ML20195G662
| ML20195G662 | |
| Person / Time | |
|---|---|
| Site: | Braidwood  |
| Issue date: | 06/20/1988 |
| From: | Delgeorge L COMMONWEALTH EDISON CO. |
| To: | Lieberman J NRC OFFICE OF ADMINISTRATION & RESOURCES MANAGEMENT (ARM), NRC OFFICE OF ENFORCEMENT (OE) |
| References | |
| 4706K, NUDOCS 8806280090 | |
| Download: ML20195G662 (23) | |
Text
v I__'N Dy
/
Commonwealth Edison -
i
[
) One First NzSonal Plata Chicago, Illinois k
C' ~ J Address Reply to: Post Omers Box 767 Ny Chicago, Illinois 60690 0787 June 20, 1988 Mr. Ja.acs Lieberman, Director Office of Enforcement U.S. Nuclear Regulatory Commission Washington, DC 20555 ATTN: Document Control Desk
Subject:
Braidwood Station Unit 1 Proposed Imposition of Civil Penalty Inspection Report No. 50-456/8800'1 NRC Docket No. 50-456 References (a): March 25, 1988 C.E. Norelius letter to Cordell Reed (b): April 4, 1988 C.J. Paperiello letter to Cordell Reed (c): May 6, 1988 A.B. Davis letter to J.J. O'Connor
Dear Mr. Lieberman:
Reference (c) provided the Notice of Violation (NOV) and Proposed Imposition of Civil Penalty related to the concerns identified in Reference (a). This letter provides Commonwealth Edison's (Edison) answer to the NOV in Attachment A.
Edison acknowledges that there were specific deficiencies which required corrective action, but based on an extensive review of relevant portions of the design and test control processes, Edison believes that no programmatic defects exist warranting the imposition of a Severity Level III civil penalty. The reasons for this belief are based on the following:
1.
The failure to coordinate mechanical and electrical design requirements was an isolated occurrence resulting from one individual's interpretation of nomenclature.
8806280090 880620 PDR ADOCK 05000456 O
\\\\
l L': ly
(
O.
9 J. Lieberman June 20, 1988 2.
A 100% review of similar safety-related designs revealed no similar discrepancies, thus demonstrating that adequate measures were established to control design interfaces.
3.
The failure to conduct a proper test of the change in heater design resulted from an individual (rather than general) failure to judge accurately the complexity of the change.
4.
A review of 2,176 preoperational testing "deficiencies",
resulting from changes in design after preoperational testing, showed that the proper tests had been conducted in all but five (5) cases. Of these, only the two (2) cases cited in the NOV are safety-related. The remaining three (3) are non-safety related. This demonstrates that the test control program, though requiring some improvement, was in general, fundamentally sound and properly implemented.
5.
A review of the violations identified during the last SALP period indicated that those items are not considered to be spaptomatic of the items presented in the NOV.
Attachment B provides Edison's evaluation of the bases for mitigation. Attachment C provides the assessment of safety significance in answer to concerns presented in reference (b). Attachment D provides a summary of violations identified during the SALP-7 period in the pre-operational testing area.
We request that the NRC Staff re-review this matter based on the above, commonwealth Edison is available to answer any questions concerning any area related to this issue. On June 3, 1988, an extension until June 20, 1986. for submittal of this answer was granted by Mr. J. Grobe.
Very truly yours, L.O. DelGeorge Assistant Vice President Attachments:
(A) Answer to a Notice of Violation and proposed Imposition of Civil penalty (B) Bases for Mitigation (C) Safety Significance (D)
SALP-7, pre-operational Testing Violations cc:
A. B. Davis Braidwood Resident Inspector 4706K
o ATTACHMENT A ANSWER TO A NOTICE OF VIOLATION AND PROPOSED IMPOSITION OF CIVIL PENALTY (NRC INSPECTION REPORT NO. 50-456/88007(DRSS))
The letter providing the Notice of Violation states:
"We have considered your arguments concerning the ability of the Control Room Ventilation System to function without the proper preheating of makeup air.
However, our concerns with the violations are based not only on the degraded system, but also, and more importantly, on the underlying design control and testing issues. These violations appear to be symptomatic of deficiencies that were identified during your last SALP period (Inspection Report Nos.
50-456/88001; 50-457/88001) and which reeulted in rating declines from Category 1 to Category 2 in the functional areas of Quality Programs and Administrative Controls Affecting Quality and of Preoperational and Startup Testing."
As indicated by the following responses to both the general concerns and to the specific violations cited, Edison believes that there should not be a generic concern with either the design control or testing programs utilized at Braidwood Station. Consequently, the basis for the proposed civil penalty is much less significant than that stated and Edison believes that the civil penalty should be mitigated accordingly.
GENERAI, CONCERNS During SALP 6 for Braidwood Station, the Quality Programs and Administrative Controls Affecting Quality Area was rated a Category 1 in recognition of outstanding work in the management and resolution of a large number of construction corrective action programs, while maintaining ongoing construction quality. The enforcement history of the SALP 6 period and that of the SALP 7 period were characterized as similar by the NRC.
The SALP 7 assessment was concentrated on operational activities rather than the construction activities as in SALP 6.
The decline in rating was attributed by the NRC to just the overall adequacy of the operational programs during SALP 7 as opposed to the aggressive resolution of construction issues during SALP 6.
Effectively, the SALP reports had assessed two different management activities and arrived at different conclusions.
The Preoperational Testing Area had also been rated a Category 1 during SALP 6.
This rating was in recognition of outstanding work in the conduct of testing, the creation of a unique, separate project startup organization and an excellent enforcement history because of receiving only
.< one violation. The SALP 6 assessment was concentrated on preoperational testing activities for Braidwood Unit 1.
The SALP 7 period saw an intense testing period whereby the startup testing of Unit 1 occurred concurrently with the preoperational testing of Unit 2.
During this period of high activity, eight (8) violations were identified. These are summarized in
-Attachment D.
No violation identified improper test selection nor improper installation of a design change.
The SALP-7 report stated that these violations formed the basis for a decline in rating in this area.
The root cause of the violation contained in reference (c) is attributed by Edison to a misinterpretation within the Architect / Engineer's organization. None of the deficiencies cited in the identified SALP areas are attributable to this root or contributing cause and none are design errors.
ALLEGED VIOLATION A 10 CFR, Part 50, Appendix B, criterion III, "Design Control", requires that measures be established for the identification and control of design interfaces and for coordination among participating design organizations.
Design control measures are required to provide for verifying or checking the adequacy of design, such as by the performance of design reviews or by the performance of a suitable testing program.
Contrary to the above, as of December 16, 1986, measures for coordination among design organizations participating in Design Change VC-041, to the Control Room Ventilation Systems' heater interlock control systems were inadequate in that, the measures failed to ensure that ECN No. 34272 was correctly incorporated into ECN 34446.
A.1 Admission or Denial of the Alleged Violation Commonwealth Edison admits that the design requirements in mechanical Engineering Change Notice (ECN) No. 34272 were not correctly incorporated into electrical ECN No. 34446. This was identified by Edison Project Engineering during a startup test review and was reported in LER 87-58 on l
November 6, 1987. A "normally-closed" contact from a DifferentiJ1 Pressure Switch (DPS) was used in the heater control circuit rather than a "normally-open" DPS contact.
This error caused the heaters to shut-off when they should actually energize which was in conflict with the intent j
of the Control and Instrumentation (C&I) design issued via ECN No. 34272.
I l
A.2 Reasons for the Alleged Violation i
The Sargent & Lundy design error resulted from a misinterpretation of the "normal / abnormal" DPS nomenclature used in the logic diagrams in ECN No.
l 34272. The DPS interlock was a change of the original heater control j
circuit design, intended to energize the heaters when the Control Room Emergency Makeup Air Filter Unit Fans start and when normal differential pressure is developed across the fans. A contributing factor which may have prevented the design error from being identified is the lack of a mechanical interfacing cciament on the electrical ECN No. 34446.
l
-.g
! Sargent & Lundy General Quality Assurance Procedure GQ-3.13, "Engineering Change Notices", describes the quality assurance requirements for the preparation, review and approval of ECNs. This procedure states that "the preparer shall forward the ECN for internal interfacing comments.
If no interfacing comments are required, the preparer shall so indicate that condition on the ECN and forward it directly to the Reviewer."
This procedure provides adequate requirements for interfacing comments on ECNs. However, the preparer of electrical ECN No. 34446 felt that his interpretation of the mechanical ECN was correct. Because he made this determination, he indicated that no interfacing comments were required.
This error in judo 'ent contributed to the design error not being identified in tr.
.cer"acing comment process.
Sargent & Lundy uality Assurance procedure GQ-3.13, also states that "the Reviewel shall review the ECN for technical adequacy of the design change end for resolution of comments.
If the ECN is technically adequate, the Reviewer.shall sign as reviewer and forward the ECN to the authorized approver."
Based on the above, it is evident that measures (i.e., procedures) are provided for verifying or checking the adequacy of a design change. The design error that was not detected during the review process was an isolated event caused by the incorrect interpretation of the Control and Instrumentation ECN as described above.
A.3 Corrective Steps that have Been Taken and Results Achieved The immediate corrective action taken by Sargent & Lundy was the issuance of the following modification:
Post Puel Load Engineering Change Notice (SECN) No. S-182, dated November 6, 1987.
The above modification utilized the correct (normally-open) DPS contact, allowing the heaters to operate es intended.
The design error appeared to be significant and was discussed at the December 4, 1987, Sargent and Lundy internal Nuclear Projects Meeting as required by Electrical Department Standard ESI-254, "Electrical Department Procedure for Reporting and Correction of Design Errors and Deficiencies in Approved Design Documents". The participants of this meeting determined that the design errer was an "apparent non-conformance" as defined in the S&L QA Manual. The error was submitted for review to the Sargent & Lundy Quality Assurance Division (QAD) on December 14, 1987, in accordance with the requirements of Quality Assurance Procedure GQ-16.01, "Corrective Action Reports". One Sargent & Lundy nonconformance, Corrective Action Report (No. 647) was initiated to monitor completion of the required corrective actions.
. To determine whether the design error was or was not of a recurring nature, Sargent & Lundy Byron /Braidwood project instruction PI-BB-210 was prepared on February 4, 1988, under which (1) the total population of safety-related differential pressure switches (DPS) on all four units at Byron and Braidwood Stations was identified, (2) the logic diagram and schematic diagram corresponding to each DPS were reviewed by Sargent and Lundy Electrical Project Engineering and Control and Instrumentation Engineering representatives, to assure that the schematic diagram correctly implements the logic diagram's intended function of the DPS, (3) any discrepancy between the logic and schematic diagrams was identified and documented with a renommended disposition by the review team for approval by the Senior Electrical Project Engineer and (4) review records would be placed in the project files.
The above activities were completed on April 1, 1988. A 100% review of the safety-related DPS applications was performed. The review revealed that there were no similar discrepancies.
A.4 Corrective Steps Taken to Avoid Further Alleged Violations A clarifying revision has been incorporated into the following Sargent and Lundy Mechanical Engineering Standard:
Control Logic Diagram - Format and Procedure MES-3.8 (Revision B, 04-08-88)
The change includes the addition of an instruction / discussion concerning the terms to be used on logic diagrams to describe the "control or Interlock Function" of input or initiating devices. The terms incorporated in this change are compatible and consistent with those presently specified for similar switches in Electrical Design Standard EDSI-32, "Electrical Drafting Guidelines for Depicting Temperature, Pressure / Vacuum, and Level Switch contacts".
This revision of MES-3.8 enhances this procedure and should preclude incorrect interpretation by Electrical Engineers of the Control and Instrumentation engineers' intended functions. The change is as follows:
The "Control or Interlock Function" should be carefully warded so as to accurately and clearly describe the condition under which the device initiates or permits the indicated action / operation.
, Ambiguous terms (e.g., "Normal", "Abnormal",
"Available", "Unavailable", "Acceptable",
Unacceptable", etc.) that are subject to incorrect interpretation and require further explanation to relate the process parameter action shall not be used. However, the use of such terms is acceptable when they are followed by a clarifying explanation (e.g., "Normal - Increasing Temperature", "Abnormal
- Decreasirig Differential Pressure", "Available -
Increasing Level", "Unacceptable - Decreasing Flow", etc.).
A.5 Date when Full Compliance Will be Achieved Corrective actions were complete as of April 8, 1988.
. = ~ -
t:
' ALLEGED VIOLATION B 10 CFR, Part 50, Appendix B, Criterion XI, "Test Control", r quires in part, that a test program be established to demonstrate that systems and components will perform satisfactorily in service.
Commonwealth Edison Company Quality Procedure No. 11-2, "Development Performance, Documentation, and Evaluation of Pre-operational and Startup Tests", in part implements 10 CPR part 50, Appendix B, Criterion XI.
Section
~
3.2 of Quality procedure No. 11-2 defines pre-operational tests as tests to dencnstrate the satisfactory mechanical and electrical operation of the systems involved including interlocks between systems.
Contrary to the above, the licensee's test program did not demonstrate that the Control Room Ventilation System would perform satisfactorily in that pre-operational testing of the Control Room Ventilation Systems which was performed on March 4 and 11, 1987 on trains B and A respectively did not identify that heater interlock logic switches were wired incorrectly, that specified switch setpoints had not been adjusted, and that the Control Room Ventilation Systems were inoperable.
B.1 Admission or Denial of the Alleged Violation Commonwealth Edison denies this violation because the design error (that heater interlock logic switches were wired incorrectly and tnat specified switch setpoints had not been adjusted) could not have been detected by the pre-operational testing of the Control Room Ventilation System which had been performed on March 4 and 11, 1987 on trains B and A, respectively. The design change was completed several weeks later, on May 20 and 21, 1987. Edison does admit that testing required subsequent to the installation of the design change was incorrectly selected. This was identified by Edison project Engineering duilng a start-up test review and was reported in LER 87-58 on November 6, 1987. We slso agree with the transmittal letter characterization of this event as a degraded system (rather than an inoperable system as stated in Violat$ca B, above).
B.2 Reasons for the Violation The System pre-operational test was completed in March, 1987. The design change was initiated, in response to a test deficiency and implemented in May, 1987, subsequent to the pre-operational test. The type of testing necessary to assure that the design change would result in a system that would perform satisfactorily was incorrectly determined. The complexity of the change had been misjudged and a functional check test (rather than component demonstration) was selected and performed.
B.3 Corrective Steps that Have Been Taken and Results Achieved post Fuel Load Engineering change Notice (SECN) No. S-182, dated November 6, 1987, was issued.
The DpS contacts, allowing the heater to operate as intended, were corrected on November 6, 1987. The degraded system was returned to the intended configuration on that date.
j
7 B.4 Corrective Steps Taken to Avoid Further Alleged Violations During the enforcement conference the NRC expressed a concern regarding the unknown number of plant systems that may be in a "window of vulnerability" in that they may-be susceptible to the types of= errors
' associated with that identified LER 87-58-(i.e., design changes occurred after completion of system preoperational testing but before the systems were releasad to the operations department).
A review was performed of deficiencies generated as a result of changes in design subsequent to pre-operational testing to verify that appropriate testing was accomplished after installation. The scope of the review included all safety-related pre-operational tests, which includes all Emergency Safeguard Features (ESP) systems, all non-safety related system demonstration tests for special systems as defined in the Startup Manual, and 10% of the remaining non-safety related System Demonstration Tests.
The time span reviewed included the date of initial authorization of a specific test through the last test deficiency. A total of 19,494 deficiencies were reviewed, of these 2,176 were design related.
A listing of deficiencies was generated, within the scope and time span defined above.
For each deficiency, the testing requirements that were used were listed. The five (5) types of tests included:
test, retest, component demonstration, functional. check, or none required. Deficiencies that required tests, retests, or component demonstrations to close them were considered acceptable. Deficiencies that indicated a "functional check" (the type of testing that resulted in the error identified in LER
~
87-58) or "none required" as the required tests nere reviewed and categorized as follows:
1.
Although "Functional check" or "None Required" was specified on the deficiency, the work performed on the deficiency was included in the system main test, a retest, or a component demonstration.
2.
The "Functional Check" specified and performed by the System Test Engineer (STE) was adequate for change described on the deficiency.
3.
Where "None Required" was specified, no testiug by the STE was required or the construction test performed was adequate to verify proper operation of the change.
4.
Where "None Required" was specified, the design change has not been installed or has been cancelled.
5.
Additional testing is required to verify proper operation of t'.e system following installation of the design change.
+v(sf1}
L,'
a
. The results of this portion of the review showed that approximately iwo-thirds of the deficiencies associated with design changes were listed as "None Required" for testing and were included in Categories
- 3. and 4. above. The items included in Categories 3. and 4 were reviewed further to determine which of the followl'g'sub-categories applied to the deficiency:-
A.
Design change was made to reflect the as-built condition or to correct a design document.
B.
The construction test performed during electrical checkout, instrument calibration, or stacion surveillance test were considered adequate.
c.
Design change has not been installed or change was cancelled.
D.
Work performed did not affect system or equipment functional operation and therefore no testing is required.
The results of these reviews are summarized in the attached Table.
The Table reflects the actual testing that has been performed following installation. Item 6. of the Ta: le shows the five (5) cases that were found to require additional testing than that originally performed, only the two (2) cases cited in the NOV affect safety-related systems. The remaining three (3) are non-safety related.
A brief summary of the five deficiencies that were categorized as requiring additional testing is as follows:
Non-Safety-Related (3) 1.
Unit 1 System Demonstration Test - Special Systems Deficlency T0-22-034 Level indicator 1LT-T0004 (main turbine oil reservoir level) was removed and later reinstalled as part of human factors upgrading.
The deficiency was closed prior to recalibration of the instrument loop. This instrument was not used to collect test data as noted on the deficiency. The instrument loop has been recalibrated.
1
.. 2.
Unit 1 System Demonstration Test Deficiencies AB-21-075 and AB-21-088 Both of these deficiencies address the replacement of the recycle evaporator concentrate pump OAB02DA.
The pump was replaced and electrical construction circuit and functional checks performed. A typical system demonstration test would also include pump flow data.
This data will be taken in component demonstration test AB-61, Demo 40.
Safety-Related (2) 1.
Unit Common pre-operational Test Deficiencies VC-10-5230 and VC-10-521 These deficiencies address the revision to the control room ventilation system heater control circuits which were the subject of the NOV.
Modification M20-0-87-060 has been processed to permanently correct the control circuit. Testing of the corrected circuit has been performed as part of the modification.
As can be seen five (5) of 2,176 deficiencies reviewed resulted in the need for additional testing. Of the five (5), only the two (2) cases cited in the NOV affect safety related systems. This indicates that, in general, appropriate testing methods were selected and that the existing administrative system performed its function in this area.
Since the 100% retrospective review has demonstrated that there is no generic problem in this area, no further corrective steps are considered necessary.
B.5 Date When Full Compliance Will be Achieved Corrective actions were complete as of May 18, 1988.
l
,+
1 j VIOLATION B TABLE TEST DEFICIENCY REVIEW UNIT 1 UNIT 2 TOTAL SYSTEM DEMO SYSTEM DEMO PRE-OP PRE-OP TEST SPECIAL 10%
TEST SPECIAL 10%
(88)
(55)
(12)
(82)
(29)
(7)
(273)
Deficiencies Reviewed 8,672 4, 168 760 4,338 1,090 466 19,494 Deficiencies with Design Changes 888 691 161 328 67 41 2,176 1.
Test 161 30 14 72 5
9 291 2.
Retest 68 0
0 11 0
0 79 3.
Component Demonstration 1
12 7
5 0
0 25 4.
Functional Check 154 102 11 53 2
1 323 l-5.
dNone Required 504 543 126 185 60 31 1,449 A.
As-Built / Correction 274 192 84 123 48 20 741 B.
Construction Test Adequate 132 272 29 24 4
1 467 C.
Not Installed / Cancelled 18 42 4
11 4
2 81 D.
No Testing Required 80 41 10 27 4
2 164 6.
Additional Testing Required 0
1 2
2 0
0 5
l l
l 4706K l
l l
I l
11 ALLEGED VIOLATION C.1 10 CPR part-50, Appendix B, Criterion V, "Instructions, Procedures and Drawings", requires that activities affecting quality be prescribed by
-documented instructions, procedures, or drawings and be accomplished in accordance with these instructions, procedures or drawings.
Contrary to the above, as of November 6, 1987, it was identified that
-activities affecting quality had not been accomplished in accordance with prescribed instructions or drawings, in that:
1.
The Architect Engineer did not perform the inter-disciplinary review of ECN 34446, to verify or check the adequacy of the design infornation, as required by procedures.
c.1.1 Admission or Denial of the Alleged Violation Edison denies this violation because it is bclieved to be a restating of Violation A.
The appropriate actiont taken are presented in response to that violation. Sargent & Lundy General Quality Assurance Procedure 00-3.13 "Engineering Change Notices" which describes the quality assurance requirements for the preparation, review and approval of ECN's had been in place at the time of the inspection.
00-3.13 states "..the preparer shall forward the ECN for internal interfacing comments.
If no interfacing comments are required the preparer shall so indicate that condition on the ECN and forward it directly to the Reviewer". This procedure provides adequate requirements for interfacing comments on ECNs to implement Criterion V of 10CFR50, Appendix B.
The preparer of electrical ECN No. 34446 followed the-procedure, however he felt that his interpretation of mechanical ECN No. 34272 was correct. Because he made this determination, he indicated that no interfacing comments were required. This error in judgement contributed to the design error presented in Violation A not being identified in the interfacing comment process. However, we believe that the error in judgement does not infer that the procedure was inadequate.
c.1.2 Reasons for the Alleged Violation 5?e Response to Violation A.
c.1.3 Cotrective Steps That Have Been Taken and Results Achieved See Response to Violation A.
C.l.4 Corrective Steps Taken to Avoid Purther Alleged Violations See Response to Violation A.
n __ _ _ _ _ _ _ _ _ _
.. C.1.5 Date When Full compliance Will be Achieved See Response to Violation A.
' ALLEGED VIOLATION C.2 10 CFR Part 50,' Appendix B, Criterion V, "Instructions,' Procedures, and Drawings", requires that activities affecting quality be prescribed by
. documented instructions, procedures, or drawings and be accomplished in accordance with these instructions, procedures, or drawings.
Contrary to the above, as of November 6, 1987, it was identified that activities affecting quality had not been accomplished in accordance with prescribed instructions or drawings, in that:
1.
The heater interlock logic switches for the control Room Ventilation Systems had not been modified'in accordance with the instructions or drawings of E(34 No. 34272 which was issued December 16, 1986 or in accordance with the differential pressure switch setpoint specifications for Switches OPDS-VC069 (Sheet No. PS631) and OPDS-VC060 (Sheet No.
PS633) which were promulgated on February 9, 1987.
C.2.1 Admission or Denial of Alleged Violation Commonwealth Edison denies the first part of this violation because the heater interlock logic switches for the Control Room Ventilation had been modified in accordance with the instructions and drawings of ECW No. 34272 on May 20 and 21, 1987. Commonwealth Edison admits that the differential pressure switch setpoint specifications had not been implemented in a timely fashion, per the Station Review Program, because of a work backlog.
C.2.2 Reasons for-the Alleged violation The Station (Setpoint) Review Program was not completed in a timely manner, because personnel underestimated the scope of work. Had the impacted data sheet been reviewed and implemented in a timely manner it is expected that this would have been identified and the system would not have been degraded.
C.2.3 Corrective Steps That Have Been Taken and Results Achieved The Station (Setpoint) Review Program work backlog, existing at the time of the violation, has been eliminated. For the cases cited, the required setpoints have been implemented.
C.2.4 Corrective Steps Taken to Avoid Further Alleged Violations Appropriate station personnel were advised that setpoint data sheets should be reviewed and implemented in a timely manner.
. C.2.5 pate When Full Compliance Will Be Achieved corrective actions were complete on April 13, 1988.
4~106K
,, ATTACHMENT B BASES FOR MITIGATION Edison believes an adequate basis exists for mitigation of the proposed Civil Penalty. The five factors contained in Section V(B) of 10 CPR Part 2, Appendix C are addressed below.
1.
Prompt Identification and Reporting The NOV does acknowledge that Edison made a timely report after the problem was identified but discounted that, based on the length of time the plant operated before the matter was discovered. Under the Enforcement Policy, the reasonableness of the length of time to discovery depends on the opportunities for discovery and the ease of discovery.
Because the complexity of_the changes had been misjudged, a functional check was performed initially rather than a component demonstration since the changes had not affected established acceptance criteria. Moreover, as the NOV recognizes, the error itself masked the ability to detect it by routine surveillance testing. Under these circumstances, the length cf time to discovery (six months) was not unreasonably long and, as such, should not be the basis to discount Edison's prompt reporting.
2.
Corrective Action As described in Attachment A, Edison has taken prompt and comprehensive corcective actions. Not only was the design error corrected as quickly as l
possible., but it was also promptly brought to the attention of the l
personnel involved with it.
A In34 review of Class 18 differential pressure switch applications was conducted which verified that the error l
was an isolated incident.
Moreover, the underlying cause of the incident, an ambiguity resulting from using terms subject to different interpretations, has been eliminated by enhancing an existing procedure.
3.
Past Performance Edison believes that this incident is distinct from other issues addressed in the last Braidwood SALP. Although it is recognized that prior noncompliances have occurred in the Braidwood Startup Test Program, and l
that this Program is significant to the safe operation of Braidwood Station, the remedial review done of the results of the Program, as they l
relate to detection of design errors has identified no prior occurrence for which prior corrective action was either inadequate or ineffective.
l l
l
.. 4.
Prior Notice As presented in the Inspection Report (Reference (a)) and in the Enforcement Conference Report (Reference (b)], there appears to have been no prior notice of the general concern related to the previous SALP.
Furthermore, it is Edison's belief that the cited violation and the identified SALP items share no common characteristics.
5.
Multiple occurrences In the post-enforcement conference report ((Reference (b)) the NRC raised additional concerns which seemed to suggest that Edison's procedures for processing design changes enhanced the probability of undetected cases like the one of interest. Subsequent to the enforcement conference, Edison performed an extensive review of all design changes made during the time period of interest and has found only the two (2) cases cited in the NOV to be safety-related, (from a total population of 2,176 that required additional testing), a relatively insignificant amount.
Also, because the 100% review of the differential pressure switch applications showed this occurrence to be isolated, there should not be escalation for this reason.
P l-
,, ATTACHMENT C SAFETY SIGNIFICANCE At the Enforcement Conference, Edison believes we presented two possible accidents during which the license control room dose could not have exceeded the 30 REM to the thyroid dose limit due to the inoperability of the Control Room Make-up Air Filter Unit (EMUAFU) heater. Those accidents were a Main Steam Line Break (MSLB) and a Loss of Coolant Accident (LOCA). The source for these accident scenarios is FSAR Table 15.0-12, which lists accidents with postulated offsite dose.
Both of these accidents could potentially affect control room habitability by contaminating the air supply and, as a result, requiring operation of the EMUAFU.
In the event of an accident in which radioiodine is detected, the EMUAFU is started and draws air from the turbine building or from outside the plant (see PSAR Figures 6.4-6 and 6.4-76).
The efficiency of both the EMUAFU charcoal adsorber (2-two inch beds of charcoal) and the recirculation charcoal adsorber was determined.
From this the resulting control room dose was calculated, based on an outside air con 61 tion of 105 F and 100% RH for 30 days, for both accident cases.
In the 0
calculation, it was determined that the recirculation charcoal adsorber efficiency was uneffected by the inlet conditions to the EMUAFU.
In the MSLB accident (the onli accident on Table 15.0-12 that is postulated to affect the turbine building relative humidity), the relative humidity at the inlet condition to the EMUAFU was assumed to be 100% RH, instantly.
Table 1, attached, presents the effect of relative humidity on charcoal adsorber efficiency based on a data set from from the IREL Report BOG-CS-7643, page 11, Figure 1.
From Table 1 the EMUAFU charcoal adsorber efficiency would be 54.3%, based on 100% RH, which is significantly better than the minimum efficiency of 10% required to keep the control room dose to the thyroid under 30 REM.
For the LOCA, the most radiologically severe accident, the turbine building air intake conditions for the EMUAFU were calculated to be 1200 F and 69% RH, based on a constant 150F temperature rise through the turbine building. Since the efficiency of the EMUAFU charcoal adsorber, per Table 1, is greater than 99% the calculated dose to the thyroid of 17.18 REM remains unchanged.
During the Enforcement Conference and in the subsequent report
[ Reference (b)) the NRC staff expressed a concern related to the temperatures used in the analysis of safety significance. Specifically, the report states..."the temperature measurements were ad hoc measurements rather than statistically derived limiting conditions and therefore cannot be relied upon generically.
Also, contrary to the licensee analyses, under design basis accident (DBA) conditions the heat sources in the turbine building would soon dissipate. Thus, under DBA conditions, the air inside the turbine building including the shouldbeassumedtobeidenticaltotheatmos$hericconditionshe safety significance relative humidity.
It therefore appears that
- .i
, presented in Inspection Report No. 50-456/880007-(DRSS) is correct in that under certain conditions (DBA conditions with high relative humidity), the control room potentially could have been uninhabitable per GDC-19 criteria.
If the control room was uninhabitable, a condition would exist which could prevent the fulfillment of the safety function of systems needed to shutdown the reactor and maintain a safe shutdown condition."
A constant temperature rise through the Turbine Building was considered unrealistic by the NRC staff. As presented above,'the NRC staff indicated that the inlet air to the make-up air filter unit "...should be assumed to be-identical to the atmospheric conditions...".Following a LOCA concurrent with a' Loss of Emergency Power (LOEP), the heat in the Turbine
' Building is expected to dissipate but not disappear. The conditions at the inlet will be a function of the outside temperature and relative humidity and the temperature rise through the Turbine Building. A more detailed analysis was performed to incorporate the temperature rise due to the decay in the Turbine Building residual heat contained within the equipment and piping.
In this analysis, it was determined that 80% of the Turbine Building heat had dissipated after 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />; therefore it was assumed that the make-up filter unit inlet conditions would be the same as the outside for the folluwing 28 days. Also, in the first 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, 85% of the radioiodine dose would have occurred (assuming a constant filter adsorber efficiency). This analysis considered two different outside air conditions.
The first condition maintained the outside air temperature at 1030F and the relative humidity at 100% for the first 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> and then assumed that the temperature would vary but the relative humidity would stay at 100% for the next 28 days. These conditions are meteorologica11y extreme because the highest recorded average two day temperature with a simultaneous relativa humidity above 95% was 780F for~the past 21 years. This information is from the Greater Peoria Airport. Peoria was selected because it is reasonably representative of the Braidwood Site area and has been used extensively as a source of weather data for previous Braidwood studies.
For the first 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> of analysis the EMUAPU charcoal adsorber efficiency was 99%, because the relative humidity never exceeded 95.6%.
For the next 28 days the relative humidity was considered to be 100%. This resulted in a charcoal adsorber efficiency of 54.3%.
These efficiencies resulted in a projected control room operator dose to the thyroid of 23.7 REM.
The second condition simulated a diurnal variation in temperature and relative humidity with an average daily temperature and relative humidity higher than the 1% frequency of occurrence conditions in Illinois. This simulated day was repeated for 20 days. For the first 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> the EMUAFU charcoal absorber efficiency was 99% because the relative hamidity at the Turbine Building make-up filter unit inlet never exceeded 93.6%.
The actual charcoal adsorber efficiency for the last 28 days can only be bounded because relative humidity exceeded 95% for some periods during those 28 days. The average charcoal adsorber efficiency would be between 99% and 54.3%, for the last128 days because, in the analysis, the relative humidity exceeded 95.78%
.. for six hours each day, and therefore maximum possible control room operator dose to the thyroid would be 23.7 REM. The original calculation of control room ' operator dose to the thyroid is 17.18 REM. This was based upon a 99%
efficient make-up air filter unit charcoal adsorber and a 90% recirculation-charcoal adsorber. This calculated dose is based on a LOCA in Braidwood Unit
-1.
In conclusion, the maximum control room dose to the thyroid under the most extreme conditions would be 23.7 REM which is 79% of the 30 REN limit set by 10CPR50 Appendix A, Criteria 19 of Group II - Control Room. Therefore, no condition would have existed under which the control room would have been uninhabitable due to external sources of radiation that could have prevented the fulfillment of the safety function of systems needed to shutdown the reactor and maintain a safe shutdown condition.
TABLE 1 PENETRATION AND EFFICIENCY VERSUS RELATIVE HUMIDITY
% RH
% PEN.
% EFF.
50
.02 99.98 70
.10 99.90 80
.16 99.84 90
.19 99.81 93
.29 99.71 95
.56 99.44 95.78
- 1.00 99.00 96 1.12 98.88 97 4.85 95.15 98 10.5 89.5 99 21.8 78.2 100 4 5.7 *
- 54.3
- BASED ON LINE AR INTERPOL ATION BETWEEN 95% AND 96% RH.
" BASED ON LINE AR REGESSION OF 97%, 98% AND 99% RH.
,s ATTACHMENT D SALP 7 VIOLATION
SUMMARY
PRE-OPERATIONAL TESTING The SALP 7 period saw the startup. testing of Unit 1-occurring concurrently with the preoperational testing of Unit 2.
Eight (8) violations were identified during this SALP period I.
Pour (4) violations were identified and issued during the SALP 7 period:
(a)
A Severity Level V violation citing an inaccurate startup test deficiency resolution.
(b)
A Severity Level V. violation for failing to assure that' applicable design requirements were incorporated-into a startup test procedure as originally performed.
(c)
A Severity Level V violation citing three examples of failing to follow written test procedures.
(d)
.A' Severity Level IV violation for failing to include a leak test of the fuel transfer tube expansion bellows in the Primary Containment B and.C Local Leakage Rate Test.
(This violation was actually identified in May 1986 (SALP 6)-but was not issued until February 1987 (SALP 7).]
II.
Four (4) violations were identified during the SALP 7 period but issued after its conclusion:
-(a)
A Sevarity Level V violation whereby a System Test Engineer in charge of a preoperational test did not use an oppropriate procedure to troubleshoot a power operated relief valve.
(b)
A Severity Level V violation identifying three examples of late or non-existent test deficiency reporting.
(The example of non-existent reporting was subsequently withdrawn by the NRC).
i I
(c)
A Severity Level V violation for failing to make a timely (30 day) notification for a change to the Initial Startup Test program.
(d)
A Severity Level IV violation identifying two examples of inadequate test procedure review.
o-
_y The above violations, except for I.b present concerns that are not related to that presented in the NOV.
Item I.b, upon initial review, may appear to be similar to the concern of the NOV, but upon more detailed review is found to be different.
Item I.b addressed a case where a test change request had not included appropriate information from a Westinghouse Vendor's Manual. The violation focused on the failure to adequately review and approve a major test change against the original test procedure. However, the-appropriate test had been selected for the application.
As presented above, no violation identified improper test selection nor improper installation of a design change as discussed in the NOV.
Furthermore, during SALP 8, no other violations have been issued in the pre-operational test area..
4706K p