ML20205A160
| ML20205A160 | |
| Person / Time | |
|---|---|
| Site: | South Texas  |
| Issue date: | 03/24/1999 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV) |
| To: | |
| Shared Package | |
| ML20205A123 | List: |
| References | |
| 50-498-99-04, 50-498-99-4, 50-499-99-04, 50-499-99-4, NUDOCS 9903300308 | |
| Download: ML20205A160 (12) | |
See also: IR 05000498/1999004
Text
. . .
- _ _ _ _ _ - _ _ - _ _ _ _ _ _ _ _ _
.
'~
)'
ENCLOSURE
U.S. NUCLEAR REGULATORY COMMISSION
REGION IV
Docket Nos.: 50-498;50-499
Report No.: 50-498/99-04;50-499/99-04
Licensee: STP Nuclear Operating Company
Facility: South Texas Project Electric Generating Station, Units 1 and 2
Location: FM 521 - 8 miles west of Wadsworth
Wadsworth, Texas
Dates: February 22 to 25,1999
Inspectors: P. Gage, Senior Reactor inspector, Operations Granch
P. Balmain, Operations Engineer, Office of Nuuoar Reactor Regulation
P. Wilson, Senior Reactor Analyst, Office of Nuclear Reactor Regulation
Approved By: Dr. Dale A. Powers, Chief, Engineering and Maintenance Branch
Division of Reactor Safety
ATTACHMENT: Supplemental Information
i
"
9903300300 990324
PDR ADOCK 05000498
G PDR
__
,
.
.
2
EXECUTIVE SUMMARY
South Texas Project Electric Generating Station, Units 1 and 2
NRC Inspection Report No. 50-498/99-04; 50-499/99-04
The licensee had developed and implemented a prograrn in accordance with 10 CFR 50.65,
" Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants." One
Non-Cited Violation of the Maintenance Rule was identified.
Maintenance
a
!nspectors identified inadequate reliability performance measures for eight plant risk-
significant systems. As a result of the inadequate performance measures, the 480Vac
load center system for both units was allowed to degrade beyond the probabilistic risk
assessment assumed performance without the licensee having provided Odequate
technical justification for not having established goals, or appropriate corrective actions.
This was a Severity Level IV violation of the Maintenance Rule and is being treated as a
Non-Cited Violation, consistent with Appendix C of the NRC enforcement policy
(EA 99-058). This violation is in the licensee's corrective action program as documented
by Condition Record 99-2925 (Section M1.2).
i
3
l
1
u
,
-
i
j
3-
Report Details !
Summarv of Plant Status
During the inspection week, Units 1 and 2 operated at or near full power. t
i
Backaround
The licensee had implemented a Maintenance Rule program that endorsed the guidance of q
Regulatory Guide 1.160," Monitoring the Effectiveness of Maintenance at Nuclear Power 1
Plants," and NUMARC 93-01 " Industry Guideline for Monitoring the Effectiveness of
Maintenance at Nuclear Power Plants," with some exceptions noted. NRC Inspection h
Report 50-498;-499/98-01 documented the results of the Maintenance Rule baseline team
inspection.
II. Maintenance
M1 Conduct of Maintenance
M1.2 Safety or Risk Determination
a. Insoection Scope (62706 and 92902)
The inspectors reviewed sensitivity studies that tb nsee had completed to assess
the risk contribution from the postulated unavailatt, .I 9 of the 21 risk significant
systems that were the subject of this inspection. The licensee representative had stated
that the postulated unavailability of these systems would not significantly contribute to
the overall core damage frequency and, therefore, provided an additional basis for not
monitoring unavailability for these systems. The inspectors also reviewed the adequacy i
of reliability performance criteria for several systems to determine if the licensee's f
probabilistic risk assessment reliability assumptions were preserved. J
b. Observations and Findinas I
b.1 Unavailability Sensitivity Studies
The licensee performed unavailability sensitivity studies on nine risk-significant systems. I
These studies were documented in the licensee's Analysis / Assessment Sequence
Numbers PSA-98-05, PSA-98-06, PSA-98-10, and PSA-99-01. The plant systems
included in these studies were as follows: ,
. Qualified Display Processing System (AM)
.
125Vdc Class 1E (DJ)
. Main Steam Syctem (MS)
. 4.16kVac Class 1E Power System (PK)
- Reactor Coolant System (RC)
,
..
r
,
-4-
. Reactor Control System (RS)
- Engineered Safety Features System (SF)
. Solid State Protection System (SP)
. 120Vac Class 1E Power System (VA)
The inspectors noted that these studies evaluated the potential change in core damage
frequency if the probabilistic risk assessment assumptions for unavailability of these
systems were doubled. In each study, the inspectors found that the licensee had
performed full probabilistic risk assessment requantifications. The inspectors reviewed
one additional sensitivity study where the licensee requantified their probabilistic risk
assessment with a postulated solid state protection system unavailability that was
17 times greater than the nominal probabilistic risk assessment solid state protection
system unavailability. The inspectors observed that in all instances, the change in core
damage frequency was small (less than 1 percent).
The inspectors also compared recent actual maintenance unavailability for these
systems with the values assumed in the licensee's probabilistic risk assessment and
found them to be reasonably close in value. Based on the inspectors' review of the
licensee's sensitivity studies, the inspectors concluded that the licensee had adequately
demonstrated that the postulated unavailability of these systems did not significantly
contribute to the overall core damage frequency.
b.2 Reliability Performance Criteria
NUMARC 93-01," Industry Guideline For Monitoring the Effectiveness of Maintenance at
Nuclear Power Plants," Revision 2, Section 9.3.2, states, in part, ". . . that performance
criteria for risk-significant SSCs should be established to assure that reliability and
availability assumptions used in the plant-specific PRA, IPE, IPEEE, or other risk I
determining analysis are maintained or adjusted when determined necessary by the
utility." In general, the inspectors found that the licensee nad established two reliability
performance criteria for each plant system. These were Maintenance Rule functional i
failures and probabilistic safety assessment functional failures. The licensee )
representative stated that the probabilistic safety assessment functional failure was the
criterion that assured that the probabilistic risk assessment reliability assumptions were
maintained. The inspectors observed that there were eight risk-significant systems
where the licensee had not established probabilistic safety assessment functional failure ,
performance criteria, in addition, the inspectors noted that the Maintenance Rule I
functional failure performance criteria established for those systems did not appear to
preserve the probabilistic risk assessment reliability assumptions. As a result of this
observation, the licensee initiated corrective action and documented the problem in
Condition Record 99-2r48. The licensee promptly performed the necessary analyses to
establish appropriate probabilistic safety assessment functional failures for these
systems. The results nf these analyses along with the Maintenance Rule functional
failure performance criteria are documented in the table below.
L
e , _
+
.
5-
x
System MRFF Criteria New PSAFFs
Instrument Air : 5/ unit /18 months 3/ unit /18 months
Qualified Display 6/ unit /18 months 3/ unit /18 months
Processing - '-
480Vac 1E Load 5/ train /18 months or 7/ unit /18 months 1/ unit /18 months
Centers .
480Vac Non-Class 2/ unit /18 months 1/ unit /18 months
1E Load Center
480Vac Class 1E 8/ train /18 months or 15/ unit /18 months 4/ unit /18 months
Motor Control
Centers
Reactor Control - 2/ unit /18 months 1/ unit /18 months
System
Solid State Protection 3/ unit /18 months 1/ unit /18 months
120Vac Vital Power' 3/ unit /18 months 2/ unit /18 months
Based on the results of the licensee's analyses, the inspectors concluded that the
Maintenance Rule functional failure reliability performance criteria did not assure that the
'
licensee's probabilistic risk assessment reliability assumptions were maintained and,
therefore, the reliability performance criteria established for these systems were
inadequate.
10 CFR 50.65 (a)(1) states, in part, that ". . . licensees shall monitor the performance or
conditions of SSCs against licensee established goals, in a manner sufficient to provide
reasonable assurance that such SSCs, as defined in paragraph (b), are capable of -
. fulfilling their intended functions. Such goals shall be established commensurate with
safety and where practical, take into account industry-wide operating experience. When
the performance or condition of a SSC does not meet established goals, appropriate
. corrective actions shall be taken." The inspectors reviewed the recent performance of !
the above systems and found that there had been six probabilistic safety assessment i
functional failures in Unit 1's 480Vac load centers and three probabilistic safety
assessment functional failures in Unit 2's 480Vac load centers in the most recent 18
' months. However, since the licensee had not established probabilistic safety
assessment functional failure performance criteria for these systems, the licensee had - j
not evaluated these systems for Category (a)(1) nor established system performance
goals and taken appropriate corrective action as required by the Maintenance Rule. As i
a result of this observation, the licensee initiated corrective action and documented the
problem in Condition Record 99-2925.
,
L.
n
.
6-
c. Conclusiong {
The inspectors concluded that the licensee had adequately demonstrated that the
postulated unavailability of nine systems did not significantly contribute to the overall
core damage frequency. However, the inspectors identified inadequate reliability
performance measures for eight plant risk-significant systems. As a result of the
inadequate performance measures, the 480Vac load center system for both units was
allowed to degrade beyond the probabilistic risk assessment assumed performance
without the licensee having provided adequate technical justification for not having
established goals, or appropriate corrective actions. This was a Severity Level IV
violation of the Maintenance Rule and is being treated as a Non-Cited Violation,
consistent with A.ppendix C of the NRC enforcement policy (EA 99-058). This violation
is in the licensee's corrective action program as documented by Condition Record
99-2925.
M1.6 Goal Settina and Monitorina and Preventive Maintenance
a. Inspection Scope (62706)
The inspectors reviewed program documents and records in order to evaluate the ,
process that was in place to establish performance measures for monitoring systems !
under Category (a)(1), or to verify that preventive maintenance was effective under
Category (a)(2) of the Maintenance Rule. I
The inspectors reviewed in detail the systems described below to verify: that goals or
performance criteria were established with safety taken into consideration; that industry-
wide operating experience was considered where practical; that appropriate monitoring
and trending was being performed; and that corrective action was taken when a
structure, system, or component function failed to meet its goal or performance criteria,
or when a structure, system, or component function experienced a Maintenance Rule
functional failure.
AM Post Accident Monitoring (PAM)
BS 7300 Processor Support
DJ 125Vdc Class 1E
HM Mechanical Auxiliar/ Building HVAC
HZ HVAC - Miscellaneous
MS Main Steam
NI Nuclear instrumentation
PC 13.8kVac Auxiliary Power
PE 480Vac Non-Class 1E Load Center
PK 4.16kVac Class 1E Power
PL 480Vac 1E Load Centers
PM 480Vac Class 1E MCC and Distribution Panels
RS Reactor Control
L
.
.
-7-
SF Engineered Safety Features Actuation
SG Steam Generator Secondary Side
SP Solid State Protection
VA 120Vac Class 1E Vital Power
<
XC Containment Building
XS, Switchyard System Auxiliary Feedwater
b. Observations and Findinas
As described in NUMARC 93-01, Revision 2, performance includes ". . . to the maximum
extent possible both availability and reliability should be used since that provides the
maximum assurance that performance is being maintained." The inspectors noted that
under the terms of the Maintenance Rule, preventive maintenance must be
demonstrated to be effective in controlling the performance or condition of a structure,
system, or component such that the structure, system or component remains capable of !
performing its intended function.
The inspectors acknowledged, as stated in NUMARC 93-01, instances where availability
does not provide a meaningful measure of performance and should not be captured.
Examples of accepted structures, systems, and components, such as reactor coolant
system piping or electrical buses, were those which were not taken out-of-service for
any routine testing or surveillance activities during power operations because of their
absolute necessity for operation.
The inspectors found that specific safety functions associated with the electrical loads
were monitored by the corresponding system being supplied in lieu of monitoring the
distribution system. For analogous mechanical systems, such as heating, ventilation,
and air-conditioning systems, unavailability was appropriately monitored at the
supported systems. During the inspectors' review of the facility's risk-significant
structures, systems, and components without specific unavailability criteria, several
systems were found to appropriately satisfy performance monitoring requirements for
the associated structures, systems, and components, including mechanical auxiliary
building heating ventilation air conditioning, miscellaneous heating ventilation air l
conditioning,13.8kVac auxiliary power,480Vac non-class 1E load centers,4.16kVac l
Class 1E power,480Vac Class 1E load centers,480Vac Class 1E motor-control centers
and distribution panels, steam generator secondary side, containment building, and the
switchyard system. Based on the system reviews, the inspectors deM; mined that these
structures, systems, and components were being adequately monitored with appropriate
plant level criteria and reliability performance measures.
The inspectors observed that the steam generator power-operated relief valves, safety
valves, and auxiliary feedwater steam supply were the only high safety-significant
structures, systems, and components in the main steam system that provide standby
functions. The licensee had established availability performance criteria for the steam
generator power-operated relief valves and did not remove safety valves from service
while online. The inspectors noted that should a safety valve need to be removed from
service, performance would be adequately monitored by the plant level criteria. In
.-
_
, . i
.
4
4
-8-
- addition, the inspectors found that the availability of the auxiliary feedwater system
.st eam suppl y was appropr itla e y mon
it ored und er auxiliary f
ee dwa er
t sys tem -
-
. performance criteria.
The inspectors observed that the pressurizer power-operated relief valves and safety
valves were the only high safety-significant components in the reactor coolant system
that provide standby functions. The inspectors noted that online maintenance is not
performed on the pressurizer power-operated relief valves and safety' valves. Licensee {
representatives considered removal of the power-operated relief valves from service as l
. a Maintenance Rule functional failure and would monitor this under the corresponding l
reactor coolant system reliability performance criteria. In addition, the inspectors noted I
that if power-operated relief valves were isolated for extended periods of time because
of excessive seat leakage, as permitted by the licensee's technical specifications, that
the licensee's staff considered the power-operated relief valves available. ,This was
because only one action is needed to be performed by a dedicated operator to restore
the valves to service for their risk-significant function (feed and bleed). The inspectors
- found this monitoring approach acceptable.
The inspectors observed that the licensee did not formally establish specific criteria
associated with unavailability for risk significant systems, which were rendered
unavailable for various routine maintenance testing and surveillance activities. The
' inspectors noted that the affected systems included post accident monitoring,7300 -
processor support,125Vdc class 1E, main feedwater, main steam, nuclear
instrumentation, reactor coolant, reactor control, engineered safety features actuation,
solid state protection, and the 120Vac class 1E vital power system. The inspectors
observed that online maintenance performed on these systems typically involved the
removal or alteration of a normal automatic alignment, involving a channel or train for
relatively short durations of time. Licensee representatives presented the basis for the
program's adequacy as the application of plant level criteria to all risk-significant
systems, and three conservative application points including: (1) loss of redundancy of !'
a scoped function is a Maintenance Rule functional failure even if the train or system
function was not lost, (2) loss of a scoped function is a Maintenance Rule functional
failure even if the function is not needed in the current plant mode, and (3) failures were
i
considered Maintenance Rule functional failures regardless of whether maintenance
related activities were involved or associated with the failures.
- The inspectors verified that all risk-significant structures, systems, and components .
(with those exceptions documented in Section M1.2) had Maintenance Rule functional i
failure criteria established, no repeat Maintenance Rule functional failures were ;
^ permitted, and that probabilistic safety assessment functional failure criteria were
established for those systems, which were modeled in the probabilistic safety
assessment. Licensee representatives stated that all unplanned maintenance ,
unavailability was captured as a Maintenance Rule functional failure even if the
Maintenance Rule function had not been lost prior to taking it out-of-service, as
referenced in the licensee's response letter to the NRC, NOC-AE-000132, dated
April 14,1998.
E
p
/
4
.g.
In addition, the licensee management's expectation included that planned maintenance
activities, su::h as routine testing and surveillances, which exceed planned allowed
outage times for completion be characterized as Maintenance Rule functional failures.
The inspectors noted that this was not a formally documented policy within the
licensee's Maintenance Rule program, but found no examples where these conditions
had not been captured as such. The inspectors were provided a copy of Condition .
Record 99-2894, which documented management's intention for capturing unavailability l
related functional failures and to make the necessary formal changes within their
Maintenance Rule program procedures.
The inspectors reviewed Licensee Event Report 98-004, Revision 00, and Condition
Record 98 204565 for the solid state protection system and determined that adequate
evaluations were performed in accordance with management's expectations and the
requirements of the Maintenance Rule. The inspectors considered the capturing of
maintenance performance activities as functional failures with unplanned or untimely
activities as an indirect method of monitoring the associated unavailability of structures,
systems, and components.
c. Conclusions
The inspectors determined that the licensee's approach to monitoring risk-significant
structures, systems, and components to be acceptable.
M8 Miscellaneous Maintenance issues (92902)
M8.1 (Closed) Violation 50-498:-499/9801-01: Failure to include the digital rod position
indication and a control room heating ventilation air conditioning function within the
Maintenance Rule program scope. The inspectors verified that the licensee's staff had
placed the digital rod position indication system and the control room ventilation smo'ke
purge actuation function in the scope of their Maintenance Rule program. In addition,
the inspectors found that adequate historical review for the Maintenance Rule functional
failures resulted in an appropriate classification in accordance with the Maintenance
Rule.
M8.2 (Closed) Unresolved item 50-498:-499/9801-03: Failure to adequately monitor the solid
state protection system. The inspectors verified that the licensee's staff had establ!shed
an indirect method of monitoring unavailability for risk-significant structures, systems,
and components through capturing unplanned maintenance activities or planned routine
maintenance (testing or surveillance) exceeding allowed outage times as Maintenance
Rule functional failures. In addition, the inspectors noted that appropriate unavailability
sensitivity studies for probabilistic safety assessment modeled structures, systems, and
components showed minimal risk impact. The inspectors concluded that the licensee's
actions were considered acceptable.
L __
p
'
i. ,
. *
I -10-
V. Manacement Meetinas I
X1 Exit Meeting Summary
i
The inspectors discussed the progress of the inspection on a daily basis and presented the l
inspection results to members of licensee management at the conclusion of the inspection on I
February 25,1999. The licensee's management acknowledged the findings presented. i
The inspectors asked the licensee staff and management whether any materials examined
during the inspection should be considered proprietary. No proprietary information was -
identified.
During the exit meeting on February 25,1999, the Manager, Systems Engineering, stated STP
Nuclear Operating Company would include the requirement to count as a Maintenance Rule
functional failure any instance where a high-risk system (or one of its trains) that does not have
availability performance criteria is taken out-of service (not performing its risk-significant
function) while at power for corrective maintenance, or any instance when its technical
specification allowed outage time is exceeded, and that this will apply even if no Maintenance
Rule function had been lost prior to taking the system out-of-service.
l
L
i-
I
w..
v
.
9
ATTACHMENT j
SUPPLEMENTAL INFORMATION
'
PARTIAL LIST OF PERSONS CONTACTED
- Licensee
P. Arrington, License Engineering
W. Cottle, President and Chief Executive Officer
R. Grantom, Administrator, Risk Management
J. Groth, Vice President, Generation
R. Harris, Manager, Reliability Engineering
S. Head, Supervisor, License Engineering l
J. Johnson, Manager, Engineering Quality ;
T. Jordan, Manager, System Engineering
A. Moldenhauer, Probabilistic Risk Assessment Engineer
B. Mookhoek, License Engineering
M. Murray, Supervisor, S stem Engineering
T. Riccio, System Engir sering
J. Sheppard, Vice Prec, dent and Special Assistant to the President
T. Stroschein, Supervisor, Engineering
J. Winters, Maintenance Rule Coordinator j
i
NBC ,
!
N. O'Keefe, Senior Resident inspector
INSPECTION PROCEDURES USED
IP 62706 Maintenance Rule
IP 92902 Followup - Maintenance
ITEMS OPENED. CLOSED. AND DISCUSSED
Opened
50-498;-499/9904-01 NCV Inspectors identified inadequate reliability performance
measures for eight plant risk-significant systems. As a
result of the inadequate performance measures, the
480Vac load center system for both units was allowed to
degrade beyond the probabilistic risk assessment assumed
perforrnance without the licensee having provided
adequate technical justification for not having established
goals, or appropriate corrective actions.
n
.
1
-2-
Closed
50-498;-499/9904-01 NCV inspectors identified inadequate reliability performance
measures for eight plant risk-significant systems. As a
result of the inadequate performance measures, the
480Vac load center system for both units was allowed to
degrade beyond the probabilistb risk assessment assumed
performance without the licensee having provided
adequa e technical justification for not having established
goals, or appropriate corrective actions. 4
/
50-498;-499/9801-01 NOV Failure to include the digital rod position indication and a
control room heating ventilation air conditioning function
within the Maintenance Rule Program scope.
50-498;-499/9801-03 URI Failure to adequately monitor the solid state protection 1
system.
PARTIAL LIST OF DOCUMENTS REVIEWED
Condition Records:
98-20456
99 2743
99 2908
99-2916
99 2925
99-2984
Licensee Correspondence:
.
NOC-AE-000132
NOC-AE-000230
Procedures:
Procedure Title Revision
OPGP03-ZA-0090 Work Process Program 20
OPGP03-ZX-0002 Condition Reporting Process 17
OPSP03-SP-0005R SSPS Logic Train R Functional Test 7
OPSP03 SP-00088 . SSPS Train B Slave Relay Test (Outputs Blocked) 4
OPSP03-SP-0006R Train R Reactor Trip Breaker TADGT 5
OPGP04-ZE-0313 - Maintenance Rule Program 1
4
OPGP03-ZA-0091 Configuration Risk Management Program 0