ML20153G244

Notice of Violation & Proposed Imposition of Civil Penalty in Amount of $50,000.Violations Noted:Measures for Coordination of Design Organizations Participating in Design Change Failed to Ensure That Change Incorporated Correctly

ML20153G244
Person / Time
Site:	Braidwood
Issue date:	05/06/1988
From:	Davis A NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
To:
Shared Package
ML20153G235	List: IR 05000456/1988007 ML20153G244
References
EA-88-091, EA-88-91, NUDOCS 8805110179
Download: ML20153G244 (4)

Text

. I, NOTICE OF VIOLATION AND PROPOSED IMPOSITION OF CIVIL PENALTY Commonwealth Edison Company Docket No. 50-456 Braidwood Station, Unit 1 License No. NPF-72 EA 88-91 During an NRC inspection conducted during the period March 1-17, 1988, violations of NRC requirements were identified. In accordance with the "General Statement of Policy and Procedure for NRC Enforcement Actions,"

10 CFR, Part 2, Appendix C (1988), the Nuclear Regulatory Commission proposes to impose a civil penalty pursuant to Section 234 of the Atomic Energy Act of 1954, as amended (Act), 42 U.S.C. 2282, and 10 CFR 2.205. The particular viciations and associated civil penalty are set forth below:

A. 10 CFR, Part 50, Appendix B, Criterion III, "Design Control," requires that measures be established for the identification and control of desige interfaces and for coordination among participating design organizations. Design control measures are required to provide for verifying or checking the adequacy of design, such as by the performance of design reviews or by the performance of a suitable

~

testing program.

Commonwealth Edison Company Quality Procedure No. 3-1, "Design Control,"

in part, ieplements 10 CFR Part 50, Appendix B Criterion III.

Section 4.2 of Quality Procedure No. 3-1 requires that the capability of each item with respect to meeting design requirements be verified for each application.

Commonwealth Edison Company Quality Procedure No. 3-2, "Design Change Control," in part also implements 10 CFR 50, Appendix B, Criterion III.

Section 2.0 of Quality Procedure No. 3-1 requires that design reviews be conducted within the participating departments on each design change.

Further Section 3.6 defines an Engineering Change Notice (ECN) as a design change by the Architect Engineer (A/E) which documents and authorizes design changes engineered and issued by the A/E.

Contrary to the above, as of December 16, 1986, measures for coordination among design organizations participating in Design Change VC-041, to the Control Room Ventilation Systems' heater interlock control systems were inadequate in that, the measures failed to ensure that ECN No. 34272 was correctly incorporated into ECN 34446.

B. 10 CFR, Part 50, Apper. dix B Criterion XI, "Test Control," requires in part, that a test program be established to demonstrate that systems and components will perform satisfactorily in service.

8305110179 DR 880506 ADOCK 05000456 DCD

l Notice of Violation 2 MAy 6 1989 I Commonwealth Edison Company Quality Procedure No. 11-2, "Development, Performance, Documentation, and Evaluation of Preoperational and Start-up Tests," in part implements 10 CFR Part 50, Appendix B, Criterion XI.

Section 3.2 of Quality Procedure No. 11-2 defines preoperational tests as tests to demonstrate the satisfactory mechanical and electrical operation of the systems involved including interlocks between systems.

Contrary to the above, the licensee's test program did not demonstrate that the Control Room Ventilation System would perform satisfactorily in that preoperational testing of the Control Room Ventilation Systems which was performed on March 4 and 11, 1987 on trains B and A respectively did not identify that heater interlock logic switches were wired incorrectly, that specified switch setpoints had not been adjusted, and that the Control Room Ventilation Systems were inoperable.

C. 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," requires that activities affecting quality be prescribed by documented instructions, procedures, or drawings and be accomplished in accordance with these instructions, procedures, or drawings.

Contrary to the above, as of November 6, 1987, it was identified that activities affecting quality had not been accomplished in accordance with prescribed instructions or drawings, in that:

1. The Architect Engineer did not perform the interdisciplinary review of ECN 34446, to verify or check the adequacy of the design information, as required by procedures.

2. The heater interlock logic switches for the Control Room Ventilation Systems had not been modified in accordance with the instructions or drawings of ECN No. 34272 which was issued December 16, 1986 or in accordance with the differential pressure switch setpoint specifica-tions for Swi+.ci as GPDS-VC059 (Sheet No. PS631) and OPDS-VC060 (Sheet No. PS632) which were promulgated on February 9,1987.

These violations have been categorized in the aggregate as a Severity Level III problem (Supplement I).

Cumulative Civil Penalty - 550,000 (assessed equally among the violations).

Pursuant to the provisions of 10 CFR 2.201, Commonwealth Edison Company is hereby required to submit a written statement or explanation to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission within 30 days of the date of this Notice. This reply should be clearly marked as a "Reply to a Notice of Violation" and should include for each alleged violation: (1) admission or denial of the alleged violation; (2) the reasons for the violation if admitted;

Notice of Violation 3 NAY 6 1989 (3) the corrective steps that have been taken and the results achieved; (4) the corrective steps that will be taken to avoid further violations; and (5) the date when full compliance will be achieved. If an adequate reply is not received within the time specified in this Notice, an order may be issued to show cause why the license should not be modified, suspended, or revoked or why such other action as may be proper should not be taken. Consideration may be given to extending the response time for good cause shown. Under the authority of Section 182 of the Act, 42 U.S.C. 2232, this response shall be submitted under oath or affirmation.

Within the same time as provided for the response required above under I 10 CFR 2.201, Commonwealth Edison Company may pay the civil penalty by letter addressed to the Director, Office of Enforcerrent, U.S. Nuclear Regulatory Commission, with a check, draft, or money order payable to the Treasurer of the United States in the amount of the civil penalty proposed above, or may protest imposition of the civil penalty in whole or in part by a written answer addressed to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission. Should the licensee fail to answer within the time specified, an order imposing the civil penalty will be issued. Should the licensee elect to file an answer in accordance with 10 CFR 2.205 protesting the civil penalty, in whole or in part, such answer should be clearly marked as an "Answer to a Notice of Violation" and may: (1) deny the violation (s) listed in this Notice in whole or in part, (2) demonstrate extenuating circumstances, (3) show error in this Notice, or (4) show other reasons why the penalty should not be imposed. In addition to protesting the civil penalty, such answer may request remission or mitigation of the penalty.

In requesting mitigation of the proposed penalty, the five factors addressed in Section V.B of 10 CFR Part 2, Appendix C (1988), should be addressed. Any written answer in accordance with 10 CFR 2.205 should be set forth separately from the statement or explanation in reply pursuant to 10 CFR 2.201, but may incorporate parts of the 10 CFR 2.201 reply by specific reference (e.g.,

citing page and paragraph numbers) to avoid repetition. The attention of the Licensee is directed to the other provisions of 10 CFR 2.205, regarding the procedure for imposing a civil penalty.

Upon failure to pay any civil penalty due which subsequently has been determined in sccordance with the applicable provisions of 10 CFR 2.205, this matter may be referred to the Attorney General, and the penalty, unless compromised, remitted, or mitigated, may be collected by civil action pursuant to Section 234c of the Act, 42 U.S.C. 2282c.

The responses to the Director, Office of Enforcement, noted above (Reply to a Notice of Violation, letter with payment of civil penalty, and answer to a Notice of Violation) should be addressed to: Drrector, Office of Enforcement, U.S. Nuclear Regulatory Commission, ATTN: Document Control

Notice of Violation 4 MAY 6 1988 Desk, Washington D.C. 20555, with a copy to the Regions 1 Administrator, U.S. Nuclear Regulatory Commission, 799 Roosevelt Road, Glen Ellyn, Illinois 60137 and a copy to the NRC Resident Inspection at the Braidwood Station.

FOR THE NUCLEAR REGULATORY COMMISSION

$0

• A. Bert Davis Regional Administrator DatedagGlenEllyn, this 6 Illinois day of May 1988 1

I l

I i

I

{

l - - ._ .

.. i, ,

i U.S. NUCLEAR REGULATORY COP 94ISSION REGION III Reports No. 50-456/88007(DRSS)

Docket No. 50-456 License No. NPF-70 Licensee: Commonwealth Edison Company Post Office Box 767 Chicago, IL 60690 Facility Name: Braidwood Station, Unit 1 Inspection At: Braidwood Site, Braidwood, Illinois Inspection Conducted: March 1-17, 1988 Inspector: Charles F. Gill b.

Date 3/X / '

L Approved By: L. Robert reg r, Chief MIM Facilities Radiation Protection l ate Section Inspection Summary Inspection during the period March 1-17, 1988 (Report No. 50-456/88007CORSS))

Areas Inspected: Special, announced inspection of licensee action fol'Iowing a startup test which indicated operibility problems with the Control Roon Ventilation Systems.

Results: The licensee's failure to have Control Root Ventilation Systems operable apparently violated regulatory requirements (Section 4). The appropriate enforcement action for this failure will be determined and communicated to the licensee by separate correspondence.

L m r ff ,11 t 11 1

-9 7 R

'O y W ~[L f'f h k f , v, -

i

DETAILS

1. Persons Contacted B. Andrews, Shielding Project Engineer, S&L

1. • P. Barnes, Regulatory Assurance Superviser .

• E. Carroll, Regulatory Assurance Engineer

1. D. Christinia, Project Field Engineer

• L. Davis, Assistant Superintendent Technical Services

1. D. Elras, PWR Engineering Si perintendent

1. D. Galanis, Senior Electrical Project Engineer, S&L

1. P. Holland, Regulatory Assurance Engineer

1. S. Hunsader, Nuclear Licensing Administrator

• J. Jasnosz, AR/PR Coordinator G. Lanti, Assistant NSLD Head, S&L

1. F. Lentine, PWR Nuclear Licensing Supervisor

1. M. Lohmann, Project Startup Construction Superintendent

1. C. Moerke, Project Engineer

1. P. Myrda, Project Field Engineer

1. • D. O'Brien, Services Superintendent

1. W. Paschal, Assistant HVACD Head, S&L

1. J. Phelan, Lead Electrical Engineer

1. • R. Richard, HVAC Group Leader

1. B. Sheldon, PWR Engineering Manager

1. • T. Simpkin, Regulatory Assurance Engineer

1. 5. Stimac, Staff Engineer

1. L. Greger, NRC/RIII, Chief, Iacilities Radiation Protection Section

1. J. Hinds, NRC/RIII, Chief, Resetor Projects Section IA T. Tongue, NRC/RIII, Senior Resident Inspector The inspector also contacted other licensee and contractor employees.

I

• Denotes those attending the interim exit meeting on March 4,1988.

1. Denotes those attending the telephone exit meeting on March 17, 1988.

2. General l

This inspection which began on March 1,1988, was conducted to review the circumstances surrounding a startup test which indicated inoperability of a Control Room Ventilation System while the plant was in operational Mode 1 (power operation).

3. Licensee Event Report (LER) Followup Through direct observations, discussions with licensee personnel, and i

review of records, the following event report was reviewed to determine i

2

, l that reportability requirements were fulfilled, immediate corrective action was accomplished, and corrective action to prevent recurrence had been accomplished in accordance with Technical Specifications.

LER No. Description 456/87-058-00 Both Trains of Control Room Ventilation Inoperable Due to Incorrect Design Incorporation I The LER was reviewed as part of the inspection into the apparent inability of both independent Control Room Ventilation Systems to meet their design requirements; this matter is discussed in Section 4.

4. Inability of Independent Control Room Ventilation Systems to Perform Their Design Requirements

a. Event Summary On November 6,1987, during a review of the Control Room Ventilation Startup Test (BwSU VC-30) and Engineering Design Change DC-V041 by the licensee's Project Engineering Department (PED), it was identified that the train B heater for the emergency makeup filter unit did not energize during the startup test on October 2,1987, although the fan was operating. After consulting with station technical staff engineers and the Architect Engineer (Sargent &

Lundy), PED confirmed that an error in design existed in the heater i interlock logic circuitry and the heaters on both trains (A and B) l of the Control Room Ventilation (VC) Systems would not energize at l the proper time.

At 1135 on November 6,1987, both trains of VC were declared l inoperable and Technical Specification 3.0.3 was entered. Upon i declaring both trains of VC inoperable, the station's Electrical Maintenance Depart. ment was contacted to determine if the train B

heater would energize with the emergency fan operating. The test of the train B heater revealed that the heater was energized as

' soon as the fan was started but de-energized shortly afterwards.

' After installation of temporary alterations on both trains of VC to correct the design error (miswiring), the train B heater was again tested; tha heater was found to energize shortly after the emergency fan began cperation and to remain energized. Based on the success of the tent of the train B heater, Technical Specification 3.0.3 was exited at 1234. Since a test was not made at the time for correct operation of the train A heater, LCO Action Requirement 1.a of T/S 3.7.6 was entered on train A of the Control Room Ventilation Systems.

3

't Upon reviewing setpoint data sheets for the fan dP heater interlock logic switch for the Control Room Ventilation Systems, station technical staff engineers noted on November 6,1987, that the setpoints I had not been reset, as required, af ter design change. On November 7, 1987, the as-found setpoint on train A was 16.5" wg, af ter setpoint readjustment the value was 5.75" wg, compared to the desired setpoint of 5.73" wg. The LCO action requirement on train A was exited at 0820 on November 9,1987. Because train S was demonstrated operable with the existing fan dP heater interlock switch setpoint on November 6,1987, LCO Action Requirement 1.a of T/S 3.7.6 was not entered for setpoint readjustment until 0858 on November 20, 1987.

The as-found setpoint was 13.2" wg; the as-left setpoint was 5.70" wg on November 20, 1987, compared to the desired setpoint of 5.73" wg.

The LCO action requirement on train B was exited at 1342 on November 21, 1987. The probable effect that the switch wiring and setpoint errors had on systee operability are discussed further in Subsection 4.g.

Refer to Appendi.x A for the sequence of relevant events.

b. Event Causation The following occurrences contributed to the failure of the Control Room Ventilation Systems to meet their design requirements:

l (1) The incorrect heater operation was the result of a design error in the Architect Engineer's (A/E's) electrical schematic and l wiring diagrams issued via Engineering Change Notice (ECN)

No. 34446 on December 16, 1986.

, (2) The cause of the design error was an incorrect interpretation by the A/E's Electrical Project Engineering Division of the "Normal / Abnormal" nomenclature shown un the Mechanical-Control and Instrumentation Logic Diagram (issued via ECM No. 34272 on December 16, 1986) to describe the interlock function.

i (3) Adequate measures were not established for coordination among participating design organizations in that ECN No. 34272 generated by the A/E's Control and Instrumentation Division was improperly understood and incorrectly incorporated into ECN No. 34446 by the A/E's Electrical Project Engineering Division.

(4) Adequate measures were not provided for*  :/ ing or checking the adequacy of design in that a design review was not adequately perfortned to assure that the design change initiated by ECN No. 34446 was proper before the design change was complete.

l <

(5) Failure to detect these design errors in the heater control circuits at the time of installation was due to a preservice testing deficiency in that the design change was not verified by component demonstration or retest, although a functional check of heater operation was performed.

(6) Contrary to standard preoperational testing practice, setpoint checks of the heater interlock logic switches were not made upon installation. The licensee's Instriment Maintenance Department (IMD) apparently was not aware of the need to adjust the setpoints after completion of ECNs Nos. 34272 and 34446. Due to the setpoint changes not being made, heater operation under certain conditions could appear normal, as it did during the functional test and subsequent surveillances (see Appendix A).

(7) When the startup test revealed that the heater was not operating on train B, test personnel apparently did not realize that heater operability is directly tied by the Technical Specifications to Control Room Ventilation System operability.

Refer to Appendix A for the sequence of relevant events.

c. Corrective Actions (1) Initial actions were taken to correct the wiring and setpoint ernes when they were discovered. A modification package for pesuent alterations to the heater interlock logic circuits of both trains of the Control Room Ventilation Systes is being developed.

(2) The A/E's engineering and quality assurance personnel are investigating the design error to verify that it is an isolated error and to determine the appropriate corrective action to prevent recurrence.

(3) The licensee has identified no other preservice testing deficiencies involving a design change. The licensee therefore considers this incident to be an isolated event and proposes no other corrective actions regarding the preservice program,

d. Safety Significance (1) The operability of both trains of VC was jeopardized by the incorrect design changes and failure to properly adjust the heater interlock logic switch setpoints from the time of system required operability at 2120 on May 29,1987 (initial criticality), until 1342 on November 21, 1987, after both trains had the design errors and setpoints e.orrected. The 5

design error would result in heater operation whenever the fan was energized unless the high dP setpoint was reached. Had the correct setpoint changes been made initially, the fan dP setpoints would have been reached on both trains short1/ after fan energization and the heaters would not have optrated. Due to the licensee's failure to change the dP setpoints, it appears that the train A heater may have operated under oormally expected ventilation conditions, but the train 8 hecter wo91d only sporadically operate because under existiry ventilation conditions, the fan dP was about equal to the d) setpoint.

Subsequent to the electrical modifications on November 6,1987, it a, years that the hain B heater would continue to operate sporadically, but the train A heater now would not operate under normally expected ventilation conditions.- Design operation of the heaters would be expected subsequent to the setpoint changes on November 7, 1987, and November 20, 1987, for Train A and Train B, respectively.

(2) Without the heaters operational to assure 70% relative humidity (T/5 laboratory test RH for charcoal adsorber acceptance), the intake of makeup air of greater than 70% RH would lead to less adsorber efficiency than that for which the charcoal has been tested ar.d would thus lead to higher Design Basis Accident (DBA) control room operatcr thyroid doses than anticipated. Under certain conditions (DBA conditions with high relative hianidity), '

the control room potentially could have been uninhabitable per GDC-19 criteria. If the control room was uninhabitable, a condition would exist which could prevent the fulfillment of the safety function of systems needed to shutdown the reactor and maintain a safe shutdown condition.

l The licensee's safety analysis of this event contends that only the main stenaline break accident is postulated to significantly affect turbine building relative humidity (100% RH). A humidity l sensor located in the turbine building energency makeup air l

intake would reportedly annunciate in the Main Cont.rol Room to

!! alert tne operators. Nakeup air from the minimum outside air intake can be established by opening the normally closed damper and closing the turbine building emergency sakeup air intake l'i damper. The licensee claims that the source of moisture in the air could thus be removed. It should be noted, however, that because the turbine building is not a Seismic Category I l

structure, no credit is given for that buiMing's presence in accident analyses; nor did the NRC give credit for dual emergency I air intakes. Also, as discussed above, inoperable heaters will allow atmospheric relative humidity to imp nge on the charcoal adsorbers which will then have e lower iod ne removal efficiency than if the heaters were operating; this is true for all relative e

6

\

e, y 1 humidities and types of re.diciodine release accidents. For these reasons, the licensee arguwnts appear to be invalid. l l

(3) Another potential problem resulted f rom the design and setpoint errors in that the heaters would operate at less than their design air flow. The heat removal by air flow would thus be less than designed, and the heater would tend to raise the temperature of the air impinging on the charcoal adsorbers. Although the probability of a charcoal fire may be only slightly increased, the licensee has committed to the heater design required of  ;

ANSI /ASME N509-1976. (ANSI /ASME N509-1976, Section 5.5 states  ;

that the sensible heat produced by the heater shall not result  ;

in increasing air temperatures to more than 225'F and a manual  ;

overtemperature control switch set at this value shall be '

provided.) Nevertheless, it appears that under some low flow conditions, charcoal combustion may have been possible. Until this matter is reviewed further, it is considered an Unresolved Item. (456/88007-01)

e. Quality Assurance Regulatory Requirements ,

Appendix B to 10 CFR 50 defines the required quality assurance criteria for nuclear power plants to assure safe operation, including quality assurance requirements for design, construction, and testing of systems that mitigate the consequences of postulated accidents that could cause undue risk to the health and safety of the public. As used in this appendix, quality assurance comprises all actions necessary to provide adequate confidence that systems l and components will perform satisfactorily in service.

l (1) Design Control Cosmonwealth Edison Company Quality Procedure No. 3-1, Design Control, Section 4.2, states that design review and control is required to assure meeting design and regulatory requirements.

Comonwealth Edison Company Quality Procedure No. 3-2, Design l ; Change Control, Section 3.6, identifies an Engineering Change l Notice (ECN) as a design change by the Architect Engineer (A/E) which documents and authorizes design changes engineered and i issued by the A/E; Section 2.0, states that design reviews a're conducted within the participating departments on each design change. The Braidwood Startup Manual is a procedure which provides requirements for the completion and initial testing of the plant in conformance with the requirements of the Comonwealth Edison Company Quality Procedures and Appendix B i

of 10 CFR 50.

7

^

c. .. .

l Contrary to the above, the design control measures were inadequate to correctly implement Design Change No. VC-041 to the Control Room Ventilation Systems' heater interlock

, control systems:

• Adequate measures were not established for coordination among participati.g design organizations in that ECN No. 34272 generated by the A/E's Control and Instrumenta'. ion Division was improperly understood and incorrectly incorporated into ECN No. 34446 by the A/E's Electric Project Engineering Division.

• Adequate measures were not provided for verifying or checking the adequacy of design in that a des:3n review <

was not adequately performed to assure that the design l change initiated by ECN No. 34446 was proper by verifying or checking the adequacy of design, such as by the i performance of adequate design reviews or by the performance l of a suitable testing program.

t l

Failure to meet the requirements of the Startup Manual and Quality Procedures Nos. 3-1 and 3-2 is an apparent violation of Criterion III, Design Control, Appendix B to 10 CFR 50.

(456/88007-03)

(2) Test Control Commonwealth Edison Company Quality Procedure No. 11-2, Development, Performance, Documentation and Evaluation of Preoperational and Startup Tests, Section 3.2, states that preoperational tests are tests made prior to initial '

criticality to demonstrate the satisfactory mechanical and l electrical operation of the systems involved, including interlocks between systems. The Braidwood Startup Manual is I

a procedure which provides requirements for the completion and l initial testing of the plant in confomance with the requirements of the Commonwealtfi Edison Company Quality Procedures and l Appendix B to 10 CFR 50. This manual states in part, that a preoperational test will demonstrate the capability of spstems and components to safety related performance requirements, a l component demonstration is a test completed to reverify proper l

operation after a control circuitry change, and a retest is a test necessary to complete steps omitted during the execution or to repeat test sections.

Preoperational Test BwPT VC-10, Control Room Ventilation, was performed on March 4 and 11,1987, on trains B and A, respectively. These tests, as well as retests on train A on March 30 and April 3,1987, and on train B on April 4, 1987, indicate that the Control Room Ventilation Systems' heaters were operating. On April 15, 1987, Deficiencies (DEF)

Nos. VC-10-520 and VC-10-521 were initiated to complete ECN No. 34446 for train B and A, respettively. On May 20, 8

1 .

A

.., s, .

1987, DEF Nos. VC-10-520 and 521 were closed. Initial criticality for Unit 1 occurred at 2120 on May 29, 1987; VC was declared operational by Technical Specifications. Because the licensee did not conduct a component demonstration or a retest af ter completion of ECN No. 34446, the licensee was apparently unaware until it was identified during a review of the VC startup test on November 6,1987, that design change errors jeopardized the operability of the Control Room Ventilation Systems. The failure to meet the requirements of the Startup Manual and Quality Procedure No.11-2 is an apparent violation of Criterion XI, Test Control, Appendix 8 to 10 CFR 50.

(456/88007-04)

(3) Instructions, Procedures, and Drawings On February 9,1987, the ser. ting of 5.73" wg was specified on design drawing instructions for differential pressure switches l on train A (OPDS-VC059, Sheet No. PS631) and train B (0PDS-VC060, Sheet No. PS633) for the heater interlock logic circuitry of the Control Room Ventilation Systems. On November 7,1987, the l

as-found setpoint on train A was 16.5" wg; on November 20, 1987, the as-found setpoint on train B was 13.2" wg. The failure to reset the setpoints on these switches after the completion of ECN No. 34446 and to verify the setpoints as part of the preoperational test prcgran pursuant to the requirements of the Startup Nanual is an apparent violation of Criterion V, Instructions, Procedures, and Drawings, Appendix 8 to 10 CFR 50. (456/88007-05)

f. Safety Review Regulatory Requirement The Brafsvood Final Safety Analysis Report (FSAR), Section 6.5.1 states that each control room HVAC sakeg air filter unit utili heaters to assure optimum air conditions entering the charcoal .res ,

absorbers. Appendix A of the FSAR indicates, in response to Regulatory Guide 1.52 Position 3.b, that the heater stage is sized to reduce the relative humidity of the entering air-steam mixture from 100% to approximately 70%. FSAR Subsection 7.3.1.1.9 states that the electric heating coils are interlocked with the corresponding standby makeup air fans; FSAR Subsection 9.4.1.4 states that the interlocks are. cold checked, adjusted, and tested to ensure the proper sequence of operation. The calculated LOCA control room operator doses presented in Table 6.4-1 of the FSAR are based on iodine removal efficiency credits of 99% and 90% for the control room makeup air intake and recirculation charcoal atsorber filters, respectively. Assuring these f odine removal efficiencies is dependent upca maintaining relative humidity at or below 70%, as specified in T/S 4.7.6.a.2 and T/S 4.7.6.h.2.

The basis for T/S 3/4.7.6 states that the operability of the Control Room Ventilation System ensures that the control room will remain habitable for operations personnel during and following all credible accident conditions based on limiting the personnel radiation exposure consistent with the requirements of GDC-19.

9

l N .

The licensee made changes in the facility as described in the safety analysis report without prior Commission approval even though the change involved an unreviewed safety question, when on May 20, 1987, the licensee incorrectly implemented a design change to the Control Room Ventilation Systes heater interlock control system which shut the heater off when the fan dP setpoint was reached rather than the desired change which was to turn the heater on when the f an dP setpoint was reached.

This is an apparent violation of 10 CFR 50.59(a)(1) which prohibits

, a licensee from making changes in the facility as described in the safety analysis report, without prior Commission approval, if the proposed change involves an unreviewed safety question.

10 CFR 50.59(a)(2) states that a proposed change shall be deemed to involve an unreviewed safety question if, among others (1) the consequences the of an accident previously evaluated in the safety analysis report may be increased; or (ii) a possibility for a malfunction of a different type than any evaluated previously in the safety analysis report say be created; or (iii) the margin of safety as defined in the basis for any technical specification is reduced. (456/88007-02)

g. Technical Specification Limiting Conditions for Operation Technical Specification 3.7.6 LCO, states that two independent Control Roos Ventilation Systems shall be operable for all operational modes and that for modes 1, 2, 3 and 4, with one Control Roon Ventilation System inoperable, restore the inoperable system to operable status within 7 days or be in at least hot staney within the next six hours and in cold shutdown within the fol. lowing 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

Technical Specification 3.0.3 LCO, states that when an LCO is not net, except as provided in the associated action requirements, within one hour action shall be initiated to place the unit in a. node in which the specification does not apply by placing it, as applicable, in at least hot standby within the next six hours, at least hot shutdown within the following six hours, and at least cold shutdown within the subsequ6nt 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The train B heater was apparently operable on October 1 and 19,1987, during surveillance tests; yet the train B heater tested inoperable

during the October 2,1987 startup test and on November 6,1987.

The apparent contradictions in operability test results may be due to the nearness of the fan dP to the heater interlock logic switch setpoint. The f an oP measured 13.0" wg on October 2,1987; the as-found setpoint on November 20, 1987 was 13.2" wg. Thus, it appears that at least between October 2,1987 and November 6,1987, train 8 operability was sufficiently in doubt and it should have

' been declared inoperable on October 2, 1987.

i D

4 30

) .

Af ter the heater interlock logic switches were rewired on November 6, 1987, to correct the design errors, train 8 was declared operable at 1234. Later in the day it was discovered by station technical staff engineers that the setpoints on both trains were incorrect. This i

discrepancy combined with the rewired logic switches made it unlikely that train A was operable and put the operability of train B in significant doubt. It appears that both trains should have been declared inoperable and the action requirements of T/S 3.0.3 entered when the f ailure to reset the switch setpoint was identified.

Instead, af ter setpoint readjustment the licensee exited the LCO action requirement (AR) of T/S 3.7.6 for train A at 0820 on November 9,1987, entered T/S 3.7.6 LCO AR to reset setpoint on the train 8 heater interlock logic switch at 0853 on November 20, 1987, and exited train B T/S 3.7.6 LCO AR at 1342 on November 21, 1987.

The licensee appears to have been in violation of the T/S 3.7.6 LCO AR at least interoittently between October 2,1987 (perhaps since initial criticality on May 29,1987), and 1342 on November 21, 1987, and of the T/S 3.0.3 LCO AR between 1235 on November 6,1987, and 0820 on November 9,1987. (456/88007-06)

5. Exit Meetina The inspector met with licensee representatives (denoted in Section 1) at the conclusion of the inspection on March 4,1988, and by telephone on March 17,1988. The inspector summarized the scope and findings of the inspection, including the unresolved ites and the apparent violations.

The inspector also discussed the likely informational content of the inspection report with regard to documents or processes reviewed by the inspector during the inspection. The licensee did not identify any such documents / processes as proprietary.

e 9

.I J

Appendix A l

Sequence of Relevant Events Date/ Time - Event Description October 14, 1986 Fan dP interlock switch (0PDS-VC059) on train A set at 16.1" wg with the switch in the normally closed position. (The switch was designed to open upon Hi-dP across fan OVC03CA, thus turning the fan off.)

October 23, 1986 Design Change VC-041 was initiated to delete f an OVC03CA/CB high delta P trip and add low flow trip and heater interlock. (Based on Byron experience.)

December 16, 1986 Engineering Change Motice (ECN) No. 34272 approved by S&L's CAI Division in response to DC-VC041. ,

December 16, 1986 ECN No. 34446 approved by S&L's EPE Division in response to ECN No. 34272.

NOTE: ECN 34446 was based on a af sunderstanding of ECN 34272 which resulted in switches OP05-VC059 & 060 remaining in the normally closed (NC) position when used as heater interlock switches.

Thus, when the fan started the heater would start and run until the fan dP setpoint was reached.

December 16, 1986 Fan dP interlock switch (0PDS-VC060) on ,

Train 8 set at 16.0" wg with the switch in i the nomally closed position. I February 9,1987 The setting of 5.73" wg was specified on  !

differential pressure switches on Train A (OPDS-VC059, Sht. No. PS631) and Train B (0PDS-VC060, Sht. No. PS633). ,

March 4,1987 Preoperational Test DwPT VC-10. "Control Roos Ventilation," was performed on Train B.

The heater generated about 30 amps.

Piarch 11, 1987 VC-10 performed on Train A. The heater generated about 30 asps.

March 30,1987 Retest No.146 was performed on Train A; reason for retest >as unrelated to heater performance. The mater generated about 30 amps.

s. t Appendix A 2 April 3, 1987 Retest No.147 was performed on Train A; reason for retest was unrelated to heater performance. Heater contacts reported closed.

April 4,1987 Retest No. 147 was performed on Train B.

Heater contacts reported closed.

April 15,1987 Deficiencies Nos. YC-10-520 and VC-10-521 written to complete ECN No. 34446 for train B and A, respectively.

May 1, 1987 Retest No.149 was performed on Train A; reason for retest was unrelated to heater perforsance. The dT across the filter unit was 11-12'F; criteria for indication of heater function is a minimum of 5'F dT.

May 12, 1987 Electric construction on train B regarding DEF No. VC-10-520 completed.

May 15, 1987 Rework reverification complete for DEF No.

VC-10-520.

May 16, 1987 Electrical construction on train A

( regarding DEF Mo. VC-10-521 complete.

May 19, 1987 Rework reverification complete for DEF No. VC-10-521.

l; May 20, 1987 DEF Nos. VC-10-520 and 521 closed.

'. NOTE: At this point in time the design changes required by ECN No. 34446 l

were complete; however, the heater interlock logic switches were wired in the wrong position (NC rather than the correct N0 setting) l and the fan dP setpoints had not been revised to the correct value (5.73" wg). The root cause for incorrect wiring diagras in ECH No. 34446 is discussed above (December 16, 1986 ECN approval date).

- In accordance with the startup manual, the modifications of the interlock logic switches appear to require either retests or, at least, component demonstrations to verify the adequacy of the design change; neither type of verification was performed.

The standard preoperational testing practice was to complete all setpoint changes after any required design changes on affected components were cotepleted without a specific setpoint change l request. However, reportedly contractor instrue,ent raintenance l

personnel assumed this instruction only applied until fuel load.

)- .

Because the VC system was not required to be operational until ]

' initial criticality the setpoints erroneously remain unchanged.

I

8 Appendix A 3 P

May 23, 1987 Preoperational Test Program for VC completed.

May 29, 1987 f.2120 Initial Criticality for Unit 1; VC delcared operable.

September 30, 1987 Startup Test BwSu VC-30, "Heat Capacity Verification for Control Room HVAC Systee,"

was performed on Train A. Because heater amps / volts were not seasured, Deficiency B-501 was written. The resolution of DEF 8-501 was that heater operation would not affect overall test acceptability; therefore no retest was required for the heater.

September 30, 1987 thru Surveillance Procedure No. 08w0s 7.6.8-1 war.

October 1, 1987 performed on Train 8. Filter Unit dT was 7'F; criterion for heater function is a

! minimum dT of 5'F.

October 2, 1987 Startup Test VC-30 was performed on Train B. Proper heater voltage was measured; l

however zero amps were measured.

NOTE: The response of the startup test personnel was inadequate in that personnel did not realize that heater operability is directly tied by the Technical Specifications to the Centrol Roon Ventilation System operability. The startup test procedure was apparently inadequate in that heater operability, including setpoint verification, was not part of the overall test acceptability criteria, i October 3, 1987 Surveillance 7.6.8-1 was performed en train A; filter Unit dT was 8'F.

l' October 18-19, 1987 Surveillance 7.6.8-1 was performed on train l*

B; filter unit dT was 16'F.

l November 3,1987 Surveillance 7.6.8-1 was performed on train A; filter unit dT was 10'F.

NOTE: The train 8 heater was apparently operable on October 1,1987 and October 19, 1987; yet the train B heater tested inoperable on October 2,1987 and November 6,1987. The apparent contradictions in operability test results may be due to the nearness of the fan dP to the heater interlock logic switch setpoint. The fan dP measured 13.0" wg on October 1,1987; and the as-found setpoint on November 20, 1987 was 13.2" wg.

o >

Appendix A 4 November 6,1987 The licensee's Project Engineering 9 approx. 1100 Department (PED) notified the station that during a review of the startup test VC-30 and Engineering Design Change DC-VC041, it was noted that the train 8 heater did not energize.

After consulting with Sargent & Lundy,. the licensee confinned that an error in design existed in the heater interlock logic circuitry and the heaters on both trains (A&B) would not energize at the proper time.

November 6, 1987 9 1135, 61% Both trains of VC were declared inoperable reactor power and T/S 3.0.3 was entered (T/S 3.7.6 LCO Action requirement 1.a was entered for Train A). LCO AR-1.a states that in modes 1, 2, 3 and 4; with one control room ventilation system inoperable, restore the inoperable system to operable status within 7 days or be in at least hot standby with the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in cold shutdown within the following 30 days.

NOTE: Upon declaring both trains of VC inoperable, the licensee's Electrical Maintenance Department (EN)) was contacted to determine if the train 8 heater would energize with the emergency fan running.

The component check of the B train heater revealed that the heater was energized as soon as the fan was started but de-energized after the fan had been running for a few seconds. Train A was not tested.

l. If train A had been tested, the heater may have energized. The fan

'; dP for Train A seasured on September 30, 1987, was 11.5" wg; the as found setpoint on November 7,1987 was 16.5" wg.

After installation of temporary alterations (changing switches l

OPDS-VC059 and OPDS-VC060 from the NC to the N0 positions) of l both trains of VC by EMD, the train B heater was again tested; the heater was found to energize shortly after the emergency fan began operation and to remain energized. Train A was not tested; because of the still undiscovered setpoint error, it

. is likely that train A would have failed the component test.

November 6, 1987 9 1234 T/S 3.0.3 is exited; Train A remained in T/S 3.7.6 LCO Action Requirement 1.a.

NOTE: The heaters are energized only if the fan energizing contacts and the fan dP contacts are both closed (an AND interlock logic gate).

l Thus it was expected that with the fan dP heater interlock switch in the incorrect NC position, the heater would come "on" when the

Appendix A 5  !

fan was started and turn "off" when the fan dP setpoint was reached.

Likewise, when the fan dP heater interlock switch was in the correct N0 position, it was expected that the heater would not turn "on" until the fan dP setpoint was reached. Although the train 8 heater behaved as expected, it did so at a later time after fan start than expected.

Station technical staff engineers reviewed setpoint data sheets to determine that the setpoint changes required by the design change specified by ECN No. 34446 had not been cospleted. Since train A was in T/S 3.7.6 LCO AR-1.a and train B had been demonstrated operable, no change in LCO AR's were deemed necessary by the licensee. Setpoint change request for train A was initiated on November 6, 1987.

November 7, 1987 Train A switch OPDS-VC059 as-found setpoint

, was 16.5" wg; the as-left setpoint was 5.75" wg. The setpoint had drifted up from the October 14, 1986 value of 16.1" wg.

November 9, 1987 90820 Train A T/S 3.7.6 LCO-AR-1.a was exited.

November 9, 1987 Setpoint change request for train 8 was initiated. .

\-

November 20, 1987 00853 Train 8 T/S 3.7.6 LC0AR-1.a was entered.

t Train 8 switch OPDS-VC-060 as-found setpoint November 20, 1987 was 13.2" wg; the as-left setpoint was 5.70" wg. The setpoint had drifted down from the December 16, 1986 value of 16.0" wg.

l *l NOTE: Switches OPDS-VC059 and 060 were initially high delta P fan trips both at Byron and Braidwood. The switch was converted to a heater interlock logic switch, in part, because setpoint drift at Byron

+

resulted in spurious fan trips.

! November 21, 1987 91342 Train B T/S 3.7.6 LC0 AR-1.a was exited.

1' I

l 1

1 5

i

' 7 d ', \

"c U. S. NUCLEAR REGULATORY COMMISSION REGION III I l

Report No. 50-456/88012(DRSS)

Docket No 50-456 License No. NPF-70 )

Licensee: Commonwealth Edison Company Post Office Box 767 Chicago, IL 60690 Facility Name: Braidwood Station, Unit 1 Meeting At: Region III Office, Glen Ellyn, Illinois Meeting Conducted: March 28, 1988 Approved By: L. Ro ert Greger, Chief M-Y W Facilities Radiation Protection Date Section Inspection Summary Meeting On March 28, 1988 (Report No. 50-456/880012(DRSS))

Areas Discussed: An enforcement conference conducted to discuss licensee errors associated with a design change to the electrical heaters in the Control Room Ventilation Systems.

F l c.t y )- /l_ k ) .' g fl l ~ ?

= ,y 17 w , + - g/y. _ _ - - _ - _ - .

DETAILS

1. Meeting Attendees Commonwealth Edison Company T. Maiman, Vice President, PWR Operations K. Graesser, General Manager, PWR Operations B. Shelton, PWR Engineering Manager F. Lentine, PWR Licensing Supervisor S. Hunsader, Nuclear Licensing Administrator D. O'Brien, Services Superintendent M. Lohmann, Project Construction and Startup Superintendent L. Davis, Assistant Superintendent Technical Services P. Barnes, Regulatory Assurance Supervisor P. Holland, Regulatory Assurance Engineer R. Richard, Technical Staff Engineer .

T. Coomer, Technical Staff Engineer  !

W. Paschal, Assistant Head HVAC Division, S&L D. Galants, Senior Electrical Project Engineer, S&L Nuclear Regulatory Commiss hn - Region III C. Paperiello, Deputy Regional Administrator C. Norelius, Director, Division of R.Miation Safety and Safeguards W. Shafer, Chief, Emergency Preparedness and Radiation Protection Branch L. Greger, Chief, Facilities Radiation Protection Section J. Hinds, Chief, Reactor Projects Section 1A W. Schultz, Enforcement Coordinator C. Gill, Senior Radiation Specialist R. Lerch, Reactor Engineer C. Anderson, Enforcement Specialist

2. Enforcement Conference Details The enforcement conference was held to discuss an event which is described in Inspection Report No. 50-456/88007(DRSS). This event involved operability problems with the Control Room Ventilation Systems resulting from electrical heater design change errors.

The NRC/ Region III staff summarized the inspection findings, apparent violations of regulatory requirements, and other regulatory concerns.

The concerns discussed by Region III personnel included:

• The heater interlock circuitry design and switch setpoint errors resulted in the Control Room Ventilation Systems not meeting system design requirements for an extended period of time (from May 29, 1987 until November 21,1987). Although these problems were identified and corrected by the licensee, it was not done in a timely manner.

2

e

• The design errors were not identified during the design review process before installation.

• System operability was not adequately verified during the pre-service testing program subsequent to installation.

• The setpoints for the heater interlock switches used to tie heater operation to fan operation were not revised to reflect the circuitry design change. Although this error initially resulted in a higher probability of heater operability, it was a fortuitous set of circumstances, not the result of purposeful licensee action. (The setpoint error also hindered the design error from being detected by routine surveillance testing.)

• The NRC has noted over the last few years that, in general, control room ventilation systems are frequently neglected and often misunderstood by licensees. NRC efforts to inform licensees of concerns regarding the neglect of these important ESF systems is indicated by the issuance on August 28, 1986, cf Information Notice No. 86-76, "Problems Noted in Control Room Emergency Ventilation Systems." Inadequate system understanding may have contributed to the failure to adequately test the systems after completion of the design changes, and probably contributed to the f ailure to identify the problem promptly when the startup test was conducted and to the failure to appreciate the significance of not having made the

, setpoint changes once it was recognized that they he.d not been made, including the apparent need to enter Technical Specification (T/S) 3.0.3 at that point.

• In addition to addressing the concerns associated with this event, the licensee had earlier been requested to provide assurance that similar problems associated with other design changes /modffications have not occurred. Specifically, that design changes / modifications made during or subsequent to applicable system preoperational tests have been adequately tested to ensure system operability, and that required setpoint revisions have been made.

In response to the Region III comments, the licensee stated that the NRC concerns would be addressed, and indicated that the dasign, design review, and testing program deficiencies were due to individual personnel judgment errors, not to program inadequacies or to a lack of Control Room Ventilation System familiarity. The licensee then provided their account of the event and event causation, which did not vary significantly from that provided in Inspection Report No. 50-456/88007(DRSS).

The licensee identified the following corrective actions and programmatic reviews:

• Initial actions were taken to correct the wiring and setpoint errors when they were discovered.

• Engineering Change Notice SECN 182 was issued on November 6,1987 to correct the design changes.

3

a ,

• On December 4,1987, at the Architect Engineer's (Sargent & Lundy)

Biweekly Nuclear Projects Meeting, the design error was determined to be an apparent S&L nonconformance.

• The design error was reported to S&L QA on December 14, 1987 in accordance with S&L QA Procedure GQ-16.01.

• S&L Project Instruction PI-BB-210 was prepared on February 4, 1988, under which a random sample of Class IE differential pressure switch applications were to be reviewed to determine whether the design error was of a recurring nature.

• The above review, completed on March 19, 1988, identified no other similar errors (100% review of Class 1E differential pressure switch applications was performed).

• A revision of S&L Hechanical Standard HES-3.8, which should prevent recurrence of the design error problem, is expected to be issued by May 2, 1988.

• The licensee stated that project startup test personnel misjudged the complexity of the design change and selected the incorrect type of verification test. Since no other similar errors have been identified to date, the licensee had felt that no pre-service testing program corrective actions were necessary; based on NRC comments, however, tl e licensee agreed to reevaluate this decision.

• The licensee stated that because the adequacy of the survoillance tests was questionable, the criteria for the minimum acceptable temperature rise across the filter units was changed from 5'F to 9 F, in part, to iccount for the i 4*F accuracy of the temperature probes.

If the tempe,ature rise is less than 9*F, the ctrrent (amperes) output of the heater is to be measured to confirm heater operation.

• The licensee decision to dismiss contractor reviewers and process setpoint data sheets in-house created a significant (several months) backlog which was, responsible for the failure to reset the heater interlock logic switches in a timely manner. The licensee stated that a review for other incidents of design change setpoints not being reset before system operation revealeo two similar errors, both of which involved of non-ESF systems. The licensee has reduced the setpoint data sheet review backlog from about 2,000 on November 6, 1987, to somewhat more than 400 currently, only a few of which are for Unit 1 systems.

The licensee presented a heater interlock circuitry design change history which compared design change milestone dates on Byron and Braidwood from initial design issuance to final change approval. The licensee stressed I that Byron used the modification process because it was an operating l plant and Braidwood used the design change process because it was still l under construction. The initial design issuances for Byron and Braidwood were by PECN 705 on February 18, 1987, and ECN 34446 on December 16, 1986, 4

l

.[ t j respectively. The design problem was identified at Byron during the modification package review on October 24, 1987, and independently at Braidwood by review of the Startup Test on November 6, 1987. The design change corrections were issued by PECN 705-1 on October 29, 1987, and by SECN 182 on November 6,1987, for Byron and Braidwood, respectively. The changes were approved for Byron on November 3,1987, and for Braidwood on December 1,1987. Although there may not have been direct coordination between the operations personnel at both plants cor.cerning the design error identification, the licensee stated that the fact that the design revision for Braidwood was issued on same day (November 6,1987) that the design error was identified independently by Braidwood personnel indicates design engineering groups for the two plants were closely coordinated. The licensee also stated that Byron may have identified the probism earlier than Braidwood because the modification process includes a technical review of the modification package which the design change construction review process at Braidwood lacked.

The licensee's presentation of the safety significance stressed the licensee hypothesis that, although required by commitments to Regulatory Guide 1.52 and ANSI /ASME N509-1976, Control Room Ventilation System

, heater operation is not needed for LOCA conditions, the turbine building should be considered to remain intact post-LOCA, and that the heat sources in the turbine building would raise outside air to a temperature high enough to reduce atmospheric relative humidity from 100% to less than 70% (the control emergency makeup air intakes are in the turbine building and the heaters are required by Technical Specifications to reduce the relative humidity which impinges on the charcoal adsorbers to no more than 70%). The licensee also contended that the heaters were not needed for the main steam line break (MSLB) accident (makeup air in the turbine building would be at 100% relative humidity) because of a licensee analysis which indicates that only a fraction of a percent iodine removal efficiency for the makeup charcoal adsorbers is needed to reduce postulated control room operator thyroid doses below 10 CFR 50, Appendix A, GDC-19 guideline limits. The licensee claimed that the i expected iodine removal efficiency under MSLB accident conditions would i

be in excess of that needed.

The NRC responded to the licensee's safety significance presentation by l

stating that regardless of accident analysis assumptions used to calculated postulated post-accident doses to control room operators, the fact remains that both independent Control Room Ventilation Systems would not have performed as designed and had remained in a degraded condition for five months because of the design errors and the failure of the licensee to identify and correct the errors in a timely manner.

Subsequent to the enforcement conference, this matter was discussed further with the licensee by telephone on March 29 and 31,1988. These discussions revealed that the licensee's analyses were based, in part, on the temperature differences between the outside atmosphere and the turbine building atmosphere on September 30, 1987, during the startup test on Train A of the Control Room Ventilation Systems while Unit I was operating at 49% of rated power. However, the temperature measurements were ad hoc reasurements rather than statistically derived limiting 5

l _ _ _ - - - - .

. 'a v

e conditions and therefore cannot be relied upon generically. Also, contrary to the licensee analyses, under design basis accident (DBA) conditions the heat sources in the turbine building would soon dissipate. Thus, under DBA conditions, the air inside the turbine building should be assumed to be identical to the atmospheric conditions, including the relative humidity. It therefore appears that the safety significance presented in Inspection Report No. 50-456/85007(URSS) is correct in that under certain conditions (DBA conditions with high relative humidity),

the control room potentially could have been uninhabitable per GLC-19 criteria. If the control room was uninhabitable, a condition would exist which could prevent the fulfillment of the safety function of systems needed to shutdown the reactor and maintain a safe shutdown condition.

After the licensee gave a summary to close the presentation, the senior NRC representative expressed concern regarding the unknown number of plant systems that may be in a "window of vulnerability" in that they may be susceptible to the types of errors associated with this event because design changes occurred after completion of system preoperational testing but before the systems were released to the Operations Department.

The senior licensee representative responded by stating that information on ESF and non-ESF systems that were in that category would be provided to Region III in the near future.

The senior NRC representative acknowledged the licensee's presentation and stated that the Region III recommendation concerning enforcement action for the event would be forwarded to the NRC Office of Enforcement for its concurrence. After review by that Office, the licensee would be notified in writing of the NRC's proposed enforcement action.

(

6

[