

c (1) TSLWMT - Temporary Secondary Liquid Waste Monitor Tank

[ SLWMT- Secondary Liquid Waste Monitor Tank j ,

j g IEEE Standard 805-1983 System - WD IEEE Standard 803A-1983 Componcet - Ilt f

.s g

f I, 5 E(2) All values listed are shown in % of limit.

5 le .v -

. e asea va=ve6...aucron,co==imio-}

LICENSEE EVENT CEPORT (LER) TEXT C NTINUATION u..ovio o.. ~o 2,so 4 o.

tapiats 3,3tre pac Lovy esaastets oocuar = vanes. ele gen guesega gg, g , AGE E31 "aa "t!!!. "' t'.B Callaway Plant Unit 1 o l5 l0 lo j o l4 l8 l 3 8l6 -

Ol3l9 -

0l0 0 16 0F 0]6 ttxt ,,- . ,nac r ms..mn TABLE 2 PLANT CONDITIONS AT TIME OF EVENTS l

l l

Event No. Mode Other Conditions 1 Mode 4 - Hot Shutdown Reactor Coolant System ( } (RCS)

RCS Temperature - 268'F RCS Pressure - 390 psig Plant heat-up in progress .

i l

2 Mode 1 - Power Operation Normal operating temperature 75% Reactor Power and pressure 3 Mode 1 - 100% Reactor Power Normal operating temperature and pressure 4 Mode 1 - 100% Reactor Power Normal operating temperature and pressure 5 Mode 1 - 100% Reactor Power Normal operating temperature and pressure 6 Mode 5 - Cold Shutdown RCS Temperature - 177'F RCS Pressure - 379 psig Refuel I in progress 7 Mode 3 - Hot Standby RCS Temperature - 557'F RCS Pressure - 2144 psig Plant heat-up from Refuel I in progress 8 Mode 1 - 91" Reactor Power Normal operating temperature and pressure g IEEE Standard 805-1983 System - AB m .. e r.o.. .. . .

I)-) AAg raw SSINS W.: 6835 IN 85-52 UNITED STATES NUCLEAR REGULATORY COMMISSION OFFICE OF INSPECTION AND ENFORCEMENT WASHINGTON, D.C. 20555 July 10, 1985 IE INFORMATION NOTICE NO. 85-52: ERRORS IN DOSE ASSESSMENT COMPUTER CODES AND REPORTING REQUIREMENTS UNDER 10 CFR PART 21 Addressees:

All nuclear power reactor facilities holding an operating license (OL) or a construction permit (CP).

Purpose:

The purposes of this information notice are to alert licensees (1) of errors in a dose assessment computer code supplied by a vendor, and (2) that, in general, computer codes can be considered basic components under the requirements of Part 21, and errors that can lead to substantial radiation exposures would be considered reportable under 10 CFR 21. It is expected that recipients will review the information for applicability to their facilities and consider actions, if appropriate, to preclude a problem at their facilities. Licensees l are also encouraged to share this information with their vendors. However, suggestions contained in this information notice do not constitute NRC require- '

ments; therefore, no specific action or response is required.

Description of Circumstances:

The NRC staff recently evaluated an event.where errors were found in computer software supplied by Nuclear Data, Inc. (ND) for predicting offsite doses at San Onofre. Attachment 1 provides further details of the San Onofre event, including the cause and effect of the computer err.or. Although notification was made via INPO's electronic " notepad", this information was prepared to ensure that all potentially affected licens'ees are aware of the problem.

In the past, licensees and vendors appear to have been diligent in ~ reporting non-conservative errors in computer software used to perform design calcula-tions. However, NRC staff conversations with licensees in regard to the .

Sa, Onofre problem have indicated that some licensees believe, in general, that I errors in vendor supplied computer software used for offsite dose assessments are not reportable under 10 CFR 21. However, such errors may be reportable in some circumstances. This particular error was not reportable under 10 CFR Pa'rt 21 because the error led to substantially overestimating calculated offsite doses. However, if the error had been non-conservative and caused significant underestimation of offsite doses, then this could have (theoretically) led to 6

g

Attachment 1

'* IN 85-52 July 10, 1985 DESCRIPTION OF SAN 0.10FRE EVENT During a recent emergency preparedness exercise at San Onofre, NRC Region V personnel noted large differences between the results of the offsite dose calculations made by the licensee and the region. With the licensee and Region V using the same input parameters (radiological source ters and meteorological conditions), offsite doses calculated by the region were an order of magnitude less than the licensee's estimations. The NRC staff recognizes that there is no " standard code" for calculating offsite doses. Because of modeling assump-tions and complexities, large differences in resultant doses can exist when comparing two codes with both codes still correctly considered to be error-free.

However, when they examined their code for internal accuracy, the licensee noted the problems discussed below. -

The licensee found errors in the dose assessment computer programs, supplied by NO, used to estimate environmental doses for both routine operations and emergency operations. Coordinating with NO, the licensee corrected these errors and notified other licensees via INP0's electronic " notepad." The vendor-supplied computer program DISP (main program for calculating, atmospheric dispersion) had an inherent error,'which led to predicting less atmospheric dispersion (dilution) than the code should have calculated, hence leading to an overestimation of the effect of a radioactive gaseous release (by a factor of approximately 10 for emergency doses). '

During an emergency situation, overestimating or underestimating the dose due to code errors'could lead to potential confusion. During an emergency situa-j tion protective action decisionmaking would be based principally on plant conditions. However, dose projection calculations do influence such decisions.

Therefore, the calculations need to meet accuracy expectations to be useful.

Given the levels of real-time technical oversight and review by local govern-mental authorities and Federal agencies, including independent dose estima-tions, it is not likely that a protective actions decision by the local authorities would be based solely on the licensee dose projection.

Staff discussions with the San Onofre licensee and another licensee indicated that some licensees believe such software errors.are simply not reportable.

However, NRC staff maintains that such errors are reportable in some circum-stances as a mat,erial defect.

If errors result in substantially underestimating or overestimating offsite doses, it could possibly result in inappropriate protective actions. An error that substantially underpredicts offsite doses (non-conservative) would cer-tainly be reportable under 10 CFR 21. This underestimation could possibly cause a delay or deferral of a protective action which could clearly lead to the unnecessary exposure to a person in an unprotected area, thereby creating a

" substantial safety

• hazard." An error that substantially overpredicts (conser-vative) is not strictly reportable under 10 CFR 21, since it is very unlikely that such an overestimation could result in personnel radiation exposures exceeding the' referenced guidelines. However, given the potential non-radiological negative impact from unnecessary protective actions that could result from overly conservative dos.e estimates, licensees should continue to cooperate with vendors and share information concerning common problems with generic computer codes.

Staff guidance on the amount of radiation exposure that can be considered to represent a substantial safety hazard is provided in NUREG-0302 (Rev. 1) (see Attachment 2).

.