ML20205A160

Insp Repts 50-498/99-04 & 50-499/99-04 on 990222-25. Violations Noted.Major Areas Inspected:Maint

ML20205A160
Person / Time
Site:	South Texas
Issue date:	03/24/1999
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV)
To:
Shared Package
ML20205A123	List: IR 05000498/1999004 ML20205A120 ML20205A160
References
50-498-99-04, 50-498-99-4, 50-499-99-04, 50-499-99-4, NUDOCS 9903300308
Download: ML20205A160 (12)

See also: IR 05000498/1999004

Text

. . .

- _ _ _ _ _ - _ _ - _ _ _ _ _ _ _ _ _

.

'~

)'

ENCLOSURE

U.S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket Nos.: 50-498;50-499

License Nos.: NPF-76; NPF-80

Report No.: 50-498/99-04;50-499/99-04

Licensee: STP Nuclear Operating Company

Facility: South Texas Project Electric Generating Station, Units 1 and 2

Location: FM 521 - 8 miles west of Wadsworth

Wadsworth, Texas

Dates: February 22 to 25,1999

Inspectors: P. Gage, Senior Reactor inspector, Operations Granch

P. Balmain, Operations Engineer, Office of Nuuoar Reactor Regulation

P. Wilson, Senior Reactor Analyst, Office of Nuclear Reactor Regulation

Approved By: Dr. Dale A. Powers, Chief, Engineering and Maintenance Branch

Division of Reactor Safety

ATTACHMENT: Supplemental Information

i

"

9903300300 990324

PDR ADOCK 05000498

G PDR

__

,

.

.

2

EXECUTIVE SUMMARY

South Texas Project Electric Generating Station, Units 1 and 2

NRC Inspection Report No. 50-498/99-04; 50-499/99-04

The licensee had developed and implemented a prograrn in accordance with 10 CFR 50.65,

" Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants." One

Non-Cited Violation of the Maintenance Rule was identified.

Maintenance

a

!nspectors identified inadequate reliability performance measures for eight plant risk-

significant systems. As a result of the inadequate performance measures, the 480Vac

load center system for both units was allowed to degrade beyond the probabilistic risk

assessment assumed performance without the licensee having provided Odequate

technical justification for not having established goals, or appropriate corrective actions.

This was a Severity Level IV violation of the Maintenance Rule and is being treated as a

Non-Cited Violation, consistent with Appendix C of the NRC enforcement policy

(EA 99-058). This violation is in the licensee's corrective action program as documented

by Condition Record 99-2925 (Section M1.2).

i

3

l

1

u

,

-

i

j

3-

Report Details  !

Summarv of Plant Status

During the inspection week, Units 1 and 2 operated at or near full power. t

i

Backaround

The licensee had implemented a Maintenance Rule program that endorsed the guidance of q

Regulatory Guide 1.160," Monitoring the Effectiveness of Maintenance at Nuclear Power 1

Plants," and NUMARC 93-01 " Industry Guideline for Monitoring the Effectiveness of

Maintenance at Nuclear Power Plants," with some exceptions noted. NRC Inspection h

Report 50-498;-499/98-01 documented the results of the Maintenance Rule baseline team

inspection.

II. Maintenance

M1 Conduct of Maintenance

M1.2 Safety or Risk Determination

a. Insoection Scope (62706 and 92902)

The inspectors reviewed sensitivity studies that tb nsee had completed to assess

the risk contribution from the postulated unavailatt, .I 9 of the 21 risk significant

systems that were the subject of this inspection. The licensee representative had stated

that the postulated unavailability of these systems would not significantly contribute to

the overall core damage frequency and, therefore, provided an additional basis for not

monitoring unavailability for these systems. The inspectors also reviewed the adequacy i

of reliability performance criteria for several systems to determine if the licensee's f

probabilistic risk assessment reliability assumptions were preserved. J

b. Observations and Findinas I

b.1 Unavailability Sensitivity Studies

The licensee performed unavailability sensitivity studies on nine risk-significant systems. I

These studies were documented in the licensee's Analysis / Assessment Sequence

Numbers PSA-98-05, PSA-98-06, PSA-98-10, and PSA-99-01. The plant systems

included in these studies were as follows: ,

. Qualified Display Processing System (AM)

.

125Vdc Class 1E (DJ)

. Main Steam Syctem (MS)

. 4.16kVac Class 1E Power System (PK)

- Reactor Coolant System (RC)

,

..

r

,

-4-

. Reactor Control System (RS)

- Engineered Safety Features System (SF)

. Solid State Protection System (SP)

. 120Vac Class 1E Power System (VA)

The inspectors noted that these studies evaluated the potential change in core damage

frequency if the probabilistic risk assessment assumptions for unavailability of these

systems were doubled. In each study, the inspectors found that the licensee had

performed full probabilistic risk assessment requantifications. The inspectors reviewed

one additional sensitivity study where the licensee requantified their probabilistic risk

assessment with a postulated solid state protection system unavailability that was

17 times greater than the nominal probabilistic risk assessment solid state protection

system unavailability. The inspectors observed that in all instances, the change in core

damage frequency was small (less than 1 percent).

The inspectors also compared recent actual maintenance unavailability for these

systems with the values assumed in the licensee's probabilistic risk assessment and

found them to be reasonably close in value. Based on the inspectors' review of the

licensee's sensitivity studies, the inspectors concluded that the licensee had adequately

demonstrated that the postulated unavailability of these systems did not significantly

contribute to the overall core damage frequency.

b.2 Reliability Performance Criteria

NUMARC 93-01," Industry Guideline For Monitoring the Effectiveness of Maintenance at

Nuclear Power Plants," Revision 2, Section 9.3.2, states, in part, ". . . that performance

criteria for risk-significant SSCs should be established to assure that reliability and

availability assumptions used in the plant-specific PRA, IPE, IPEEE, or other risk I

determining analysis are maintained or adjusted when determined necessary by the

utility." In general, the inspectors found that the licensee nad established two reliability

performance criteria for each plant system. These were Maintenance Rule functional i

failures and probabilistic safety assessment functional failures. The licensee )

representative stated that the probabilistic safety assessment functional failure was the

criterion that assured that the probabilistic risk assessment reliability assumptions were

maintained. The inspectors observed that there were eight risk-significant systems

where the licensee had not established probabilistic safety assessment functional failure ,

performance criteria, in addition, the inspectors noted that the Maintenance Rule I

functional failure performance criteria established for those systems did not appear to

preserve the probabilistic risk assessment reliability assumptions. As a result of this

observation, the licensee initiated corrective action and documented the problem in

Condition Record 99-2r48. The licensee promptly performed the necessary analyses to

establish appropriate probabilistic safety assessment functional failures for these

systems. The results nf these analyses along with the Maintenance Rule functional

failure performance criteria are documented in the table below.

L

e , _

+

.

5-

x

System MRFF Criteria New PSAFFs

Instrument Air : 5/ unit /18 months 3/ unit /18 months

Qualified Display 6/ unit /18 months 3/ unit /18 months

Processing - '-

480Vac 1E Load 5/ train /18 months or 7/ unit /18 months 1/ unit /18 months

Centers .

480Vac Non-Class 2/ unit /18 months 1/ unit /18 months

1E Load Center

480Vac Class 1E 8/ train /18 months or 15/ unit /18 months 4/ unit /18 months

Motor Control

Centers

Reactor Control - 2/ unit /18 months 1/ unit /18 months

System

Solid State Protection 3/ unit /18 months 1/ unit /18 months

120Vac Vital Power' 3/ unit /18 months 2/ unit /18 months

Based on the results of the licensee's analyses, the inspectors concluded that the

Maintenance Rule functional failure reliability performance criteria did not assure that the

'

licensee's probabilistic risk assessment reliability assumptions were maintained and,

therefore, the reliability performance criteria established for these systems were

inadequate.

10 CFR 50.65 (a)(1) states, in part, that ". . . licensees shall monitor the performance or

conditions of SSCs against licensee established goals, in a manner sufficient to provide

reasonable assurance that such SSCs, as defined in paragraph (b), are capable of -

. fulfilling their intended functions. Such goals shall be established commensurate with

safety and where practical, take into account industry-wide operating experience. When

the performance or condition of a SSC does not meet established goals, appropriate

. corrective actions shall be taken." The inspectors reviewed the recent performance of  !

the above systems and found that there had been six probabilistic safety assessment i

functional failures in Unit 1's 480Vac load centers and three probabilistic safety

assessment functional failures in Unit 2's 480Vac load centers in the most recent 18

' months. However, since the licensee had not established probabilistic safety

assessment functional failure performance criteria for these systems, the licensee had - j

not evaluated these systems for Category (a)(1) nor established system performance

goals and taken appropriate corrective action as required by the Maintenance Rule. As i

a result of this observation, the licensee initiated corrective action and documented the

problem in Condition Record 99-2925.

,

L.

n

.

6-

c. Conclusiong {

The inspectors concluded that the licensee had adequately demonstrated that the

postulated unavailability of nine systems did not significantly contribute to the overall

core damage frequency. However, the inspectors identified inadequate reliability

performance measures for eight plant risk-significant systems. As a result of the

inadequate performance measures, the 480Vac load center system for both units was

allowed to degrade beyond the probabilistic risk assessment assumed performance

without the licensee having provided adequate technical justification for not having

established goals, or appropriate corrective actions. This was a Severity Level IV

violation of the Maintenance Rule and is being treated as a Non-Cited Violation,

consistent with A.ppendix C of the NRC enforcement policy (EA 99-058). This violation

is in the licensee's corrective action program as documented by Condition Record

99-2925.

M1.6 Goal Settina and Monitorina and Preventive Maintenance

a. Inspection Scope (62706)

The inspectors reviewed program documents and records in order to evaluate the ,

process that was in place to establish performance measures for monitoring systems  !

under Category (a)(1), or to verify that preventive maintenance was effective under

Category (a)(2) of the Maintenance Rule. I

The inspectors reviewed in detail the systems described below to verify: that goals or

performance criteria were established with safety taken into consideration; that industry-

wide operating experience was considered where practical; that appropriate monitoring

and trending was being performed; and that corrective action was taken when a

structure, system, or component function failed to meet its goal or performance criteria,

or when a structure, system, or component function experienced a Maintenance Rule

functional failure.

AM Post Accident Monitoring (PAM)

BS 7300 Processor Support

DJ 125Vdc Class 1E

FW Feedwater

HM Mechanical Auxiliar/ Building HVAC

HZ HVAC - Miscellaneous

MS Main Steam

NI Nuclear instrumentation

PC 13.8kVac Auxiliary Power

PE 480Vac Non-Class 1E Load Center

PK 4.16kVac Class 1E Power

PL 480Vac 1E Load Centers

PM 480Vac Class 1E MCC and Distribution Panels

RC Reactor Coolant

RS Reactor Control

L

.

.

-7-

SF Engineered Safety Features Actuation

SG Steam Generator Secondary Side

SP Solid State Protection

VA 120Vac Class 1E Vital Power

<

XC Containment Building

XS, Switchyard System Auxiliary Feedwater

b. Observations and Findinas

As described in NUMARC 93-01, Revision 2, performance includes ". . . to the maximum

extent possible both availability and reliability should be used since that provides the

maximum assurance that performance is being maintained." The inspectors noted that

under the terms of the Maintenance Rule, preventive maintenance must be

demonstrated to be effective in controlling the performance or condition of a structure,

system, or component such that the structure, system or component remains capable of  !

performing its intended function.

The inspectors acknowledged, as stated in NUMARC 93-01, instances where availability

does not provide a meaningful measure of performance and should not be captured.

Examples of accepted structures, systems, and components, such as reactor coolant

system piping or electrical buses, were those which were not taken out-of-service for

any routine testing or surveillance activities during power operations because of their

absolute necessity for operation.

The inspectors found that specific safety functions associated with the electrical loads

were monitored by the corresponding system being supplied in lieu of monitoring the

distribution system. For analogous mechanical systems, such as heating, ventilation,

and air-conditioning systems, unavailability was appropriately monitored at the

supported systems. During the inspectors' review of the facility's risk-significant

structures, systems, and components without specific unavailability criteria, several

systems were found to appropriately satisfy performance monitoring requirements for

the associated structures, systems, and components, including mechanical auxiliary

building heating ventilation air conditioning, miscellaneous heating ventilation air l

conditioning,13.8kVac auxiliary power,480Vac non-class 1E load centers,4.16kVac l

Class 1E power,480Vac Class 1E load centers,480Vac Class 1E motor-control centers

and distribution panels, steam generator secondary side, containment building, and the

switchyard system. Based on the system reviews, the inspectors deM; mined that these

structures, systems, and components were being adequately monitored with appropriate

plant level criteria and reliability performance measures.

The inspectors observed that the steam generator power-operated relief valves, safety

valves, and auxiliary feedwater steam supply were the only high safety-significant

structures, systems, and components in the main steam system that provide standby

functions. The licensee had established availability performance criteria for the steam

generator power-operated relief valves and did not remove safety valves from service

while online. The inspectors noted that should a safety valve need to be removed from

service, performance would be adequately monitored by the plant level criteria. In

.-

_

, . i

.

4

4

-8-

- addition, the inspectors found that the availability of the auxiliary feedwater system

.st eam suppl y was appropr itla e y mon

it ored und er auxiliary f

ee dwa er

t sys tem -

-

. performance criteria.

The inspectors observed that the pressurizer power-operated relief valves and safety

valves were the only high safety-significant components in the reactor coolant system

that provide standby functions. The inspectors noted that online maintenance is not

performed on the pressurizer power-operated relief valves and safety' valves. Licensee {

representatives considered removal of the power-operated relief valves from service as l

. a Maintenance Rule functional failure and would monitor this under the corresponding l

reactor coolant system reliability performance criteria. In addition, the inspectors noted I

that if power-operated relief valves were isolated for extended periods of time because

of excessive seat leakage, as permitted by the licensee's technical specifications, that

the licensee's staff considered the power-operated relief valves available. ,This was

because only one action is needed to be performed by a dedicated operator to restore

the valves to service for their risk-significant function (feed and bleed). The inspectors

- found this monitoring approach acceptable.

The inspectors observed that the licensee did not formally establish specific criteria

associated with unavailability for risk significant systems, which were rendered

unavailable for various routine maintenance testing and surveillance activities. The

' inspectors noted that the affected systems included post accident monitoring,7300 -

processor support,125Vdc class 1E, main feedwater, main steam, nuclear

instrumentation, reactor coolant, reactor control, engineered safety features actuation,

solid state protection, and the 120Vac class 1E vital power system. The inspectors

observed that online maintenance performed on these systems typically involved the

removal or alteration of a normal automatic alignment, involving a channel or train for

relatively short durations of time. Licensee representatives presented the basis for the

program's adequacy as the application of plant level criteria to all risk-significant

systems, and three conservative application points including: (1) loss of redundancy of  !'

a scoped function is a Maintenance Rule functional failure even if the train or system

function was not lost, (2) loss of a scoped function is a Maintenance Rule functional

failure even if the function is not needed in the current plant mode, and (3) failures were

i

considered Maintenance Rule functional failures regardless of whether maintenance

related activities were involved or associated with the failures.

- The inspectors verified that all risk-significant structures, systems, and components .

(with those exceptions documented in Section M1.2) had Maintenance Rule functional i

failure criteria established, no repeat Maintenance Rule functional failures were  ;

^ permitted, and that probabilistic safety assessment functional failure criteria were

established for those systems, which were modeled in the probabilistic safety

assessment. Licensee representatives stated that all unplanned maintenance ,

unavailability was captured as a Maintenance Rule functional failure even if the

Maintenance Rule function had not been lost prior to taking it out-of-service, as

referenced in the licensee's response letter to the NRC, NOC-AE-000132, dated

April 14,1998.

E

p

/

4

.g.

In addition, the licensee management's expectation included that planned maintenance

activities, su::h as routine testing and surveillances, which exceed planned allowed

outage times for completion be characterized as Maintenance Rule functional failures.

The inspectors noted that this was not a formally documented policy within the

licensee's Maintenance Rule program, but found no examples where these conditions

had not been captured as such. The inspectors were provided a copy of Condition .

Record 99-2894, which documented management's intention for capturing unavailability l

related functional failures and to make the necessary formal changes within their

Maintenance Rule program procedures.

The inspectors reviewed Licensee Event Report 98-004, Revision 00, and Condition

Record 98 204565 for the solid state protection system and determined that adequate

evaluations were performed in accordance with management's expectations and the

requirements of the Maintenance Rule. The inspectors considered the capturing of

maintenance performance activities as functional failures with unplanned or untimely

activities as an indirect method of monitoring the associated unavailability of structures,

systems, and components.

c. Conclusions

The inspectors determined that the licensee's approach to monitoring risk-significant

structures, systems, and components to be acceptable.

M8 Miscellaneous Maintenance issues (92902)

M8.1 (Closed) Violation 50-498:-499/9801-01: Failure to include the digital rod position

indication and a control room heating ventilation air conditioning function within the

Maintenance Rule program scope. The inspectors verified that the licensee's staff had

placed the digital rod position indication system and the control room ventilation smo'ke

purge actuation function in the scope of their Maintenance Rule program. In addition,

the inspectors found that adequate historical review for the Maintenance Rule functional

failures resulted in an appropriate classification in accordance with the Maintenance

Rule.

M8.2 (Closed) Unresolved item 50-498:-499/9801-03: Failure to adequately monitor the solid

state protection system. The inspectors verified that the licensee's staff had establ!shed

an indirect method of monitoring unavailability for risk-significant structures, systems,

and components through capturing unplanned maintenance activities or planned routine

maintenance (testing or surveillance) exceeding allowed outage times as Maintenance

Rule functional failures. In addition, the inspectors noted that appropriate unavailability

sensitivity studies for probabilistic safety assessment modeled structures, systems, and

components showed minimal risk impact. The inspectors concluded that the licensee's

actions were considered acceptable.

L __

p

'

i. ,

. *

I -10-

V. Manacement Meetinas I

X1 Exit Meeting Summary

i

The inspectors discussed the progress of the inspection on a daily basis and presented the l

inspection results to members of licensee management at the conclusion of the inspection on I

February 25,1999. The licensee's management acknowledged the findings presented. i

The inspectors asked the licensee staff and management whether any materials examined

during the inspection should be considered proprietary. No proprietary information was -

identified.

During the exit meeting on February 25,1999, the Manager, Systems Engineering, stated STP

Nuclear Operating Company would include the requirement to count as a Maintenance Rule

functional failure any instance where a high-risk system (or one of its trains) that does not have

availability performance criteria is taken out-of service (not performing its risk-significant

function) while at power for corrective maintenance, or any instance when its technical

specification allowed outage time is exceeded, and that this will apply even if no Maintenance

Rule function had been lost prior to taking the system out-of-service.

l

L

i-

I

w..

v

.

9

ATTACHMENT j

SUPPLEMENTAL INFORMATION

'

PARTIAL LIST OF PERSONS CONTACTED

- Licensee

P. Arrington, License Engineering

W. Cottle, President and Chief Executive Officer

R. Grantom, Administrator, Risk Management

J. Groth, Vice President, Generation

R. Harris, Manager, Reliability Engineering

S. Head, Supervisor, License Engineering l

J. Johnson, Manager, Engineering Quality  ;

T. Jordan, Manager, System Engineering

A. Moldenhauer, Probabilistic Risk Assessment Engineer

B. Mookhoek, License Engineering

M. Murray, Supervisor, S stem Engineering

T. Riccio, System Engir sering

J. Sheppard, Vice Prec, dent and Special Assistant to the President

T. Stroschein, Supervisor, Engineering

J. Winters, Maintenance Rule Coordinator j

i

NBC ,

!

N. O'Keefe, Senior Resident inspector

INSPECTION PROCEDURES USED

IP 62706 Maintenance Rule

IP 92902 Followup - Maintenance

ITEMS OPENED. CLOSED. AND DISCUSSED

Opened

50-498;-499/9904-01 NCV Inspectors identified inadequate reliability performance

measures for eight plant risk-significant systems. As a

result of the inadequate performance measures, the

480Vac load center system for both units was allowed to

degrade beyond the probabilistic risk assessment assumed

perforrnance without the licensee having provided

adequate technical justification for not having established

goals, or appropriate corrective actions.

n

.

1

-2-

Closed

50-498;-499/9904-01 NCV inspectors identified inadequate reliability performance

measures for eight plant risk-significant systems. As a

result of the inadequate performance measures, the

480Vac load center system for both units was allowed to

degrade beyond the probabilistb risk assessment assumed

performance without the licensee having provided

adequa e technical justification for not having established

goals, or appropriate corrective actions. 4

/

50-498;-499/9801-01 NOV Failure to include the digital rod position indication and a

control room heating ventilation air conditioning function

within the Maintenance Rule Program scope.

50-498;-499/9801-03 URI Failure to adequately monitor the solid state protection 1

system.

PARTIAL LIST OF DOCUMENTS REVIEWED

Condition Records:

98-20456

99 2743

99 2908

99-2916

99 2925

99-2984

Licensee Correspondence:

.

NOC-AE-000132

NOC-AE-000230

Procedures:

Procedure Title Revision

OPGP03-ZA-0090 Work Process Program 20

OPGP03-ZX-0002 Condition Reporting Process 17

OPSP03-SP-0005R SSPS Logic Train R Functional Test 7

OPSP03 SP-00088 . SSPS Train B Slave Relay Test (Outputs Blocked) 4

OPSP03-SP-0006R Train R Reactor Trip Breaker TADGT 5

OPGP04-ZE-0313 - Maintenance Rule Program 1

4

OPGP03-ZA-0091 Configuration Risk Management Program 0