IR 05000315/1999010

From kanterella
Jump to navigation Jump to search
Final ASP Analysis - D.C. Cook 1 and 2 (IR 050003151999010)
ML20112F416
Person / Time
Site: Cook  American Electric Power icon.png
Issue date: 12/31/1997
From: Christopher Hunter
NRC/RES/DRA/PRB
To:
Hunter C (301) 415-1394
References
IR 1997024, IR 1999010
Download: ML20112F416 (14)


Text

NRC Inspection Report (IR) Nos. 50-315/97-24, 50-315/99-10 Event Description: Lack of a procedure for manually backwashing the emergency service water pump discharge strainers Date of Event: December 1997 and May 1999 Plant: Donald C. Cook Nuclear Plant, Units 1 and 2 Analyst: Sunil Weerakkody Event Summary During inspections by the NRC staff at Donald C. Cook Nuclear Plant, Units 1 and 2 (Cook 1 and 2) in December 1997 and May 1999, the inspectors identified a violation in which the licensee failed to treat the manual backwashing of the essential service water (ESW) strainers in accordance with quality standards commensurate with the importance of the safety functions to be performed. The inspection reports concluded that (1) the licensee did not have a procedure for manually backwashing the ESW pump discharge strainers, and (2) the evolution would require tools which were not readily available, and (3) the operators had not been trained in how to perform a manual backwash of the strainers. In addition, the inspection reports concluded that there were degraded material conditions that decreased the automatic backwash capability during earthquakes and other events and therefore had the potential to impact core damage frequency (CDF) sequences relative to seismic and other events.

The estimated change in CDF associated with this issue is 3.2x10-5/year.

Event Description The NRC staff conducted an inspection at Cook 1 and 2 from November 8, 1997 through December 27, 1997 (Ref. 1). During the inspection, the team questioned the adequacy of the licensees basis for the ESW system strainers not being a support system required for ESW system operability.

Consistent with this treatment, the licensee had classified the ESW strainer backwash system as a non-safety-related system. However, it was possible for the strainers to be manually backwashed if the air system or the relays were to fail, in order to support the continued operability of the ESW system. The licensee supplied additional information to the inspectors, who in turn requested that the NRCs Office of Nuclear Reactor Regulation (NRR) review the licensees design basis, and reach a conclusion about the need for operable strainers to support an operable ESW train.

In their response to the inspectors request, NRR concluded that the licensee should consider any procedures for manually backwashing the ESW strainers to be safety-related. NRR also concluded that the licensee should ensure that the emergency procedures for responding to a loss of offsite power (LOSP) contain appropriate actions to take if the plant lost the capability to automatically backwash the strainers. However, the inspectors subsequently determined that no procedure for manually backwashing the strainers existed, the evolution would require tools which were not readily available to the operators, and the operators had not been trained in how to perform a manual backwash of the strainers.

As a result of NRRs conclusion, the inspectors determined that the licensee had failed to comply with the basis for Technical Specification 3/4.7.4 for the Cook plant, which states in part, The OPERABILITY of the essential service water system ensures that sufficient cooling capacity is available for continued operation of safety-related equipment during normal and accident conditions. Consequently, this meant that the licensee was in violation of Criterion V of Appendix B to Title 10 CFR Part 50, which requires in part, That activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawing IRs 50-315/97-24, 50-315/99-10 An NRC inspection report issued in 1999 (Ref. 2) noted that the licensee did not perform an operability evaluation to determine the aggregate impact of multiple degraded conditions relating to the ESW strainers. The inspection report identified the following events and conditions:

! Failure of the Unit 1 West left strainer to backwash due to a failed backwash valve;

! Degraded gate seal on the inlet gate of the Unit 1 strainer;

! Rounded key on the motor operator on the inlet gate of the Unit 1 strainer;

! Cracked support pads for both of the Unit 1 strainers;

! Improperly supported air lines to the backwash valves of all four ESW strainers;

! Improperly supported instrument lines to all four ESW strainers; and

! Jerky operation of Unit 2 East ESW strainer basket backwash valve 2-WRV-773 In light of the above, the risk associated with the following three degraded conditions was examined:

! Lack of a procedure of for manually backwashing the strainers;

! Degraded capability of the automatic backwashing system (which is not seismically qualified); in case of a seismic event and

! Potential decrease in the backwash capability due to degraded material conditions.

Additional Event Related Information The ESW system at Cook consists of four ESW pumps. Two pumps are sufficient to supply all service water requirements for both units. The ESW system provides cooling water to the component cooling water (CCW) heat exchangers, the residual heat removal system (RHR) heat exchangers, the containment spray (CTS) heat exchangers, and the emergency diesel (EDG) coolers. The CCW system is used to cool a large number of loads, including high pressure injection (HPI) lube oil. Therefore, in the event of a loss of both trains of ESW, all safety-related systems except the auxiliary feedwater (AFW)

system could fail.

The AFW system at each of the Cook units consists of three trains; two motor-driven and one turbine-driven. Two motor-driven trains are powered from safety-related 4 KV buses. The third train is a turbine-driven auxiliary feedwater pump (TDAFP) that does not rely on AC power, except for its room ventilators.

The TDAFP room of each unit has doors which are open to the turbine building. The turbine-driven pumps are capable of running for several hours without ventilation. Therefore, even during a station blackout scenario, the turbine-driven auxiliary feedwater pump would remain available.

Modeling Assumptions The conditions identified in the inspection reports (lack of procedure to perform manual backwash, degraded material conditions that decreased the automatic backwash capability during events other than earthquakes, degraded material conditions that decreased the automatic backwash capability during an earthquake) had the potential to impact CDF sequences relative to seismic events or events other than earthquakes. The risk associated with events other than earthquakes was determined to be negligible due to the following:

IRs 50-315/97-24, 50-315/99-10

! During normal plant operation, in the absence of stormy weather, the strainers plug up at a relatively low rate. In the absence of stormy weather conditions on the ultimate heat sink (Lake Michigan), the ESW pumps may run for weeks before a strainer plugs (Ref. 3).

! Even if the strainers plug, unless the automatic backwash capability fails, manual backwash is not needed. The inspection reports (Refs. 1, 2) identify one failure of the automatic backwash capability for each Unit and several other degraded conditions. Given that this system is normally running, if these degraded conditions are significant enough to affect the functionality of the system, they will be self-revealing unless the accident condition imposes additional stresses compared to the normal operation.

! The ESW system is shared by both units. The system has many redundancies and capabilities to share ESW pumps between the two units as shown in Figure 1. The two Cook units are equipped with four ESW pumps. Only two of the pumps are needed to support normal operation or accident loads of both units. The heat exchangers for the two diesel generator sets on each unit are served by both ESW headers of that unit. As a result of this configuration, any of the four ESW pumps can be aligned to cool a given EDG.

! Lack of a procedure did not eliminate the capability to perform backwashing of strainers in the event of losing automatic backwashing capability. According to discussions with the senior resident inspector at the Cook plant (Ref. 3), because there was no procedure, it may require about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for the operators to perform manual backwashing. Even if a procedure were available, the backwashing is expected to take 15-30 minutes (Ref. 3).

To illustrate the fact that the CDF increase associated with this issue due to events other than earthquakes is less than 1x10-6, the following sequence was considered. Probabilities and frequencies used to quantify Sequence 1 are provided in Table 2. Sequence 1 below is considered limiting, since the initiating event (severe weather induced loss of offsite power) leads to the stormy condition that challenges the automatic backwashing capability. In this analysis, it was conservatively assumed that one of the ESW pumps in each of the two ESW headers is dedicated to the Unit 1 EDGs (i.e., capability to share ESW pumps among units was not credited):

Sequence 1: Loss of offsite power (LOSP) due to stormy conditions

! LOSP from stormy conditions (no earthquake);

! Automatic backwash capability of a train of ESW fails;

! The second ESW train fails to continue to run prior to recovery of the first ESW train by manual backwashing; and

! Loss of ESW leads to core damage.

There are other method of failing two ESW pump trains which could lead to loss of two ESW pump trains after a LOSP beyond the failures considered in Sequence 1 above (e.g., probability of failing to start ESW pumps, ESW pump out of service). However, these failure combinations are not considered here since they are not impacted by the degraded condition (lack of a procedure to perform manual backwashing).

For example, the probability of both trains of ESW trains failing due to pumps in both trains failing to start after a LOSP is independent of the availability of a procedure to manually backwash the strainers.

LOSP due to stormy conditions (no earthquake) - From Table B-4 of Reference 4, the mean frequency of severe weather-related LOSP events at the Cook site is 5.2x10-3/calendar yea IRs 50-315/97-24, 50-315/99-10 Automatic backwash capability of a train of ESW fails -Since the postulated initiating event is assumed to fail offsite power and is associated with stormy conditions, it was assumed that automatic backwashing capability of ESW would be challenged. The Cook Individual Plant Examination (IPE) does not provide a failure probability for automatic backwash. Based on the description of the automatic backwash system, in consideration of its reliance on pressure switches, pressure transmitters, relays, and air-operated valves and the typical failure probabilities for these components (See Table 3.3-1 of Ref.

5), the approximate failure probability of the automatic backwashing system of an ESW train was assumed to be less than 1.0x10-2.

The second ESW train fails to continue to run prior to recovering the first ESW train by manual backwashing - Even though the ESW train that failed may be recovered in spite of the fact that a procedure did not exist, there is insufficient basis to credit that capability. Moreover, the ASP program does not credit recovery actions unless a procedure exists to support those recovery actions.

Consequently, the second ESW train would be expected to run for its entire mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The running train of the ESW may fail due to a variety of reasons. The dominant failure modes of the running train are (a) ESW pump fails to run, and (b) ESW train fails due to plugging of the strainer and the automatic backwashing (of the second train) fails. Based on the Cook IPE (Ref. 5), the probability of the ESW pump failing to run is 3.0x10-5/hour. The Cook IPE does not provide a failure probability for the automatic backwashing system. Given that the automatic backwash capability has failed several times (six failures between August 1996 and June 1999 in four ESW strainers), the failure rate based on these known failures is about 0.5 failures/strainer/year. Using Bayesian updating with a non-informative prior, and conservatively assuming 1.0 failures/strainer/year, the failure rate is estimated to be approximately 1.7x10-4/hour (= 1.5/8760).

Therefore, the total failure to run rate is 2.0x10-4/hour (1.7x10-4/hour + 3.0x10-5/hour).

In the absence of a procedure to perform manual backwashing, the probability of failure of the second train of ESW to run over its mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is 4.8x10-3 (= 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />sx2.0x10-4/hour).

Loss of ESW failure leads to core damage - The ESW system provides cooling water to the component cooling water (CCW) heat exchangers, the residual heat removal system (RHR) heat exchangers, the containment spray (CTS) heat exchangers, and the emergency diesel (EDG) coolers.

The CCW system is used cool a large number of loads, including high pressure injection (HPI) lube oil.

Therefore, in the event of a loss of both trains of ESW, all safety-related systems except the auxiliary feedwater (AFW) system could fail. When both ESW pump trains supporting a unit fail (one train fails due to strainer plugging and failure to backwash and the other train fails while running before the first train is recovered), the EDGs cannot be cooled. As a result, the EDGs must be stopped or they would fail. As a result, the plant will not have motive power to run its ESW pumps. Once the ESW pumps stop, the strainers cannot be backwashed (pumps must be running to perform the backwash automatically or manually). Therefore, ESW cannot be recovered. Consequently, the EDGs cannot be recovered.

Even though AFW is initially available, unless the ESW and EDGs can be recovered within several hours, AFW will fail due to loss of ventilation. Therefore, conservatively, this probability was assumed to be 1.0.

Using the above frequencies and probabilities (some of which are conservative upper bounds), the frequency of Sequence 1 was estimated as follows:

(Frequency of LOSP from stormy conditions (no earthquake): 5.2x10-3/calendar-year) x (Criticality factor: 0.79) x

IRs 50-315/97-24, 50-315/99-10 (Probability of failure of the automatic backwash capability of a train of ESW: 1.0x10-2) x (Probability the second ESW train fails to continue to run prior to recovering the first ESW train by manual backwashing over 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />s: 4.8x10-3) x (Probability of loss of ESW failure leading to core damage: 1.0) = 2.0x10-7/year.

Since there are two sequences similar to Sequence 1 (one in which West ESW train fails first and the other in which East ESW train first), the increase in frequency is 4.0x10-7/year. The above calculation does not credit the capability to share ESW pumps among the two units. When that capability is credited, the increase in frequency will be less than 4.0x10-7/year.

The frequency estimated above is less than 1.0x10-6/year. Therefore, this sequence is excluded from further analysis.

The automatic backwashing capability of the ESW strainers is not seismically qualified. In addition, the inspection reports documented several material conditions that indicated degradations in the system (e.g., improperly supported air lines to the backwash valves of all four ESW strainers, improperly supported instrument lines to all four ESW strainers). As a result, it was reasonable to assume that the automatic backwash capability would fail after an earthquake. Two scenarios were considered: (a) an earthquake that failed the automatic backwash capability of both ESW trains, and fails offsite power, and (b) an earthquake that affected the automatic backwash capability without affecting offsite power. Of the above, Scenario (a) in which both offsite power and ESW would be affected was limiting, and was analyzed. Scenario (b) is lower in risk significance compared to (a) since, if offsite power were available, emergency diesel generators (EDGs) that need ESW within minutes would not be needed to mitigate the accident.

The sequence of actions that would lead to a non-recoverable station blackout (SBO) consists of the following. As a result of a postulated earthquake, offsite power would be lost. The ESW train that was normally running would trip during load shedding. Subsequently, both ESW trains would be started.

Therefore, strainers in both ESW trains would plug simultaneously. The automatic backwashing capability would be expected to fail since that system is not seismically qualified and was in a degraded condition. The manual backwashing capability would not be established, since there is no procedure.

The EDGs would fail due to the degraded ESW flow, and consequently an SBO would occur.

The non-recoverable SBO described above would lead to core damage.

Therefore, the second sequence of interest is as follows:

Sequence 2: Loss of Offsite Power and ESW due to earthquake and AFW failure

! An earthquake capable of failing offsite power and automatic backwashing capability of ESW occurs;

! Automatic backwashing capability is demanded due to earthquake stirring up the lake intake with sand and debris and it fails;

! Manual backwashing fails, leading to EDG unavailability; and

! Core damage occurs due to SBO.

Earthquake capable of failing offsite power and ESW automatic backwash capability occurs - The automatic backwash system of ESW is not seismically qualified in that it relies on relays, pressure switches, and air-operated valves which are not qualified. In addition, there were degraded conditions that could have affected the seismic capability (improperly supported air lines to the backwash valves,

IRs 50-315/97-24, 50-315/99-10 improperly supported instrument lines). The seismic fragility of the automatic backwash system in this as-found condition is unknown.

The seismic fragility of the switchyard is dependent upon the fragility of ceramic insulators. According to Table 3 of the licensees seismic Individual Plant Examination of External Events (IPEEE) (Ref. 6), the median capacity of the ceramic insulators is 0.2g. Table 5 of Reference 6 and the hazard curves (also in Ref. 6) were used to calculate the frequency of occurrence of an earthquake at the Cook site. Table 1 shows the contribution of individual earthquake acceleration groups to the seismically induced LOSP frequency. The total LOSP frequency (summation of frequencies from all seismic groups) was approximately 4.0x10-5/year.

Automatic backwashing capability is demanded due to the earthquake stirring up the lake intake with sand and debris and it fails - The automatic backwashing capability may be challenged in the aftermath of an earthquake. During an earthquake, due to the ground movement, energy will be added to the lake. It was assumed that the energy added by this means would generate waves and turbulence in the lake similar to those induced during stormy weather conditions, and this would result in a challenge to the automatic backwash capability of both ESW trains. From Reference 3, when the licensee last vacuumed out the sand deposited near the pumps, there were sand dunes and piles of sand 10 feet high near the pumps. A likely scenario would be an earthquake causing the sand dunes near the pump to collapse and push a slug of sand into the suction of the pumps (Ref. 3, 7).

Since the automatic backwash capability was not seismically qualified and was degraded, it was assumed to fail. Since the large number of air lines in the plant were not seismically qualified, and since these air lines could fail by themselves or could fail due to objects that fall on them during an earthquake, this is a reasonable assumption. This assumption is used in the IPEEE and other licensing based seismic analyses [e.g., resolution of Unresolved Safety Issue (USI) A-46)]. Therefore, the probability of demanding the automatic backwash system and its subsequent failure was conservatively assumed to be 1.0.

Manual backwashing fails, leading to EDG unavailability - Since there was no procedure to implement manual backwashing of ESW strainers, and tools required to for backwashing was unavailable, no credit was given for this action. As a result, EDGs would become unavailable and the ESW pumps would stop running. Therefore, the probability of this event was assumed to be 1.0.

Core damage occurs due to SBO - If a SBO occurs as a result of ESW pumps failing leading to failure of the EDGs and if the ESW pumps failed due to plugged strainers, the ESW pumps could not be recovered. The ESW strainer cleaning (automatic or manual) relies on ESW pumps, and since the EDGs would be unavailable the strainers could not be recovered. Therefore, the probability of this event was assumed to be 1.0.

Using frequencies and probabilities above, the frequency of Sequence 2 was calculated as follows:

(Frequency of earthquake causing LOSP and failing ESW: 4.0x x 10-5/calendar-year) x (Criticality factor: 0.79) x (Probability of automatic backwashing failure: 1.0) x (Probability of manual backwashing failure leading to EDG failure: 1.0) x (Probability of core damage given non-recoverable SBO: 1.0) = 3.2x10-5/year.

Analysis Results The estimated increase in the core damage frequency (CDF) associated with this issue is the sum of frequencies of Sequences 1 and 2 above which is 3.2x10-5/year. It is dominated by Sequence 2. This

IRs 50-315/97-24, 50-315/99-10 sequence is highlighted in Figure 2. In Sequence 2, core damage results due to an earthquake which fails offsite power and ESW due to the degraded automatic backwash capability that is not seismically qualified. The manual backwash capability was not credited due to lack of a procedure to perform that function.

References 1. Donald C. Cook Nuclear Generating Plant, NRC Inspection Report No. 50-315/97024(DRP);

50-316/97024(DRP), January 23, 1998.

2. Donald C. Cook Nuclear Generating Plant, NRC Inspection Report No. 50-315/99010(DRP);

50-316/99010(DRP), June 11, 1999.

3. Electronic mail communication between B. Bartlett (Senior Resident Inspector at Cook) and S.D. Weerakkody (U. S. Nuclear Regulatory Commission), February 4, 2000.

4. C. L. Atwood, et al., Evaluation of Loss of Offsite Power Events at Nuclear Power Plants:

1980-1996, NUREG/CR-5496, November 1998.

5. Donald C. Cook Nuclear Plant Units 1 and 2, Individual Plant Examination, Revision 1, October 1995.

6. Donald C. Cook Nuclear Plant Units 1 and 2, Individual Plant Examination of External Events, Revision 1, February 1995.

7. Electronic mail communication, R. Wescott (U.S. Nuclear Regulatory Commission) to S.D. Weerakkody (U. S. Nuclear Regulatory Commission/Office of Nuclear Regulatory Research/Operating Experience Risk Assessment Branch), February 9, 200 IRs 50-315/97-24, 50-315/99-10 Figure removed during SUNSI revie Figure 1. Emergency service water system simplified flow diagra IRs 50-315/97-24, 50-315/99-10 Figure 2. Seismic-induced station blackout event tre IRs 50-315/97-24, 50-315/99-10 Table 1. The contribution of individual earthquake acceleration groups to the seismically induced LOSP frequenc Earthquake 0.15-0.25 0.25-0.30 0.30-0.35 0.35-0.40 0.40-0.45 >0.45 acceleration range in gs Frequency . 4.0x10-5 8.6x10-6 5.1x 10-6 2.97x10-6 1.75x10-6 2.50x10-6 (per year)

Prob. of .82 .96 0.99 LOSP in the range Frequency of 2.0x10-5 7.1x10-6 4.6x10-6 2.9x10-6 1.7x10-6 2.5x10-6 seismically induced LOSP Table 2. Summary of failure probabilities and initiating event frequencie LOSP caused by stormy Parameter weather conditions LOSP caused by earthquake Initiating event frequency 5.2x10-3/critical year 4.0x10-5/critical year Criticality factor 0.79 0.79 Probability of plugging strainers .0 Probability of failing automatic less than 0.01 backwash capability Probability of failing automatic .0 backwash capability Probability of failing redundant 4.8x10-3 ESW train

IRs 50-315/97-24, 50-315/99-10 Response to Comments Comments were provided by the licensee (Ref. D-4.1), and NRC staff from the Division of Engineering Technology (Office of Nuclear Reactor Research) and Region III Office.

1. Comment from Licensee: The following comments apply to Sequence 2, Loss of Offsite Power and Emergency Service Water due to Earthquake and Auxiliary Feedwater failur In the postulated event, an earthquake occurs causing failure of offsite power and automatic emergency service water backwashing capability. The automatic backwashing function is demanded due to the earthquake stirring up sand and debris in the lake. Manual backwashing fails, leading to emergency diesel generator unavailability and core damage occurs due to the station blackou Although there was no procedure to manually backwash the strainers, inspection and maintenance (I&M) has concluded that it would be unlikely that the emergency service water system would fail due to plugging of the strainer caused by a seismic event. The basis for this conclusion is provided belo It was assumed that the energy added by a seismic event would generate waves and turbulence in the lake similar to those induced during stormy weather conditions and this would result in a challenge to the automatic backwash capability of both emergency service water trains. However, the emergency service water system at Cook has never functionally failed despite the occasional very severe weather conditions that occur on Lake Michiga Response: The licensee has commented that since the emergency service water system at Cook has never functionally failed in spite of stormy weather conditions which it has experienced in the past, it is unlikely that the emergency service water system would fail due to plugging of the strainer caused by the seismic even We considered the basis of the licensees comment and concluded that emergency service water could fail during an earthquake (even though it has not failed during storms) since an earthquake would not only plug up the strainer (similar to a severe weather condition) but also fail the automatic backwashing capability. The manual backwash capability did not exist at Cook due to lack of procedures and tool Additional details are as follows:

Even though the emergency service water system at Cook has never functionally failed during stormy weather conditions, during these stormy conditions, the emergency service water strainers have frequently plugged up rapidly (within minutes) and demanded the function of the automatic shift capability. However, in the absence of an earthquake, since the stormy weather conditions do not challenge the automatic shifting capability, the plugged up strainer basket of the duplex strainer would be automatically replaced with the clean strainer basket. Therefore, during stormy weather, in the as-found condition, the emergency service water strainers will continue to function successfull Consequently, for non-seismic initiators, the staffs analysis did not assume that emergency service

IRs 50-315/97-24, 50-315/99-10 water fails. Rather, as shown in Sequence No. 1 of our analysis, for non-seismic initiators, we used a random failure probability of 0.01 for the probability of failure of the automatic backwash capability of a train of emergency service wate However, during an earthquake, in addition to the plugging the strainer basket, the automatic shift capability will also fail due to inadequate seismic capacity of that system. In addition, there were no procedures or equipment readiness to recover from this condition. Consequently, the running emergency service water train would fail after an earthquake.

2. Comment from Licensee: If sand were to be ingested into the emergency service water system, it would not be expected to plug the strainer. The openings in the strainer are approximately 1/8 inch in diameter. In a recent sand particle size evaluation, the largest dimension of the typical particle found was less than 1/8 inch. The sand would most likely pass through the strainer element and the emergency service water system with little or no effect on the system operatio Response: The licensee comments that based on a recent particle size evaluation, the sand particles would most likely pass through the strainer element rather than plug i We considered the licensees comment and concluded that, based on actual operating experience at Cook, the particle size evaluation referred is not relevant to the condition of the distribution of particles (size distribution and quantity) that would be present at strainers after an earthquak The distribution of particle sizes drawn in after stormy weather conditions in the lake is more representative of the distribution of particle sizes after an earthquake. Based on discussions with the senior resident inspector at Cook, the operating experience at Cook has shown that after stormy weather conditions, the strainers plug up relatively rapidly (within minutes). This operating experience was the basis for assuming that the strainers would plug up after an earthquak During normal conditions, strainers plug up slowly (i.e., weeks may go by before observing significant differential pressure across the strainers). This observation is consistent with the findings of the particle size evaluation.

3. Comment from Licensee: Even if the sand did plug one strainer, the clogged duplex strainer would have to fail to shift, or after the strainer shifts, the clean strainer basket would have to plug or otherwise fai Response: As pointed out on Page 8 of Appendix A, the automatic backwash capability was not seismically qualified. Furthermore, it was degraded. According to Section M2.1 of the inspection report No. 50-315/99-010(DRP), the air lines to the backwash valves were improperly supporte Even when air lines are properly mounted, Individual Plant Examination External Events (IPEEE) and USI A-46 studies assumed that these lines would be unavailable after an earthquake. Since these air lines (which were not seismically qualified) were not properly supported, they could not be relied upon to function after an earthquake.

4. Comment from Licensee: In addition, the standby emergency service water pump and its associated strainer baskets would have to fai Response: During normal operation, only one of the two emergency service water pumps for each Cook unit is in operation (i.e., for both units, two pumps would be running). However, after the loss of normal power which is caused by the postulated earthquake, after load shedding, both emergency service water pumps (all four emergency service water pumps for the two units) will be started. As a result, one of the two strainer baskets in each emergency service water strainer would plug u IRs 50-315/97-24, 50-315/99-10 5. Comment from Licensee: Even if all four operating strainer baskets were to plug and automatic backwashing were to fail, or if the strainers failed to shift, the operators and maintenance staff have more than two hours (based on the current Cook IPE) to restore at least one strainer and place an emergency service water pump in servic Response: As stated in one of our previous responses to your comments, the degraded condition of the automatic backwash capability of Cooks emergency service water was compounded by the fact that in August 1997, Cook did not have procedures or training to implement manual backwashin Consequently, in the event of the failure of the automatic backwash capability, staff could not rely on the manual backwash capability {Note: Both the Accident Sequence Precursor (ASP) analysis guidance as well as guidance developed for the Significance Determination Process of the new Reactor Oversight Process examines whether procedures and training exist before recovery actions are credited.}

6. Comment from Licensee: Restoration of emergency service water would allow operation of at least one emergency diesel generator and provide ventilation cooling to any of the auxiliary feedwater pump rooms. Even without room cooling, the turbine driven auxiliary feedwater pump can operate 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> once the door to the room is open (per the station blackout analysis). In summary, I&Ms position is that a design basis earthquake would not be expected to cause a loss of the emergency service water system due to plugging of the strainers. Therefore, consideration should be given to reducing the failure estimate for this even Based on the preceding discussion, I&M believes that the analysis in Sequence 2 should include the frequency of failures of both the standby emergency service water pump and the turbine driven auxiliary feedwater pump. If each of these events is conservatively estimated to have a failure probability of 0.1 (1.00-10-1), then a core damage frequency of 3.06 x 10-7 would be obtained. This value is below the ASP threshol Response: The staff did not credit the turbine-driven auxiliary feedwater since without room cooling this pump could fail after several hours. Furthermore, even if the turbine-driven auxiliary feedwater was available, extended station blackout would lead to core damage due to either reactor coolant pump seal failure or battery depletion. The standby emergency service water pump could not be credited since that pump also fails due to the earthquake.

7. Comment from RES/DET: In this report, in order to estimate the seismic core damage frequency caused by the failure of a component, it was simply assumed that the median seismic capacity of a component to be the same as the input seismic peak ground acceleration. In so doing, the amplification of buildings and equipment where the component is attached to was ignored. This assumption generally will introduce certain amount of non-conservatism into the analyses, since the frequency of occurrence of earthquakes used at this level is less than the actual frequency of earthquake should the amplification of buildings and equipment be considere For components that are close to the ground (such as ceramics in the switch yard) and have high natural frequencies, the conservatism introduced by this assumption may be negligible. But for components situated in a building or attached to an equipment (such as power-operated relief valves on the pressurizer), based on the seismic hazard curves used in the D.C. Cook IPEEE submittal (Figure 4-1), the frequency of occurrence of earthquakes could be underestimated by several time The overall evaluation will be bounding only if other factors of conservatism are introduced to balance this non-conservatism, which seems to be the case we have in this repor Response: We agree with the overall comment that ignoring the building amplification factors could lead to non-conservative results. We revisited our analysis to determine whether this potential non-

IRs 50-315/97-24, 50-315/99-10 conservatism could have impacted our conclusions relating to the risk significance of issues. After this review, we concluded that the risk significance determinations of issues were not affecte We have used the failure probabilities of ceramic insulators due to seismic events in each seismic interval (See Table 5 of the revised seismic IPEEE) rather than median capacities (Table 3 of revised seismic IPEEE) to estimate the core damage frequencies. Since values provided in Table 5 have already accounted for the amplification factors, non-conservatisms have not been introduced to the analysis. The delta core damage frequency (CDF) associated with this issue will remain above the accident sequence precursor threshold of 1.0 x 10-6.

8. Comment from RES/DET: It seems that during a strong earthquake (earthquake that has failed offsite power, tripped the reactor, caused the loss of main feedwater, and failed PORVs, as well as failing the emergency service water and emergency diesel generators), the only system left is auxiliary feedwater (turbine driven pumps) and the condensate storage tank. But condensate storage tank may deplete quickly. Without emergency service water or other make-up water, the plant may lose the capability to remove decay heat from the cor Response: Per your comment, we checked whether Cooks condensate storage tank has adequate inventory and included several statements in Issue No. 2 writeup to explain the adequacy of the condensate storage tank inventory. We do not credit auxiliary feedwater in Issue No. 6 According to the Cook IPE, the condensate storage tank has a capacity of 500,000 gallon According to Section 14.1.9 of the accident analysis section of Cook Updated Final Safety Analysis Report (UFSAR), the auxiliary feedwater system including the condensate storage tank has been sized to cooldown the reactor and achieve cold shutdown when main feedwater is lost and steam is released to the atmosphere rather than recycled back to the condensate storage tank. Further, after looking at UFSARs of similar sized plants (Oconee UFSAR, Section 10.4.7.1.10) we found out that the inventory needed to achieve cooldown is approximately 94,000 gallons for 100 degree F/hour cooldown rate. If the cooldown rate is 50 degrees per hour, the inventory needed is about 145,000 gallons. These amounts are much less than the condensate storage tank capacity at Cook.

9. Comment from Region III: Would the sand from the sand dunes near the pumps suction pass through the strainers?

Response: Only the fine sand can pass through the strainers. According to discussions with the senior resident inspector, based on past experience during stormy conditions, there are enough sand particles of large particle size in the dunes to clog the strainers within minutes.

Reference D-4.1. M. W. Rencheck, Indiana Michigan Power Company, Cook Nuclear Plant, letter to U. S. Nuclear Regulatory Commission, dated August 24, 2000. (ADAMS Accession No. ML003744851)

14