ML20199J559
| ML20199J559 | |
| Person / Time | |
|---|---|
| Site: | South Texas  |
| Issue date: | 11/21/1997 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV) |
| To: | |
| Shared Package | |
| ML20199J541 | List: |
| References | |
| 50-498-97-24, 50-499-97-24, EA-97-523, NUDOCS 9711280169 | |
| Download: ML20199J559 (48) | |
See also: IR 05000498/1997024
Text
,
.
'O
ENCLOSURE
U.S. NUCLEAR REGULATORY COMMISSION
REGION IV
Docket Nos.: 50 498: 50 499
License Nos.: NPF 76; NPF 80
Report No.: 50 498/97 24
50-499/97 24
EA No.: 97 523
Licensee: Houston Lighting & Power Company
Facility: South Texas Project Electric Generating Station, Units 1 and 2
Location: FM 521 - 8 miles west of Wadsworth
Wadsworth, Texas
Dates: September 15 through November 12,1997
- Team Leader: L. Smith, Senior Reactor inspector
Division of Reactor 3afety
inspectors: T. Alexion, Project Manager
D. Acker, Senior Project inspector
Division of Reactor Projects
P. Gage Senior Reactor inspector
- Division of Reactor Safety
W. Wagner, Senior Reactor Inspector
Division of Reactor Safety
. Approved Ry: Arthur T. HowellIll, Director
Division of Reactor Safety
ATTACHMENT: - Supplemental information
i
kl 9e
. - .- .
.
.
TABLE OF CONTENI.S
E X E C UTIV E S U M M A RY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iil
Ill . E ng ine er ing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
E2 Engineering Support of Facilities and Equipment .................. 1
E2.1 10 CFR 50.59 Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . 1
E3 Engineering Procedures and Documentation (37550) . . . . . . . . . . . . . . . 3
E3.1 Program for Control of Accuracy of Measuring and Test Equipment
Used in Surveillance Procedur es . . . . . . . . . . . . . . . . . . . . . . . . . 3
E3.2 Battery Service Surveillance Test Acceptance Criteria . . . . . . . . . 6
E7 Quality Assurance in Engineering Activities . . . . . . . . . . . . . . . . . . . . . . 7
E7.1 Control of Calculation Amendments . . . . . . . . . . . . . . . . . . . . . . 7
E7.2 Effect of Design and Licensing Dasis Changes on Calculations . . . 10
E7.3 Licensing basis Change Effects on the Updated Final Safety Analysis
Report (U F S A R) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
E7.4 Safety Evaluation Not Performed for Calculation Revision ..... 15
E8 Miscellaneous Engineering issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
E8.1 (Closed) Inspection Followup Item 50 498; 499/9009-01: review of
the licensee's self assessment and followup of the actions taken to
evaluste the apparent discrepancies in the setpoint program . . . . 16
E8.2 (Open) Unresolved item 50 498;.499/9716-01: Review of the safety
impact of the licensee's decision to defer the planned setpoint
program improvements and review of the overall calculation control
p r og r a m . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 0
E8.3 (Closed) Licensee Event Report 50-498; 499/97-06: Inappropriate
surveillance procedure monitoring parameters. .....,.......29
ii
-
.
.
.
EXECUTIVE SUMMARY
South Texas Project Electric Generating Station, Units 1 and 2-
NRC Inspection Report 50 498; 499/97 24
This team inspection evaluated the capability of the licensee's design engineering
organization to develop an analytical basis for the design of the f acility. This inspection
assessed control of the design and licensing basis, as well as, corrective actions for
previously identified weaknesses related to the development of scaling and setpoint
documents. The team reviewed electrical, mechanical and instrumentation and control
calculations to assess the scope of design control weaknesses. The team also reviewed
- 10 CFR 50.59 safety evaluations and 10 CFR 50.59 applicability screening evaluations.
The inspection covered a 5 week period with two of those weeks conducted onsite. .
The team found that the unreviewed safety question evaluations and screenings were
generally logical and of good quality. The team found that the licensee had not promptly
addressed self identified weaknesses related to the development of setpoint calculations.
In addition, the team identified calculation errors and associated apparent violations related
to design control, control of the licensing basis and corrective action. However, no
examples of inoperable equipment were identified. -The licensee initiated and planned
corrective actions for the program weaknesses identified by the team.
Engineering
- In general, the unreviewed safety question evaluations reviewed were
comprehensive and well researched. Of the screenings which the team reviewed,
none were found that required an unreviewed safety quest.on evaluation
(Section E2.1).
'
- Measuring and test equipment accuracy assumptions from the process
instrument uncertainty calculations were not being correctly translated into
the process instrument calibration procedures. This f ailure was identified as an
apparent violation of 10 CFR Part 50, Appendix B, Criterion lli (Section E3.1).
- Loads were being added and subtracted from the vital batteries without
documenting an evaluation of the impact of the changes on the battery service
surveillance test acceptance criteria. However, the team reviewed the critical
loading period and determined that the acceptance criteria was bounding
(Section E3.2).
- - Amendments to calculations were not being adequately controlled. Three
calculations had greater than 100 amendments. Eleven calculations had 15 to-
99 amendments and 62 calculations had 6 to 14 amendments. The failure to assure
that design changes were subject to design control measures commensurate with
l- . those applied to the original design was identified as an apparent violation of
-10 CFR Part 50, Appendix B, Criterion ill (Section E7.1).
L
iii
)
.
.
- Design basis calculations were not always consistent with the physical design of the
rfant. Calculations were not being systematically evaluated or revised, when their
associated design inputs were changed. The f ailure to assure that design changes
were subject to design control measures commensurate with those applied to the
original design was identified as an apparent violation of 10 CFR Part 50,
Appendix B, Criterion 111 (Section E7.2).
- The team identified two examples where the licensee did not accurately update the
Updated Final Safety Analysis Report (Section E7.3).
- Af ter discussions with the team, the licensee identified an example of a
programmatic weakness. Prior to the inspectio1, the licensee did not have a
procedural requirement to evaluate calculation changes for impact on the Updated
Final Safety Analysis Report. As a result, they failed to perform a safety evaluation
for changes in refueling watei storage tank volumes and uncertainty analysis
assumptions described in the Updated Final Safety Analysis Report. This failure was
identified as an apparent violation of 10 CFR 50.59 (Section E7.4).
- The licensee did not recognize that setpoint calculation deficiencies identified in
1992 and 1995 were conditions adverse to quality. As a result they did not take
Ofective corrective action until prompted by the NRC. This f ailure was identified as
ea Aparent violation of 10 CFR Part 50, Appendix B, Criterion XVI (Section E8.1).
- Dased on a sample review, the team concluded that the licensee's setpoint guidance
procedure was technically adequate. The team reviewed the basis for 20 setpoints,
which had been identified as potentially having no basis. The team determined that
3 of 20 setpoints still had a weak calculation basis. The team concluded that a
random sampling of existing safety-related plant process values indicated that
appropriate uncertainty calculations had not always been accomplished through the
end of 1996. The team selected 6 safety related process values from the Updated
Final Safety Analysis Report and found that calculations associated with
4 of 6 process values were incorrect and required revision. The unresolved item
related to the review of the safety impact of the licensee's decision to defer planned
setpoint program improvements was lef t open for additional review. The NRC plans
to evaluate the results of calculation revisions, performed to address team concerns,
which were not complete at the conclusion of the inspection (Section E8.2l.
- The licensee identified that they had not ensured that instrument measurement
uncertainty related to reactor coolant system average temperature was adequately
accounted for in operating logs. This licensee identified f ailure to assure the
design basis was correctly translated into procedures was identified as an apparent
violation of 10 CFR Part 50, Appendix B, Criterion ill (Section E8.3).
iv
)
.
.
- The NRC subsequently identified that wher, the licensee accounted for the
instrument uncertainty related to reactor coolant system average temperature in the
operating logs, they used vendor information to revise a surveillance procedure
without voiding the conflicting site calculation and without understanding the
technical basis for the reduction in uncertainty. The NRC identified failure to assure
that design changes, including field changes, were subject to design control
measures comrnensurate with those applied to the original design was identified as
an apparent violation of 10 CFR Part 50, Appendix B, Criterion 111 (Section E8.3).
v
j
.
.
Beoort Details
insoection Obiectives (37001 and 37550)
This inspection was performed to continue tha review of the adequacy of the licensee's
design control program related to instrument wtpoint criteria, initiated in NRC Inspection
Report 50 498:-499/97-16. Design engineering management had previously deferred
planned corrective actions to correct design control program problems and calculation
deficiencies involving instrument setpoint criteria. This inspection included further reviews
of the implications stemming from the licensee % decision to defer corrective actions for
setpoint calculation problems, and the effectiveness of the licensee's corrective actions for
identified setpoint calculation problems. In addition, this inspection rev6ewed design control
measurer associated with the mechanical and electrical discipline to determine the scope of
design control weaknesses. This inspection also included an evaluation of the licensee's
control of changes to the f acility pursuant to 10 CFR 50.59, " Changes, Tests and
Experiments."
111. Enginnathig
E2 Engineering Support of Facilities and Equipment (37001)
,
E 2.1 10 CFR 50.59 Imolementation
a. luncction Sconc
The team reviewed nine unreviewed safety question evaluations (USOEs) and five
10 CFR 50.59 applicability screenings and subsequent nuclear safety evaluations for
temporary modifications, permanent modifications, engineering change notices,
engineering analyses, and procedure changes.
b. Observations and Findinas
The team found that the USOEs and screenings were generally logical and of good
quality. Summary statements or assumptions were either supported with additional
information within the USOE, or supported by additionalinformation that was
promptly provided by the licensee upon request, in general, the USOEs were
comprehensive and well researched in that they provided the appropriate
background information and considered the appropriate accidents and licensing
basis. None of the screenings reviewed were found to require a USOE. The team
found two USOE's, which warranted detailed discussion: one USOE that could have
used more clarification or detail and one USOE involved a smallincrease in
probability of equipment malfunction, that was found acceptable.
1
)
.
.
.USOE 95-0028 Reactor Vessel Head Stud Tensioners
This USOE addressed a change to the Updated Final Safety Analysis Report (UFSAR)
- o more generically describe the reactor vessel head stud tensic,aers and to remove
.
statements that were incorrect or misleading. This change did not affect the
function of the stud tensioners or the way the tensioner operated. The USOE also
stated that the change would not affect the operation of the tensioner in a manner
that was not accounted for in " previous analyses."
The team asked what was meant by the previous analyses. The licensee responded
that the previous analyses referred to was the stress / fatigue analyses, which
assigned usage f actors to cover normal operating conditions, trans!ent expectations,
and the number of expected vessel head detensioning and retensioni.'q cycles during
refueling outages. The licensee further indicated that in their view, no elaboration in
the USOE was needed on what was meant by previous analyses because both the
originator and the qualified reviewer of the USOE understood the meaning of the
term " previous analyses."
The team considered the USOE would have been more complete and would have
better stood alone, if the previous analyses had been clearly identified.
USOE 96 0016 Defeat of Main Turbine Generator Overspeed Trip
This USOE addressed a temporary modification to defeat the electrical overspeed
trip for the main turbine generator. Apparently, the electrical overspeed trip of the
main turbine generator became inoperable, and troubleshooting of this circuit
involved a certain measure of risk that possibly could have caused a main turbine
generator trip. Since the f ailure mechanism was unknown at the time, the licensee
performed a temporary modification to defeat actuation of the overspeed trip.
The licensee's USOE stated that the overspeed trip was part of the mitigation for
- turbine missile generation, and that the overall probability of turbine missile
generation from destructive overspeed would not be significantly impacted.
Therefore, the overall probability of turbine missile generation from all scenarios was
not significantly impacted and was within the safety analysis report limit. The USOE
also stated that disabling the electrical overspeed trip would not increase the
probability of missile generation beyond the threshold of E-4 events per year.
The team then asked the licensee for clarification on the statement that the
probability of turbine missile generation would not be significantly impacted. The
licensee then provided a supplement to the USOE (that was inadvertently not
provided earlier) that was done because the licensee's Nuclear Safety Review Board
had also asked for clarification of the meaning of "there is little impact to the overall
probability of missile generation." The supplement stated that setting the probability
of the electrical overspeed trip failure to "one" resulted in no change to the third
significant digit of the probability of destructive overspeed (one of three types of
l
overspeed), and that the overall probability for missile generation was not
2
0
. . _ . _-. .
.
.
statistically changed by deletion of the overspeed trip. While not statistically
significant, the licensee agreed that intentional defeat of the overspeed trip device
slightly increased the probability of generating a turbine missile. However, the
licensee noted that af ter considering the overspeed trip defeat, the probability of
generating a turbine missile was still much less than the criteria approved by the
NRC staff, E 4 events per year.
To verify the licensee's statement, the team reviewed a May 18,1993, Safety
Evaluation by NRC's Office of Nuclear Reactor Regulation, related to the turbine
maintenance program. The Safety Evaluation concluded that the licensee's turbine
missile program was acceptable because the licensee's turbine missile generation
probability satisfied the staff's requirements of E-4 per year for favorable orientation.
The team also reviewed NUREG-1606, " Proposed Regulatory Guidance Related to
implementation of 10 CFR 50.59 " NUREG 1606 stated that " Changes that might
increase the probability of (turbine missile] generation from the existing level.to a
level that is still below the specified criteria would not create a new type of
accident, or increase the probability of an accident previously evaluated."
Based on the above, the team found that deletion of the electrical overspeed trip
was not an unreviewed safety question because the licensee's turbine missile
generation probability continued to satisfy the staff's specified criteria of E-4 events
per year. The team agreed with the licensee's USOE.
_
c. Conclusions
The unreviewed safety question evaluations reviewed were comprehensive and well
researched. With one exception, the team found the background documentation
contained in the nuclear safety evaluations to be well developed and complete. In
general, the safety evaluations provided appropriately detailed bases for reaching
conclusions regarding changes, tests, and experiments. All conclusions appeared to
be logically supported and did not represent any unreviewed safety questions. Of
the screenings which the team reviewed, none were found that required an
unreviewed safety question evaluation.
E3 Engineering Procedures and Documentation (37550)
E3.1 &ngram for Control of Accuraev of Meas.Urina and Test Eauioment Used in
Surveillance Procaduins
a, lasoection Scops
The team performed a limited review of instrument setpoint program documents and
maintenance and surveillance procedures to determine if measuring and test
equipment (M&TE) accuracy assumptions made in the process instrument setpoint
uncertainty analysis were being implemented in the field.
3
J
.
.
b. Observations and Findin25
The team reviewed safety related setpoint calculations performed by the reactor
vendor, Westinghouse. The team found that the Westinghouse calculations for
safety-related instrument setpoints assumed that M&TE used would be four times
more accurate than the installed instrumentation, except for detectors, where the
M&TE was assumed to be as accurate as the detector. The team reviewed the
licensee's surveillance program and determined that Plant Surveillance
Procedure OPGP03 ZE 0005, " Procedure Preparation," Revision 12, had a checklist
item for ensuring that the testing methodology supported setpoint assumptions.
The team reviewed four procedures associated with setpoint criteria provided
by Westinghouse and determined that two of the four procedures specified
M&TE accuracies which were less accurate than was assumed by Westinghouse.
Surveillance Procedures OPSP05 RC-0417, "RCS Flow Transmitter Calibration,"
Revision 0, and OPSP05 MS 0514L, " Main Steam Pressure Loop Calibration,"
Revision 1, both required a voltmeter accuracy of 0.15 percent, when an accuracy
of 0.015 percent was assumed in the associated Westinghouse calculations.
10 CFR Part 50, Appendix 0, Criterion Ill, requires that the design basis be correctly
translated into procedures. The team considered that f ailure of Surveillance
Procedures OPSP05 RC 0417, Revision 0, and OPSP05 MS-0514L, Revision 1, to
incorporate the voltmeter accuracies assumed in the associate i Westinghouse
uncertainty calculations was an example of an apparent design control violation
re!ated to translation of M&TE accuracy requirements (50-498; 499/9724-01).
The team discussed M&TE accuracy with the licensee, who noted that the actual
instruments, which had been used to perform the procedures did have an accuracy
of 0.015 percent. Th.s team noted, however, that the procedures listed test
equipment or equal, so that an voltmeter with an accuracy of 0.15 percent could be
used to perform the surveillance. Tha licensee stated that they would correct the
procedures.
The team reviewed two surveillance procedures associated with setpoint
calculations performed by the licensee and determined that although test equipment,
or equal, was specified, there was no listing of required accuracies. The team
reviewed Procedures OPMPOS ZE-0034, "Caliteation of ITE-27 Relays," Revision 3,
and OPSP06 PK-0005, "4.16kV Class 1E Degraded Voltage Relay Channel
Calibration /TADOT Channel 1", Revision 4. The team was unable to determine how
the licensee maintained control of M&TE accuracy when the procedures did not
specify any accuracy requirements.
4
j
. - . .- -- ., ._ - -
..
.
The team requested that the licensee provide the accuracies of the test equipment
specified in Procedure OPSP06 PK-0005 Procedure OPSP06 PK-0005 directed that
the degraded voltage relays be tested using a test set monitor, either a EPOCH lit or
an EPOCH 30. The licensee provided ir. formation which indicated that the accuracy
of the voltmeter on the EPOCH 30 was plus or minus 1.0 percent of reading.
The team reviewed the calculation for the degraded voltage relay trip setpoint,
Calculation EC5052, " Degraded and Undervoltage Protection," Revision 3. The
team found that this calculation required a test voltmeter accuracy of plus or
minus 0.4 percent, in addition, as discussed in Section E8.2, the team considered
the uncertainty analysis performed in this calculation to be in error. After
considering the use of test equipment with an accuracy of 1.0 percent of reading
and the calculation errors discussed in Section E8.2, the team determined that
Procedute OPSP06 PK 0005 and Calculation EC5052 were inadequate to
demonstrate that the degraded voltage relay trip setpoint met its design basis of
ensuring adequate voltage to safety related equipment.
The licensee reviewed this information, interviewed personnel, and concluded that
all recent data for degraded voltage relay trip setpoints had been taken with a
multimeter with an accuracy of 0.5 percent or better. The team noted that
Procedure OPSP06-PK 0005 listed a multimeter in the list of test equipment, but at
no time during the setting of the degraded voltage relay trio setpoint did the
procedure specify that the multimeter be connected or used for voltage readings.
As noted in Section E8.2, the licensee perforrned a revised uncertainty analysis for
the relay circuit. This revised analysis was based on M&TE accuracy of .5 percent
or better. Af ter considering the corrected uncertainty analysis and the licensee's
use of more accurate test equipment, the team agreed with the licensee's
conclusion that the equipment was operable.
10 CFR Part bO, Appendix B, Criterion ill, requires that the design basis be
correctly translated into procedures. The team considered that failure of
Procedure OPSP06-PK-0005 to incorporate the M&TE accuracy requirements
required in Calculation EC5052 was a second example of an apparent design
control violation related to translation of M&TE accuracy requirements
(50 498;-499/9724-01).
The licensee stated that this issue was programmatit in that the required eccuracy
i_nformation was not readily accessible to field personnel. The licensee stated that
they initiated a number of actions to ensure that calculation assemptions would be
included in field instructions. Included in this review was Condition Report 97 238,
Action 104, to ensure electrical maintenanc6 and surveillance procedures
implemented calculation requirements.
5
0
__
.
e
c. Conclunops
The team concluded that M&TE accuracy assumptions were not being adequately
translated into surveillance procedures. For the identified examples, the licensee
determined that appropriate measuring and test equipment had been used.
However, the f ailure to translate M&TE accuracy requirements into surveillance ,
'
procedures was an apparent violation of 10 CFR Part 50, Appendix B, Criterion ill,
" Design Control." The licensee stated that this issue was programmatic in that the
required accuracy information was not readily accessible to field personnel. The
licensee planned to upgrade their program.
l
E3.2 Batterv Service Surveillance Test Acceotence Criteria
a. Scnns
The team reviewed the battery load calculation, the Updated Final Saf t.ty Analysis
l
Report direct current load table and the battery service surveillance test to determine
if the acceptance criteria was bounding.
b. Observations and Findinas
The team noted that Calculation EC5008, " Class 1E Battery, Battery Charger, and
inverter Sizing," Revision 10, had 10 amendments. The licensee stated this
calculation was the calculation of record for determining plant electricalloading for
the Class 1E 125Vdc system. The team found that Calculation EC5008 had been
updated on November 27,1995 and appeared to be adequate for specific design
basis accidents.
The tearn noted that the des;ga change packages, included in the 10 amendments,
did not identify the battery service surveillance test procedure for appropriate review
within the design change process. The team found, as an example, that design
change package 96-3056-34 installed a backup power supply for a damper actuator
in the fuel handling building, which would be powered from the Class 1E 125Vdc
station batteries. As indicated on the 10 CFR 50.59 screening form for the design
change package, a review of the Updated Final Safety Analysis Report section 8.3
and Calculation EC5008 were performed. The team noted that no references were
made regarding updates to assure that affected surveillance procedures used to
verify the operability of the Class 1E 125Vdc system were reviewed or updated.
The team determined the licensee's program for design control was weak in this
area, because a review of affected battery service surveiFance tests was not
performed.
The team selected the critical battery loading period, zero to one minute on the
Channel I battery, for additional review. The team concluded that, af ter
consideration of all of the amendments (some reduced the loading), the battery
service surveillance test acceptance criteria was bounding.
6
l
,
.- . - - - - . - - - - - - ---- --
.
. .
c. ' conclusions
The licensee's program for design change control related to battery testing was
weak. Loads were being added and subtracted from the vital batteries without
documenting an evaluation of the impact of the changes on the battery service
surveillance test acceptance criteria. However, the team reviewed the critical
battery loading period and determined that the acceptance criteria was bounding.
E7 Quality Assurance in Engineering Activities (37550)
E7,1 Control of Calculation Amendments
a. Insoection Sqogg
As part of the review of the licensee's calculation control program, the team
selected for review a calculation with a large number of amendments. -The team
reviewed the adequacy of the control of amendments to Calculation EC5002,
" Auxiliary Power System Load Study," Revision 4, dated October 30,1988.
b. Observations and Findinas
Calculation EC5002 was a computer aided study which determined plant total
connected electricalloads and expected loads for startup, full power. loss of offsite
power, and loss of coolant conditions. The licensee stated that this calculation vvas
the calculation of record for determining plant electricalloading.
The team noted that Calculation EC5002 had approximately 190 open and 30
- pending amendments. The licensee later determined there were 214 open
amendments. The licensee's definition of amendments included a number of
document types for accomplishing design changes. The licensee's design control
program allowed amendments to be attached to affected documents, without
changing the original document, or updating the list of effective pages. However,
the licensee required personnel making an amendrnrst to consider, and incorporate
previous amendments, if the previous and new amendments affected the same part
of the document.
The team reviewed all of the open amendments to Calculation EC5002 and
determined that, for the most part, there was no attempt by personnel making
amendments to EC5002, to incorporate previous amendments or there was no
attempt by personnel to determine the overall affect on plant loading as the number
of amendments increased. In addition, most of the amendments addressed only
. total connected load and not operational conditions, and many of the amendments
- only described the changes on a cover sheet, without making any changes to the -
actual calculation sheet
7
!
- .-- - - - - - - - - _- - --- -. .-.-.- -.-
,
,
A few of the specific problems discovered by the team were as follows:
- Design Change EC 62, dated October 16,1991, made load changes for
Buses 3E171EMCE1C2 and B4 without incorporating changes made by
Design Change EC 49, approved February 26,1990, causing the loss of-
power loads to be incorrect.
- Design Change EC 62, dated October 16,1991, made load changes for
Bus 3E151ESGOE1 A without incorporating changes made by Design
Change EC 32, dated August 30,1989. Design Change EC 32 had increased I
load on the bus by 83 kilowatts (kw), which was not recognized by EC 62,
thus, the totalload shown by EC 62 was 83 kw low. I
l
'
- Design Change PCF 176712A approved June 19,1995, made load changes
to the total connected load of Bus 8E171EMOC1F2 without incorporating
changes made by Design Change PFC 211205A, approved April 27, 1994.-
- Design Change MDCN 90037 04, issued December 18,1995,added
technical support center diesel control circuits to the full power loads, but not '
to the total connected loads or loss of power loads.
by cover sheet without showing the specific changes to Calculation EC5002.
Based on this review, the team was unable to determine that the licensee had .
'
adequate design control for the electrical distribution system. The team discussed
this issue with the licensee. They stated that all of the amendments to EC5002
were minor, and that other documents, such as design drawings, were available to
show that the present design configuration was adequate, During this discussion,
the team determined that the licensee had not purchased the computer program
used by the architect engineer to perform the original design. As a result, they
could not easily recalculate total connected load and had not maintained a
calculation commensurate with the original study. The licensee stated that they had
recently purchased new sof tware and were in the process of inputing electrical
distribution system design and operational data into a new computer aided study.
Because the team was concerned with the adequacy of the electrical distribution
system, the team reviewed two calculations specifically performed to ensure
adequate electrical distribution support for safety related equipment, Calculation
EC5092, " Class 1E Standby Diesel Generator Loading Analysis," Revision 0 and
e Calculation EC5008, " Class 1E Battery / Battery Charger / Inverter Sizing," Revision
10. The team determined that the licensee. had updated these calculations and, in
..
general, the calculations indicated adequate electrical distribution system support for
safety related equipment under accident conditions which required operation of the
emergency diesel generators and safety related batteries.
!
8
m
j
.
.
Even though Calculations EC5008 and EC5092 had been updated more recently and
appeared to be adequate for specific design basis accidents, the team was unable to
conclude that the licensee had maintained adequate control of the design of the
electrical distribution system without a full understanding of the results of the
auxiliary power system load study that was covered by Calculation EC5002.
The licensee initiated Condition Report 9714608 to revise Calculation EC5002.
Af ter 20 person days of research, the licensee was able to demonstrate to the team
that the total effects of all the amendments to Calculation EC5002 were well within
the capabikties of the affected buses. In response to the team's findings, the
licensee performed a self assessment regarding the generic aspects of the Isrga
number of open amendments posted against specific calculations. The licensee
identified that two other calculations had greater than 100 amendments, that
11 other calculations had between 15 and 99 amendments, and that 62 calculations
had between 6 and 14 amendments. The licensee evaluated the immediate safety
significance of these design control measures. They noted that in several cases
there were alternetive methods for controlling the design. For example, the licensee
noted that plant changes associated with cables and raceways were also controlled
by a computer aided circuit and raceway program. The licensee indicated that they
had carefully maintained this program, to ensure that plant changes had not
overloaded cables or raceways.
The licenseo stated that review of Calculation EC5002 and other calculations with
amendments, led them to conclude that the present practice for amendment control
did not meet engineering management's expectations for control of chlculations.
The licensee stated that they planned to limit most calculations to five amendments,
and planned to revise all calculations with more than five amendments to
incorporate all of the amendments. For example, the licensee stated that they
would revise the cable and raceway calculations discussed above to ensure that the
design had been adequately maintained by use of the computer aided cable and
raceway program. The licensee noted that a relatively small percentage of the total
population of approximately 6000 calculations was affected.
The team noted that prior to March,1994 amendments were controlled by
Procedure OEP 3.070, " Preparation of Engineering Calculations." During this period
Calculation EC5002, described above, had over 50 active amendments. Rather than
solving the problem, the licensee relaxed the requirements and, af ter March 1994,
effectively allowed an unlimited number of amendments to exist before a calculation
was revised.
10 CFR Part 50, Appendix 8, Criterion Ill, requires that design changes, including
field changes, shall be subject to design control measures commensurate with those
applied to the original design. The team noted that the South Texas Operations
Quahty Assurance Plan, Chapter 6.0, " Design and Modification Control,"
Section 5.2.3 stated that design analyses shall be sufficiently detailed as to
purpose, method, assumptions, design input, references, units, and status
(preliminary or final) such that a technicelly qualified pe son can review and
9
d
. . . _ . - - - - -
- i
.
l
understand the analyses and verify the adequacy of the results without recourse to
the originator. The team concluded that design changes to Calculation EC5002 j
were not subject to design control measures commensurate with those applied to
the original design. As a result a technically qualified person could not review and .
understand the analyses and verify the adequacy of the results. The team
concluded the f ailure to update Calculation EC5002 commensurate with the original
design was an apparent design control violation related to amendment control !
'
(50 498; 499/972A 02h
c. CDDdu11gHS I
l
Amendments to calculations were not being adequately controlled. Three l
calculations had greater than 100 amendments,11 other calculations had between )
15 and 99 amendments, *nd 62 calculations had between six and 14 amendments.
The team reviewed one c. 4e in detail and found amendments were not being
integrated to develop a coherent analytical basis for the auxiliary power system load
study. The f ailure to assure that design changes were subject to design control
measures commensurate with those applied to the original design appeared to be a
violation of 10 CFR Part 50, Appendix B, Criterion Ill.
E7.2 Effect of Desian and Licensing Basis Chances on Calculations
a. Inspaction Scops
The team reviewed electrical and mechanical calculations to assess the adequacy of
design control measures. The team reviewed these calculations to determine
whether the impact of design and licensing basis changes had been fully considered.
b. Observations and Findings
Diesel Generator Transient Loading
During the revicw, the team observed that Condition Report 95-10936 identified
potential problems with the transient loading of the emergency diesel generatcis.
Based on this condition report, the team reviewed the emergency diesel generator
transient loading calculation.
The licensee indicated that NEl Peebles Electric Products, Inc., Study
Order T 1031, " Transient Voltage Response of the Diesel Generator Units, Trains A,
B, and C to Postulated Emergency Loading," Revision 0, and associated changes
provided the technical analysis that supported the conclusion that the emergency
diesel generators would perform satisf actorily during a loading sequence upon
loss-of-offsite power or upon a loss of-offsite power with a loss-of-cooling accident.
10
,m y -m
_ __
.
.
The last change to this study that was provided to the team was made in 1989. I
The team observed that many changes had been made to the loading of the i
emergency diesel generators since the study had been done, as indicated in
Calculation EC5092, " Class 1E Standby Diesel Generator Loading Analysis,"
Revision O.
The team found that there was conflicting and incorrect information within the
transient study. For example, inputs listed on the computer modeling did not match j
the loading inputs developed in the study and changes had been made to the study
that changed base information without explanation. The team also found that the
study contained conflicting load sequencing information, and that the study did not ;
match existing configurations because numerous changes had been made to loads ;
and load sequencing since the study was last updated in 1989. !
Despite the numerous problems, the team determined that all the loading and 1
'
loading sequences listed as input information for the computer modeling were
conservative with respect to the current load and load soquencing calculated in i
Calculation EC5092. Current total loads and individualli ad block additions were
appropriately less than sssumed in the study. The licens se stated that they planned
to update the emergency diesel generator transient loadhg analysis using newly
purchased computer programs.
10 CFR Part 50, Appendix B, Criterion ill, requires that design changes, including
field changes, shall be subject to design control measures commensurate with those
applied to the original design. South Texas Opetations Quality Assurance Plan,
Chapter 6.0, Section 5.1, states that measures shall be esiablished to document
selection of design inputs. Changes to specified design inputs, including
identification of their source, shall be identified and documented. While the team
did not have a safety concern in this case, the team concluded that the licensee had
changed the design innuts to Study Order T 1031, Revision 0, without identifying
and documenting that the inputs had been revised and evaluating the effect. As a
result, the current design was not being controlled commensurate with the original
design. The failure to identify and evaluate the load changes against the study to
confirm it was still bounding was one example of an apparent design control
violation related to identifying and documenting design input changes
(50 498;-499/9724-03).
Change in Auxiliary Feedwater System Requirements
The team found that the licensee made several changes to the dynamic
requirements for the auxiliary feedwater system which affected various calculations.
On May 27,1994, the NRC staff issued Technical Specification Amendment 61 for
Unit 1 and Amendmei.t 50 for Unit 2 to reduce the system flow requirements from
550 gallons per minute (gpm) to 500 gpm. On May 2,1995, the NRC staff issued
Technical Specification Amendment 78 for Unit 1 and Amendment 67 for Unit 2 to
change the Technical Specification main steam safety valve tolerance from i 1 %
to 13% This had the effect of increasing the required pump discharge pressure.
11
J
__ _ . ._ _
,
.
At initial licensing the licensee installed new pump impellers to improve system
performance and generated new pump curves. The licensee also had modified the
piping configuration and developed a more detailed estimate of system resistance.
The team reviewed current calculations to determine if they had been updated to
reflect these changes. The team found that the following five calculations had not ,
been revised or evaluated when the system parameter used as a design input was
updated.
- 'the piping configuration was changed and the change was not identified and
documented in Calculation MC5004, "AFW Suction Line Sizing and Pump
Available NPSH," Revision 2 dated August 22,1995. Specifically, the
available net positive suction head in Calculation MC5004 was calculated
based on 100 feet of 6 inch piping. The latest isometric drawings showed
approximately 23 feet of 6 inch pipe and 109 feet of 8 inch pipe.
- The design pressure for the turbine driven auxiliary feedwater discharge
pipmg was changed and the change was not identified and documented in
Calculation MC5060, " Auxiliary Feedwater Line Sizing," Revision 1, dated
Der ember 6,1985. Calculation MC5060 was based on Revision 1 of
Ce station MC5001, " AFW Pump D!scharge Pressure," and did not include
the crianges in Revision 4 of Calculation MC5051, issued March 27,1992.
- The syn tem reristant e model was updated to reflect current piping
configurations and the change was not identified and documented in
Calculation MC6864, "AFW Pump Runout Flow," Revision 2, dated June 7,
1989. Calculation MC5864 was based on Colculation MC5861, " Auxiliary
Feedwater (AFW) Pump Design TDH and Flowrate," Revision 1, dated
January 15,1987, and did not include the changes in Revision 3 of
Calculation MC5801 issued July 14,1997.
- Minimum system flow requirements, maximum system pressure
requirements, and system resistance were updated and the changes were not
identified or documented in Calculation MC5056, " Auxiliary Feedwater (AFW)
Control Valve Sizing: AFW System Resistance," Revision 12, dated
January 3,1986. Calculation MC5056 used these parameters as inputs and
was not updated when the t,ystem requirements changed.
- Maximum system pressure, the auxiliary feedwater pump curve and the
system resistance were updated and the changes were not identified or
documented in Calculation MC5924, " Auxiliary Feedwater Regulating
Valves Anticipated Cycles," Revision 1 dated April 16,1987.
Calculation MC5924 used these parameters as inputs and was not updated
when system requirements changed.
10 CFR Part 50, Appendix 8, Criterion lil, requires that design changes, including
field changes, shall be subject to design control measures comn,ensurate with those
applied to the original design. South Texas Operations Quality Assurance Plan,
12
-)
.
.
Chapter 6.0, Section 5.1, states that measures shall be ests.olished to document
sclection of design inputs. Changes to specified desig*1 inputs, including
identification of their source, shall be identified and documented. The team
concluded that the licensee chariged the design inputs to the five noted calculations
without identifying and documenting that the inputs had been reviced. As a result
the current design basis ca culations were not consistent with the physical design of
the plant. The five failures to identify and evaluate the impact of auxiliary
feedwater system changes as described above represented five additional;xamples
of an apparent design control violation related to identifying and docummiting design
input charges (50 498; 499/9724 03).
Calculation impact Review Sheet
The licensee agreed that calculations were not always being updated to match the
current plant configuration. Several of the examples involved the output of one
calculation being used as an input to a second calculation. When the first
calculation was revised, it changed the design input to the second calculation.
However, the second calculatinn was not revised To address this programmatic
weakness, the licensee revised their calculation control program te 'nclude an impact
review sheet. The licensee planned to use the impact review to identify and
document the impact of calculation changes on procedures, the Updated Final
Safety Analysis P ort, and other calculations,
c. CDDclusions
The licenseo changed the design inputs to Study Order T 1031, " Transient Voltage
Response of the Diesel Generator Units, Trains A, B, and C to Postulated Emergency
Loading," Revision 0 without identifying and documenting that the design inputs had
been revised. As a result the current design was not being controlled commensurate
with the original design. While the licensee's study to demonstrate adequate
emergency diesel generator voltage, in response to accident loads, was out of date
and contained errors, it bounded the current loading calculations and was not
considered to be a safety concern. The team identified five similar examples of
inadequate design change control for the auxiliary feedwater system. The licensee
revised key system parameters without identifying and documenting the design
input changes to five calculations, lne team concluded that the licensee was not
systematically ensuring all calculations affected by design and licensing basis
changes were reviewed and updated as needed to be consistent with the physical
design of the plant. The team concluded these f ailures to identify and document
design input changes resulted in a f ailure to assure that design changes were subject
to design control mr asures commensurate with those applied to the original design.
This appeared to be a violation of 10 CFR Part 50, Appendix B, Criterion Ill.
13
- - -.
j
_ . - _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ .. _ _ _ _ _ _ __ _ _ _ _ .
r
l
!
.
E7.3 Licensina basis Chance Effects on the Undated Final Safety Analysis Reggs i
LUFSAR)
, s. 'Insnaction Scone
i
During the review of electrical and mechanical calculations discussed in.
Section E7.2, the team evaluated the UFSAR to determine if it was consistent with ;
the latest revision to the calculations.
b. Observations and Findinos
'
The team found two examples where the UFSAR was not accurately updated during
the last revision as required by 10 CFR Part 50.71(e), " Maintenance of Record, '
Making of Reports." Both examples involved incorporation of design information
which had been reviewed and approved by the NRC staff. ;
i
- The license revised the response to Oudstion 440.30N to say that the
485,000 gallon limit was all usable. The team noted that the 485,000 gallon ;
limit also included an unusable portion which had been accounted for in ;
calculations and reviewed by the NRC staff.
'
- The licensee did not comprehensively update UFSAR Section 7A.ll E.1.1,
" Auxiliary Feedwater System Evaluation," when the auxiliary ieedwater
system flow was reduced. They did not change the amount of time to
specified to purge the volume between the water solid portions of the
auxiliary feedwater/ main feedwater system and the steam generators
following an auxiliary feedwater pump start. However, the licensee
determined that these purge times were not an input to the safety analysis;
therefore, there was no safety significance to this finding.
The licensee stated that the change notices, which initiated these updates were
prepared before the licensee increased their emphasis on UFSAR accuracy. The
licensee previously committed to a complete reverification of the UFSAR to confirm
its accuracy. The licensee stated that they had not yet performed the reverification
of these specific safety analysis report sections in question. i
This item is unresolved pending further NRC review of the 10 CFR 50.71(e) issues
(50 498; 499/9724-04).
c, Conclusions
The team identified two examples where the licensee did not accurately update the
,
14
e ,
O
- ._ _ - - .
.
.
E7.4 Safetv Evaluation Not Performed for Calculation Revision .
The team noted that the licensee lacked a procedural requirement to perform a
10 CFR 50.59 safety evaluation screening review of calculation revisions to identify
those calculation changes which impacted the f acility as described in the UFSAR.
The licensee subsequently identified an example of a calculation change which ,
changed the f acility as described in the safety analysis report without a 10 CFR
50.59 safety evaluation.
The licensee provided Calculation MC5037, " Determination / Validation of RWST
Level Sotpoints," Revision 7, dated July 11,1995, and Condition Report 97 14434,
dated September 17,1997 to the team. Condition Report 9714434 identified
differences between Revision 7 of the calculation and UFSAR Section 6.3.1. The
licensee identified discrepancies between nominal refueling water storage
tank (RWST) volumes specified in the safety analysis report and the volumcs
calculated in Calculation MC5037. The licensee stated that the differences were
minor and that they wNid correct the UFSAR.
The team reviewed the calculation and the UFSAR and noted that the discussion of
instrument uncertain les was also different between the two documents, but agreed
with the licensee that the differences appeared minor.
However, the team noted that the more conservative instrument uncertainty ,
assumed in the safety analysis report provided additional margin against air ingestion
into the suction of the emergency core cooling system pumps. Both the calculation
and the UFSAR treat all of the water above the opening of the suction pipe as
available water. The team was concerned that this assumption is not technically
valid. This concern is discussed further in Section E8.2.
10 CFR 50.59(b)(1) requires that the licensee maintain records of changes in the
f acility made pursuant to this section, to the extent that these changes constitute
changes in the f acility as described in the safety analysis report. Further, these
records must include a written safety evaluation which provides the basis for the
determination that the change does not involve an unreviewed safety question. The
f ailure to perform a written safety evaluation for Calculation MC5037,
"DeterminationNalidation of RWST Level Setpoints," Revision 7, dated July 11,
1995, which changed the f acility as described on page 6.3-4 of the UFSAR is an
apparent violation of 10 CFR 50.59(b)(1) (50-498; 499/9724 05).
The licensee recognized the generic implications of this issue and revised their
calculation program to require impact reviews for calculation revisions. These
impact reviews will consider whether the f acility as described in the UFSAR was
impacted by the calculation change.
15
)
.
.
c. Conclusions
Af ter discussions with the team, the licensee identified an example of programmatic
weakness in that there was no procedural requirement to evaluate calculation
changes for impact on the UFSAR. As a result, they failed to perform a safety
evaluation for changes in RWST volumes and uncertainty analysis assumptions.
This was considered to be an apparent violation of 10 CFR 50.59.
E8 Miscellaneous Engineering issues
E8.1 (Clas.cd) Inspection Fol!nwuo item 50-498: 499/9609-01: review of the licenseo's
self assessment and followup of the actions taken to evaluate the
apparent discrepancies in the setpoint program,
a. Dankaround
The licensee originally identified weaknesses in their setpoint calculation progiam
during their engineering assurance assessment in May of 1992, initially they
planned a corrective action program which involved various contractor assessments.
One of the first assessments, completed in December of 1993, documented that
while program improvements were required, immediate operability problems
probably did not exist. However, later contractor assessments, submitted in April
and Juno of 1995, identified 35 calculations which required major revision for
reasons which indicated that the calculations did not meet the licenseo's design
control program. Af ter prompting by the NRC, the licensee included these
calculations in their corrective action system in December of 1996; however, they
still were not identified as conditions adverse to quality. The licensee planned
additional assessment in 1997.
The NRC initiall > concluded in NRC Inspection Report 50-498; -499/96-09 that there
was no regulatory basis for determining that a violation of NRC requirements had
occurred. However, the NRC initiated an inspection followup item to review the
results of the licensee's self assessments in more detail and to follow the actions
taken to evaluate the apparent discrepancies in the setpoint program.
b. InsprcioLf.ollo.wup
The team reviewed the following five engineering self assessment reports to
evaluate the licensee's program for control of design basis calculations and confirm
that design and licensing basis requirements were being met:
- Engineering Assurance Assessment 92 01, " Instrument Setpoint
Methodology," dated May 27,1992:
- Hurst Consulting, incorporated, Task 1, " Independent Assessment of the
South Texas Project Setpoint Control Program," dated January 21,1994;
16
a
l
.
.
- Hurst Consulting, incorporated, Task 2, "STP Setpoint Program Assessment
(Identification of Existing Setpoint Calculations and the detail of revision
needed)," dated April 18,1995; and,
- Hurst Const i ting, incorporated, Task 3, " Identification of Setpoints with and
without Calculations," dated June 2,1995.
- Engineering Self Assessment of Setpoint Calculations, Methodology and
Control, Condition Report 96 16020, dated February 21,1P97.
'
The team found two of the engineering self assessments were performed by the
licensee and three by a third party engineering firm to evaluate the plant
instrumentation setpoint calculations, methodologies and programs. These self
assessments were performed from January 1992 through January 1997.
Failure to Promptly Correct Deficient Setpoint Analyses identified in 1992
Engineering Assurance Assessment 'J2 01 was conducted from January 30 through
April 28,1992, in this assessment, the licensee identified that it was necessary to
revise several of their channel statistical allowance calculations because the
instrument uncertainties associated with the Veritrak transmitters were in excess of
those assumed in the ssfety analysis. This resulted in non-conservative technical
specifications, which the licensee corrected in Amendments 61 and 50 to License
Nos. NPF 76 and NPF 80, respectively. The assessment also included the
observation that there was an error in the RWST recirculation swap over setpoint
analysis.
Since several of these items were significant, the assessment included
programmatic observations as well for a total of 14 observations.
Observation 92-01 13, classified as Level11 (potential plant safety impact),
addressed programrnath concerns regarding setpoint calculations. In
Observation 92-01 13, the licensee documented that s'ome of the technical
assumptions, contents, scopes, and results of the plant design basis calculations
were not consistent with the physical design of the p! ant.
As a result of NRC questioning, during NRC Inspection Report 50-498;-499/96-09,
the licensee conducted an assessment in January,1997, of the completion of the
corrective action for the 14 observations. The licensee found that they had not
implemented all of the corrective actions for Observation 92-01-13. Specifically,
the design engineering department plan of action to conduct a " review and repair"
of the design basis setpoint calculations was not implemented. The licensee
initiated Condition Report 97-1526 to investigate why the Design Engineering
Department had not implemented this plan of action,
in Condition Report 97 1526, the licensee noted that the actual " review and repair"
of instrument setpoint calculations was to be addressed by an approved business
plan program element, H9 CALC, " Plant Setpoint Program." in accordance with the
17
]
.
,
Operations Quality Assurance Plan, this response was accepted by quality assurance
as documented in Station Problem Report 92 0584. However, the licensee
subsequently decided not to perform a 100% review and repair program, because
they believed the remaining discrepancies with the calculations were non-safety
significant. Instead, according to Condition Report 97 1526, engineering
management elected to utilize the business plan program element funds, to develop
the compute *ized scaling / calibration data sheet program. This change in work
priority was supported by operations and raaintenance management. Therefore,
Condition Report 971526 concluded that the cause was " resources used to
complete higher priority work."
The team noted that the business plan item was not viewed as a condition adverse
to quality in accordance with 10 CFR Part 50, Appendix B, Criterion XVI. As a
result, licensee management believed that they were only deferring planned program
enhancements.
The team found that South Texas Operations Quality Assurance Plan specified
acceptable design control measures for setpoint analyses and calculations performed
to confirm compliance with design limits. Chapter 6.0, Section 5.2.3, stated that
design analyses shall be sufficiently detailed as to purpose, method, assumptions,
design input, references, units and status (preliminary or final) such that a
technically qualified person can review and understand the analyses and verify the
adequacy of the results without recourse to the originator, Section 5.5 stated that
measures shall be established to control the approval, issuance and changes of
design documents to prevent the inadvertent use of superseded design information.
Design documents included setpoints with tolerances and design limits. Section 5.7
stated that errors and deficiencies found in approved design documents, including
design methods, that could adversely affect the quality related structures, systems,
or components shall be documented and action taken to correct and prevent the
recurrence of deficiencies.
Chapter 13, " Deficiency Control," which applied to deficiencies discovered in
activities under the scope of the Operations Quality '.ssurance Plan (including design
control), stated that procedures shall be developed for the control of activities which
do not conform to established requirements. These procedures shall provide for the
identification and documentation of deficient conditions, resolution and/or
disposition, documentation of the corrective action taken, and actions to be taken to
assure timely corrective action on deficiencies.
The team determined that calculations which form the basis for specifying setpoints
and tolerances or form the basis for confirming compliance with design limits that
did not meet the criteria of the Operations Quality Assurance Plan Sections 5.2.3,
and 5.5 were deficient and were, by definition, conditions adverse to quality, which
required prompt identification and correction.
18
1
f
,
.
10 CFR Part 50, Appendix B, Criterion XVI, includes the requirement to promptly
identify and correct conditions adverse to quality including deficiencies.
Considering, that the licensee had already identified that programmatic deficiencies
of the type described in Observation 92-01 13 could adversely affect quality re%ed
components, the team determined that cancelin9 the corrective action for
Observation 92 01 13 was one example an apparent violatic.7 of 10 CFR Part 50,
Appendix B, Criterion XVI (50 498; 499/9724 06).
Failure to Promptly Correct Deficient Setpoint Analyses identified in 1995
As a part of their long term efforts to address the setpoint analysis issue, the license
hired contractors (Hurst) to perform an assessment of the currant state of their
setpoint calculations. In 1995, the licensee received information from this
assessment that 35 calculations required major revisions for recsons that would
make them deficient with respect to design control standards included in the
Operations Quality Assurance Plan. As discussed in the 1995 Hurst assessment
reports, the 35 calculations required major revision because they were deficient due
to invalid / unverified assumptions, inconsistent format, non retrievable references,
references with no revision numbers, no methodology specified, no instrument
uncertainties considered, no calibration or process effects considered and/or
outdated references. In December of 1996, following questioning by the NRC,
engineers documented the issues raised in the Hurst assessment reports as a
condition not adverse to quality in Condition Report 96-16020 because they
determined that the setpoint calculation discrepancies were not safety significant.
In addition, ever, af ter the issue was raised in NRC Inspection
Report 50 498' 499/96 09, the licensee did not perform an operability
evaluation of all the calculations listed in the 1995 assessment as having major
problems. Operability was questioned again in May of 1997, during NRC
Inspection 50 498; 499/9716 and the licenseo performed and operability
evaluation at that time. As a result, the team determined that the licensee had no
basis for defet.,ng corrective actions to review existing setpoint calculations in
1995.
The team found that the licensee's basis for concluding that the setpoint calculation
discrepancies were proven to be non safety significant was documented in their
Letter ST HL AE-5705 to the NRC, dated July 22,1997. Letter ST HL-AE-5705
was written in response to NRC Inspection Report 50-498; -499/9716 regarding
setpoint calculations issues. Regarding the safety significance of the setpoint
calculations, this letter stated that "Although not documented at the time,
Engincering evaluated the reports and concluded that the operability of safety
related components was not af fected by these calculation problems."
During this inspection the team asked the licensee to provide any information related
to actions the licensee had actually taken to reach the conclusion that operability
problems did not exist in 1995. Licensee personnel stated that the vendor indicated
in 199; that no operability issues existed and that licensee personnel believed the
19
-)
.
.
vendor would have indicated operability concerns in the 1995 report, if the vendor
had operability concerns. The team determined that the licensee's July 22,1997,
letter was potentially misleading and the reliance by licensee personnel on the
vendor was not commensurate with an acceptable operability review.
The team determined that the licensee missed a second opportunity to identify
design deficiencies within the setpoint calculation program as conditions adverse to
quality requiring prompt corrective action.10 CFR Part 50, Appendix B,
Criterion XVI, states that measures shall ae established to assure that conditions
adverse to quality such as deficiencies are promptly identified and corrected. The
f ailure to promptly identify the 35 deficient setpoint calculations requiring major
revision as conditions adverse to quality requiring prompt corrective action is the
second example of an apparent violation of 10 CFR Part 50, Appendix B,
Criterion XVI (50-498; 499/9724 06).
Current Status of Planned Corrective Actions Related to Setpoint Deficiencies
The team found that on March 19,1997, ir. Condition Report 97-5666 the licensee
initiated an action to revise affected setpoint calculations to ensure compliance with
the newly developed programmatic controls. In addition, on August 5,1997, the
licensee committed to a full upgrade of their setpoint analysis by December 1998.
The licensee stated that they expect to complete this upgrade in conjunction with
their ef fort to transition to improved technical specifications,
c. Conclusions
Setpoint calculation deficiencies, which were identified by the licensee in 1992 and
1995, were not promptly corrected. The licensee f ailed to identify these
deficiencies as conditions adverse to quality or to take eff ective corrective action
until prompted by the NRC. These failures were apparent violations of
10 CFR Part 50, Appendix B, Criterion XVI.
E8.2 10 cent Unresolved item 50-498: 499/9716-01: Review of the safety impact of the
licensee's decision to defer the planned setpoint program improvements and review
of the overall calculation control program,
a. Backaround
The NRC reviewed the adequacy of the licensee's design control program related to
instrument setpoint criteria. The NRC also reviewed three setpoint calculations and
identified the following deficiencies:
- The low-level alarm for the essential cooling water pond, which is the safety-
related ultimate heat sink, had been disabl3d by a design changt but the
calculation was not voided.
20
]
.
4
- The diesel generator fuel oil storage tank level setting calculation did not
include any uncertainty for changes in fuel specific gravity, differences in
temperatures, height measurements, instrument loop, and test instruments.
The NRC was .:oncerned that the alarm setpoint might not ensure that
operators were alerted to a low-level condition prior to exceeding the
technical specification limit. The licensee stated that an alternative local
indicator was actually used to confirm technical specification compliance.
- The residual heat removal system low pressure alarm setting calculatio'1
included a 6 psig margin for instrument error, but the calcuiation did not
provide any technical basis for this 6 psig margin. Based on the span of the
detector, the NRC calculated that the actualinstrument uncertainties would
be greater than the 6 psig established by the calculation for instrument error.
A licensee representative stated that, due to spurious low pressure alarms,
they were in the process of revising the calculation and planned to reset the
alarms. The licensee representative stated that a preliminary calculation
established an instrument loop uncertainty of 15 psig.
The NRC noted that even though the instrument setpoints provided the operators
with important information on the status of safety related equipment, they were not
setpoints that were required to be established in accordance with Regulatory
Guide 1.105. The NRC concluded there was a need to conduct further review of
the safety implications of the management decision to not correct identified design
control deficiencies,
b. lDioector Followun
The team reviewed the licensee's setpoint program for compliance with licensing
commitments. The team clso reviewed a sampling of instrument setpoint
documents associated with two general areas: setpoints previously identified by a
contractor as having no identified basis, and setpoints selected from safety related
UFSAR described operations.
Setpoint Criteria
The licensee's guidance for determining setpoints was contained in
Procedure SZ120ZO1028, " Design Criteria for Instrument Loop Uncertainty
and Setpoint Methodology," Revision O.
The UFSAR, Table 3.121, stated that South Texas conformed to the intent of
Regulatory Guide 1.105, " Instrument Setpoints for Safety Related Systems."
Regulatory Guide 1.105, Revision 2, endorsed instrument Society of America
Standard ISA S67.041982, "Setpoints for Nuclear Safety Relatea instrumentation
Used in Nuclear Power Plants," for ensuring that instrument setpoints remain within
technical specification limits. The Instrument Society of America Standard was
updated in 1994.
21
._}
.o
c-
Based on a sample review, the team considered that Procedure SZ120ZO1028
implemented the Instrument Society of ' America Standard.
Setpoints With No Basis
LA contractor, Hurst Consulting Inc., reviewed a number of safety related instrument a
'setpoints and identified a number of setpoints that did not identify a calculation to
document the setpoint basis. The results of this review were contained in
Letter ST 5W-HS 090237 of June 2,' 1995. =
_
,
!
The team selected 20 of these setpoints for followup review and requested the
licensee to provide any information they currently had related to the setpoint bases.
The licensee determined that the basis for several of the setpoints was developed in
site calculations. The licensee determined that some of the setpoints were provided
by Westinghouse as part of their standard design. The team limited followup to the
Wastinghouse provided setpoints to reviewing documentation which indicated that
Westinghouse considered the licensee's setpoints conservative. After reviewing the
documentation provided by the licensee, the team determined that three of the
setpoints had a weak calcu'ation basis.
Ranciot Coolant Pumo Seal inlection Flow
To ensure adequate reactor coolant pump seat lubrication and cooling is maintained,
adequate sealinjection flow must be maintained. The licensee determined the
minimum and maximum reector coolant pump seal injection flow from the reactor
coolant pump technicalinstruction manual. The team determined that the pump
. technicalinstruction manual provided a valid basis for acceptable seal flow rates. l
'
However, the team r,uted that the licersee had not accounted for instrument
uncertainties, when determining the minimum acceptable flow value. The technical
manual specified a minimum seat injection flow of 6 gpm for each reactor coolant
pump seal, with a designated maximum limit of 20 gpm. Thr technicalinstruction
manual stated that the normal operating values were between 8 and 13 gpm per
pump. Emergency operating procedures specified a setpoint range vvhich included a
lower minimum value of 6 gpm and a maximum normal value of 13 gpm as an
acceptable range for seal injection flow. With a lower limit of 6 gpm for indicated
flow, instrument uncertainties could place the actual pump seal flow outside the
specifications of the technicalinstruction manual,
,
Volume Control Tank (VCT) Level
To ensure that suctico to the charging pumps was not lost, upon loss of inventory in.
the VCT, the licensee had an alarm and automatic swap-ovei of the supply to the
charging pumps from the VCT_to the RWST at three percent levelin the VCT. This '
swap over ensured that the charging pumps always had a source of process fluid
during normal plant operation and protected them against loss of net positive
suctiori head and consequent cavitation.
22
j
[
e.
.-
The licensee indicated that the besis for the three percent swap-over was conta;aed
in Design Change PCF 308010A, dated September 2,1993. l'CF 308010A
indicated that the setpoint had been one percent, but testing in 1993 indicated that
had the VCT been drained, no swap-over would have occurred. With the VCT
drained below the associated level instrument taps, two level indicators read 1.6
and 3.1 percent, so no swap-over would have occurred. Based on this test, the
licensee raised the' swap over and alarm setpoints to three percent, however, no
calculation wat performed to ensure that the three percent setpoint was adequate
to account for instrument uncertainties.
The team questioned the adequacy of the three percent setpoint, given that during
testing one of the two associated ecators read greater than three percent with the
VCT drained. The team asked f 1 - ior information on the VCT and associated
swap-over circuits, in order to cac J. ate a uncertainty using the licensee's setpoint
guldence, Procedure 5Z12Z01028. The licenseo provided the team with the
requested information, along with a preliminary calculation which indicated that the
instrument uncertainty associated with the three percent setpoint was 2.7 percent.
The team revie'wed this calculation and determined that the calculation was
generally performed using the licensee's setpoint guidance.
The tean; observed that within the 2.7 percent, the licensee allowed 1.0 percent
uncertainty for process measurement errors and treated the uncertainty as a
random, inde. pendent error. Process uncertainty covers non-instrument related
uncertainty. The licensee stated that the 1.0 percent process uncertainty was a
conservatism added based on judgement and not on review of actual potential
process uncertainties.
The team determined that two process uncertainties existed, changes in fluid
density due to temperature changes and differences in the elevation between the
instrument taps and the associated sensors. The team noted that
Ce:culatica JC5280, " BAT (Boric Acid Tankl Level instrument Uncertainties /
Setpoirit: " Revision 0, included process uncertainty due to fluid density changes as
a bias but the revised preliminary VCT calculation did not. The licensee provided the
team with sensor elevation information which indicated that the sonsors were not
located at exactly the elevation c' the instrument taps, therefore, the team
considered that this uncertainty also needed to be included in the revised
calculation.
The team considered that the specific uncertainty due to fluid density changes and
sensor locations needed to be included in the calculation, and were required to be
considered as biases, not random, independent uncertainties. Because bias errors
must be directly added to the statistical formula for random, independent
uncertMnties (normally a square root sum of the squares method) moving the
1.0 pei,.ent process uncertainty from a random, independent error to a bias would
increase the instrument uncertainty from 2.7 percent to 3.5 percent.
'
23
- - )
0
.
In addition, the team observed that capillary tubes were installed but not included in
the licensee's uncertainty calculation. Procedure 5Z12Z01028 stated that capillary
tubes may affect the accuracy of the sensors and that the vendor should be
contacted to provide assistance in determining the effect. The team asked the
licensee for information relating to the accuracy of Lapillary tubes. The licensee
stated that there was no information available on site on the capillary tubes, but
they believed the capillary tubes had no effect on the sensors used for VCT level
determination.
The team discussed the VCT level swap over setpoint with the licensee. The
licensee stated that they believed the actual process uncertainties were less than
1.0 percent, and that the calculation provided to the team was preliminary, The
licensee stated that a more formal calculation would be performed as part of actions
on Condition Report 97 15708. The licensee stated that if the uncertainties were
determined to be greater than 3.0 percent, a setpoint change would be considered.
This issue will remain open pending an NRC review of the final calculation to
confirm the licensee has successfully assured that the automatic VCT/RWST swap-
over would be reliable and that air-binding of the centrifugal charging pumps would
not occur.
Reactor Coolant System Low Pressure Residual Heat Removal Valve InteriorA
The reactor coolant system low pressure residual heat removal setpoint was a
permissive interlock, which allowed operations personnel to open residual heat
removalisolation valves at a decreasing reactor coolant system pressure of
332 psig. The licensee indicated that the basis for the 332 psig isolation valve open
permissive interlock setpoint was contained in Design Change ECN 88E344A, dated
September 11,1988.
The team found that ECN 88E344A discussed a changa to the permist.ive interlock
to account for instrument uncertainty. TW design change indicated that
Westinghouse agreed to a temporary setpoint of 332 psig, but that efforts should be
instituted to revise the Technical Specifications and return the setpoint to 350 psig.
The team asked the licensee what actions had been taken to resolve this issue in the
current and pending improved technical specifications. The licensee reviewed
- associated records and informed the team that no action had been taken. The team
asked the licensee if continued operation with a temporary setpoint was acceptable.
The licensee initiated Condition Report 97-14670 to evaluate why no apparent
action had been taken to date and whether the pending improved technical
specifications should be revised. The licensee did not consider this to be an
operability concern.
24
_ __ _ _ _ . _ __. . __
'
.. _
!
- j
The team ob' served that the technical basis for this setpoint. as discussed in the- I
licensee's Residual Heat Removal System Design Basis Document, allowed a range ;
of pressure which would make a setpoint of 332 technically acceptable, based on
an informel calculation of instrument uncertainties. Therefore, the team agreed with
the licensee that there was no immediate operability concern.
Safety Related Process Values Selected from Final Safety Analysis Report
The team selected six safety-related process values described in the UFSAR and
asked the licensee for the calculation basis for these valuer,, to determine the
adequacy of supporting calculations. The team determined that two of the values
chosen had an adequate design basis which considered appropriate instrument and '
process uncertainties. The remaining four values are discussed below.
RWST Usable Volume and Level Instrument Setnoints
The team reviewed uncertainties associated with two RWST requirements: having
350,000 gallons available to support emergency core cooling and having sufficient
volume to supply the ECCS pumps, during swap-over of pump suction from the
RWST to the emergency sump, approximately 11,100 gallons.
The licensee Provided the basis for both of these volumes in Calculation MC5037,
"Determinati3n/ Validation of RWST Level Setpoints," Revision 7, dated July 11,
1995. Calculation MC5037 indicated that maintaining the level above the Technical
Specification limit of 458,000 gallons would ensure that 350,000 gallons would be
available for emergency core cooling. The licensee calculated the available volume
by subtracting the volume remaining in the tank, when swap-over to the
- containment sump is initiated, from the total available water maintained in
accordance with the technical specification limit. Calculation MC5037 determined
the volume available to allow the valves to swap-over by subtracting the water
below the bottom of the suction piping from water remaining when swap-over is
initiated, in both of these calculations, the licensee considered instrument
uncertainty.
The team reviewed Calculation MC5037 and observed that Revision 7, dated
July 11,1995, determined that instrument uncertainty was 4.38 percent. The team
determined that the uncertainty calculation was completely invalid, in that it
assumed that most sensors uncertainties did not exist, and incorrectly calculated the
remaining uncertainties. The team discussed Calculation MC5037 with the licensee.
! The licensee agreed that the instrument uncertainty calculation was incorrect and
documented this problem on Condition Report 97-14434.
The licensee performed a preliminary' uncertainty calculation and determined that the
actual uncertainty was 4.09 percant. The licensee considered that this preliminary
calculation bounded the incorrect calculation. However, the team reviewed the
25
L
,
_ ..
N
._
.
.
preliminary calcu' tion and observed that the licensee had included a random,
independent 1.0 percent process uncertainty. The team questioned this uncertainty
for the reasons discussed above for VCT level uncertainties. The licensee stated
that they planned to perform a more detailed uncertainty calculation as part of
Condition Report 97 14434.
Tnis issue will remain open pending an NRC review of the final uncertainty
calculation to determine whether or not the licensee has adequately accounted for
level instrument uncertainties associated with maintaining an adequate usable
volume in the RWST.
When determining net positive suction head available, the team observed that the
licensee took credit for the volume of water from the low-low alarm / swap-over poir't
of 11 percent all the way down to the bottom of the downward facing suction
piping. The licensee calculated the maximum flow rate to be 22,200 gpm, which
was also specified in the Updated Final Safety Analysis Report. The team
considered that, at the flow rates discussed in the Updated Final Safety Analysis
Report, vortexing would cause air ingestion and loss of net positive suction head to
ECCS pumps before the bottom of the 24 inch diameter suction piping was reached.
The downward facing suction intake was located one foot from the bottr.m of the
tank, with the centerline of the p:pe exiting the tank at the three foot lesel. The
licensee stated that they did not expect that the RWST level would actuelly drop to
the bottom of the suction piping. However, they had not calculated the minimum
expected level. The team calculated that, based on instrument uncertainties, the
low low alarm / swap-over start point, and 11,100 gallon allowance for swap-over
valve operations, the required levelin the tank would be approximately 2.75 feet
above the bottom of the tank, which is below the center line of the suction intake
pipe.
The team asked the licensee for a calculation or test which indicated that air would
not be ingested into the ECCS pump suction piping due to vortexing in the RWST.
The licensee provided the team with a drawing which showed that a deck grating
vortex suppressor was installed around the suction inlet inside the RWST Drawings
for this vortex suppressor indicate that it was approximately four feet,10 inches
long; six feet wide; and two feet high. The licensee stated that, based on a review
of criteria provided in Regulatory Guide 1.82, " Water Sources for Long-Term
Recirculation Cooling Following a Loss-of-Coolant Accident," Revision 2, they
concluded that the design of the vortex suppressor in the RWST would ensure that
vortexing would not cause air ingestion above the team's calculated 2.75 feet.
However, the licensee had no calculation, test or analysis N support this conclusion.
The team observed that the vortex suppressor in the RWST did not meet the design
criteria discussed in Regulatory Guicio 1.82 as acceptable to limit air ingestion.
Subsequent to the onsite inspection the licensee provided an additional informal
calculation to support their view that the installed configuration was operable and
that unacceptable pump air ingestion would not occur. The team noted that the
26
- .-- - . . . .- - - -. . .- - -.
.-
I
l
.
minimum expected level of the RWST was not clearly defined in either the
- calculation or the UFSAR. Therefore it was difficult to accurately assess the
licensee's application of Regulatory Guide 1.82 test data. The licensee agreed that
they had not clearly documented their design basis. They planned to revise 1
Calculation MC5037, and perform an evaluation to correct and clarify their design
and licensing basis for the minimum RWST level and maximum expected flow at i
swap-over, and any other assumptions necessary_to assess air ingestion potential.
)
'
- This item remains open pending additional NRC review of the finalized calculation,
the safety evaluation for the change in UFSAR design assumptions, and the
application of Regulatory Guide 1,82 data to the vortex suppressor configuration.
This inspection will be performed to confirm the licensee has successfully assured
that the automatic RWST/ containment sump swap-over would be reliable and that
air binding of the ECCS pumps would not occur.
AFST Usable Volume and LeveLinstrument Setnoints
The team reviewed the instrument Jncertainty calculations associated with the
AFST and noted that Calculation MC6082, " Misc. AFST Losses," Revision 2,
determined that instrument uncertainty was 2.87 percent of instrument span, which
was equivalent to approximately 15,500 gallons. When the team requested the
uncertainty calculation for review, the licensee provided a new preliminary
calculation which indicated that instrument uncertainty was equivalent to
20,500 gallons. This potentially reduced the available design margin for the AFST
by 5000 gallons. The licensee issued Condition Report 97-15906 to validate the
preliminny calculation and update the AFST calculation, as necessary. The team
reviewtJ the licensee's preliminary calculation and considered the calculation
reasonable, although a detailed validation was not accomplished.
During discussions with the licensee, the team determined that this potential
nonconservatism was identified several weeks ago. The item was being tracked as
an action that was added to Condition Report 97 15807 when a contractor first
identified the potential nonconservatism. The team noted that the condition report
was not identified as a condition adverse to quality requiring prompt corrective
action.
.
The team also noted that the calculation of record only included a design margin of
approximately 6500 gallons between the estimateo worst case required volume of
auxiliary feedwater and the amount of usable auxiliary feedwater maintained by the
technical specification limit. Similar to the discuseions in Section E7.1, the team
determined that a potential 5000 gallon reduction in design margin should have been
viewed as a condition adverse to quality.
27
_ _. . . . . . ._
. _ . . ..- .-
'
.
.-
' This issue will remain open pending an NRC review of the final uncertainty
calculation to determine whether or not the licensee has adequately accounted for
levelinstrument uncertainties associated maintaining an adequate usable volume in
the AFST.
To estimate the amount of auxiliary feedwater needed to achieve residual heat-
removal initiation conditions, the licensee calculated tiie losses expected to occur
- during system operation. The team reviewed Calculation MC6082 and determined
that with one exception the calculation conservatively modeled losses associated
with each case considered. The exception was that the licensee had modeled the
reserve required to prevent vortex formation without considering all flows. The
licensee had not included flows associated with postulated pipe breaks and valve
f ailures. -The licensee agreed and evaluated the discrepancy and determined that
even af ter including the additional flow the specified vortex reserve was sufficient.
.They planned to revise their calculation to correctly determine the necessary vortex
reserve.
This issue will remain open pending an NRC review of the final loss calculation to
determine whether or not the licensee has adequately accounted for vortex reserve
associated maintaining an adequate usable volume in the AFST.
Dearaded Grid Voltana Relav Setooint I
The team reviewed Calculation EC5052, " Degraded and Undervoltage Protection,"
Revision 3, dated August 7,1997, which determined the adequacy of the degraded
grid relay trip setpoint to ensure that the grid source would trip before Class 1E
equipment became inoperable, due tn low voltage. The team observed that
Revision 3 changed the calculation of instrument uncertainties for +he relay. The
team considered that this uncertainty calculation was inadequate because it did
not include any uncertainty for calibration accuracy or follow the licensee's
dpproved setpoint program guidelines. The licensee agreed that the uncertainty
calculation within Calculation EC5052 was incorrect. The licensee issued Condition
Report 97-15658 to correct the calculation. The licensee performed a preliminary
uncertainty calculation and concluded that the actual uncertainty was less than that
indicated in Calculation EC5052.- The team reviewed the preliminary calculation and
, agreed.
This issue remains open pending further NRC review of the finalized uncertainty
calculation.
Comoonent Coolina Water (CCW) Surae Tank Volume
.,
During review of calculations associated with the component cooling water system
the team identified that Calculation MC6007, "CCW Surge Tk Vol & Lev,"
Revision 1, dated January 15,1987, and Calculation ZC6019, "lLUE and
.
Determination of Trip Setpoint(s) for CCW Surge Tank Level NNS isolation,"
Revision 1, d' ated March 24,1986, calculated the volume of the surge tank by
. 28
i
._ $
l
.
.
different methods and indicated different volumes. The licensee indicated both
calculations were active, but had different purposes. The team discussed the two
calculations with the licensee. The licensee concluded that Calculation MC6007
was correct and that Calculation'ZC6019 was wrong by about 400 gallons. The
licensee issued Condition Report 97-14448 to correct Calculation ZC6019. The
licensee concluded that there were large margins for setpoints determined in
Calculation ZC6019 and that the error did not affect tank operability. The team
reviewed the calculations and agreed with the licensee's conclusions.
c. Conclusions
Based on a sample review, the team concluded that the licensee's setpoint guidance
procedure was technically adequate.
Based on a review of twenty setpoints which had been identified as potentially
having no basis, the team concluded three of the setpoints had a weak calculation
basis.
Based on a random sampling of existing safety-related plant process values, the
7
team concluded that appropriate uncertainty calculatiens had not always been
"
accomplished through the end of 1996. The calculations for four of six process
values were incorrect and required revision. The team also determined that the
analytical basis for preventing air ingestion into the ECCS pumps from the RWST,
during swap-over to containment sump, was not adequate.
1
The unresolved item remains open pending completion of the new followup
inspections described above.
E8.3 (Closedi Licensee Event Reoort 50-49 1 499/97-06: Inappropriate =.urveillance
procedure monitoring parameters,
a. Backaround
On May 7,1997, the licensen identified that the operator log surveillance procedure
for reactor coolant system riterage temperature did not take into account i'istrument
measurement uncertainties to ensure that actual reacto; Mr+ system
temperature was less than the safety analysis limit. The safety analysis simit of
598*F was developed in support of the Vantage SH fuel upgrade, submitted in
license amendment application ST-HL AE-4364 dated May 27,1993. This analytical
limit was incorporated into the Technical Specifications on May 27,1994,
b. Insoector Followuo
{
The team reviewed the basis for Technical Specification Surveillance
Requirement 4.2.5.1 and the licensee's calculation for establishing the
measurement uncertainty associated with wide range reactor coolant system
average temperature, Calculation ZC7002, " Analysis of uncertainties for the DNB
29.
_ - - - _ - - - _ - - )
~ .ex-+, .a = + e 4 . . + . . . . 1-mn -
+=s - an... ..m - ,am, y s .an -.a..r. u __ - - .. . . a .4
. .
y
- . [
Related Parameter .- Tavr ." Revision 0, issued on July 7,1987. The team observed
that the technical spec wation basis in the license amendment annotated that the'
temperature limit was palytical, and that the measured value needs adjustment to
'
account for measurement uncertainties before comparison with the required limit.
The team noted that 10 CFR Part 50, Appendix B, Criterion lil, " Design Control,"
~
L requires that measures shall be established to assure that apolicable regulatory
- requirements are correctly translated into procedures. The team determined that' ;
the licensee had identified an apparent design control violation, which lasted from l
May 27,1994, to May 7,1997, related to translation of measurement uncertainties .!
(50-498; 499/9724-07). I
The team found that Calculation ZC7002, had annotated a 3.5'F uncertainty for
average temperature of the reactor coolant system, which when subtracted from the -
safety analysis limit of 598 F resulted in an upper indicated value of 594.5'F. The-
team noted that the licensee stated in Licensee Event Report 50-498/97-06 that a ,
temporary operationallimit of 593*F was established for e"erage reactor coolant
temperature. The team determined this value was conse- itive
The team reviewed current surveillance procedure, Procedure UPSP03-ZQ-0028,
" Operator Logs," Revision 33, dated August 21,1997, associated with setpoint
calculations for departure from nucleate boiling parameters to assess the long term
corrective actions, associated with Licensee Event Report 50 498/97-06. The team
fourvd that the operator logs used to perform the surveillanca for ensuring that
-average coolant temperature is within the safety analysis indicated an upper limit'of
595'F, which did not aopear to be conservative.
The team questioned the licensee's implementation of a less conservative
uncertainty in the surveillance procedure compared with the information provided in
- the design calculation. Plant personnelinformed the team that vendor information
regarding departure from nucleate boiling parameters was provided in
,
Letter ST-WN HS-97 0018, dated June 30,1997. The team observed that the
uncertainty for average coolant temperature as stated in the June 30,1997, letter
was 2.1'F, which implied an upper limit for indicated average temperature of
' 595.9'F, which was_ consistent with the techrncal specification surveillance limit
indicated on the operator logs. Plant personnelinformed the team that Condition
Report 97-14628 was subsequently issued to void Calculation ZC7002.
~ The team questioned the basis for selecting the less conservative value supplied via
= a letter compared with the design calculation information. Plant personnel were
,
unable to provide the basis for selecting the less conservative value. After NRC
questioning, the licensee requested a copy of the vendor calculation and evaluated
the differences between the two calculations. The licensee was able to
_
, .
-
demonstrate that the information provided in Letter ST-WN-HS-97-0018 was
i' . correct.
4
30
1
1
A. , _ _ - . . . _ . _ - ., - - - ig.. , . .~ _
- -. . ~ - .- . - .. - - ...
.
e
9
~
~
The team was concerned that a sclection of uncertainty parameters regarding a -
parameter significant for monitoring departure from nucleate boiling was made
without performing a technical review or evaluation to. understand the basis of
. vendor supplied information that was in conflict with ir. formation contained in a site
design calculation.
~ 10 CFR Part 50; Appendix B, Criterion 111, reo"hc;; that design changes, including-
field changes, shall be subject to design control measures commensurate with those
applied to the original design. South Texas Operations Quality A ssurance Plan,
Chapter 6.O! Section 5.5, states that measures shall be established to control the
approval, issuance and changes of design documents to prevent the inadvertent use
of superseded design information.
Section 1.13 of Procedure OEP-3.07Q "Prepaiation of Engineering Calculations,"
~
Revision 4, states, in part. " Design calculations which are no longer required to
support design activities are to be voided..."
The team determined that use of vendor information to revise a surveillance
- procedure without voiding the conflicting site calculation and without understanding
the technical basis for the reduction in uncertainty was an apparent design control
violation related to use of vendor informat;on and control of superseded documents
(50 498;-499/9724-08). .
c. Conclusions
The licensee identified an apparent design cont.ol violation related to failure to
translate instrument measurement uncertainty into surveillance procedures. The
NRC subsequently identified and apparent design control violation related to the
f ailure to adequately review vendor information and failure to control superseded
documents. These were apparent violations of 10 CFR Part 50, Appendix B,
Criterion 111.
V. Management Meetinas
X1 Exit Meeting Summary
The team met with the management of South Texas Project Electric Generating Station on
October 20,1997 to conduct an exit interview. During the exit, the licensee provided
additionalinformation, including their basis for requesting reconsideration of two proposed
violations. Following the exit, the team considered the licensee's comments, performed
- additional research and concluded that the licensee position was correct. The NRC
reviewed the remaining proposed enforcement actions and determined a predecisional
escalated enforcement nieeting was warranted. A subsequent exit interview was
- conducted by telephone on November 12,1997, to discuss the change in characterization
of the findings.
I 31
i
h -.
I
i
'
- , _ _ . _ . .
.. . .- . _ . . . ._ _ . . - . . _ _ _ . . _ . . _ . _ . _ _ -- _ --
- ..
.,p'
,
--
1,1
, - Durh.g the inspection the_ licensee provided several proprietary documents to.the team. . For
' - the most parti these documents'had previously been submitted to the agency and they .
'
E- -fw'ere ac'cepted by the NRC staff as being proprietary documentsi All proprietary
- documents were returned to'the licensee. .
'
.
.
'
.-'
t
7'
a
,
.
32.
I .,
..
l,
________ _ _ ___
m
i
4
ATTACHMENT 1
SUPPLEMENTAL INFORMATION
PARTIAL LIST OF PERSONS CONTACTED
4
Licensee -
' C. Albury, Superves;9r, Nucleer Fuel and Analysis
M. Campbell, Engineer, Plant Auxiliary Section, DED
1 J. Carbone, SGRP inc. Project Engineer -
T. Cloninger, Vice President, Nuclear Engineering .
!
J. Cottam, Plant Auxiliary Supervisor, DED
.W. Cottle, Executive Vice President
- D,' Gore, Supervisor, Nuclear Fuel and Analysis
- J. Groth, Vice President, Nuclear Generation
W. Harrison, Senior Consulting Engineer
S. Head, Sr. Consulting Engineer, Licensing
- B. Humble, Plant Auxiliary Supervisor, SED
M. Kanavos, Manager, Mechanical / Civil Engineering
A. Kent, Manager, Electrical and Instrumentation and Control Systems
R. Kersey, Engineer, N&SSS Section, DED
T Koser, Licensing Engineer
D. Leazar, Manager, Nuclear Fuel and Analysis
M. McBurnett, Licensing Manager
C. Pham, Engineer, Balance of Plant Section, DED
D. Rencurrel, Manager, Electrical /l&C, DED
- Vi Starks, Design Engineer
S. Thomes, Manager, Design Engineering Department
B. Wellborn, Supervisor, l&C Design
'NBC
- D. Loveless, Senior Resident inspector
INSPECTION PROCEDURES USED
37550 Engineering
37001 =10 CFR 50.59 Safety Evaluations
. ITEMS OPENED. CLOSED. AND DISCUSSED
,
1
_ _ _ _ _ - _ _ _ _ _ - - _
. - . - ---. - ~ - - .- - -
,
.
~.
e
Ooened
50-498;-499/9724 01 APV M&TE accuracy assumptions included in the_ process -
instrument uncertainty calculations were apparently not
translated to the process instrument calibration surveillance
procedures as required by 10 CFR Part 50, Criterion lli
(Section E3.1).
50-498;-499/9724-02 APV Excessive uw -f amendments resulted in desicn changes
which were apparently not subject to design ce,atrol
measures commensurate with those applied to the original
design as required by 10 CFR Part 50, Criterion 111
(Section E7.1).
50-498;-499/9724-03 APV Calculations were not being updated or evaluated when the
design inputs were changed. As a result the current design
calculations were apparently not being controlled-
commensurate with the original design as required by 10
CFR Part 50, Criterion lli (Section E7.2).
50-498; 499/9724-04 URI Two UFSAR Inaccuracies were identified: 1) inaccurate
description of usable AFST volume and 2) inaccurate
description of purge volume (Section E7,3).
50-498, 499/9724-05 APV Lack of procedural requirement to evaluate calculation
charges for impact on the UFSAR results in an apparent
f ailure to perform a safety evaluation required by
10 CFR 50.59 (Section 7.4).
50-498; 499/9724-06 APV Apparent failure to promptly identify and correct setpoint
calculation deficiencies identified in 1992 and 1995 as
required by 10 CFR Part 50, Appendix B, Criterion XVI
(Section E8.1).
'
50-498;-499/9724-07 APV Licensee identified failure to translate instrument
uncertainty for t,y into operations surveillance procedure is
an apparent violation of 10 CFR Part 50, Appendix B,
Criterion 111 (Section E8.3).
50-498; 499/9724-08' APV Failure to evaluate a design change related to instrument
uncertainty for t,y and f ailure to void the superseded calc
is an apparent violation of 10 CFR Part 50, Appendix B,-
Criterion ill (Section E8.3).
Closed
2
.
.. - . _.. .
,
-
1
.A-
.;' 4
. .
l
50 498;.-499/9609-01 IFl - Review of licensee's self assessment and followup of
actions taken to evaluate apparent discrepancies in the-
setpoint program.-
,50-498;-499/97 06
_
lLER- Inappropriate surveillance procedure monitoring
parameters.
Discussed
50-498;-499/9716 01 URI Review of the safety impact of the licensee's decision to
defer planned setpoint program improvements. {
LIST OF ACRONYMS USED
'AFST auxiliary feedwater storage tank
&
CCW- component cooling water
cfm cubic feet per minute
CR condition report
CVCS chemical volume and control system
DBD design basis document
-DNB departure from nucleate boiling
ECCS - emergency core cooling system
EOP- emergency operating procedures
gpm gallons per minute
HELB- high energy line break
HVAC . heating ventilation and air conditioning
ILUE instrument loop uncertainty evaluation
LOCA - loss of coolant acciderit
LOOP loss of offsite power
M&TE measuring and test equipment
NNS nonnuclear system
3
.
9
- -- -
, , -
, - _ _
_ . - _
,, ._
. , . %
- , a i
g .-.
< +
NPSH: inet positive suction head
psig : pounds per square inch gage:
OPDS; 7 quality parameter display system
RCS . reactor coolant system ,
RHR residual heat removal system -
-RSB, -Reactor Systems Branch
. RWSTE .siuehng water storage tank
PWR- pressurized water reactor
SER. Safety Evaluation Report
SR- ' surveillance requirement
(.STPEGS - So'uth Texas Project Electric Generating Station
-TDH total developed head
TS technical specification
-TADOT:- trip actuating device operational test
UFSAR Updated Final Safety Analysis Report
- USQE unreviewed safety question evaluation
VCT. volume control tank
DOCUMENTS REVIEWED
Unreviewed Safety Question Evaluations-
Number Title Revision
USOE 95-0001 UFSAR Section 6.2.6.1 and Table 6.2.6- Revision 0
1 (Allow Flexibility in Selection of
Systems / Penetrations not to be Vented
During a Type A Test)
EUSOE 95-0011 ~ RCS Administrative Cooldown Limit Revision O
USOE 95-020- This Change will Limit the Accumulator Revision O
Water Temperature to Less Than or
Equal to 90 Degrees Fahrenheit
- _.
,
.
4
-
+-
4
.
USOE 95-0028 - (Modify UFSAR Description of Reactor Revision O '
-Vessel Stud Tensioner
- USOE 96-0004 - Mid Loop Flow lncrease from 1500 -
.
Revision 0
' gpm/RHR Tra'n to 3000 gpm/RHR Train
J USOE 96 0014 - Plant Cooldown with Control Rods - Revision O .
Partially Withdrawn
. USOE 96-0016 Temporary Modification T2 96 4520-4, Revision 0
- Defeat of the Electrical Overspeed Trip
for the Main Turbine Generator
USOE 96-0101 - Control Room Envelope HVAC - Revision 0
Emergency Makeup Flow Control
Damper B2HEFCV9585 Temporary
Modification
USOE 97-0008 UFSAR Change Notice 2142, Maximum Revision 0
Boron Concentration in Modes 3,4 and
5
10 CFR 50.59 Applicability Screening Reviews
Number Title Re. ision
MOD 87-030 Replace the Transformers in Class-1E Revision O (approved
Channel I and IV Battery Chargers 03/31/94, but not yet
implemented)
DCP 9415610 Four Changes to the OPDS Processirig Revision 0
Algorithms and Display leonics (P:,moval
of Automatic Essential Chilled Water
Flow Control to the Essential Chillers, '
Removal of trie Residual Hert Removal
. Flow Interlock, Modification of the Cold
Overpressurization Mitigation Curve, and
Completion of Adverse Containment
Condition Human Engineering
Deficiency)
DCP 9612225-7- This Change is to Allow the Use of an Revision 0
Alternate Battery (Power Battery
Company P/N PRC636) in Emergency
Lighting Fixture Model M 19
5-
.. . .. . . .
. _ - _ _ _ _ - _ - _ _ _ - _ _ _ __. _. A
'n - --- - - _ __
.
. .
l
Clarify Wording of UFSAR Section Supplement 0
DCP 97-9555 4
9.5.3.2.3 in Order to Remove Ambiguity
in Statement Describing Sealed Beam
Battery Pack Units as Seismically
Supported Only and Remove Possibility
of Interpretation as Seismically Qualified
Clarify References to "1/2T Compact 02/21/97
CN 2134/97-646
Tension (CT) Fracture Mechanics Test
Specimens" in UFSAR Sections 5.3.1.6
and 5.3.2.1
Calculations
Title Revision
Number
Class 1E Standby Diesel O
Generator Loading Analysis
Voltage Regulation 6
Auxiliary Power System Load 4
Study
Class 1E Battery, Battery 10
Charger, and Inverter Sizing
Degraded and Undervoltage 3
Protection
Class 1E Battery Duty Cycle 0
in Station Blackout
BAT LevelInstrument 0
JC5280
Uncertainties /Setpoints
AFW Suction Line Sizing and 2
Pump Available NPSH
Determination / Validation of 7
RWST Level Setpoints
MC5041 Design and Operating 1
Pressure and Temp of the
Containment Penetrations
AFW Pump Discharge 4
Pressure
6
- - _ - - - _ - _ - _ - _ _ _ - _ _ . -
. - . . .
= . - ~ . - ~ . - . . - - . . - . - - . _.
a
4
.
MC5056 Auxiliary Feedwater (AFW)- 1 >
Control Valve Sizing - 1
' MC5057 - Maximum and Minimum- 3 r.:nended . l
Flow Requirements of ;
-
Auxiliary Feedwater System i
MC5060 Auxiliary Feedwater Line 1
)
Sizing ;
MC5861 Auxiliary Feedwater (AFW) 0,1,2,3 I
Pump Design TDH and .
Flowrate
MC5864 AFW Pump Runout Flowrate 2
. MC5871 Verification of AFW 10 1
Minute Unattended
Operation
Regulating Valves -
Anticipated Cycles
MC6007 CCW Surge Tk Vol & Lev 1
MC6082 Misc. AFST Losses 2
MC6092 AFST Volume & Level 2
Setpoints
"- Study Order T-1031 (NEl Transient Voltage Response O
Peebles Electric Products, of the Diesel-Generator
Inc) Units, Trains A,- 8, & C to
Postulated Emergency
Loading
Temperature Switches
ZC6019 ILUE and Determination of 1
Trip ~Setpoint(s) for CCW
Surge Tank Level NNS
isolation
ZC7002- '
Analysis of Uncertainties - 0'
for the DNB related ~
, parameter'- Tavg
7
<-
t
!
- , - , , , , - . -
--, .
- - . . - - . , . . -
.-- - . -
,
4 --
3
- .
iRHR Closure Alarm- -O
' Setpoint_- Surtion Valves
Drawings
Number ~ Title - Revision
. D 781247_ - Stainless Steel Liners For =15
Storage Tanks
- 35520 Auxiliary Feedwater Pump ; superseded ,
Curve
46306= Auxiliary Feedwater Pump 6/22/95 ~
Curve
3G69PAF602- Auxiliary Feedwater "AF"- Sheet 15/R6-
SS141FOOO24 Piping and Instrument 2 ,
Diagram Auxiliary
SS199FOOO2O Piping and Instrument 26 ,
Diagram
Condensate Storage
5Z121Z50001 Sh 8 Delta T and T average O
SZ121Z50001 Sh 9 RCS Hot Leg Temp NR O
,5R 17 9-Z-42410 Letdown isolation Valves 8
Logic
,
9-E DJAA-01 #1 125VDC Class 1E 13
Distribution SWBD E1 A11
9 E DJAB-01 #1 125VDC Class 1F 14
Distribution SWBD E1D11
9-E-DJAC 01 #_1 125VDC Class 1E 13
D stribution SWBD E1811-
r 9 E DJAD 01 #1 125VDC Class 1E 11
. Distribution SWBD E1C11
' Modification Packages
Number . Title Revision
-
- 8
- - - . . - . - . . - --
r
" $' ,
f .
E C 6 2-: Electrical Calc. 0-
EC 32 : - Calculation / Load Study 0
EC 49: -
- Electrical Calc./ Load Study ' O-
.PCF 308010A -Change the VCT to RWST O
Switch Over and Low Low-
Alarm Set Point from 1% to.
3% VCT Level-
PCF 176712 - Add Lighting at the O
Chemical Feed Skid -
PCF 211205 Add Lighting Around the O-
. Steam Generator Startup .
Feed Pump
ECN 88 L-OO10G . Provide Permanent Power 0-
to Trailer
- ECN 88E344A Change Unit 1 Spray 0
Additive Tank Alarms -
MDCN 9003704 Provide Enclosure for Tech O
Support Center Diesel
Generator - Unit 1
!
Procedures and instructions -
- Number Title Revision
Procedure OPGPO5 ZA- 10 CFR 50.59 Evaluations 6
0002
Procedure OPGPO3-ZE- Procedure Preparation- 12-
- 0005
Procedure OPSPOS-MS- Main Steam Pressure Loop 1
0514LL Calibration
Procedure OPSPOS RC-
'
RCS Flow Transmitter- 0
0417 Calibration
i
'
9
(::
-o
%
.-
Procedure OPMPOS-ZE- Calibration of ITE-27 Relays 3
0034
Procedure OPSP06-PK- 4.16KV Class 1E Degraded 4
0005 Voltage Relay Channel
Calibration /TADOT-Channel
1
Procedure 5Z120ZO1028 Design Criteria for O
Instrument Loop
Uncertainty and Setpoint
Methodology
Procedure OPSP03-SI-0020 Safety injection System 2
Miscellaneous and Train
1 A(2A) Valve Operability
Test
Procedure OEP 3.07Q Preparation of Engineering 4
Calculations
Procedure OPSP03 ZQ- Operator Logs 32 & 33
0028
Procedure EOPT-03.25 STPEGS EOP Technical 5
Guidelines
Procedure 52529ZB01024 DBD EOP Setpoints O
Procedure 5Z529Z901003 EOP Sctpoint Document 1
Procedure 3ZO10ZO1027 Design Criteria for 2
Instrument Scaling
Methodology
Procedure OPGPO4-ZA- Piant Instrumentation 1
0011 Scaling Program
Procedure OPMP08-Zl- Generic Temperature 12
f. 0011 Switch Calibration
Procedure OPGPO3-ZM- Installed Plant 13
0016 instrumentation Calibration
Verification Program
Procedure OPSP06-DJ- 125 Volt Class 1E Battery 2
0004 Service Surveillance Test
Procedure OPSP06 DJ- 125 Volt Class 1E Battery 2
0002 Quarterly Surveillance Test
10 ,
. - - - _ _ _ - _ .
_ _ _ _
o
i
,
Procedure OPSP06-0J- Battery Charger 8 Hour 5
0006 Load Verification
Condition Reports (CR) and Nonconformance Evaluations
Number Title initiation Date
CR 9714434 Comparison of Revision 7 09/16/97
of the RWST Determination
of Level Setpoints
Calculation to the UFSAR
-CR 97-15906 Provide an Instrument 10/02/97
Uncertainty Calculation in
Support of AFST Level
Instrument Setpoints
'CR 9714448 Resolve Discrepancy 09/16/97
Between Calculation
MC6007 and ZC6019
CR 97-14670 investigate the Possible 09/18/97
Revision of TS SR 4.5.6.2A
CR 97-14608 Evaluate impact of Large 09/24/97
Number of Amendments to
Electrical Calculation
CR 97-15708 Calculate of VCT
Instrument Uncertainties
CR 97 238 Action 104 Ensure that M&TE
Requirements are
Accounted for in
Procedures
CR 97-15658 Correct instrument
Uncertainties in Calculation
CR 9510936 Potential for Simultaneous 09/21/95
Start of Containment Spray
Pump and Other EAB
Chillers During a LOOP with
11
I
.. .. .-
_ _ _ _ _ _ _ _ _ _ _ _ _ - _ _
[= <
j
.
j-
-o -
CR 97714628l Revise , Void, or Retire DNB 09/18/97
.
!
. parameter calculation
CR 97 8349 incorrect limits for DNB - 05/07/97-
parameters used in
surveillance T/S '4,2.5.1
-
\
- Miscellaneous
Number- . Title - Revision
Design Basis Document Auxiliary Feedwater System Revision 2
- 5S149MB1016 :
Design Basis Document Reactor Coolant System Revision 2
- SR149MB1027
Design Basis Document - Residual Heat Removal Revision 3
SR169MB1021 System
Design Basis Document Class 1E 125V DC System O <
4E529EB1111
License Amendment 63/52
License Amendment 73/62
Technical Specifications
Updated Final Safety Revision 5
Analysis Report
u-
i
e
$
V
D
.,
12
Ty
1
J
--