ML20203Q211: Difference between revisions
StriderTol (talk | contribs) (StriderTol Bot insert) |
StriderTol (talk | contribs) (StriderTol Bot change) |
||
Line 18: | Line 18: | ||
=Text= | =Text= | ||
{{#Wiki_filter: | {{#Wiki_filter:_ | ||
. | |||
. | |||
U.S. NUCLEAR REGULATORY COMMISSION | |||
REGION III | |||
Report No. 50-346/85040(DRP) | |||
Docket No. 50-346 License No. NPF-3 | |||
Licensee: Toledo Edison Company | |||
Edison Plaza, 300 Madison Avenue | |||
Toledo, OH 43652 | |||
Facility Name: Davis-Besse 1 | |||
Inspection At: Oak Harbor, OH | |||
Inspection Conducted: November 4, 1985, through March 14, 1986 | |||
Inspectors: W. Rogers | |||
D. Kosloff | |||
~ | |||
f | |||
M B c-Bu)rI 'Is | |||
' | |||
I'd'N | |||
Date | |||
/ w | |||
Approved By: I. . Ja tw, Chief b)8'85 | |||
P oject Section 2B Date | |||
Inspection Summary | |||
Inspection on November 4, 1985, through March 14, 1986 | |||
(Report No. 50-346/85040(DRP)) | |||
Areas Inspected: Special inspection of the circuinstances involving the | |||
inoperability of the air-cooled and water-cooled subsystems of the control | |||
room emergency ventilation system. | |||
Results: Six violations were identified involving the violations of Technical | |||
Specifications 3.7.6.1 and 3.0.3, requiring two trains of CREVS be operable in | |||
Modes 1, 2, 3, and 4; failure to review design changes to the control room for | |||
impact on the heat loading of the CREVS; inadequate procedures; inadequate | |||
testing; inadequate corrective action; and failure to report. | |||
. | |||
8605090119 860505 | |||
PDR ADOCK 050003 6 | |||
G | |||
, | |||
. | |||
. | |||
DETAILS | |||
1. Persons Contacted | |||
*L. Storz, Plant Manager | |||
*J. Lietzow, Nuclear Specialist | |||
*W. O' Conner, Assistant Plant Manager, Operations | |||
R. Peters, Nuclear Licensing Manager | |||
*J. Wood, Nuclear Plant Systems Director | |||
*F. Miller, Nuclear Facilities Engineering, Principle Engineer | |||
*W. Alton, System Engineer | |||
*F. Whitcomb, Plant Services System Supervisor | |||
*F. Piccolo, Assistant Restart Test Program Manager | |||
,NRC Personnel | |||
B. Burgess, Project Inspector | |||
W. Rogers, Senior Resident Inspector | |||
*D. Kosloff, Resident Inspector | |||
*P. Byron, Senior Resident Inspector | |||
* Denotes those present at the exit interview on March 31, 1986. | |||
2. Control Room Emergency Ventilation System Design Basis | |||
Davis-Besse Technical Specification Limiting Condition for Operation | |||
3.7.6.1 requires two independent control room emergency ventilation | |||
systems (CREVS) to be operable in Modes 1, 2, 3 and 4. Each of two | |||
identical independent systems is required to perform the following two | |||
system safety functions: (1) Maintain the ambient air temperature below | |||
the maximum allowable temperature for continuous operation of the | |||
equipment and instrumentation in the area cooled by this system and (2) | |||
Maintain the control room habitable for operations personnel during and | |||
following all credible accidents. | |||
The CREVS is discussed in Subsection 9.4.1.2 of the Updated Safety Analysis | |||
Report (USAR), " System Description." Each CREVS includes three subsystems. | |||
One subsystem uses a fan, du: ting and filters to circulate clean air through | |||
the control roon area. This subsystem is also required to maintain the air | |||
pressure in the control room area higher than the air pressure in the | |||
adjacent portions of the auxiliary building. The circulating air is cooled | |||
by a mechanical refrigeration subsystem utilizing Freon and a compressor. | |||
A third subsystem was intended to cool the Freon using a water-cooled | |||
condensing unit with an air-cooled condensing unit as a back-up if service | |||
water temperature was to become unsuitable. The water-cooled condensing | |||
unit is considered to be incapable of functioning following a design-basis | |||
seismic event and the air-cooled condenser was not protected from tornado | |||
driven missiles. Therefore, both subsystems must be operable for the system | |||
to be operable. | |||
As described in USAP Subsection 9.4.1.3, " Safety Evaluation," the design | |||
of the CREVS requires that when the system is started, the water-cooled | |||
2 | |||
. | |||
. | |||
condensing unit will start to automatically provide cooling. The USAR | |||
states that "If the CREVS starts, the automatic service water valves will | |||
open." If the water-cooled condensing unit is not available, the air- | |||
cooled condensing unit is to automatically provide cooling as required. | |||
3. Licensee Review of the Control Room Emergency Ventilation System | |||
' | |||
Following the June 9, 1985, Loss of Feedwater Event, and in response to | |||
concerns raised as a result of the event, the licensee established a | |||
program to review the history, functions and testing of systems important | |||
to the safe operation of the Davis-Besse Station. The purposes of this | |||
review are to identify problems which could impact the ability of those | |||
systems to perform their intended function and to identify and test any | |||
, | |||
functions which had not been adequately tested. | |||
On November 1,1985, a Licensee Event Report stated that during the review | |||
of the CREVS as part of the System Review and Test Program (SRTP), it was | |||
determined that the existing system tests did not prove that the cooling | |||
function was operable. Further reviews of the operation of equipment in | |||
the system indicated that the system was not operable. The licensee's | |||
' | |||
internal report documenting the problems identified with CREVS was issued | |||
on February 26, 1986. This report was routinely provided to the NRC, as | |||
are all SRTP reports. | |||
4. Uncorrected CREVS Design Errors Preventing Operability | |||
The CREVS has never been operable due to the following design errors: | |||
f a. The water-cooled condensing unit in each train of the the CREVS | |||
i was never operable because the Service Water (SW) supply valve | |||
' | |||
control circuits would not allow the SW supply valves to remain | |||
open. The control circuit for the SW supply valve has a low water | |||
flow interlock. The intended function of this interlock is to shut | |||
the SW supply valve on low flow and transfer cooling to the | |||
* | |||
air-cooled condensing unit. However, the actual circuit design | |||
placed the flow interlock in the valve opening circuit. The valve | |||
is normally closed, with no flow; therefore, the interlock prevents | |||
the valve from ever automatically opening. This circuit design | |||
error prevented the water-cooled subsystem from ever being operable, | |||
thereby preventing the CREVS from being operable. 10 CFR 50, | |||
* | |||
Appendix B, Criterion XI, " Test Control," requires that testing | |||
demonstrate that systems and components will perform satisfactorily | |||
! in service. The Toledo Edison Nuclear Quality Assurance Manual | |||
(NQAM), Section II, implements 10 CFR 50, Appendix B, Criterion XI. | |||
Surveillance procedure ST 5076.01.06, dated April 16, 1985, " Control | |||
Rcom Emergency Ventilation System Monthly Test," did not require | |||
, | |||
testing that would demonstrate that the service water supply valve | |||
to the water-cooled condensing unit would function as designed. | |||
Failure of this test to demonstrate that the SW supply valve would | |||
perform satisfactorily in service is considered an example of a | |||
violation of 10 CFR 50, Appendix B, Criterion XI " Test Control" | |||
(346/85040-4a). | |||
. | |||
3 | |||
- | |||
, _ - . , .-. . . . . ._ | |||
_ - - . , . -- - | |||
_ _ | |||
. | |||
. | |||
The inspectors had brought this concern to the attention of the | |||
licensee's engineering department in February of 1984, and requested | |||
a determination of the adequacy of the design. It is possible to | |||
bypass this interlock by using manual controls for the SW supply | |||
valve before the CREVS is started, but operating personnel were not | |||
aware of this method and it was not included in the CREVS operating | |||
procedure. | |||
b. Both the air-cooled and water-cooled condensing units for each train | |||
of the CREVS were inoperable whenever the outside air temperature was | |||
below about 15 degrees F because refrigerant temperature would drop | |||
to ambient causing the refrigerant compressors to trip on low | |||
refrigerant pressure. This condition was brought to the attention of | |||
licensee management by licensee maintenance personnel on February 1, | |||
1984, in a written Facility Change Request (FCR). The CREVS was not | |||
declared inoperable and corrective action was not taken (see | |||
Paragraph 9b). | |||
c. The refrigerant piping on the roof is not protected from tornado | |||
driven missiles. A refrigerant pipe broken by a missile could allow | |||
refrigerant to escape, disabling the cooling function of the CREVS. | |||
Since piping for both trains is separated by less than 8", it is likely | |||
that a single missile could rupture piping for both trains. USAR | |||
Table 9.4-1, " Single Failure Analysis-CREVS" states that, for the | |||
CREVS piping, " Rupture is not considered credible since all piping is | |||
. . . protected from missiles." The control room operators were not | |||
provided with direct indication of a loss of refrigerant. | |||
The CREVS design flaws described in Paragraphs a, b and c were | |||
present in the original design of the system and had not been | |||
corrected as of the end date of this report. Individually, each | |||
flaw caused both trains of the CREVS to be inoperable; combined, the | |||
flaws prevented both trains of the CREVS from being able to perform | |||
their cooling function in a significant variety of plant conditions. | |||
Technical Specification (TS) Limiting Condition for Operation | |||
(LCO) 3.7.6.1 requires that two independent CREVS be operable in | |||
Modes 1, 2, 3 and 4. TS 3.0.3 allows operation to continue if an | |||
appropriate Action Statement is provided and followed. If no action | |||
statement is provided, TS 3.0.3 requires that within a specified | |||
time period the unit to be placed in a mode in which the TS LC0 does | |||
not apply. On July 2, 1977, the unit was taken from Mode 5 to | |||
Mode 4, requiring both CREVS systems to be operable. At this point, | |||
since there was no Action Statement provided to be followed in the | |||
event that both CREVS were inoperable, the licensee was required to | |||
either make one or both CREVS operable or place the unit in cold | |||
shutdown (Mode 5) within twenty four hours. Neither CREVS were made | |||
operable and the unit was not placed in cold shutdown within twenty | |||
four hours. During the period from July 2,1977, until June 8, | |||
1985, the unit was in Modes 1, 2, 3 and 4 on numerous occasions with | |||
both CREVS remaining inoperable. On most of those occasions the | |||
mode of operation of the unit was not changed within the time limits | |||
of TS 3.0.3. These failures to comply with Technical Specification | |||
3.0.3 are examples of a violation (346/85040-01a and Olb). Other | |||
examples of violation la are discussed in Paragraph 6. | |||
4 | |||
. | |||
. | |||
5. Air-Cooled Condensing Unit Hydromotor Actuators | |||
The CREVS air-cooled condensing units are located out-of-doors, exposed | |||
to the environment. USAR Table 3.11-1 " Design Basis Accident Environment" | |||
lists -10*F as the lowest out-of-doors Design Basis Temperature. Outside | |||
air temperatures as low as -20 F have been observed by the resident | |||
office staff. The hydromotor actuators that position the airflow control | |||
dampers for the air-cooled condensing units are located on the units. | |||
The actuators operate sluggishly at subzero temperatures because they | |||
were not designed to be operated at such temperatures. Sluggish damper | |||
operation would degrade the performance of the air-cooled condensing units. | |||
Inadequate maintenance allowed the controls for the air-cooled condensing | |||
unit control dampers to fail, causing the dampers to close when they | |||
should have opened and open when they should have closed. This condition | |||
rendered the CREVS inoperable because the refrigerant compressor would | |||
trip on high or low refrigerant pressure. | |||
Section 11 of the licensees NQAM is intended to assure that testing of | |||
systems will demonstrate that they will perform satisfactorily in service. | |||
Section 11 of the NQAM implements the requirements of 10 CFR 50, Appendix B, | |||
Criterion XI, " Test Control." Surveillance Test ST 5076.01.06, " Control | |||
Room Emergency Ventilation System Monthly Test," dated April 10, 1985, was | |||
implemented to comply with the requirements of the NQAM and Appendix B by | |||
testing the performance of the CREVS. This test was not adequate to | |||
detect the problems described above because it did not test the cooling | |||
function of the CREVS. Fcilure to adequately test the CREVS is considered | |||
an example of a violation of 10 CFR 50, Appendix B, Criterion XI | |||
(346/85040-4a). | |||
6. Corrected CREVS Design Errors Preventing Operability | |||
The CREVS refrigerant compressor motors were designed and installed with | |||
electrical overload protection. Since the original design of the system | |||
did not include an air-cooled condensing unit, the overload protection was | |||
sized for operation with the water-cooled condensing unit. The additional | |||
current required by the compressor motor whenever the air-cooled condensing | |||
unit was required to operate was enough to trip the motor on overload. | |||
During CREVS preoperational testing using the air-cooled condensing unit | |||
the compressor repeatedly tripped on overload. This problem was documented | |||
on April 12, 1977, in Startup Field Report E771 and corrected on August 4, | |||
19'/7, when higher rated overload protection was installed. The ' overload | |||
protection was later eliminated. Both trains of the CREVS were unable to | |||
perform their cooling function using the air-cooled condensing units and | |||
were inoperable for this reason alone until August 4,1977. As discussed | |||
in Paragraph 4.a. both trains of the CREVS were never able to perform | |||
their cooling function using the water-cooled condensing units. Therefore | |||
until August 4, 1977 both trains of the CREVS were unable to perform their | |||
cooling function, utilizing either cooling method, thereby defeating the | |||
systems' intended safety function. Technical Specification (TS) Limiting | |||
Condition for Operation (LC0) 3.7.6.1 requires that two | |||
5 | |||
. _ | |||
.. | |||
. | |||
independent CREVS be operable in Modes 3 and 4. TS 3.0.3 allows operation | |||
to continue if an appropriate Action Statement is provided and followed. | |||
3 In no action statement is provided, TS 3.0.3 requires that within a | |||
specified time period the unit to be placed in a mode in which the TS LC0 | |||
does not apply. On July 2, 1977, the unit was taken from Mode 5 to Mode 4, | |||
requiring both CREVS systems to be operable. At this point, since there | |||
was no Action Statement provided to be followed in the event that both | |||
CREVS were inoperable, the licensee was required to either make one or | |||
both CREVS operable or place the unit in cold shutdown (Mode 5) within | |||
twenty four hours. Neither CREVS were made operable and the unit was not | |||
placed in cold shutdown within twenty four hours. During the period from | |||
, | |||
July 2, through August 4, 1977, the unit was in Modes 3 and 4 on other | |||
occasions with both CREVS inoperable. On those occasions the mode of | |||
operation of the unit was not changed within the time limits of TS 3.0.3. | |||
These failures to comply with Technical Specification 3.0.3 are examples | |||
of a violation (346/85040-01a). Other examples of violation la are | |||
discussed in Paragraph 4. | |||
7. CREVS Heat loads | |||
Since the plant was first started up in 1977 the licensee has completed | |||
several Facility Change Requests (FCRs) that added essential electrical | |||
; equipment to the area cooled by the CREVS. When energized the electrical | |||
4 circuitry of the added equipment produces heat. Much of the equipment | |||
added would be required to be in operation while being cooled by the | |||
CREVS. FCR design controls did not require evaluation of the effect the | |||
added heat production (heat loads) would have on the capability of the | |||
CREVS to cool the control room area when required. The heat loads added | |||
by the licensee were not included in USAR Table 0.4-2, "CREVS Heat Loads." | |||
The installation of Post Accident Indicating Panels and Post Accident | |||
Monitoring Equipment Racks (FCR 79-446) in 1980,1981,1982 and 1983 is | |||
' | |||
. an example of a change that added heat loads. Other examples include the | |||
Anticipatory Reactor Trip System (FCR 79-184) and the Safety Parameter | |||
Display System. | |||
Failure to provide adequate design control measures commensurate with those | |||
applied to the original design is considered a violation 10 CFR 50, | |||
, Appendix B, Criterion III, " Design Control" and the licensee's NQAM, | |||
Section 3 (345/85040-2). | |||
8. Licensee Control of the CREVS | |||
The licensee did not know that the CREVS design basis required both the | |||
air-cooled and water-cooled condensing units to be operable for the CREVS | |||
to be operable. The water-cooled condensing unit of one train of tt3 | |||
CREVS was out of service for maintenance from August 11, 1984 to May 12, | |||
1985. The air-cooled condensing units of both trains were not operable | |||
until August 4, 1977, due to a design deficiency that was discovered in | |||
April 1977. In each case the licensee's operations and management | |||
6 | |||
- - - | |||
. _- . .-. . . .. -- - - . -- -- .- .. - . . | |||
. | |||
.. | |||
personnel were aware that a condensing unit was inoperable, but they did | |||
not conform with the action statement of LC0 3.7.6.1 because they did not | |||
realize that the CREVS was inoperable. | |||
This lack of awareness of the plant design basis has been a repetitive | |||
problem. On November 21, 1984, a civil penalty (IER 84015) was imposed | |||
to emphasize to the licensee the importance of design basis requirements. | |||
One of the two ventilation systems identified in IER 84015 was the CREVS. | |||
- | |||
Prior to that, in the September 23, 1982 SALP, the NRC had identified a | |||
weakness in the licensee's ability to recognize design basis requirements | |||
' | |||
for equipment operability. The concern had been restated several times | |||
in the interim. Failure to implement appropriate design requirements | |||
into station procedure SP 1104.69.08 dated April 9, 1985, " Control Room | |||
Emergency Ventilation System" is considered a violation of 10 CFR 50 | |||
Appendix B, Criterion V, " Instructions, Procedures, and Drawings" | |||
(346/85040-3b). | |||
The licensee did not have a procedure for shedding nonessential heat loads | |||
in the area cooled by the CREVS. Such a procedure was necessary to allow | |||
heat loads to be reduced enough to allow the CREVS to maintain the proper | |||
temperature in the control room. The CREVS cooling capacity is lower | |||
than the cooling capacity of the normal control room air conditioning | |||
, | |||
system. Failure to incorporate appropriate guidance into procedure | |||
SP1104.14.10, dated August 25,1985, " Control Room Heating, Ventilation | |||
and Air Conditioning System Procedure," is considered a violation of | |||
10 CFR 50 Appendix B, Criterion V (346/85040-3a). | |||
9. Licensee Corrective Action | |||
a. USAR Section 9.4.1.3, " Safety Evaluation," states that ". . . control | |||
room integrity for leaktightness is maintained by airtight . .. | |||
doors . . . ." In June 1979, the licensee completed the replacement | |||
of door No. 509, part of the boundary between the control room area | |||
and the auxiliary building. Door No. 509 is one of the doors | |||
referred to in the USAR as being airtight. After replacement of the | |||
door, no testing was performed to verify that the door was airtight | |||
or that the CREVS could maintain the USAR, Chapter 9, required .125" | |||
t g., pressure differential between the control room area and the | |||
ddjacent areas of the auxiliary building. Failure to test the door | |||
is considered a violation of 10 CFR 50, Appendix B, Criterion XI, | |||
" Test Control" (346/85]40-4.b). | |||
Additionally, personnel from Bechtel, working under contract with | |||
the licensee on another Facility Change Request, (FCR), noted that | |||
door No. 509 did not have gaskets required to make it airtight. | |||
In May 1980, the licensee received a letter from Bechtel informing | |||
the licensee that the gaskets were missing and should be replaced. | |||
The licensee did not take corrective action to install the gaskets | |||
until February, 1986. Failure to take prompt corrective action is | |||
considered a violation of 10 CFR 50, Appendix B, Criterion XI, | |||
" Corrective Action" (346/85040-5b). | |||
7 | |||
. _ . . _ __ _ _ _ _ _ ._ . _ _ _ | |||
__ _ | |||
_ _ _ | |||
- - . | |||
. | |||
. | |||
b. On February 1,1984, licensee maintenance personnel initiated a | |||
request for FCR 84-0054, documenting a malfunction that affected | |||
both trains of the CREVS. The FCR stated that the CREVS compressors | |||
would not start in winter when outside temperatures were 15 to 20 F | |||
J | |||
due to refrigerant migration to the air-cooled condensing unit. This | |||
condition made both trains of the CREVS inoperable. Although the FCR | |||
did not specifically state that the condition made the CREVS inoperable, | |||
1 | |||
it was marked as " required to ensure nuclear safety" and it stated that | |||
the condition ". . . would cause excessive high temperatures in the | |||
control room if the EVS would be required. . .." It also stated that | |||
the reason for the FCR request was "to enable (the CREVS) to meet its | |||
" | |||
design criteria during the winter. . . . The licensee did not declare | |||
the CREVS inoperable, did not report the condition to the NRC until | |||
November 1, 1985, and did not take corrective action until October | |||
1985. 10 CFR 50.72 requires the reporting, within one hour, of any | |||
event or condition that results in a nuclear power plant being in a | |||
condition outside the design basis of the plant. Having both CREVS | |||
inoperable placed the plant in a condition outside the design basis. | |||
Failure to report the CREVS condition identified in FCR 84-0054 is | |||
considered a violation of 10 CFR 50.72.(ii)(B) (346/85040-6). | |||
In addition, failure to take prompt corrective action to restore the | |||
CREVS to proper operating condition is considered a violation of | |||
10 CFR 50, Appendix B, Criterion XI, " Corrective Action" (346/85040-5a). | |||
, 10. Safety Significance | |||
The specific problems described in this report would have prevented the | |||
CREVS from performing its safety function under certain conditions from | |||
initial entry of the plant into mode 4 (1977) until the June 9 event. Most | |||
likely plant shutdown would not have been prevented by high control. room | |||
temperature. However, some event scenarios, may have caused difficulties | |||
with plant control and control room habitability. | |||
11. Exit Interview | |||
' | |||
The inspectors met with licensee representatives listed in Paragraph 1, on | |||
February 28 and March 31, 1986, and summarized the purpose, scope and | |||
findings of the inspection. The inspector discussed the likely | |||
informational content of the inspection report with regard to documents | |||
or processes reviewed by the inspector during the inspection. The | |||
licensee did not identify any such documents or processes as proprietary. | |||
8 | |||
. . ._ - . -- | |||
. - - - . - - __ - . ._ | |||
}} | }} |
Latest revision as of 02:20, 31 December 2020
ML20203Q211 | |
Person / Time | |
---|---|
Site: | Davis Besse |
Issue date: | 05/02/1986 |
From: | Burgess B, Jackiw I NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III) |
To: | |
Shared Package | |
ML20203Q196 | List: |
References | |
50-346-85-40, NUDOCS 8605090119 | |
Download: ML20203Q211 (8) | |
See also: IR 05000346/1985040
Text
_
.
.
U.S. NUCLEAR REGULATORY COMMISSION
REGION III
Report No. 50-346/85040(DRP)
Docket No. 50-346 License No. NPF-3
Licensee: Toledo Edison Company
Edison Plaza, 300 Madison Avenue
Toledo, OH 43652
Facility Name: Davis-Besse 1
Inspection At: Oak Harbor, OH
Inspection Conducted: November 4, 1985, through March 14, 1986
Inspectors: W. Rogers
D. Kosloff
~
f
M B c-Bu)rI 'Is
'
I'd'N
Date
/ w
Approved By: I. . Ja tw, Chief b)8'85
P oject Section 2B Date
Inspection Summary
Inspection on November 4, 1985, through March 14, 1986
(Report No. 50-346/85040(DRP))
Areas Inspected: Special inspection of the circuinstances involving the
inoperability of the air-cooled and water-cooled subsystems of the control
room emergency ventilation system.
Results: Six violations were identified involving the violations of Technical
Specifications 3.7.6.1 and 3.0.3, requiring two trains of CREVS be operable in
Modes 1, 2, 3, and 4; failure to review design changes to the control room for
impact on the heat loading of the CREVS; inadequate procedures; inadequate
testing; inadequate corrective action; and failure to report.
.
8605090119 860505
PDR ADOCK 050003 6
G
,
.
.
DETAILS
1. Persons Contacted
- L. Storz, Plant Manager
- J. Lietzow, Nuclear Specialist
- W. O' Conner, Assistant Plant Manager, Operations
R. Peters, Nuclear Licensing Manager
- J. Wood, Nuclear Plant Systems Director
- F. Miller, Nuclear Facilities Engineering, Principle Engineer
- W. Alton, System Engineer
- F. Whitcomb, Plant Services System Supervisor
- F. Piccolo, Assistant Restart Test Program Manager
,NRC Personnel
B. Burgess, Project Inspector
W. Rogers, Senior Resident Inspector
- D. Kosloff, Resident Inspector
- P. Byron, Senior Resident Inspector
- Denotes those present at the exit interview on March 31, 1986.
2. Control Room Emergency Ventilation System Design Basis
Davis-Besse Technical Specification Limiting Condition for Operation
3.7.6.1 requires two independent control room emergency ventilation
systems (CREVS) to be operable in Modes 1, 2, 3 and 4. Each of two
identical independent systems is required to perform the following two
system safety functions: (1) Maintain the ambient air temperature below
the maximum allowable temperature for continuous operation of the
equipment and instrumentation in the area cooled by this system and (2)
Maintain the control room habitable for operations personnel during and
following all credible accidents.
The CREVS is discussed in Subsection 9.4.1.2 of the Updated Safety Analysis
Report (USAR), " System Description." Each CREVS includes three subsystems.
One subsystem uses a fan, du: ting and filters to circulate clean air through
the control roon area. This subsystem is also required to maintain the air
pressure in the control room area higher than the air pressure in the
adjacent portions of the auxiliary building. The circulating air is cooled
by a mechanical refrigeration subsystem utilizing Freon and a compressor.
A third subsystem was intended to cool the Freon using a water-cooled
condensing unit with an air-cooled condensing unit as a back-up if service
water temperature was to become unsuitable. The water-cooled condensing
unit is considered to be incapable of functioning following a design-basis
seismic event and the air-cooled condenser was not protected from tornado
driven missiles. Therefore, both subsystems must be operable for the system
to be operable.
As described in USAP Subsection 9.4.1.3, " Safety Evaluation," the design
of the CREVS requires that when the system is started, the water-cooled
2
.
.
condensing unit will start to automatically provide cooling. The USAR
states that "If the CREVS starts, the automatic service water valves will
open." If the water-cooled condensing unit is not available, the air-
cooled condensing unit is to automatically provide cooling as required.
3. Licensee Review of the Control Room Emergency Ventilation System
'
Following the June 9, 1985, Loss of Feedwater Event, and in response to
concerns raised as a result of the event, the licensee established a
program to review the history, functions and testing of systems important
to the safe operation of the Davis-Besse Station. The purposes of this
review are to identify problems which could impact the ability of those
systems to perform their intended function and to identify and test any
,
functions which had not been adequately tested.
On November 1,1985, a Licensee Event Report stated that during the review
of the CREVS as part of the System Review and Test Program (SRTP), it was
determined that the existing system tests did not prove that the cooling
function was operable. Further reviews of the operation of equipment in
the system indicated that the system was not operable. The licensee's
'
internal report documenting the problems identified with CREVS was issued
on February 26, 1986. This report was routinely provided to the NRC, as
are all SRTP reports.
4. Uncorrected CREVS Design Errors Preventing Operability
The CREVS has never been operable due to the following design errors:
f a. The water-cooled condensing unit in each train of the the CREVS
i was never operable because the Service Water (SW) supply valve
'
control circuits would not allow the SW supply valves to remain
open. The control circuit for the SW supply valve has a low water
flow interlock. The intended function of this interlock is to shut
the SW supply valve on low flow and transfer cooling to the
air-cooled condensing unit. However, the actual circuit design
placed the flow interlock in the valve opening circuit. The valve
is normally closed, with no flow; therefore, the interlock prevents
the valve from ever automatically opening. This circuit design
error prevented the water-cooled subsystem from ever being operable,
thereby preventing the CREVS from being operable. 10 CFR 50,
Appendix B, Criterion XI, " Test Control," requires that testing
demonstrate that systems and components will perform satisfactorily
! in service. The Toledo Edison Nuclear Quality Assurance Manual
(NQAM),Section II, implements 10 CFR 50, Appendix B, Criterion XI.
Surveillance procedure ST 5076.01.06, dated April 16, 1985, " Control
Rcom Emergency Ventilation System Monthly Test," did not require
,
testing that would demonstrate that the service water supply valve
to the water-cooled condensing unit would function as designed.
Failure of this test to demonstrate that the SW supply valve would
perform satisfactorily in service is considered an example of a
violation of 10 CFR 50, Appendix B, Criterion XI " Test Control"
(346/85040-4a).
.
3
-
, _ - . , .-. . . . . ._
_ - - . , . -- -
_ _
.
.
The inspectors had brought this concern to the attention of the
licensee's engineering department in February of 1984, and requested
a determination of the adequacy of the design. It is possible to
bypass this interlock by using manual controls for the SW supply
valve before the CREVS is started, but operating personnel were not
aware of this method and it was not included in the CREVS operating
procedure.
b. Both the air-cooled and water-cooled condensing units for each train
of the CREVS were inoperable whenever the outside air temperature was
below about 15 degrees F because refrigerant temperature would drop
to ambient causing the refrigerant compressors to trip on low
refrigerant pressure. This condition was brought to the attention of
licensee management by licensee maintenance personnel on February 1,
1984, in a written Facility Change Request (FCR). The CREVS was not
declared inoperable and corrective action was not taken (see
Paragraph 9b).
c. The refrigerant piping on the roof is not protected from tornado
driven missiles. A refrigerant pipe broken by a missile could allow
refrigerant to escape, disabling the cooling function of the CREVS.
Since piping for both trains is separated by less than 8", it is likely
that a single missile could rupture piping for both trains. USAR
Table 9.4-1, " Single Failure Analysis-CREVS" states that, for the
CREVS piping, " Rupture is not considered credible since all piping is
. . . protected from missiles." The control room operators were not
provided with direct indication of a loss of refrigerant.
The CREVS design flaws described in Paragraphs a, b and c were
present in the original design of the system and had not been
corrected as of the end date of this report. Individually, each
flaw caused both trains of the CREVS to be inoperable; combined, the
flaws prevented both trains of the CREVS from being able to perform
their cooling function in a significant variety of plant conditions.
Technical Specification (TS) Limiting Condition for Operation
(LCO) 3.7.6.1 requires that two independent CREVS be operable in
Modes 1, 2, 3 and 4. TS 3.0.3 allows operation to continue if an
appropriate Action Statement is provided and followed. If no action
statement is provided, TS 3.0.3 requires that within a specified
time period the unit to be placed in a mode in which the TS LC0 does
not apply. On July 2, 1977, the unit was taken from Mode 5 to
Mode 4, requiring both CREVS systems to be operable. At this point,
since there was no Action Statement provided to be followed in the
event that both CREVS were inoperable, the licensee was required to
either make one or both CREVS operable or place the unit in cold
shutdown (Mode 5) within twenty four hours. Neither CREVS were made
operable and the unit was not placed in cold shutdown within twenty
four hours. During the period from July 2,1977, until June 8,
1985, the unit was in Modes 1, 2, 3 and 4 on numerous occasions with
both CREVS remaining inoperable. On most of those occasions the
mode of operation of the unit was not changed within the time limits
of TS 3.0.3. These failures to comply with Technical Specification 3.0.3 are examples of a violation (346/85040-01a and Olb). Other
examples of violation la are discussed in Paragraph 6.
4
.
.
5. Air-Cooled Condensing Unit Hydromotor Actuators
The CREVS air-cooled condensing units are located out-of-doors, exposed
to the environment. USAR Table 3.11-1 " Design Basis Accident Environment"
lists -10*F as the lowest out-of-doors Design Basis Temperature. Outside
air temperatures as low as -20 F have been observed by the resident
office staff. The hydromotor actuators that position the airflow control
dampers for the air-cooled condensing units are located on the units.
The actuators operate sluggishly at subzero temperatures because they
were not designed to be operated at such temperatures. Sluggish damper
operation would degrade the performance of the air-cooled condensing units.
Inadequate maintenance allowed the controls for the air-cooled condensing
unit control dampers to fail, causing the dampers to close when they
should have opened and open when they should have closed. This condition
rendered the CREVS inoperable because the refrigerant compressor would
trip on high or low refrigerant pressure.
Section 11 of the licensees NQAM is intended to assure that testing of
systems will demonstrate that they will perform satisfactorily in service.
Section 11 of the NQAM implements the requirements of 10 CFR 50, Appendix B,
Criterion XI, " Test Control." Surveillance Test ST 5076.01.06, " Control
Room Emergency Ventilation System Monthly Test," dated April 10, 1985, was
implemented to comply with the requirements of the NQAM and Appendix B by
testing the performance of the CREVS. This test was not adequate to
detect the problems described above because it did not test the cooling
function of the CREVS. Fcilure to adequately test the CREVS is considered
an example of a violation of 10 CFR 50, Appendix B, Criterion XI
(346/85040-4a).
6. Corrected CREVS Design Errors Preventing Operability
The CREVS refrigerant compressor motors were designed and installed with
electrical overload protection. Since the original design of the system
did not include an air-cooled condensing unit, the overload protection was
sized for operation with the water-cooled condensing unit. The additional
current required by the compressor motor whenever the air-cooled condensing
unit was required to operate was enough to trip the motor on overload.
During CREVS preoperational testing using the air-cooled condensing unit
the compressor repeatedly tripped on overload. This problem was documented
on April 12, 1977, in Startup Field Report E771 and corrected on August 4,
19'/7, when higher rated overload protection was installed. The ' overload
protection was later eliminated. Both trains of the CREVS were unable to
perform their cooling function using the air-cooled condensing units and
were inoperable for this reason alone until August 4,1977. As discussed
in Paragraph 4.a. both trains of the CREVS were never able to perform
their cooling function using the water-cooled condensing units. Therefore
until August 4, 1977 both trains of the CREVS were unable to perform their
cooling function, utilizing either cooling method, thereby defeating the
systems' intended safety function. Technical Specification (TS) Limiting
Condition for Operation (LC0) 3.7.6.1 requires that two
5
. _
..
.
independent CREVS be operable in Modes 3 and 4. TS 3.0.3 allows operation
to continue if an appropriate Action Statement is provided and followed.
3 In no action statement is provided, TS 3.0.3 requires that within a
specified time period the unit to be placed in a mode in which the TS LC0
does not apply. On July 2, 1977, the unit was taken from Mode 5 to Mode 4,
requiring both CREVS systems to be operable. At this point, since there
was no Action Statement provided to be followed in the event that both
CREVS were inoperable, the licensee was required to either make one or
both CREVS operable or place the unit in cold shutdown (Mode 5) within
twenty four hours. Neither CREVS were made operable and the unit was not
placed in cold shutdown within twenty four hours. During the period from
,
July 2, through August 4, 1977, the unit was in Modes 3 and 4 on other
occasions with both CREVS inoperable. On those occasions the mode of
operation of the unit was not changed within the time limits of TS 3.0.3.
These failures to comply with Technical Specification 3.0.3 are examples
of a violation (346/85040-01a). Other examples of violation la are
discussed in Paragraph 4.
7. CREVS Heat loads
Since the plant was first started up in 1977 the licensee has completed
several Facility Change Requests (FCRs) that added essential electrical
- equipment to the area cooled by the CREVS. When energized the electrical
4 circuitry of the added equipment produces heat. Much of the equipment
added would be required to be in operation while being cooled by the
CREVS. FCR design controls did not require evaluation of the effect the
added heat production (heat loads) would have on the capability of the
CREVS to cool the control room area when required. The heat loads added
by the licensee were not included in USAR Table 0.4-2, "CREVS Heat Loads."
The installation of Post Accident Indicating Panels and Post Accident
Monitoring Equipment Racks (FCR 79-446) in 1980,1981,1982 and 1983 is
'
. an example of a change that added heat loads. Other examples include the
Anticipatory Reactor Trip System (FCR 79-184) and the Safety Parameter
Display System.
Failure to provide adequate design control measures commensurate with those
applied to the original design is considered a violation 10 CFR 50,
, Appendix B, Criterion III, " Design Control" and the licensee's NQAM,
Section 3 (345/85040-2).
8. Licensee Control of the CREVS
The licensee did not know that the CREVS design basis required both the
air-cooled and water-cooled condensing units to be operable for the CREVS
to be operable. The water-cooled condensing unit of one train of tt3
CREVS was out of service for maintenance from August 11, 1984 to May 12,
1985. The air-cooled condensing units of both trains were not operable
until August 4, 1977, due to a design deficiency that was discovered in
April 1977. In each case the licensee's operations and management
6
- - -
. _- . .-. . . .. -- - - . -- -- .- .. - . .
.
..
personnel were aware that a condensing unit was inoperable, but they did
not conform with the action statement of LC0 3.7.6.1 because they did not
realize that the CREVS was inoperable.
This lack of awareness of the plant design basis has been a repetitive
problem. On November 21, 1984, a civil penalty (IER 84015) was imposed
to emphasize to the licensee the importance of design basis requirements.
One of the two ventilation systems identified in IER 84015 was the CREVS.
-
Prior to that, in the September 23, 1982 SALP, the NRC had identified a
weakness in the licensee's ability to recognize design basis requirements
'
for equipment operability. The concern had been restated several times
in the interim. Failure to implement appropriate design requirements
into station procedure SP 1104.69.08 dated April 9, 1985, " Control Room
Emergency Ventilation System" is considered a violation of 10 CFR 50
Appendix B, Criterion V, " Instructions, Procedures, and Drawings"
(346/85040-3b).
The licensee did not have a procedure for shedding nonessential heat loads
in the area cooled by the CREVS. Such a procedure was necessary to allow
heat loads to be reduced enough to allow the CREVS to maintain the proper
temperature in the control room. The CREVS cooling capacity is lower
than the cooling capacity of the normal control room air conditioning
,
system. Failure to incorporate appropriate guidance into procedure
SP1104.14.10, dated August 25,1985, " Control Room Heating, Ventilation
and Air Conditioning System Procedure," is considered a violation of
10 CFR 50 Appendix B, Criterion V (346/85040-3a).
9. Licensee Corrective Action
a. USAR Section 9.4.1.3, " Safety Evaluation," states that ". . . control
room integrity for leaktightness is maintained by airtight . ..
doors . . . ." In June 1979, the licensee completed the replacement
of door No. 509, part of the boundary between the control room area
and the auxiliary building. Door No. 509 is one of the doors
referred to in the USAR as being airtight. After replacement of the
door, no testing was performed to verify that the door was airtight
or that the CREVS could maintain the USAR, Chapter 9, required .125"
t g., pressure differential between the control room area and the
ddjacent areas of the auxiliary building. Failure to test the door
is considered a violation of 10 CFR 50, Appendix B, Criterion XI,
" Test Control" (346/85]40-4.b).
Additionally, personnel from Bechtel, working under contract with
the licensee on another Facility Change Request, (FCR), noted that
door No. 509 did not have gaskets required to make it airtight.
In May 1980, the licensee received a letter from Bechtel informing
the licensee that the gaskets were missing and should be replaced.
The licensee did not take corrective action to install the gaskets
until February, 1986. Failure to take prompt corrective action is
considered a violation of 10 CFR 50, Appendix B, Criterion XI,
" Corrective Action" (346/85040-5b).
7
. _ . . _ __ _ _ _ _ _ ._ . _ _ _
__ _
_ _ _
- - .
.
.
b. On February 1,1984, licensee maintenance personnel initiated a
request for FCR 84-0054, documenting a malfunction that affected
both trains of the CREVS. The FCR stated that the CREVS compressors
would not start in winter when outside temperatures were 15 to 20 F
J
due to refrigerant migration to the air-cooled condensing unit. This
condition made both trains of the CREVS inoperable. Although the FCR
did not specifically state that the condition made the CREVS inoperable,
1
it was marked as " required to ensure nuclear safety" and it stated that
the condition ". . . would cause excessive high temperatures in the
control room if the EVS would be required. . .." It also stated that
the reason for the FCR request was "to enable (the CREVS) to meet its
"
design criteria during the winter. . . . The licensee did not declare
the CREVS inoperable, did not report the condition to the NRC until
November 1, 1985, and did not take corrective action until October
1985. 10 CFR 50.72 requires the reporting, within one hour, of any
event or condition that results in a nuclear power plant being in a
condition outside the design basis of the plant. Having both CREVS
inoperable placed the plant in a condition outside the design basis.
Failure to report the CREVS condition identified in FCR 84-0054 is
considered a violation of 10 CFR 50.72.(ii)(B) (346/85040-6).
In addition, failure to take prompt corrective action to restore the
CREVS to proper operating condition is considered a violation of
10 CFR 50, Appendix B, Criterion XI, " Corrective Action" (346/85040-5a).
, 10. Safety Significance
The specific problems described in this report would have prevented the
CREVS from performing its safety function under certain conditions from
initial entry of the plant into mode 4 (1977) until the June 9 event. Most
likely plant shutdown would not have been prevented by high control. room
temperature. However, some event scenarios, may have caused difficulties
with plant control and control room habitability.
11. Exit Interview
'
The inspectors met with licensee representatives listed in Paragraph 1, on
February 28 and March 31, 1986, and summarized the purpose, scope and
findings of the inspection. The inspector discussed the likely
informational content of the inspection report with regard to documents
or processes reviewed by the inspector during the inspection. The
licensee did not identify any such documents or processes as proprietary.
8
. . ._ - . --
. - - - . - - __ - . ._