ML20154L523
| ML20154L523 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse  |
| Issue date: | 09/19/1988 |
| From: | Shelton D TOLEDO EDISON CO. |
| To: | NRC OFFICE OF ADMINISTRATION & RESOURCES MANAGEMENT (ARM) |
| References | |
| NUDOCS 8809260210 | |
| Download: ML20154L523 (6) | |
Text
.
TOLEDO EDISON A Catertr Errgy Cm DONALD C, $HD. TON We Preww t f Art F Docket No. 50-346 License No. NPF-3 Serial No.
,-8:.
September 19, 1988 United States Nuclear Regulatory Commission Document Control Desk Vashington, D. C. 20555
Subject:
Response to Inspection Report 88015 Gentlemen Toledo Edison has received Inspection Report 88015 (Log 1-1884), dated Audust 4, 1988, and provides the following response.
Violation 88015-01:
Criteria V of 10 CFR 50, Appendix B, requires that activities affecting quality shall be prescribed by procedures appropriate to the circumstances.
Contrary to the above, the licensee's implementing procedures do not implement the cleanliness requirements of Section 8 of the Nuclear Quality Assurance Manual (NOAM) and of ANSI N45.2.3-1973 vhich is e,ited in the NOAM.
Responses Acceptance Or Denial Of The Alleged Violation Toledo Edison acknowledges the alleged violation.
Reason For The Violation During the current refueling outage (5RFO) several deficiencias have been noted in the area of control of tools, equipment and materials to prevent the inadvertent inclusion of material or objects into critical systems as noted in the body of Inspection Report 88015.
The root cause of this violation has been determined to be the establishment of inadequate implementing procedures for the control of housekeeping activities for work around open systems.
8G09260210 080919 l
{DR ADOCK 0500 46 THE TOLEDO EDSON COYPANY EDsON PLMA 300 MAD' SON AVENUE TOLEDO. CHto.33652 g
g
Dockot N). 50-346 f.icense No. NPF-3 Serial No. 1-834 Page 2 AD 1844.05, Cleanliness control, established the requirements necessary to implement ANSI N45.2.3.
AD 1844.05 provides guidance for maintaining the cleanliness of systems, tools and components (establishment of housekeeping zones) and the maintenance and inspection of system cleanness.
Although the requirements of ANSI N45.2.3 vere generally described in AD 1844.05, the necessary detailed guidance to establish cleanliness zones at the specific work site (i.e.,
identification of applicable housekeeping zones, control of materials into the area including posting and the tethering of tools) was not proceduralized.
Corrective Actions Vhich Have Been Taken and Results Achieved The overall control of housekeeping at Davis-Besse was reviewed for improvement. This review included the requirements of ANSI N45.2.3, Nuclear Quality Assurance Manual (NOAM) Sections 2 and 8, and AD 1844.05. As a result, DB-MN-00005 (AD 1844.05).
Housekeeping Control, was revised. This procedure nov establishes requirements, guidelines, responsibilities and implementing instructions necessary to identify and establish housekeeping zones for activities surrounding systems open for maintenance in accordance with ANSI N45.2.3.
Training has been conducted for the personnel who implement the housekeeping program as defined in DB-MN-00005.
Actions Taken To Be Taken To Avoid Further Violation The NOAM currently assigns responsibility for specifying the housekeeping zone designations to the Engineering Division.
However, the reviev of the Davis-Besse housekeeping program concluded that this responsibility would be more appropriately assigned to the organization that directly determines the need for establishment of housekeeping zones based on the review of the specific vork activity.
This organization is the Station.
Therefore, a request for a NOAM change was initiated to designate the responsibility for housekeeping zone designations be transferred to the Station. The Engineering Division vill remain involved in the process of specifying system cleanliness criteria which affect the determination of the type of housekeeping zone to be established for vork surrounding that open system.
Dats Vhen Full Compliance Vill Be Achieved DB-MN-00005 is in effect and controls activities surrounding systems open for maintenance.
L The NOAM is schsduled to be revised by October 14, 1988.
' Dockot N3. 50-346 Liccnsa No. NPF-3 Serial No. 1-834 Page 3 Violation 88015-07:
Criterion III of 10 CFR 50, Appendix B states that, "Design changes, including field changes shall be subject to design control measures commensurate with those applied to original design..
Contrary to the above the licensee's review of modification, Facility Change Request 86-330, which implements flow control improvements to the Auxiliary Feedvater (AFV) System did not reveal that a single failure in the control system for either AFV pump discharge valves (AF 599 and AF 608) vould have caused both valves to close.
This failure vould have rendered the AFV system inoperable in that it vould be unable to fill either steam generator.
Responses Acceptance Or Denial Of The Alleged Violation Toledo Edison acknowledges the alleged violation.
Reason For Violation In early 1988, Toledo Edison (Independent Safety Engineering) conducted an internal reviev, similar to a Safety System Outage Modification Inspection (SSOHI).
The reviev focused on Facility Change Request (FCR)86-330, Auxiliary Feedvater (AFV)
System Flov Control Improvements. The reviev also covered, in part, other inter-related modifications that are associated with the design, functionality, and operability of the AFV system (i.e. FCR 85-0154).
FCR 85-0154 vas issued to remove the automatic close/open signals transmitted by the Steam and Feedvater Rupture Control System (SFRCS) to Steam Generator Auxiliary Feedvater Isolation Valves AF-599 and AF-608. The new valve control circuitry is designed with a power enable switch to provide power to the control circuit and a separate valve ccatrol svitch to open/close each valve thus requiring two separate operator actions to operate the vnives.
FCR 85-0154, as originally designed, called for an energized cable to provide a valve position indication to the Control Room and a separate, normally de-energized cable for the valve actuation circuit. These two cables vere to be routed together in a single conduit.
If the conductors within these two cables had come in contact (i.e., "hot short"), the actuation circuit vould have actuated the valve to the closed position (AF-599 or AF-608 depending on which is assumed to fail). This single failure, applied to either valve control circuit, vould isolate AFV from ont of the two Steam Generators.
For most anticipated i
transients requiring AFV, the non-isolated Steam Generator and ATV system would have performed the intended safety function.
l l
- Docket Ns. 50-346 1.icens3 No. NPF-3 Serial No. 1-834 Page 4 In the ovent of a main steam /feedvater line break, the Steam Generator affected by the break is automatically isolated from the AFV system by SFRCS.
If the single failure discussed above is postulated to occur on tho valve associated with the unaffected Steam Generator simultaneous with the main i
steam /feedvater line break, ATV flov vould be isolated from both Steam Generators.
The design deficiency was discovered prior to implementation of the modification.
Hence, the design deficiency had no actual impact on plant operation, safety, or AFV operability.
- However, normal design development and reviev processes did not discover and correct this design deficiency. It is unlikely that this deficiency would have been discovered during installation or l
post-installation testing since it vould not have affected normal operation of the as-designed valve circuitry.
t Accordingly, Toledo Edison has assessed the consequences of operating the AFV system with the originally designed circuitry.
Specifically, the low probability of occurrence (i.e., bot ehort coincident with a main steam /feedvater line rupture) and the availability of compensatory actions to mitigate this scenario vas evaluated.
Based on this assessment, Toledo Edison concludes that had the deficiency not been discovered, the effect on plant operation and safety vould not have been significant.
Corrective Actions Vhich Have Been Taken and Results Achieved Upon discovery of this design deficiency, a Potential Condition Adverse to Quality (PCAQ) Report was issued.
This report prevented the installation of the changes proposed by FCR 85-0154 to the AFV system.
The valve control circuitry was redesigned to eliminate the potential for a "hot short" failure.
The redesigned valve circuitry has been installed and vill be j
tested prior to restart from the current outage.
The root cause analysis of this violation concluded that the implementation of the design and subsequent design verification I
failed to adequately consider all applicable single failure criteria. As an element of the corrective action, the design criteria for consideration of hot shorts was verified to be included in the initial issue of the Davis-Besse Design Criteria Manual, dated June 27, 1988. The basis for single failure criteria is nov consolidated into a single source available for use in assessing future design changes.
There are only two other safety related motor operated valves at Davis-Besse (DH-1A and DH-1B) which have similar single failure r
criteria considerations to that of AF-599 and AF-608 (i.e.,
single valves which, for a specific initiating event, have the potential to impact the operability of both trains of a safety i
system). The designs for these two valves vere reviewed and verified to have appropriately applied these criteria.
The I
- Dockot Ns. 50-346 Liccnsa No. NPF-3 Serial No. 1-834 Fage 5 specific valve circuitry design requirements and how the current design satisfies these requirements vill be documented in the applicable System Descriptions for the AFV and DHR systems currently being prepared.
Based on the above described problem and root cause, Toledo Edison concluded that an intensified overview of selected modifications was warranted to determine whether any other weaknesses were apparent in the design process. Accordingly, Independent Design Evaluations (Vertical Slice Revievs) were performed on fou complex modifications being implemented during the fifth refuelius outage, including:
Extensive modifications of the Steam and Feedvater Rupture Control System Implementation c.' the Reactor Vessel Head Vent to Hot Leg Modification Enhancements to the Reactor Coolant System feed and bleed capability Upgrades to the Motor-Driven Feedvater Fump controls Emphasis in this reviev vas on those attributes for which problems vould not be expected to be detected during the installation process and those attributes which cannot be functionally tested. This included review of implementation of design basis criteria and consideration of required failure modes. No problems in these areas vere identified.
Therefore, the above described failure to consider all applicable single failure criteria is considered to be an isolated case.
Additionally, several other overviews of the design process have been undertaken by the Engineering Division. The purpose of thes,e overviews is to ensure the technical adequacy of plant modifications and to identify where improvements might be required in the design process. This included review of field changes vritten against modifications.
This reviev was conducted to determine if these field changes were indicative of a veakness in the design process. The results of the Independent Design Evaluations, field change reviews, and the internal SSONI were collectively evaluated. This collective evaluation indicated no significant programmatic or prevalent technical problems. The evaluation did identify a veakness in the completeness of documentation forming the bases of the modifications.
In addition, there exists a weakness in the ability to detect this incompleteness in the review and approval process. Actions have been initiated to determine the extent of
- Dockot Ns. 50-346 License No. NPP-3 Serisl No. 1-834 Page 6 these conditions and to enhance and strengthen the documentation that forms the bases for modification designs.
Some of the actions include:
"Extent of Condition" investigations for specific observations from the design reviews to determine if observed concerns are programmatic or prevalent within the design process.
Performing overall final design verifications of selected critical modifications to ensure design documentation is i
completed and is adequate.
l Toledo Edison considers that the initiatives takein to date have rigorously pursued the identification of potential problems i
vithin the design process.
It is our intention to continue with a visible program that reviews and evaluates the effectiveness of the design process and its products.
Date When Full Compliance Vill Be Achieved The FCR 85-0154 design deficiency vas discovered by Toledo Edison and corrected prior to being placed in service.
Therefore, safety-related equipment and systems within the plant vere never compromised. This violation represents a failure of both detail design and design verification to ensure implementation of a design basis criteria.
However, the additional reviews described above provide evidence to support this instance being an isolated case.
The Davis-Besse Design Criteria Manual has been issued and contains appropriate guidance for evaluation of hot short failure mechanisms. Training of appropriate personnel vill be completed by November 4, 1988. This training vill address the content and use of the Design Criteria Manual.
i The System Descriptions for AFV and DHR are part of the overall effort to document and consolidate the design basis for Davis-Besse (Configuration Management Program) currently in progress and vill be completed as part of that project.
If yo's have any questions regarding this response, please contact Mr. R. V. Schrauder, Nuclear Licensing Manager, at (419) 249-2366.
Very truly yours, t
ML JCS/d a cc DB-1 NRC Resident Inspector A. B. Davis, NRC Region III, Regional Administrator l
1
_