U-602085, Responds to NRC Re Violations Noted in Insp Rept 50-461/92-20.Corrective Actions:Search Performed on Plant Maintenance Planning Sys Equipment List to Identify Other Equipment in Use at Plant That Utilize Keyboard/Keypad

Responds to NRC Re Violations Noted in Insp Rept 50-461/92-20.Corrective Actions:Search Performed on Plant Maintenance Planning Sys Equipment List to Identify Other Equipment in Use at Plant That Utilize Keyboard/Keypad

ML20127D320
Person / Time
Site:	Clinton
Issue date:	01/11/1993
From:	Spangenberg F ILLINOIS POWER CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
U-602085, NUDOCS 9301150175
Download: ML20127D320 (4)

Text

. . .

U.602085 s 1A2 93(01-11)-LP

, , likn(3 3 onpany

• Chnton Power Staten P O Bor 076 Chn1on IL 617?7 lol217 9 M 8991 POWER 10CFR2.201 January 11, 1993 Docket No. 50 461 Document Control Desk Nuclear Regulatory Commission Washington, D.C. 20$55

Subject:

Response to Notice of Violation Documented in NRC -

Inspection Report No. 50+461/92020(DRP), dated December 11. 1992

Dear Sir:

Thic letter provides the Illinois Power (IP) response to the Notice of Violation documented in NRC Inspection Report No. 50 461/92020 (DRP). The Notice of Violation discusses a violation of Clinton Power Station (CPS) Technical Specifications. The attachment to this letter provides the response to the Notice of Violation.

The cover letter to the above mentioned Notice of Violation expressed concern that the subject violation indicated a weakness in the control of software in safety related microprocessors as well as a lack of understanding of what constitutes maintenance to equipment microprocessors. The cover letter specifically requested that IP address whether the newly issued CPS " software QA" program adequately

• controls activities on the type of safety related microprocessor involved in this Notice of Violation. The attachment to th'is letter addresses these concerns, IP believes that this response addresses the concerns identified in the Notice of Violation.

Sincerely yours,

, W F. A. Spangknberg III Manager, Licensing and Sa ty MAR /mfm Attachment cc: NRC Clinton Licensing Project Manager NRC Resident Office, V-690 Regional Administrator, Region III, USNRC Illinois Department of Nuclear Safety 150042

BR"RBhu M8$ht I

l L ,

Page 2 of 4

.' to U.602085

. The Notico of Violation states:

" Technical Specification 3.0.4 requires that entry into an operational condition (OC) shall not be made unless the condition for the limiting condition for operations are met. Technical Specifications 3.3.7.5, Table 3.3.7.$ 1, Instrument 7, requires that both the Division I and II containment and drywell llyc'rogen/0xygen (110 22 ) analyzers be operable in OC {

1, 2, and 3.  ;

Contrary to the above, on November 22, 1992, entry was made into OC 2 with the Divtsion II containment and drywell (110 22 ) analyzer inoperable." ,

1. Backcround end Reason for the ViolatiRD The Containment Monitoring system has two divisionally separate, .

redundant hydrogen and oxygen (110 22 ) analyzer subsystems, each consisting of two separate modules: the analysis sample conditioning  ;

module located in the Fuel Building and the Electronic Control Module .

(ECM) located in the Main Control Room. The sample conditioning --

module contains a Cas Chromatograph (CC) and the ECM contains a i Central Processing Unit (CPU) with a microprocessor which is l programmed to control sampling and analysis of the Containment and i Drywell atmospheres.

During normal plant operations (analyzers in the standby mode), once per day at about 0800 hours0.00926 days <br />0.222 hours <br />0.00132 weeks <br />3.044e-4 months <br /> the CPU automatically initiates a self-  !

calibration check cycle which includes an analysis of the containment ,

and Drywell atmospheres. The duration of the cycle is about-one hour. During the cycle, air from five zones in the containment and Drywell are sampled and analyzed. The CPU processes the results of the gas chromatographic analysis, provides analog / digital display of hydrogen and oxygen concentration and generates a printed report.

Each analyzer is controlled through manual-keypad entrios and the CPU's resident executive program at each divisional ECM.

On November 22, 1992, operators _ initiated a manual reactor .' CRAM.

The cause of the SCRAM was corrected; however, the plant remained in Mode 3 with the reactor startup restrained pending correction of a heat trace prchlem on the Division I Il 02 2. sampling system.

At about 0800 hours0.00926 days <br />0.222 hours <br />0.00132 weeks <br />3.044e-4 months <br /> on November 22, 1992, Maintenance and Operations personnel determined that the operability of Divisions I and II H 022 analyzers should be verified during preparations for the-operational condition change to Mode 2. At about 1035 hours0.012 days <br />0.288 hours <br />0.00171 weeks <br />3.938175e-4 months <br />, Control and Instrumentation (C&I) maintenance personnel began an operability verification of the Division II H 02 2 analyzer. During the verification process, the assistant C61 supervisor noted that the timini, traces obtained while running the analyzer indicated a need for minor adjustment of the timing in the . function table to maximize -

. the accuracy of the equipment.- The_ assistant C&I supervisor directed

!- ~ a C&I technician to . adjust the timing. At about.1040 hours0.012 days <br />0.289 hours <br />0.00172 weeks <br />3.9572e-4 months <br />, the technician made the adjustment as directed.

At about 1045 hours0.0121 days <br />0.29 hours <br />0.00173 weeks <br />3.976225e-4 months <br /> C61 personnel performed'an operability

~

verification on the Division I H 02 2 analyzer and determined that no

-l --.-- . - - - - . , - -,

4,w. w -g.-y- tey-w *ar - se

_. ~----.----- . - - - - - - . - - - - - - - - -

Page 3 of 4

,- to U.602085

, adjustments were required. Following this verification, C&I personnel informed Operations personnel that the Divisions 1 and II analyzers were in an operable status.

On November 23, 1992, at about 2000 hours0.0231 days <br />0.556 hours <br />0.00331 weeks <br />7.61e-4 months <br />, based on C&I maintenance personnel input, operators declared the Division I 1102 2 analyzer operable. The Division II analyzer was stili considered operable because it was operable before the verification.

At 2056 hours0.0238 days <br />0.571 hours <br />0.0034 weeks <br />7.82308e-4 months <br /> the plant entered Mode 2.

On November 24, 1992, at about 0800 hours0.00926 days <br />0.222 hours <br />0.00132 weeks <br />3.044e-4 months <br />, both divisions of 11022 analyzers automatically initiated their daily calibration check cycle as designed. At about 0920 hours0.0106 days <br />0.256 hours <br />0.00152 weeks <br />3.5006e-4 months <br />, during a routine walkdown of control room equipment, a control room operator noted an abnormal reading on the Division II 1102 2 analyzer printout. The reading of all zeros on the printout for the automatic daily calibration check cycle, initiated at 0800 on November 24 indicated that the analyzer ,

was not functioning properly. Further review identified that the  !

Division 11 1102 2 analyzer printout for the November 23, 1992 l automatic daily calibration check cycle also exhibited all zeros and 1 therefore the analyzer was not functioning properly at that time. l l

Following troubleshootJng, C6I Maintenance personnel determined that I the data used in adjusting the function table of the Division 11 11022 analyzer on November 22 was incorrect. C61 Maintenance personnel

• corrected the entry in the function table and natisfactorily verified operations of the H 02 2 analyzer by manually initiating the monitor  ;

calibration check cycle.

CPS Technical Specification 3.0.4 was violated because entry was made into operational condition 2 from operational condition 3_with the Division II containment and drywell !! 02 2 analyzer inoperable. This ,

can be attributed to the lack of a work document or procedure for controlling adjustments to the 1102 2 analyzer function table, thereby resulting in'the analyzer unknowingly being inoperable when the plant mode change occurred. The effect making adjustments on the H 022 analyzer function table had on H 02 2 analyzer operability also was not ,

considered. A work document or procedure providing instructions for performing the adjustment process would have- assured performance of post-maintenance testing to verify the equipment's operability. .

Ilowever, prior to this event, C&T Maintenance personnel had considered this activity a basic' skill which did not require the use of a work document or procedure.

II, Corrective Actions Taken CPS Surveillance Procedure 9437.17, " Containment /Drywell 112 /02-Monitoring System Channel Calibration," provides instructions for the e performance of channel calibrations on the Division 1 and 11 Containment /Drywell- 11 02 2 monitoring system. CPS 9437.17 was revised to include instructions for performing adjustments to the function table of the H 02 2 analyzers. The instructions also include a requirement to perform post-maintenance testing consisting of a w,,,+r. v--.-e,,--w,< =wr--**wv v-=-vw-vv r-e--wm- -->a wo-+e vm-mw-+--* , e e-w w+ g r 'w+- --e-p % i,e i--i+e w ,ne v. ww y -

• w -- w-es w -- m r 7"-="-+-v' " ' "v'r'"r"

- .-- .- - - ~. - --- -- - -- -

Page 4 of 4

. to U.602085 source gas -calibration to demonstrate operability of 1102 2 monitors af ter performing function table adjustments. l In response to the concerns regarding weaknesses in the control of software in safety related microprocessors, the activity discussed in this violation was reviewed for applicability to a " software quality assurance (QA)" program. It was concluded that this activity (adjusting the timing of H 02 2 analyzers) is now appropriately ,

controlled via the CPS procedure process. The basis for this j conclusion is pro".ided in the following paragraphs.  ;

i As noted previously, each H 02 2 analyzer contains an Electronic Control Module (ECM) located in the Main Control Room (MCR). The ECM -

is a microprocessor based data processor and control modulo. The ECM #

controller contains a microprocessor-which is programmed to control sampling and analysis of the CPS Containment and Drywell atmospheres.

Programming for the ECM controller is provided on an internal progrannable read only memory (PROM) board. The PROM board provides programmed, read only memory for executive program storage. PROM 4 chips are programmed during application development. H02 2 analyzer  !

timing adjustments do not affect the programming of the analyzer PROM chips and are therefore not included in the CPS " software QA" ,

program.

[

CPS " software QA" is directed per Corporate Nuclear Procedure (CNP) 1.13, " Computer Application Management." Nuclear Station Engineering Department (HSED) Procedure A.21, " Computer Application Management,"

was approved on September 22, 1992, to implement-the requirements of CNP 1.13. NSED Procedure A.21 is used for the development, control, and modification of computer applications and data used by the IP '

Nuclear Program for which no other controls exist. Reprogramming of ,

H02 2 analyzer ECM PROM chips is controlled under_the_ plant t modification control program.

III. Corrective Steps Taken to Avoid Further Violation A search was performed on-the CPS maintenanco planning system equipment list to identify other equipment in use'at CPS which utilize a keyboard / keypad to allow communications between an operator and the equipment. central processing unit. Procedural controls were verified to be in place on equipment which was identified in this search. -

No further actions are required to prevent recurrence.

IV. Date When Full Compliance Will be Achieved IP is now in full compliance with CPS Technical Specification 3.0.4.

L t

• w de a4-t- -> W- -y ,,w -. <.y-e.,-. g-ic . my,=-5.inp.-- .s* Ngr,,as n -g- p-. g g -,,-ap, gg re--g.-gt gw w. 7+mm gue'yy'q y-v Nr- p y .-FN-er '