IR 05000315/1995008
| ML17332A847 | |
| Person / Time | |
|---|---|
| Site: | Cook  |
| Issue date: | 07/11/1995 |
| From: | Kropp W NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III) |
| To: | |
| Shared Package | |
| ML17332A846 | List: |
| References | |
| 50-315-95-08, 50-315-95-8, 50-316-95-08, 50-316-95-8, NUDOCS 9507180084 | |
| Download: ML17332A847 (29) | |
Text
U.S.
NUCLEAR REGULATORY COMMISSION REGION I I I Repor t Nos.
50-315/95008(DRP);
50-316/95008(DRP)
Docket Nos.
50-315; 50-316 Licensee:
Indiana Michigan Power Company 1 Riverside Plaza Columbus, OH 43216 License Nos.
Donald C.
Cook Nuclear Power Plant, Units 1 and
Inspection At:
Donald C.
Cook Site, Bridgman, NI Inspection Conducted:
Hay 16 through June 19, 1995 Inspectors:
J.
A. Isom D. J. Hartland C.
N. Orsini D. S. Butler A. Dunlop Approved By:
W ne J. Kr p, Chief eactor Pr jects Secti n 2A Date Ins ection Summar
Ins ection from Na 16 throu h June
1995 Re ort Nos.
50-315 95008 DRP 50-316 95008 DRP Areas Ins ected:
Routine, unannounced safety inspection by the resident and region-based inspectors of: action on previous inspection items, operational safety verification, onsite event followup, current material condition and housekeeping, radiological controls, security, safety assessment/verification, maintenance activities, surveillance activities, and engineering technical support.
Results:
Of the 10 areas inspected, no violations, inspection follow up items (IFS), or unresolved items (URI) were'dentified.
The following is a summary of the licensee's performance during this inspection period:
Plant 0 erations:
Licensee performance in this area was good.
Operator response to a plant transient, which included a letdown isolation and two feed water regulating valves failing open, due to a simultaneous loss of several control functions was very good.
Safet Assessment ualit Verification:
The licensee's performance in this area was mixed.
The licensee's root cause investigation and corrective action 9507180084
'750711 PDR ADOCK 05000315 Q
to items closed were good.
By declaring all emergency core cooling loops inoperable, the licensee displayed a conservative operating philosophy when deciding to enter Technical Specification (TS) 3.0.3 for both units.
The decision was apparently based on a misinterpretation of Generic Letter (GL) 91-18 guidance regarding operability determinations of degraded equipment.
Maintenance and Surveillance:
Licensee performance in this area was good.
The licensee exhibited good teamwork during the repair evolution for boron makeup system valve 2-CS-392, troubleshooting of problems with the Unit 2 turbine-driven auxiliary feedwater (TDAFW) pump trip and throttle valve (TETV), and Unit 1 control rod demand counters.
Overall, the licensee's management of entries into Technical Specification (TS) limiting condition for operation (LCO) action statements for planned maintenance was good; however, the inspectors identified two examples of less than optimal management of entries into LCOs for work on the post-accident containment hydrogen monitoring system (PACHMS) system.
En ineerin and Technical Su ort:
Licensee performance in this area was good.
The inspectors did not identify any concerns during a periodic review of the licensee's inservice testing (IST) and digital upgrade modification program DETAILS 1.
Persons Contacted
- A. A.
- K. R.
- L J.
E.
T.
P.
P.
F.
D. L.
- D. 0.
T. K.
P.
G.
- J L. H.
G. A.
A. A.
Blind, Site Vice President/Plant Hanager Baker, Assistant Plant Hanager-Operations Gibson, Assistant Plant Hanager-Technical Rutkowski, Assistant Plant Hanager, Support Beilman, Scheduling Superintendent Carteaux, Training Superintendent Noble, Radiation Protection Superintendent Horey, Chemistry Superintendent Postlewait, Site Engineering Support Hanager Schoepf, Haterials Hanagement Superintendent Wiebe, guality Assurance E Control Superintendent Vanginhoven, Project Engineering Superintendent Weber, Plant Engineering Superintendent Lotfi, Site Design Superintendent
- Denotes those attending the exit interview conducted on June 19, 1995.
The inspecto'rs also had discussions with other licensee employees, including members of the technical and engineering staffs, reactor and auxiliary operators, shift engineers and foremen, and electrical, mechanical and instrument maintenance personnel, and contract security ersonnel.
~
~
P 2.
Action on Previous Ins ection Findin s
(92701)
a
~
Closed Ins ection Fol1owu Item 50-315 93012-01B 50-316 93012-
~01B DRS
During the systems based instrument and control inspection (SBICI), the licensee was unable to provide the instrument seismic reports and cable environmental qualification (Eg) reports for transmitters PT-455, LT-461, and LT-527.
In response, the licensee provided the inspectors the seismic calculations and Eg information for the above instruments and cables.
The inspectors concluded that the transmitters, piping and tubing supports were seismically installed.
The cable Eg test reports indicated the installed cables would perform their intended functions.
The inspectors concluded the cables were environmentally qualified for this application.
This item is considered closed.
b.
Closed Violation 50-315 93012-02 50-316 93012-02 DRS:
The SBICI team identified several discrepancies, errors and omissions in engineering control package (ECP)
No. 1-2-I9-03, "Refueling Water Storage Tank Level/Residual Heat Removal Pumps Interlock,"
Revision 10, and flow diagram No. OP-1-5144-13,
"Containment Spray Unit No. 1."
In response, the licensee corrected the SBICI identified items by revising the ECP and added a note to the flow diagram that indicated setpoints were provided to assist in understanding the drawing, and that actual setpoints would be obtained from setpoint documents.
The inspectors reviewed the licensee's corrective actions and concluded the identified items had been satisfactorily implemented.
In addition, the licensee measured six safety related instrument elevations to compare the as-built data with the design elevation data.
The elevation differences ranged from 0.375 to 1.125 inches.
The inspectors reviewed the licensee's evaluation of this data and concluded the differences had minimal impact on the instrument loop accuracy calculations.
This item is considered closed.
Closed Violation 50-315 93012-03 50-316 93012-03 DRS
The SBICI team identified that the licensee failed to perform a safety evaluation and to include a written evaluation which provided the bases for the determination that temporary modification (TH) No.
2-93-015 did not involve an unreviewed safety question.
This modification installed a current to current (I/I) converter in each main feed pump speed control circuit.
The I/I converter installed in the east main feed pump control circuit failed and was the precursor for a reactor trip.
In response, the licensee removed the I/I converters.
In addition, the licensee revised procedure No.
PHP 5040 HOD.001,
"Temporary Modifications," to require that a safety evaluation be performed for all new TMs.
The inspectors reviewed 14 THs implemented in 1995.
The safety evaluations adequately demonstrated that an unreviewed safety question did not exist.
This item is considered closed.
Closed Unresolved Item 50-315 93012-04 50-316 93012-04 DRS:
The SBICI team identified that auxiliary feedwater instrument sensing line 2-FFS-257 was not supported over a span of about
feet.
In response, the licensee added a unistrut pipe clamp in the middle of the unsupported sensing line span.
In addition, the licensee seismically analyzed the before and after configuration of the sensing line.
The inspectors concluded the as-found sensing line configuration was capable of performing its safety function during a seismic event.
This item is considered closed.
Closed Unresolved Item 50-315 93008-01 50-316 93008-01 DRS
This item concerned the safety injection (SI)
pump discharge check valves and component cooling water (CCW) check valves upstream of the reactor cooling pump thermal barriers that have a closed safety function, which were not included in the inservice test (IST) program.
Revision 4 incorporated the closed safety functions for these valves into the IST program.
Relief requests for these valves were submitted because the tests required to meet
the Code were considered impractical.
The proposed alternative was testing the SI check valves on a refueling outage frequency and performing disassembly/inspection of the CCW check valves on a
sampling basis.
The alternate testing for these valves was approved in a safety evaluation report, dated June 6,
1994.
This issue is considered closed.
3.
f.
Closed Ins ection Follow-u Item 50-315 93008-03 50-316 93008-
~03 DRS
This item concerned the 1ST procedures for pump testing that used tolerance bands on the fixed reference value. This was a
deviation from the Code requirement.
Test procedures for several pumps with large tolerance bands had been previously revised.
A review indicated that some pumps still exceeded the allowed M%
band.
These included the centrifugal charging pump tests (M/0)
and the residual heat removal pump tests in modes 4 and 5 (MN).
The technical data sheets for these pumps were revised during the inspection to reduce the tolerance bands to conform with the guidance in NUREG-1482.
This issue is considered closed.
No violations or deviations were identified.
Plant 0 erations The licensee operated both units at full power throughout the inspection period.
On Hay 26, 1995, the licensee entered TS 3.0.3 and declared an Unusual Event for both units.
In addition, on June 8, 1995, the licensee experienced a plant transient on Unit 1 due to a loss of several control functions.
Both events are discussed in paragraph 3.b.
0 erational Safet Verification (71707)
The inspectors verified that the facility was being operated in conformance with the licenses and regulatory requirements, and that the licensee's management control system was effective in ensuring safe operation of the plant.
On a sampling basis the inspectors verified proper control room staffing and coordination of plant activities; verified operator adherence with procedures and technical specifications; monitored control room indications for abnormalities; verified that electrical power was available; and observed the frequency of plant and control room visits by station management.
The inspectors reviewed applicable logs and conducted discussions with control room operators throughout the inspection period.
The inspectors observed a number of control room shift turnovers.
The turnovers were conducted in a professional manner and included log reviews, panel walkdowns, discussions of maintenance and surveillance activities in progress or planned, and associated LCO time restraints, as applicabl Onsite Event Follow-u (93702)
During the inspection period, the licensee experienced several events, some of which required prompt notification of the NRC pursuant to
CFR 50.72.
The inspectors pursued the events onsite with licensee and/or other NRC officials.
In each case, the inspectors verified that any required notification was correct and timely.
The inspectors also verified that the licensee initiated prompt and appropriate actions.
The specific events were as follows:
On Hay 16, 1995, the licensee identified that ultrasonic testing required by ASME Code Section XI had not been properly performed on 12 large bore branch connection welds in the reactor coolant system (RCS) for each unit.
These branch connections included all hot and cold leg ECCS injection lines.
The licensee subsequently declared the ECCS systems inoperable.
The licensee entered Technical Specification 3.0.3 and declared an Unusual Event for both units at approximately 10:25 a.m.
(EDT) on Nay 19, 1995.
Reactor power 'was reduced from 100 to approximately 98 percent on both units prior to the licensee exiting TS 3.0.3 and terminating the Unusual Event at 1: 10 p.m.
The licensee terminated the Unusual Event after contacting Region III and NRR for the purpose of requesting relief from the Code requirements, The licensee was informed that, per Generic Letter 91-18, if operability of the affected systems could be justified, the plant could continue to operate while pursuing Code relief.
Following this discussion, the licensee declared the ECCS systems operable and exited TS 3.0.3 based on the following: all welds had acceptable radiographic and penetrant exams during construction, the systems had successful hydro-static tests, walkdowns for evidence of boric acid during startups and shutdowns showed no signs of leakage, and RCS leakrate monitoring was within acceptable limits.
On June 5,
1995, the licensee submitted a request for relief from the Code requirement.
(2)
On June 8,
1995, the licensee experienced a transient on Unit 1 due to the loss of several control functions.
At 4:40 p.m., pressurizer pressure control input from channel one failed low.
The operators took action to switch control from the failed input.
About 30 minutes later, the operators experienced a letdown isolation and observed that 1-FRV 232 and 233, feedwater regulating valves (FRVs) to steam generators (SG)
2 and 3 respectively, had failed open.
The letdown isolation occurred due to failure of the
pressurizer level control input from channel one.
The operators restored letdown after switching level control from the affected channel.
The FRV's drifted open due to failure of the SG level control input from channel one, which controlled the position of both FRV's in automatic.
The operators took manual control of both FRV's and were able to stabilize SG levels.
Following troubleshooting, the licensee determined that the failure of pressurizer pressure control input was due to a
failure of a V2H card, which functioned as a Class IE isolation point between protection and indication/control racks in the reactor protection system.
Although the fault on the V2H card resulted in a blown 1/2 amp fuse on the card, as designed, the fault also blew a
amp fuse on the power distribution module DP11.
This module distributed +/-
15V of power to several V2H cards and its failure resulted in the loss of channel one reactor coolant flow indication and AFW flow indication to SG 1, and loss of pressurizer level and feedwater control functions.
Although no protective functions were affected by the failure, the licensee tripped the bistables to the associated circuits prior to troubleshooting.
Following replacement of the failed V2H card and the DP11 module, the licensee performed testing to verify proper operation and returned the circuits to service.
As documented by inspection followup item 50-315/95005-04(DRP);50-316/95005-04 (DRP), the licensee has experienced multiple failures of the V2H cards since initial installation as part of the analog-to-digital modification during the last refueling outage for both units.
This most recent failure was the first one which resulted in the failure of a power module.
The licensee had contracted an independent laboratory to perform a review of the design and quality of manufacturing of the cards, which was in progress at the time of the latest failure, In the meantime, the licensee plans to provide written guidance to personnel in the event of future failures.
The instructions require that, in the event of an instrument failure, the operators should contact instrument and control ( I&C) personnel, who will remove the suspected V2H card from the rack as soon as practical after the associated bistables have been tripped.
Operations will station an additional operator in the control room until I&C removes the card to assist in responding if other failures occur.
The instruction includes a list of common instruments which share a
common distribution module. and the operators have the option of using this information to change potentially affected control channels, taking control rods to manual, etc.
The operators have also been instructed to trip the
reactor if the card failures challenge continued safe operation of the unit.
The inspectors will continue to monitor the licensee's investigation into the card failures and actions taken to prevent future plant transients.
Current Material Condition (71707)
The inspectors performed general plant as well as selected system and component walkdowns to assess the general and specific material condition of the plant, to verify that work requests had been initiated for identified equipment problems, and to evaluate housekeeping.
Walkdowns included an assessment of the buildings, components, and systems for proper identification and tagging, accessibility, fire and security door integrity, scaffolding, radiological controls, and any unusual conditions.
Unusual conditions included but were not limited to water, oil, or other liquids on the floor or equipment; indications of leakage through ceiling, walls or floors; loose insulation; corrosion; excessive noise; unusual temperatures; and abnormal ventilation and
.lighting.
The inspectors also monitored the status of housekeeping and plant cleanliness for fire protection and protection of safety-related equipment from intrusion of foreign matter.
The inspectors observed that overall plant housekeeping and material condition was very good during the inspection period.
Radiolo ical Controls (71707)
The inspectors verified that personnel were following health physics procedures for dosimetry, protective clothing, frisking, posting, etc.
and randomly examined radiation protection instrumentation for use, operability, and calibration.
The inspectors did not identify any significant deficiencies in this area during the inspection period,
~Securit (71707)
Each week during routine activities or tours, the inspectors monitored the licensee's security program to ensure that observed actions were being implemented according to the approved security plan.
The inspectors noted that persons within the protected area displayed proper photo-identification badges and those individuals requiring escorts were properly escorted.
The inspectors also verified that checked vital areas were locked and alarmed.
Additionally, the inspectors also observed that personnel and packages entering the protected area were searched by appropriate equipment or by hand.
The inspectors did not identify any significant deficiencies in this area during the inspection perio No violations or deviations were identified.
4.
Safet Assessment ualit Verification (40500 and 92700)
a ~
Licensee Event Re ort LER Follow-u (92700)
Through direct observations, discussions with licensee personnel, and review of records, the following event reports were reviewed to determine that reportability requirements were fulfilled, that immediate corrective action was accomplished, and that corrective act'ion to prevent recurrence had been or would be accomplished in accordance with Technical Specifications (TS):
Closed LER 316 95002:
.The feed flow controller associated with Loop No.
4 feedwater regulating valve failed due to an apparent circuit board voltage regulating transistor failure.
The defective circuit board was replaced.
The failed feed flow controller board caused Loop No.
4 feedwater regulating valve (2-FRV-240) to close and resulted in a reactor trip when a low level steam generator signal was received.
All systems functioned as required with the exception of the main generator trip system.
The main generator was manually tripped by the operators in about 128 seconds.
The licensee determined that turbine control/stop valve D closed limit switch was misaligned thereby preventing actuation of the generator trip circuitry.
Vibration appeared to be the root cause for the limit switch misalignment.
The limit switches had been tested monthly and had successfully passed the surveillance test prior to the event.
The licensee has initiated periodic walkdowns to detect limit switch misalignment between surveillance periods.
The inspectors concluded the licensee responded satisfactorily to this event, identified the root cause and implemented appropriate corrective actions to prevent recurrence.
This item is considered closed.
Closed LER 316 94007-01:
Containment Type B and C Leakage Exceeds LCO Value due to Leakage of Post Accident Sample Line Check Valve.
On September 9,
1994, the accumulated leakage (15.96 L,) for the Type B and C leak rate tests on containment penetrations and isolation valves exceeded the TS LCO value of 0.6 L..
The majority of the total leakage was attributed to post accident sampling station sample waste return line check valve 2-NS-357 (calculated 15.49 L.).
Attempts made to repair/replace and to reorient the valve were not successful in reducing the leakage rate to within the allowed limits.
The valve vendor indicated that the bonnet hung swing check valve would not provide consistent seating for low differential pressure test applications.
The valve was replaced with a spring type piston check valve, which successfully passed
the leak rate test.
Due to the similar problems, the same valve in unit 1 was scheduled to be replaced.
The licensee identified that the same type of valve as the original check valve 2-NS-357 was used in two other containment isolation functions for each unit.
The valves'istory was evaluated.
Based on no significant leak rate problems and the application of the valves, a determination was made not to replace them at this time.
This LER is considered closed.
No violations or deviations were identified.
Maintenance Surveillance (62703
& 61726)
a ~
Maintenance Activities (62703)
Routinely, station maintenance activities were observed and/or reviewed to ascertain that they were conducted in accordance with approved procedures, regulatory guides and industry codes or standards, and in conformance with technical specifications.
The following items were also considered during this review:
limiting conditions for operation were met while components or systems were removed from service; approvals were obtained prior to initiating the work; functional testing and/or calibrations were performed prior to returning components or systems to service; quality control records were maintained; and activities were accomplished by qualified personnel.
Portions of the following Job Order (JO) activities were observed and reviewed:
JO C26350
"2-CCW-176E, Disassemble II Repair" JO C30027 JO C29705
"2-(IT-506, Troubleshoot 8 Repair Latch Hook"
"Replace 2-CS-392" JO C30341
"V2H Module 1-PY-455(/455A" AR A96623
"Control Bank "A" Grp 1 Moves When Grp 2 Should" JO C30224
"Repair 2-HV-AES-2 By-Pass Dampers" (1)
On May 26, 1995, while attempting to start the Unit 2 TDAFW pump for a packing adjustment, the pump tripped twice prior to coming up to normal operating speed.
The licensee declared the pump inoperable and initiated action to troubleshoot the problem.
The licensee originally determined that the problem was due to excessive wear on the trip solenoid/valve latch mechanism.
Further troubleshooting revealed that the root cause of the problem was the failure to properly reset and to de-energize the trip solenoid.
As corrective action, the
licensee initiated action request No. A96358 to inspect and to adjust the linkage as necessary during the next scheduled maintenance on the pump.
To prevent recurrence, the system engineer also recommended that Operations Department procedures/guidance be revised to include verification that the trip solenoid is de-energized when resetting the trip linkage.
At the end of the inspection period, Operations was still evaluating this recommendation.
The inspectors observed portions of the maintenance and troubleshooting evolutions and discussed the resolution of the problems with licensee personnel.
The inspectors did not have any immediate concerns regarding operability of the TDAFW pump, but will review the licensee's completed investigation and will continue to monitor performance of the T&TV.
On June 1,
1995, Unit 2 operators discovered that control bank D, group 1 demand step counter indicated 224 steps, while group 2 in the same bank read 222 steps.
When operating as designed, the demand counters in control bank D
should not differ by more than 1 step.
No urgent failure alarm was present which would indicate an operability concern with the rods.
A few minutes earlier, the operators observed that the rod withdrawal light had illuminated, which indicated a rod demand signal, but did not hear the rods step out.
During initial troubleshooting, the licensee cycled the control bank D rods in and out one step and observed that the overlap counter and master cycler, which controlled the sequence of rod motion, were operating properly.
With no symptom of a rod control problem present, the licensee pulled the bank D rods out to 233 steps on the demand counters, two steps beyond full out position, to verify rod position, and then reset the overlap and demand counters.
The licensee then performed STP 15, "Full Length Control Rod Operability Test,"
on the bank D rods to verify operability.
No abnormalities were observed.
On the following day, however, the licensee discovered that the control bank A, group 2 demand counter was indicating 232 steps, which was contrary to the expected 231 step full out position.
Using the same methodology as the previous day, the licensee verified that no rod control problems existed and reset the counter.
The licensee initiated condition report (CR) 95-0854 to investigate the problems.
As immediate action, licensee engineering has requested that operators document all rod movements.
The inspectors observed portions of the licensee's troubleshooting activities and spoke with the engineering
personnel involved.
The inspectors determined that actions taken were appropriate.
The inspectors will continue to monitor rod control performance and review the licensee's completed investigation of the event, (3)
The inspectors identified two recent examples of less than optimal LCO management regarding the Post Accident Containment Hydrogen Monitoring System (PACHMS) system:
i)
On April 4, 1995, the licensee voluntarily removed all trains of PACHMS for both units to perform EHP4030.STP.236.010,
"Leak Test of Unit 1 and Unit 2 Post Accident Containment Hydrogen Monitoring System."
The licensee performed the leak test to comply with paragraphs, 2.H and 2.G of the Unit 1 and 2 facility operating licenses.
Upon review of the procedure and discussions with licensee personnel, the inspectors determined that the licensee could have minimized the duration of the LCO entry by removing one unit's PACHMS from service at a
time.
As a result, the licensee could have reduced the duration of the LCO entry for both units by about one-half, or 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.
ii)
The inspectors also noted that the licensee entered an LCO for Train B of Unit
PACHMS on three separate occasions during the week of May 28, 1995.
Each of the LCO entries was approximately six hours in duration for replacement of solenoids for air sample containment isolation valves.
During followup, the inspectors inquired with licensee scheduling personnel to determine why separate LCO entries were made.
During the planning phase for the work, the Chemistry Department had determined that removal of a single air sample line from service would not render the PACHMS train inoperable.
However, when the package was reviewed prior to initiating work, Operations shift personnel decided to enter the LCO.
Upon further investigation, the licensee has determined that the decision by Operations was appropriate.
The inspectors determined that the safety significance for the extended out-service times was minimal, and that the licensee's overall management of LCO entries continues to be goo'he inspectors will continue to monitor licensee performance in this area.
(4)
The inspectors observed activities associated with the replacement of the bonnet of valve 2-CS-392, boron makeup isolation to the centrifugal charging pump (CCP) suction
The inspectors concluded that the evolution was well-planned and that the coordination among the departments involved was good.
No problems were noted.
b.
Surveillance Activities (61726)
During the inspection period, the inspectors observed technical specification required surveillance testing and verified that testing was performed in accordance with adequate procedures, that test instrumentation was calibrated, that results conformed with technical specifications and procedure requirements and were reviewed, and that any deficiencies identified during the testing were properly resolved.
The inspectors also witnessed portions of the following surveillances:
01-OHP 4030.STP.020W,
"West Component Water Loop Surveillance Test,"
Rev.
02-OHP 4030.STP.017TV,
"Turbine Driven Auxiliary Feed Pump Trip And Throttle Valve Operability Test,"
Rev.
02-OHP 4030.STP.007W,
"West Containment Spray System Operability Test,"
Rev.
01-IHP 4030.STP.411, Ol-IHP 4030. SMP. 201,
"Reactor Trip SSPS Logic And Reactor Trip Breaker Train "A" Surveillance Test (Monthly)," Rev
"Reactor Coolant Flow Protection Set I Functional Test And Calibration,"
Rev.
No violations or deviations were identified.
En ineerin 8 Technical Su ort (37700)
The inspector monitored engineering and technical support activities at the site including any support from the corporate office.
The purpose was to assess the adequacy of these functions in contributing properly to other functions such as operations, maintenance, testing, training, fire protection, and configuration management.
a.
Foxboro N-2AO-V2H V2H Volta e to Current Converter V I Module Failures The V/I converter module was customized for use at D.
C.
Cook by adding two DC/DC converters to isolate the module output from the field bus.
After resolving an undersized circuit board fuse problem, other module failures kept occurring'he input field effect transistor (FET) was failing in the front mounted DC/DC
'I
~
'
converter.
The licensee identified that the failures were occurring in a particular converter batch.
A warranty replacement of the DC/DC converters was initiated, Preliminary tests, performed by the manufacturer, indicated the DC/DC converters met their published specifications.
The licensee obtained 18 additional V2H modules and replaced critical control loop modules that contained the suspect batch of DC/DC converters.
Following the installations, 6 of the 18 new modules failed.
Prior to the event discussed in paragraph 3.b.(2)
of this report, the failures had not caused a plant transient.
However, the modules were removed and replaced with the original modules.
The licensee has initiated independent V2H module reviews and the failure investigation will include items such as in depth circuit design reviews and component failure analyses.
The inspectbrs concluded the licensee was proactive in addressing the V2H module failures.
This item will be further reviewed per inspector followup item 50-315/95005-04(DRP);50-316/95005-04(DRP).
Di ital U
rade Modification Reviews The digital modification review objectives were:
(1) to determine that the licensee considered applicable Standards in designing the digital upgrade; (2)
to verify the modification satisfied the plant licensing basis; (3) to ensure the licensee addressed the regulatory requirements of 10 CFR 50.59; and (4) to determine that the licensee assessed the digital upgrade failure mechanisms for affects on the systems replaced.
Three non-safety digital upgrade modifications were reviewed.
The review used NRC Generic Letter (GL) 95-02 which endorsed NUMARC/EPRI Report TR-102348,
"Guideline on Licensing Digital Upgrades."
The inspectors concluded that the licensee had a good digital upgrade program.
In addition, applicable safety evaluations adequately demonstrated that an unreviewed safety question did not exist, The following modifications were reviewed:
1)
RFC-12-2900 Subtask D. 15:
U vade Re ulator Guide RG 1.97 Wide Ran e Steam Generator Level Indication The wide range steam generator level recorders, Nos.
M-33 and M-34, were replaced with Johnson Yokogawa Model No.
4152, 2-pen, 100mm Micro Recorders.
The licensee seismically qualified the recorders for installation in the main control room.
Approximately 33 recorders of this type have been installed.
The inspectors reviewed the following:
i)
Software Desi n and ualit Assurance The recorder's base software was developed and delivered with the recorder as embedded firmware.
The
base software that implements the controller algorithms can not be changed by the user.
In accordance with GL 95-02, non-safety applications may rely on a responsible manufacturer to ensure appropriate software verification and validation (V&V)
has been implemented.
In this case, the firmware is unchanged from application to application.
The licensee indicated that the 33 installed recorders have been performing satisfactorily.
No failures have been attributed to firmware problems.
This method of software VRV meets the guidelines provided in TR-102348 for this type of application.
This was acceptable to the inspectors.
Commercial Grade Item Dedication The recorder is a simplistic device used in a non-safety application.
Thirty three recorders of this type are currently in use at D.
C.
Cook and their operating history was good.
TR-102348 indicates that when properly applied, greater reliability can be demonstrated by an extensive operating history in other similar applications.
The inspectors concluded this was an appropriate application for these recorders.
Com atibilit With the Environment The licensee performed analyses that mapped the electromagnetic interference (EHI) in the main control room and the potential effects of power system harmonics for the reactor protection system upgrade project.
The inspectors reviewed the analyses and concluded that the control room environment was suitable for the recorder installations.
Human-Nachine Interface The recorder keypad is located inside the recorder.
Access would require the recorder to be pulled from its housing.
Chart and pen replacement is easily made at the front without removing the recorder.
Recorder removal and calibration was controlled by the Job Order process.
Channel checks made by the operating shift appeared appropriate for identifying a malfunctioning recorder.
The licensee demonstrated the ease of recorder operation to the inspectors.
The inspectors concluded adequate controls were in place to prevent unauthorized entries or alteration of recorder parameter f
0
v)
Failure Anal sis and Defense in De th The failure analysis was straight forward with a limited set of failure modes for the analog recorders.
The original recorders could fail high, fail low, or fail as-is, The digital replacement recorders have the same failure mechanisms.
In addition, defense in depth for the recorders was provided by the primary RG 1.97 indicators.
This was acceptable to the inspectors.
2)
12-PM-801:
Install Sodium H
ochlorite S stem A liquid sodium hypochlorite (NaOCl) system was installed to replace the existing gaseous chlorination system.
The
,
system was used to control microbiological growth (zebra mussels)
in various water systems that use raw lake water.
The relay and timer logics were implemented using a Square D
Company programmable logic controller (PLC).
The NaOCl system was initiated by operator actions.
The licensee demonstrated the process used to configure the PLC.
The inspectors concluded this was a suitable application for a commercial grade PLC.
3)
RFC-12-3104:
Re lace AMSAC The licensee recently upgraded its reactor protection system (RPS) with Foxboro Spec 200 Micro equipment.
The inspectors reviewed the installation details, safety evaluation, post modification testing, and concluded the modification had been implemented satisfactorily and that an unreviewed safety question did not exist.
Calibration procedure No.
1IHP6030. IMP.328, "Turbine Trip AMSAC Calibration," was reviewed to determine if the steam generator low feedwater flow 3 of 4 logic and the turbine impulse pressure
.
permissives were tested.
The inspectors concluded that the licensee had satisfactorily tested the AMSAC system.
The inspectors reviewed the following:
i)
Software Desi n and ualit Assurance The MOD 30 base software was developed and delivered with the equipment as embedded firmware.
The base software that implements the controller and math al,gorithms can not be user changed.
Even though the MOD 30 equipment was installed in a non-safety application, American Electric Power Service Corporation (AEPSC)
had pursued safety related qualification of the equipment.
The MOD 30 equipment was designed, manufactured, inspected and tested under the manufacturer's quality assurance program.
In
addition, the licensee maintained control over the configuration software which is required to configure HOD 30 parameters.
This software was developed specifically for D, C.
Cook and was not required for equipment operation.
The licensee indicated that any changes to the configuration software would be performed by the manufacturer and controlled by AEPSC.
Verification and validation activities would be commensurate with the changes made.
The licensee indicated that no firmware and software failures have occurred.
The inspectors concluded that the licensee had supporting documentation for the HOD 30 AMSAC application that exceeded the guidelines provided in TR-102348.
Commercial Grade Item Dedication The HOD 30 equipment with its firmware was a mature product line with a reliable operating history.
This equipment has been in operation for 1.5 unit years.
In addition, the licensee was involved in various forms of equipment testing for a total history of 3.5 years.
The licensee indicated that the probability of a firmware failure or common cause failure was much less than a sensor, output relay, or other hardware failure.
TR-102348 indicated that when properly applied, greater reliability can be demonstrated by an extensive operating history.
The inspectors concluded this was an appropriate application for this equipment.
Ca abilit With the Environment The licensee performed analyses that mapped the electromagnetic interference (EMI) in the main control room and the potential effects of power system harmonics for the reactor protection system upgrade project.
The inspectors reviewed the analyses and concluded that the control room environment was suitable for the HOD 30 equipment installation.
Human-Machine Interface Calibration of the AHSAC system was implemented by procedure No.
1IHP6030. IHP.328 (2IHP6030. IMP.428).
Only MOD 30 qualified instrument and control technicians were permitted to calibrate this equipment.
The inspectors concluded adequate controls were in place to prevent unauthorized entries or alteration of HOD 30 configuration parameters.
v)
Failure Anal sis and Defense in De th The failure modes and effects analysis (FHEA) was performed to compare the HOD 30 equipment to the original Foxboro H-Line equipment.
The inspectors reviewed the licensee's hardware and firmware FHEA and concluded the HOD 30 equipment did not create any new or different failure mechanisms than were previously analyzed for the original H-Line equipment.
In addition, defense in depth was provided by the RPS.
The inspectors concluded the FHEA satisfactorily addressed hardware and firmware failure modes.
C.
Inservice Testin Pro ram IST (73756)
The inspectors verified that the containment spray system was in conformance with the ASHE Section XI Code.
The system scope was considered acceptable, test procedures were in place with adequate acceptance criteria to test safety functions, tests were performed when required, and corrective actions were taken when'cceptance criteria were not met.
The program was well-maintained, and no concerns were identified.
An IST basis document was being developed in support of the 10-year program update in 1996, This was considered a beneficial document to define the basis for components being included or excluded from the program scope.
This was considered a good initiative for upgrading the IST program, d.
Meetin to Discuss On-line Leak Sealin Several Region III staff members met with licensee representatives on Hay 30, 1994, to discuss on-line leak sealing issues at the site.
Representatives from two leading leak sealing vendors presented information on their general design and implementation approaches.
An online leak sealing demonstration was also observed.
The licensee discussed recent improvements in their controls for the online leak sealing process and discussed initiatives to reduce the need to use this approach.
Both of these efforts appeared to be good.
Leak sealing issues will be reviewed in detail during future inspections.
No violations or deviations were identified.
7.
Meetin s
and Other Activities Exit Interview (30703)
The inspectors met with the licensee representatives denoted in paragraph 1 during the inspection period and at the conclusion of the inspection on June 19, 1995.
The inspectors summarized the scope and results of the inspection and discussed the likely content of this inspection report.
The licensee acknowledged the information and did not indicate that any of the information disclosed during the inspection could be considered proprietary in nature.
18