ML20203Q211

Insp Rept 50-346/85-40 on 851104-860314.Violation Noted: Failure to Review Design Changes to Control Room for Impact on Heat Loading of Emergency Ventilation Sys & Inadequate Procedures

ML20203Q211
Person / Time
Site:	Davis Besse
Issue date:	05/02/1986
From:	Burgess B, Jackiw I NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
To:
Shared Package
ML20203Q196	List: ML20203Q195 ML20203Q211
References
50-346-85-40, NUDOCS 8605090119
Download: ML20203Q211 (8)

See also: IR 05000346/1985040

Text

_

.

.

U.S. NUCLEAR REGULATORY COMMISSION

REGION III

Report No. 50-346/85040(DRP)

Docket No. 50-346 License No. NPF-3

Licensee: Toledo Edison Company

Edison Plaza, 300 Madison Avenue

Toledo, OH 43652

Facility Name: Davis-Besse 1

Inspection At: Oak Harbor, OH

Inspection Conducted: November 4, 1985, through March 14, 1986

Inspectors: W. Rogers

D. Kosloff

~

f

M B c-Bu)rI 'Is

'

I'd'N

Date

/ w

Approved By: I. . Ja tw, Chief b)8'85

P oject Section 2B Date

Inspection Summary

Inspection on November 4, 1985, through March 14, 1986

(Report No. 50-346/85040(DRP))

Areas Inspected: Special inspection of the circuinstances involving the

inoperability of the air-cooled and water-cooled subsystems of the control

room emergency ventilation system.

Results: Six violations were identified involving the violations of Technical

Specifications 3.7.6.1 and 3.0.3, requiring two trains of CREVS be operable in

Modes 1, 2, 3, and 4; failure to review design changes to the control room for

impact on the heat loading of the CREVS; inadequate procedures; inadequate

testing; inadequate corrective action; and failure to report.

.

8605090119 860505

PDR ADOCK 050003 6

G

,

.

.

DETAILS

1. Persons Contacted

• L. Storz, Plant Manager

• J. Lietzow, Nuclear Specialist

• W. O' Conner, Assistant Plant Manager, Operations

R. Peters, Nuclear Licensing Manager

• J. Wood, Nuclear Plant Systems Director

• F. Miller, Nuclear Facilities Engineering, Principle Engineer

• W. Alton, System Engineer

• F. Whitcomb, Plant Services System Supervisor

• F. Piccolo, Assistant Restart Test Program Manager

,NRC Personnel

B. Burgess, Project Inspector

W. Rogers, Senior Resident Inspector

• D. Kosloff, Resident Inspector

• P. Byron, Senior Resident Inspector

• Denotes those present at the exit interview on March 31, 1986.

2. Control Room Emergency Ventilation System Design Basis

Davis-Besse Technical Specification Limiting Condition for Operation

3.7.6.1 requires two independent control room emergency ventilation

systems (CREVS) to be operable in Modes 1, 2, 3 and 4. Each of two

identical independent systems is required to perform the following two

system safety functions: (1) Maintain the ambient air temperature below

the maximum allowable temperature for continuous operation of the

equipment and instrumentation in the area cooled by this system and (2)

Maintain the control room habitable for operations personnel during and

following all credible accidents.

The CREVS is discussed in Subsection 9.4.1.2 of the Updated Safety Analysis

Report (USAR), " System Description." Each CREVS includes three subsystems.

One subsystem uses a fan, du: ting and filters to circulate clean air through

the control roon area. This subsystem is also required to maintain the air

pressure in the control room area higher than the air pressure in the

adjacent portions of the auxiliary building. The circulating air is cooled

by a mechanical refrigeration subsystem utilizing Freon and a compressor.

A third subsystem was intended to cool the Freon using a water-cooled

condensing unit with an air-cooled condensing unit as a back-up if service

water temperature was to become unsuitable. The water-cooled condensing

unit is considered to be incapable of functioning following a design-basis

seismic event and the air-cooled condenser was not protected from tornado

driven missiles. Therefore, both subsystems must be operable for the system

to be operable.

As described in USAP Subsection 9.4.1.3, " Safety Evaluation," the design

of the CREVS requires that when the system is started, the water-cooled

2

.

.

condensing unit will start to automatically provide cooling. The USAR

states that "If the CREVS starts, the automatic service water valves will

open." If the water-cooled condensing unit is not available, the air-

cooled condensing unit is to automatically provide cooling as required.

3. Licensee Review of the Control Room Emergency Ventilation System

'

Following the June 9, 1985, Loss of Feedwater Event, and in response to

concerns raised as a result of the event, the licensee established a

program to review the history, functions and testing of systems important

to the safe operation of the Davis-Besse Station. The purposes of this

review are to identify problems which could impact the ability of those

systems to perform their intended function and to identify and test any

,

functions which had not been adequately tested.

On November 1,1985, a Licensee Event Report stated that during the review

of the CREVS as part of the System Review and Test Program (SRTP), it was

determined that the existing system tests did not prove that the cooling

function was operable. Further reviews of the operation of equipment in

the system indicated that the system was not operable. The licensee's

'

internal report documenting the problems identified with CREVS was issued

on February 26, 1986. This report was routinely provided to the NRC, as

are all SRTP reports.

4. Uncorrected CREVS Design Errors Preventing Operability

The CREVS has never been operable due to the following design errors:

f a. The water-cooled condensing unit in each train of the the CREVS

i was never operable because the Service Water (SW) supply valve

'

control circuits would not allow the SW supply valves to remain

open. The control circuit for the SW supply valve has a low water

flow interlock. The intended function of this interlock is to shut

the SW supply valve on low flow and transfer cooling to the

air-cooled condensing unit. However, the actual circuit design

placed the flow interlock in the valve opening circuit. The valve

is normally closed, with no flow; therefore, the interlock prevents

the valve from ever automatically opening. This circuit design

error prevented the water-cooled subsystem from ever being operable,

thereby preventing the CREVS from being operable. 10 CFR 50,

Appendix B, Criterion XI, " Test Control," requires that testing

demonstrate that systems and components will perform satisfactorily

! in service. The Toledo Edison Nuclear Quality Assurance Manual

(NQAM),Section II, implements 10 CFR 50, Appendix B, Criterion XI.

Surveillance procedure ST 5076.01.06, dated April 16, 1985, " Control

Rcom Emergency Ventilation System Monthly Test," did not require

,

testing that would demonstrate that the service water supply valve

to the water-cooled condensing unit would function as designed.

Failure of this test to demonstrate that the SW supply valve would

perform satisfactorily in service is considered an example of a

violation of 10 CFR 50, Appendix B, Criterion XI " Test Control"

(346/85040-4a).

.

3

-

, _ - . , .-. . . . . ._

_ - - . , . -- -

_ _

.

.

The inspectors had brought this concern to the attention of the

licensee's engineering department in February of 1984, and requested

a determination of the adequacy of the design. It is possible to

bypass this interlock by using manual controls for the SW supply

valve before the CREVS is started, but operating personnel were not

aware of this method and it was not included in the CREVS operating

procedure.

b. Both the air-cooled and water-cooled condensing units for each train

of the CREVS were inoperable whenever the outside air temperature was

below about 15 degrees F because refrigerant temperature would drop

to ambient causing the refrigerant compressors to trip on low

refrigerant pressure. This condition was brought to the attention of

licensee management by licensee maintenance personnel on February 1,

1984, in a written Facility Change Request (FCR). The CREVS was not

declared inoperable and corrective action was not taken (see

Paragraph 9b).

c. The refrigerant piping on the roof is not protected from tornado

driven missiles. A refrigerant pipe broken by a missile could allow

refrigerant to escape, disabling the cooling function of the CREVS.

Since piping for both trains is separated by less than 8", it is likely

that a single missile could rupture piping for both trains. USAR

Table 9.4-1, " Single Failure Analysis-CREVS" states that, for the

CREVS piping, " Rupture is not considered credible since all piping is

. . . protected from missiles." The control room operators were not

provided with direct indication of a loss of refrigerant.

The CREVS design flaws described in Paragraphs a, b and c were

present in the original design of the system and had not been

corrected as of the end date of this report. Individually, each

flaw caused both trains of the CREVS to be inoperable; combined, the

flaws prevented both trains of the CREVS from being able to perform

their cooling function in a significant variety of plant conditions.

Technical Specification (TS) Limiting Condition for Operation

(LCO) 3.7.6.1 requires that two independent CREVS be operable in

Modes 1, 2, 3 and 4. TS 3.0.3 allows operation to continue if an

appropriate Action Statement is provided and followed. If no action

statement is provided, TS 3.0.3 requires that within a specified

time period the unit to be placed in a mode in which the TS LC0 does

not apply. On July 2, 1977, the unit was taken from Mode 5 to

Mode 4, requiring both CREVS systems to be operable. At this point,

since there was no Action Statement provided to be followed in the

event that both CREVS were inoperable, the licensee was required to

either make one or both CREVS operable or place the unit in cold

shutdown (Mode 5) within twenty four hours. Neither CREVS were made

operable and the unit was not placed in cold shutdown within twenty

four hours. During the period from July 2,1977, until June 8,

1985, the unit was in Modes 1, 2, 3 and 4 on numerous occasions with

both CREVS remaining inoperable. On most of those occasions the

mode of operation of the unit was not changed within the time limits

of TS 3.0.3. These failures to comply with Technical Specification 3.0.3 are examples of a violation (346/85040-01a and Olb). Other

examples of violation la are discussed in Paragraph 6.

4

.

.

5. Air-Cooled Condensing Unit Hydromotor Actuators

The CREVS air-cooled condensing units are located out-of-doors, exposed

to the environment. USAR Table 3.11-1 " Design Basis Accident Environment"

lists -10*F as the lowest out-of-doors Design Basis Temperature. Outside

air temperatures as low as -20 F have been observed by the resident

office staff. The hydromotor actuators that position the airflow control

dampers for the air-cooled condensing units are located on the units.

The actuators operate sluggishly at subzero temperatures because they

were not designed to be operated at such temperatures. Sluggish damper

operation would degrade the performance of the air-cooled condensing units.

Inadequate maintenance allowed the controls for the air-cooled condensing

unit control dampers to fail, causing the dampers to close when they

should have opened and open when they should have closed. This condition

rendered the CREVS inoperable because the refrigerant compressor would

trip on high or low refrigerant pressure.

Section 11 of the licensees NQAM is intended to assure that testing of

systems will demonstrate that they will perform satisfactorily in service.

Section 11 of the NQAM implements the requirements of 10 CFR 50, Appendix B,

Criterion XI, " Test Control." Surveillance Test ST 5076.01.06, " Control

Room Emergency Ventilation System Monthly Test," dated April 10, 1985, was

implemented to comply with the requirements of the NQAM and Appendix B by

testing the performance of the CREVS. This test was not adequate to

detect the problems described above because it did not test the cooling

function of the CREVS. Fcilure to adequately test the CREVS is considered

an example of a violation of 10 CFR 50, Appendix B, Criterion XI

(346/85040-4a).

6. Corrected CREVS Design Errors Preventing Operability

The CREVS refrigerant compressor motors were designed and installed with

electrical overload protection. Since the original design of the system

did not include an air-cooled condensing unit, the overload protection was

sized for operation with the water-cooled condensing unit. The additional

current required by the compressor motor whenever the air-cooled condensing

unit was required to operate was enough to trip the motor on overload.

During CREVS preoperational testing using the air-cooled condensing unit

the compressor repeatedly tripped on overload. This problem was documented

on April 12, 1977, in Startup Field Report E771 and corrected on August 4,

19'/7, when higher rated overload protection was installed. The ' overload

protection was later eliminated. Both trains of the CREVS were unable to

perform their cooling function using the air-cooled condensing units and

were inoperable for this reason alone until August 4,1977. As discussed

in Paragraph 4.a. both trains of the CREVS were never able to perform

their cooling function using the water-cooled condensing units. Therefore

until August 4, 1977 both trains of the CREVS were unable to perform their

cooling function, utilizing either cooling method, thereby defeating the

systems' intended safety function. Technical Specification (TS) Limiting

Condition for Operation (LC0) 3.7.6.1 requires that two

5

. _

..

.

independent CREVS be operable in Modes 3 and 4. TS 3.0.3 allows operation

to continue if an appropriate Action Statement is provided and followed.

3 In no action statement is provided, TS 3.0.3 requires that within a

specified time period the unit to be placed in a mode in which the TS LC0

does not apply. On July 2, 1977, the unit was taken from Mode 5 to Mode 4,

requiring both CREVS systems to be operable. At this point, since there

was no Action Statement provided to be followed in the event that both

CREVS were inoperable, the licensee was required to either make one or

both CREVS operable or place the unit in cold shutdown (Mode 5) within

twenty four hours. Neither CREVS were made operable and the unit was not

placed in cold shutdown within twenty four hours. During the period from

,

July 2, through August 4, 1977, the unit was in Modes 3 and 4 on other

occasions with both CREVS inoperable. On those occasions the mode of

operation of the unit was not changed within the time limits of TS 3.0.3.

These failures to comply with Technical Specification 3.0.3 are examples

of a violation (346/85040-01a). Other examples of violation la are

discussed in Paragraph 4.

7. CREVS Heat loads

Since the plant was first started up in 1977 the licensee has completed

several Facility Change Requests (FCRs) that added essential electrical

equipment to the area cooled by the CREVS. When energized the electrical

4 circuitry of the added equipment produces heat. Much of the equipment

added would be required to be in operation while being cooled by the

CREVS. FCR design controls did not require evaluation of the effect the

added heat production (heat loads) would have on the capability of the

CREVS to cool the control room area when required. The heat loads added

by the licensee were not included in USAR Table 0.4-2, "CREVS Heat Loads."

The installation of Post Accident Indicating Panels and Post Accident

Monitoring Equipment Racks (FCR 79-446) in 1980,1981,1982 and 1983 is

'

. an example of a change that added heat loads. Other examples include the

Anticipatory Reactor Trip System (FCR 79-184) and the Safety Parameter

Display System.

Failure to provide adequate design control measures commensurate with those

applied to the original design is considered a violation 10 CFR 50,

, Appendix B, Criterion III, " Design Control" and the licensee's NQAM,

Section 3 (345/85040-2).

8. Licensee Control of the CREVS

The licensee did not know that the CREVS design basis required both the

air-cooled and water-cooled condensing units to be operable for the CREVS

to be operable. The water-cooled condensing unit of one train of tt3

CREVS was out of service for maintenance from August 11, 1984 to May 12,

1985. The air-cooled condensing units of both trains were not operable

until August 4, 1977, due to a design deficiency that was discovered in

April 1977. In each case the licensee's operations and management

6

- - -

. _- . .-. . . .. -- - - . -- -- .- .. - . .

.

..

personnel were aware that a condensing unit was inoperable, but they did

not conform with the action statement of LC0 3.7.6.1 because they did not

realize that the CREVS was inoperable.

This lack of awareness of the plant design basis has been a repetitive

problem. On November 21, 1984, a civil penalty (IER 84015) was imposed

to emphasize to the licensee the importance of design basis requirements.

One of the two ventilation systems identified in IER 84015 was the CREVS.

-

Prior to that, in the September 23, 1982 SALP, the NRC had identified a

weakness in the licensee's ability to recognize design basis requirements

'

for equipment operability. The concern had been restated several times

in the interim. Failure to implement appropriate design requirements

into station procedure SP 1104.69.08 dated April 9, 1985, " Control Room

Emergency Ventilation System" is considered a violation of 10 CFR 50

Appendix B, Criterion V, " Instructions, Procedures, and Drawings"

(346/85040-3b).

The licensee did not have a procedure for shedding nonessential heat loads

in the area cooled by the CREVS. Such a procedure was necessary to allow

heat loads to be reduced enough to allow the CREVS to maintain the proper

temperature in the control room. The CREVS cooling capacity is lower

than the cooling capacity of the normal control room air conditioning

,

system. Failure to incorporate appropriate guidance into procedure

SP1104.14.10, dated August 25,1985, " Control Room Heating, Ventilation

and Air Conditioning System Procedure," is considered a violation of

10 CFR 50 Appendix B, Criterion V (346/85040-3a).

9. Licensee Corrective Action

a. USAR Section 9.4.1.3, " Safety Evaluation," states that ". . . control

room integrity for leaktightness is maintained by airtight . ..

doors . . . ." In June 1979, the licensee completed the replacement

of door No. 509, part of the boundary between the control room area

and the auxiliary building. Door No. 509 is one of the doors

referred to in the USAR as being airtight. After replacement of the

door, no testing was performed to verify that the door was airtight

or that the CREVS could maintain the USAR, Chapter 9, required .125"

t g., pressure differential between the control room area and the

ddjacent areas of the auxiliary building. Failure to test the door

is considered a violation of 10 CFR 50, Appendix B, Criterion XI,

" Test Control" (346/85]40-4.b).

Additionally, personnel from Bechtel, working under contract with

the licensee on another Facility Change Request, (FCR), noted that

door No. 509 did not have gaskets required to make it airtight.

In May 1980, the licensee received a letter from Bechtel informing

the licensee that the gaskets were missing and should be replaced.

The licensee did not take corrective action to install the gaskets

until February, 1986. Failure to take prompt corrective action is

considered a violation of 10 CFR 50, Appendix B, Criterion XI,

" Corrective Action" (346/85040-5b).

7

. _ . . _ __ _ _ _ _ _ ._ . _ _ _

__ _

_ _ _

- - .

.

.

b. On February 1,1984, licensee maintenance personnel initiated a

request for FCR 84-0054, documenting a malfunction that affected

both trains of the CREVS. The FCR stated that the CREVS compressors

would not start in winter when outside temperatures were 15 to 20 F

J

due to refrigerant migration to the air-cooled condensing unit. This

condition made both trains of the CREVS inoperable. Although the FCR

did not specifically state that the condition made the CREVS inoperable,

1

it was marked as " required to ensure nuclear safety" and it stated that

the condition ". . . would cause excessive high temperatures in the

control room if the EVS would be required. . .." It also stated that

the reason for the FCR request was "to enable (the CREVS) to meet its

"

design criteria during the winter. . . . The licensee did not declare

the CREVS inoperable, did not report the condition to the NRC until

November 1, 1985, and did not take corrective action until October

1985. 10 CFR 50.72 requires the reporting, within one hour, of any

event or condition that results in a nuclear power plant being in a

condition outside the design basis of the plant. Having both CREVS

inoperable placed the plant in a condition outside the design basis.

Failure to report the CREVS condition identified in FCR 84-0054 is

considered a violation of 10 CFR 50.72.(ii)(B) (346/85040-6).

In addition, failure to take prompt corrective action to restore the

CREVS to proper operating condition is considered a violation of

10 CFR 50, Appendix B, Criterion XI, " Corrective Action" (346/85040-5a).

, 10. Safety Significance

The specific problems described in this report would have prevented the

CREVS from performing its safety function under certain conditions from

initial entry of the plant into mode 4 (1977) until the June 9 event. Most

likely plant shutdown would not have been prevented by high control. room

temperature. However, some event scenarios, may have caused difficulties

with plant control and control room habitability.

11. Exit Interview

'

The inspectors met with licensee representatives listed in Paragraph 1, on

February 28 and March 31, 1986, and summarized the purpose, scope and

findings of the inspection. The inspector discussed the likely

informational content of the inspection report with regard to documents

or processes reviewed by the inspector during the inspection. The

licensee did not identify any such documents or processes as proprietary.

8

. . ._ - . --

. - - - . - - __ - . ._