ML17325B551

Application for Amends to Licenses DPR-58 & DPR-74,revising TS 3/4.8.1.2, Electrical Power Systems & Associated Bases to Provide one-time Extension of 18-month Surveillance Interval for Specific SRs

ML17325B551
Person / Time
Site:	Cook
Issue date:	04/19/1999
From:	Powers R INDIANA MICHIGAN POWER CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
Shared Package
ML17325B553	List: ML17325B551 ML17325B555
References
AEP:NRC:1322, NUDOCS 9904230125
Download: ML17325B551 (27)

Text

CATEGORY j.

REGULA RY INFORMATION DISTRIBUTI SYSTEM (RIDS)

A</CESSION NBR:9904230125 DOC.DATE: 99/04/19 NOTARIZED: YES DOCKET ¹ dACIL:50-315 Donald C. Cook Nuclear Power Plant, Unit 1, Indiana M 05000315 50-316 Donald C. Cook Nuclear Power Plant, Unit 2, Indiana M 05000316 AUTH. NAME AUTHOR AFFILIATION POWERS,R.P. Indiana Michigan Power Co.

RECIP.NAME RECIPIENT AFFILIATION Records Management Branch (Document Control 'Desk)

SUBJECT:

Application for amends to licenses DPR-58 &: DPR-74,revising TS 3/4.8.1.2, "Electrical Power Systems" 8 associated bases to provide one-time extension of 18-month surveillance interval for specific SRs. T DISTRIBUTION CODE: A001D COPIES RECEIVED:LTR ENCL S1ZE: Q'f TITLE: OR Submittal: General Distribution NOTES:

RECIPIENT COPIES RECIPIENT COPIES ID CODE/NAME LTTR ENCL , ID CODE/NAME LTTR ENCL LPD3-1 LA 1 1 LPD3-1 PD 1 1 STANG, J- 1 1 INTERNAL": FILE CENTER 0 1 1 NRR/DE/EEIB 1 1 NRR/DE/EMCB 1 1 NRR/DE/EMEB 1 1 NRR/DSSA/SPLB 1 1 NRR/DSSA/SRXB 1 1 NRR/SPSB JUNG,I 1 1 1 1 OGC/HDS3 1 0 EXTERNAL: NOAC 1 1 D E

N NOTE TO ALL "RIDS" RECIPIENTS:

PLEASE HELP US TO REDUCE WASTE. TO HAVE YOUR NAME OR ORGANIZATION REMOVED FROM DISTRIBUTION LISTS OR REDUCE THE NUMBER OF COPIES RECEIVED BY YOU OR YOUR ORGANIZATION, CONTACT THE DOCUMENT CONTROL DESK (DCD) ON EXTENSION 415-2083 TOTAL NUMBER OF COPIES REQUIRED: LTTR 14 ENCL 13

Indiana Michiga~

Power Company~

500 Circle Drive Buchanan, Ml 491071373 INOlAMA MICHIGAN PQWM April 19, 1999 ABP:NRC:1322 Docket Nos.: 50-315 50-316 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Mail Stop 0-P1-17 Washington, DC 20555-0001 Gentlemen:

Donald C. Cook Nuclear Plant Units 1 and 2 TECHNICAL SPECIFICATIONS CHANGE REQUEST ELECTRICAL POWER SYSTEMS, SHUTDOWN Pursuant to 10 CFR 50.90, Indiana Michigan Power Company (I&M),

the Licensee for Donald C. Cook Nuclear Plant units 1 and 2, proposes to amend Appendix A, technical specifications (T/S), of facility operating licenses DPR-58 and DPR-74. IBM proposes to revise T/S 3/4.8.1.2, "Electrical Power Systems, Shutdown," and its associated bases to provide a one-time extension of the 18-month surveillance interval for specific surveillance requirements for units 1 and 2. This surveillance will be performed prior to the first entry into Mode 4 subsequent to receipt of the requested T/S amendment. In addition, for unit 2 only, a minor administrative change is included to delete a reference to T/S 4.0.8, which is no longer applicable. For unit 1 only, an editorial change is made to add the word "or" to action statement 3.8.1.2.

Attachment 1 provides a detailed description and safety analysis of the proposed changes. Attachments 2A and 2B provide marked up T/S pages for unit 1 and unit 2, respectively. Attachments 3A and 3B provide the proposed T/S pages with the changes incorporated for unit 1 and unit 2, respectively. Attachment 4 describes the evaluation performed in accordance with 10 CFR 50.92(c), which concludes that no significant hazards consideration is involved. Attachment 5 provides the environmental assessment.

@gal i

'qq04230i28 ~~0+<+

08000318 PDR ADQCK PDR

U. S. Nuclear Regulatory Commission AEP:NRC:1322 Page 2 At the request of the NRC staff, we have also considered Generic Letter (GL) 98-01, "Year 2000 Readiness of Computer Systems at Nuclear Power Plants," and Supplement 1 to the GL, which requires a response by July 1, 1999, confirming year 2000 readiness of the Cook Nuclear Plants. I&M's year 2000 program is intended to ensure that emergency diesel generator control circuits, are year 2000 ready per the requirements of GL 98-01.

Copies of this letter and its attachments are being transmitted to the Michigan Public Service Commission and Michigan Department of Public Health, in accordance with the requirements of 10 CFR 50.91.

Should you have any questions, please contact Mr. David F. Kunsemiller, Director of Regulatory Affairs, at (616) 466-2405.

Sincerely, gf,'(

R. P. Powers Vice President SWORN TO AND SUBSCRIBED BEFORE ME THIS ~/ DAY OF 1999 BERNICE hL BtCKERS Nowt)t PuY~o, Berrien County, Mi IPg Commission Expbes Feb. 16,2001 Notary Public My'Commission Expires D /4'/

Kjaa Attachments c: J. A. Abramson, w/attachments J. L. Caldwell, w/attachments MDEQ - DW & RPD, w/attachments NRC Resident Inspector, w/attachments

1 I

rt

ATTACHMENT 1 TO AEP:NRC:1322 DESCRIPTION AND SAFETY ANALYSIS FOR PROPOSED CHANGES to AEP:NRC:1322 Page 1 Descri tion and Safet Anal sis for the Pro osed Chan es A. Summary of Proposed Changes I&M proposes to'evise Technical Specification (T/S) 3/4.8.1.2, "Electrical Power Systems, Shutdown," and its associated bases to provide a one-time extension of the 18-month surveillance interval for specific surveillance requirements (SRs) applicable in Modes 5 and 6. In addition, for unit 2 only, a minor administrative change is included to delete a reference to T/S 4.0.8, which is no longer applicable. For unit 1 only, an editorial change is made to add the word "or" to action statement 3.8.1.2.

The amendment request involves six emergency diesel generator (EDG) surveillances that are normally performed at 18-month intervals during reactor shutdowns (Modes 5 and 6). The request proposes to delay performance of these six surveillances, during the current extended outages only, until prior to the first entry into Mode 4 to resume operations (Modes 1-4). The delay is necessary because many plant components needed for the testing are not required to be functional during an outage, and due to the scope of the outage, are currently not functional. The delay is justified because the six deferred surveillances demonstrate the full designed functional capability of the EDGs to support mitigation of accidents that may occur in Modes 1 through 4.

This full design capability is not necessary to support EDG functional requirements during reactor shutdown. The shutdown functional requirements of the EDGs are adequately demonstrated by the nondeferred 18-month surveillances, the "required 30-day surveillances and the specified fuel oil checks. A conservative estimate utilizing Probabilistic Risk Analysis (PRA) techniques has shown that deferral of the surveillances has a very small impact on EDG unavailability. Finally, the request is consistent with NUREG-1431, "(Improved) Standard Technical Specifications,"

(ITS) in recognizing the challenge this testing represents to the limited A.C. sources required to be operable while shutdown.

When a licensee knows of no reason the surveillances would not be satisfied, the deferral is allowed by the. NUREG.

The proposed changes are described in detail in section E of this attachment. T/S pages that are marked to show the proposed changes are provided in attachments 2A and 2B for unit 1 and unit 2, respectively. The proposed T/S pages, with the changes incorporated, pre provided in attachments 3A and 3B for unit 1 and unit 2, respectively.

B. Description of the Current Requirements In Modes 5 and 6, T/S Limiting Condition for Operation (LCO) 3.8.1.2 requires the operability of a single offsite power supply and a single emergency diesel generator (EDG). For these required shutdown power supplies, T/S surveillance requirement 4 '.1.2 invokes the same surveillances as those specified in Modes 1 through 4 (SRs 4.8.1.1.1 and 4.8.1.1.2) with the one exception of SR 4.8.1.1.2.a 5 (paralleling the EDGs with offsite

~

power for a one-hour, or greater, load test). Table 1 lists and describes the surveillances required in Modes 5 and 6. Only those SRs in bold and parentheses are subject to deferral by this amendment request. Also included in the table, for reference, are the corresponding SRs of the ITS.

to AEP:NRC:1322 Page 2 TABLE l T/S 4.8.1.2 SRs Corresponding Test description/comments and (frequency) NUREG-1431 SRs 4.8.1.1.1.a 3.8.1.1 Breaker alignment checks and indicated (7 da s) ower availabilit 4.8.1.1.1.b 3.8.1.8 Offsi.te power transfer capability.

(18-months) 4.8.1.1.2.a.1 (*) 3.8.1.4 Da tank fuel level check 4.8.1.1.2.a.2 (*) 3.8.3.1 Stora e tank fuel level check 4.8.1.1.2.a.3 (*) 3.8.1.6 Fuel transfer um test 4.8.1.1.2.a.4 (*) 3.8.1.2 and Start Test and Fast Start 3.8.1.7 Test (4.8.1.1.2.a.4 is performed as a fast start ever 184 da s) 4.8.1.1.2.a.6 (*) N/A Diesel Standby ali nment verification 4.8.1.1.2.b.l (**) 3.8.1.5 Da Tank accumulated water removal 4.8.1.1.2.b.2 (**) 3.8.3.5 Stora e Tank accumulated water removal 4.8.1.1.2.c (***) 3.8.3.3 New fuel sam lin 4.8.1.1.2.d (*~) 3.8.3.3 Stora e Tank fuel sam lin 4.8.1.1 2.e.l.

~ N/A Diesel engine inspection per (18-months) manufacturer's recommendations 4.8.1.1.2.e.2. 3.8.1.9 Single-Load Rejection Test (18-months) 4.8.1.1.2.e.3. 3.8.1.10 Full-Load Rejection Test (18-months) l.

(4. 8. 1.2.e. 4. a) 3.8.1.11 Loss-of-Offsite-Power (LOOP) Test.

and b)) Includes load shedding and load (18-months) sequencing verifications.

4.8.1.1.2.e.5. 3.8.1.12 Safety Injection Actuation (18-months) Signal(SIAS)Test (4.8.1.1.2.e.6.a), 3.8.1.19 and Combined SIAS and LOOP Tests including b) and c)) 3.8.1.13 Protective Trip Bypass Test (18-months) 4.8.1.1.2.e.7. 3.8.1.14 and Endurance and Margin Test and Hot (18-months) 3.8.1.15 Restart test. The Margin Test (loading to greater than rated power) is not performed at Cook.

(4.8.1.1.2.e.8.) Intent met by Maximum Auto-Connected Load Test (18-months) 3.8.1.19.c.5.

(4. 8. l.l. 2.e. 9. a), 3.8.1.16 Synchronizing Test and Emergency Load b) and c)) Transfer Test (18-months)

(4.8.1.1.2.e.10 a) 3.8.1.17 Test Mode Change-Over Test with and b) concurrent verification of energized (18-months) safety loads (4.8.1.1.2.e.ll) 3.8.1.18 Load sequencer timing verification (18-months) 4.8.1.1.2.

(10 ears) f.l 3.8.3.6 Fuel oil storage tank cleaning 4.8.1.1.2.f.2 N/A Fuel oil system leak test (10 ears) 4.8.1.1.2.f.3 3.8.1.20 Redundant Unit Starting Independence (10 ears) Test

• Per T/S Table 4.8-1 on a staggered test basis(currently every 31 days)

• • Every 31 days

• • • Prior to adding fuel to the storage tanks

J to AEP:NRC:1322 Page 3 CD Bases for the Current Requirements As described in the current Bases for T/S 3/4.8.1.2, the operability of the minimum specified A.C. power sources during shutdown and refuel'ing provides assurance that 1) the facility can be maintained in the shutdown or refueling condition for extended time periods and 2) sufficient instrumentation and control capability is available for monitori'ng and maintaining the facility status.

D. Need for Revision of the Requirement Back round The subject surveillances of this amendment request result in plant transients that cannot be safely performed at power.

Therefore, the surveillances are performed while the plant is shutdown, typically for planned refueling outages. However, the necessary equipment to perform the testing may not be available during extended outages (including important non-safety equipment that is demonstrated to automatically disconnect from the emergency busses during the testing). Furthermore, much of the safety equipment necessary for the testing is not required by the T/Ss in Modes 5 and 6 or is actually required to be inoperable for other safety considerations (such as the potential to inadvertently damage the plant from overpressurization while cold). For normal duration outages, the subject surveillances rarely result in outage conflicts because the 18-month surveillance interval (plus allowed extension) accommodates performance of the testing after outage completion and just prior to entering Mode 4. At this time the necessary equipment to

~

support the testing has been made ready for the plant restarts However in the case of extended outages, particularly when the duration was not initially anticipated, these surveillances may come due in mid . outage. When this occurs, the only available option is to suspend outage activities so that the plant can be placed in a condition to perform the testing, or, declare the diesels T/S inoperable and comply with the applicable actions until the testing can be done. Either option results in a delay in the outage without a compensating increase in safety because the diesels may be relied upon to accomplish their function in Modes 5 and 6 without the subject surveillances being current (see details of Cook justification in F). In addition, the required testing subjects the limited A.C. sources required in Modes 5 and 6 to a significant transient. A test complication at this time could result in loss of the required A.C. supplies. This situation, and its unnecessary impact, has been anticipated and corrected by the ITS. The ITS does not require" the subject surveillances to be performed on the required operable A.C.

sources when in Modes 5 and 6. However, this flexibility is not permitted by the Cook unit 1 and unit 2 T/Ss.

Cook extended outa es Cook units 1 and 2 have been shutdown since September of 1997 and

p~

C to AEP:NRC:1322 L

Page 4 currently remain in an extended outage. Sufficient equipment is not available to perform the required surveillance testing at the specified surveillance intervals. The unit 1 surveillance interval expired on March 1 and 3, 1999, for the 1CD and 1 AB EDGs respectively, and both unit 1 EDGs were declared T/S inoperable. It is noted that at this time, the unit 1 and unit 2 EDGs were already declared inoperable due to seismic qualification issues involving HFA relays (hinged armature auxiliary) in the EDG and 4KV safety motor control circuits (this condition was reported via licensee Event Report 1999-001-00).

Correction, of the HFA relay problems, and appropriate post maintenance testing, will restore operability of the EDGs with no additional outage impact. However, unless the amendment is approved, EDG inoperability due to the expired surveillances will continue to have an adverse impact until the surveillances can be performed. Currently, unit 1 is in Mode 5 with plant temperature maintained at approximately 125'F. Low temperature overpressure protection controls are in effect with corresponding tagouts on both safety injection (SI) pumps and one centrifugal charging pump (CCP). In addition, the containment spray system (CTS) is undergoing considerable maintenance/modification to piping and pumps, including installation of a full-flow recirculation line.

Completion of the CTS work is necessary to support the testing and could require the unit 1 EDGs to remain T/S inoperable until the summer of 1999.

This same T/S relief will be needed for unit 2 in December 1999 when the surveillances become overdue.

E. Description of the Proposed Changes 1&M proposes to revise T/S 3/4.8.1.2 to permit a one-time extension of the 18-month surveillance interval for SRs 4.8.1.1.2.e.4.a) and b); 4.8.1.1.2.e.6 '), b) 4.8.1.1.2.e.8; 4.8.1.1.2.e.9.a), b) and c); 4.8.1.1.2.e.10.a) and and c);

b); and 4.8.1.1.2.e.ll for unit 1 and 2. In addition, for unit 2 only, a minor administrative change is included to delete the reference to T/S 4.0.8 that is no longer applicable. For unit 1 only, an editorial correction is made to the action statement 3.8.1.2 to add the word "or" between the words "CORE ALTERATIONS" and "positive reactivity changes."

The surveillance interval extension will be accomplished by addition of the following, statement to T/S surveillance requirement 4.8.1.2:

r Commencing in 1999 during the extended shutdown initiated in 1997, the 18-month surveillance requirements 4.8.1.1.2.e.4.a) and b); 4.8.1.1.2.e.6.a), b) and c);

4.8.1.1.2.e.8; 4.8.1.1.2.e.9.a), b) and c);

4.8.1.1.2.e.lO.a) and b); and 4.8.1.1.2.e.ll may be delayed one time until just prior to the first entry into MODE 4 following the shutdown.

1&M proposes to revise the bases for T/S 4.,8.1.2 to describe the reason for the extended surveillance intervals.

to AEP:NRC:1322 Page 5 F. Bases of the Proposed Changes Summar of Relevant Points

~ The surveillance interval extensions proposed by this request are permitted by the ITS.

~ A similar request was approved for another licensee during an extended outage.

~ Each deferred surveillance has been reviewed and is not essential to demonstrate diesel reliability in Mode 5 and 6.

~ Recent performance of the deferred surveillances has not resulted in failures that would challenge diesel functional requirements in Modes 5 and 6.

~ A PRA estimate was performed of the increase in EDG unavailability, in Modes 5 and 6, due to deferral of the subject surveillances. The results demonstrated that the deferrals do not significantly increase EDG unavailability in Modes 5 and 6.

~ Events analyzed in Modes 5 and 6 do 'not take cr'edit for auto starting of the EDGs and procedures exist to manually start and load an EDG if an auto start sequence fails.

administrative controls are in place to ensure

~ Appropriate onsite outage activities do not challenge the offsite power transmission lines.

~ The surveillances that will continue to be performed provide adequate assurance the EDGs are capable of supplying emergency power for the current conditions.

~ The amendment request does not reduce the number of required operable power supplies.

~ The amendment request does not modify the actions required for an inoperable power supply.

~ The plant is designed such that analyzed accidents credible in Modes 5 and 6 would not be initiated by an interruption of A.C. power.

~ The greatly reduced fission product activities and fission product decay heat rates currently existing provide assurance that the consequences of any accident or inadvertent release of radioactive materials are bounded by the existing analysis.

~ Although the subject T/S requires only a single operable offsite power supply and a single operable EDG in Modes 5 and 6, administrative requirements for reducing shutdown risk supplement the T/S requirements when appropriate.

Effect of the Extended Shutdown on Deca heat and Fission Product

~Activit NUREG-1431 provides the following introduction to the bases for AC Sources-Shutdown:

In general, when the unit is shut down, the Technical Specifications requirements, ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required. The rationale for this is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in Modes 1, 2, 3, and 4 have no specific analyses in Modes 5 and 6. Worst case bounding events are deemed not credible in Modes 5 and 6 because the energy contained to AEP:NRC:1322 Page 6 within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and in minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems.

'I This is particularly true for Cook units 1 and 2 at the current time due to the 18 months of continuous shutdown preceding this amendment request. Reduced decay heat loads would provide additional time, following disruption of A.C. power, to restore power prior to reaching the maximum allowable temperature of 200'F for Mode 5. Currently, for unit 1, the estimated time to reach 200'F from 130'F is 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />. For Unit 2, the estimated time to reach 200'F from 130'F is 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

Fission product activities in the fuel assembly pellet-to-cladding gaps are greatly reduced. The fuel handling accident analysis considers the thyroid dose at the site boundary and in the low population zone. This dose is dominated by the isotope iodine 131, which also decays more slowly than the other iodine contributors to the dose. The activity of iodine 131 decreases by one-half every 8.05 days. The current shutdown period of approximately 18-months represents over 70 half-lives.

Discussion of Safet Anal sis Events 1 through 8, listed below, are analyzed in the unit 1 and 2 Updated Final Safety Analysis Reports (UFSAR) in Section 14.2, "Standby Safeguards Analysis":

1. Fuel handling accident

2. Waste liquid release 3 ~ Waste gas release Steam generator tube rupture

5. Steam pipe"rupture

6. Rupture of control rod mechanism hous'ing rod cluster control (RCC) assembly ejection

7. Environmental consequences following secondary system accidents

8. Rupture of a feedline (Unit 2 only)

Other events and their UFSAR section include:

9. Uncontrolled RCCA (rod control cluster assembly) withdrawal from a subcritical condition (Section 14.1.1)

10. Uncontrolled Boron Dilution (Section 14.1.5)

The relevance of these events to this amendment request is as follows:

1. Fuel handling accident The only time a fuel handling accident could occur is during the handling of a fuel assembly. The design of fuel handling equipment is such that an interruption of A.C.

power would not cause a fuel element to be inadvertently dropped. Therefore, an interruptS. on or loss of A.C. power to AEP:NRC:1322 Page 7 could not inadvertently release a fuel element and consequently, the probability of this event is not increased. In addition, administrative controls and crane interlocks preclude the movement of loads greater than 2500 pounds, or with the potential for excessive impact energy, over the spent fuel pool.

The greatly reduced fission product activity at the current time provides assurance that the consequences of this event are bounded by the existing analysis.

2. Accidental Release of Radioactive Liquids The inadvertent release of radioactive liquid wastes to the environment was evaluated for the waste evaporator condensate and monitor tanks, condensate storage tank, primary water storage tank, refueling water storage tank (RWST), the auxiliary building storage tanks and the chemical and volume control system (CVCS) holdup tanks.

was concluded in the Chapter 14 evaluation that loss of It liquid from these tanks to the environment is not a credible accident. This conclusion does not depend on operating mode, hence, further evaluation of this event is not required.

3. Waste Gas Release Radioactive gases are introduced into the reactor coolant by the escape of fission products if defects existed in the fuel cladding. The processing of the reactor coolant by auxiliary systems results in the accumulation of radioactive gases in various tanks. The two main sources of any significant gaseous radioactivity that could occur would be the volume control tank and the gas decay tanks.

It is assumed that a tank ruptures by 'an unspecified mechanism after the reactor has been operating for one core cycle with 1% defects in the fuel cladding. There is no identified mechanism by which an interruption or loss of power could result in a tank rupture. Therefore, it is concluded that the probability of occurrence of a tank rupture would not be significantly increased by an interruption or loss of A.C. power. Furthermore, the greatly reduced fission product activity at the current time provides assurance that the consequences of this event are bounded by the current analysis.

Events 4 through 8 are not required to be analyzed in Modes 5 and 6 due to negligible stored energy in the primary and secondary systems below the Mode 5 temperature limit of 200'F.

9. Uncontrolled RCCA withdrawal from a subcritical condition This event can only occur with the reactor trip breakers closed and the control rod drive mechanisms (CRDMs) energized. With the exception of testing or special maintenance, the rod drive motor generator set remains tagged out until Mode 3 and this alone would preclude rod movement. If the conditions for rod withdrawal are met, two operable source range instruments and two reactor trip

to AEP:NRC:1322 Page 8 channels and trip breakers must be operable. An

'interruption or loss of power would preclude CRDM movement and release the control rods. The source range instruments would remain available. Therefore, it is concluded that the probability of occurrence of an uncontrolled RCCA

~

withdrawal would not be increased by an interruption or loss of A.C. power in Modes 5 or 6. I

10. Uncontrolled Boron Dilution The source of water for this event is primary grade water via the reactor makeup portion of the CVCS. The CVCS is designed to limit, even under various postulated failure modes, the potential rate of dilution to a value that provides the operator sufficient time to correct the situation in a safe and orderly manner. The rate of addition of unborated water makeup to the reactor coolant system is limited by the capacity of the primary water pumps. The maximum addition rate in this case is 225 gpm with both primary water pumps running. An interruption or loss of A.C. power would preclude pump operation and accidental dilution. Acceptable consequences for this event rely on precluding its occurrence and by detection with the source range nuclear instrumentation required by the T/S in Modes 5 and 6.

During certain types of operation, it is plausible that the P

RWST is at a lower boric acid concentration than the reactor coolant system water. Due to the large reactivity margins inherent in the design basis for the RWST boron concentration and slow dilution process, it has been determined that this need not be considered as a dilution source (this conclusion is recognized by an existing footnote to T/S 3/4.8.1.2). Therefore, it is concluded that the probability of occurrence of an uncontrolled boron dilution from the RWST would not be increased by an interruption or loss of A.C. power.

Discussion of Station Blackout (SBO)

Station blackout (loss of all A.C. power) was evaluated for Cook units 1 and 2 in accordance with the Nuclear Management and Resource Council (NUMARC) 87-00, "Guidelines and Technical Basis for NUMARC Initiatives Addressing Station Blackout at Light Water Reactors," Rev. 1. The NUMARC guidelines assume a SBO occurs at power and is evaluated based on coping with the event and maintaining the plant in hot standby for a specified duration.

The basis for this assumption is provided in NUMARC 87-00, paragraph 2.'2.2:

(1) The potential for core damage from a station blackout is bounded by events initiated from 100%

power due to the presence of substantial decay heat.

(2) Transients initiated from normal operating conditions are considered most probable.

Therefore, an SBO was not required to be evaluated in Modes 5 and

6. Nevertheless, SBOs in Modes 5 and 6 have occurred in the industry and have been the subject of generic correspondence.

For example, IEN 90-25, Supplement 1, "Loss Of Vital AC Power to AEP:NRC:1322 Page 9 With Subsequent Reactor Coolant System Heat-Up", describes the Vogtle nuclear plant event in which a truck caused damage in the electrical switchyard and initiated a SBO. Occurrence of a similar event at Cook is unlikely due to administrative controls over access and work in the switchyard areas during outages. The following discussion is provided to demonstrate that the probability of an SBO in Modes 5 and 6 will not be significantly increased by deferral of the subject surveillances.

As part of the NUMARC 87-00 guidelines, 1&M committed to implement and maintain an EDG reliability program. This program is implemented by procedure PMI 6080, Rev.2, "Emergency Diesel Generator (EDG) Reliability Monitoring Program." The program is applicable at all times, including Modes 5 and 6. As part of this program, Cook Nuclear Plant is required to maintain the EDGs credited in the SBO coping assessment at or above specified target reliability levels. 1&M committed to maintain an EDG target reliability of greater than 0.975, as described by the NUMARC guidelines. -If the target is not met, specific remedial actions are required to restore the EDGs to above the target reliability level. The Cook Nuclear Plant unit 1 and 2 EDGs currently meet their target reliability levels.

The SBO program was the subject of safety evaluation reports dated October 31, 1991 and April 23, 1992 Reliabilit 'iesel In addition to the NUMARC program described above for SBO, EDG reliability is tracked as part of 10CFR 50.65 "Requirements for monitoring the effectiveness of maintenance at nuclear power plants, " (i.e., the Maintenance Rule) and by T/S surveillance testing.

When required by T/S Table 4.8-1, the EDGs are placed on an accelerated test frequency. The unit 1 CD EDG and the unit 2 AB EDG have each been on an accelerated test frequency on one occasion since the 1997 shutdowns. The 1 CD EDG was on an accelerated test frequency due to consecutive test failures from fuel oil leaks at individual injectors. The 2 AB EDG was on an accelerated test frequency due to consecutive test failures from a broken bracket on the exhaust manifold on one occasion and broken or leaking injector lines on three occasions. These failures are individual mechanical failures not directly related to the load shedding, load sequencing, and emergency starting contxol circuits of the EDGs. Individual mechanical failures such as these are typically (and in this case were) detected and corrected during monthly testing activities not involving the subject deferred surveillances. Currently, all four EDGs are on normal T/S surveillance schedules.

The T/S test failures described above, for the 2AB EDG, also contributed to this machine being placed in a Maintenance Rule

"(a)(1)" status under the Maintenance Rule trending program.

Other contributors to the (a)(1) status involved a failed voltage regulator and a failed starting air check valve (these two failures occurred prior to the 1997 unit 2 shutdown). None of these failures involved a diesel load shed or load sequencing control circuit malfunction and were not identified during performance of any of the subject surveillances. The (a)(1)

1 I

tE to AEP:NRC:1322 Page 10 status under the Maintenance rule is a classification indicating that established performance criteria are not being met.

Specific actions are required to correct the conditions, and monitor performance, until the established goals are met. This monitoring is currently in progress and it is anticipated that the 2AB EDG will be out of the (a)(1) status prior to the subject surveillances becoming due (see additional discussion below under "Estimate of EDG unavailabilit due to the extended surveillances").

Estimate of EDG unavailabilit due to the extended surveillances An assessment of the load shedding and sequencing control circuits was made to determine a bounding increase in diesel unavailability due to deferring the subject surveillances. The assessment was performed using PRA techniques. The starting point for the assessment was the Mode 1 PRA EDG unavailability model. EDG failure due to overload was considered in the Mode 1 PRA EDG model and was implicitly included in the "Fail to Run" failure mode. The Mode 1 EDG model also includes unavailability.

of the EDGs caused by the unavailability of required support systems, such as Essential Service Water, 250 VDC, and room cooling. The overall Mode 1 EDG average unavailability due to all causes was determined as approximately 13.2 days per year.

For the purposes of this assessment, it was decided to add a simplified representation of load shedding and sequencing control circuits in the Mode 1 EDG unavailability model to allow an explicit estimate of the impact of these circuits. One key assumption of the PRA model addition is that the failure of any single load-shed relay will result in an EDG overload. This conservative assumption is made to simplify the modeled EDG response; it is recognized that an EDG overload condition is not a certainty if a single load-shedding relay fails to close and that many of the loads required to be shed are already secured in Modes 5 and 6. Another key simplifying assumption of the PRA model addition is that, given the occurrence of an SI signal, the failure of any single SI load-conservation relay will result in an EDG overload. Finally, the model also considers relay failures that could result in simultaneous starts of sequenced loads to cause an EDG overload; in this case, simultaneous Black-out and SI signals are required. The average contribution to EDG unavailability due to the failure of any of these relays was determined using Electric Power Research Institute (EPRI) data.

The addition of the load shedding and sequencing control circuit model just described to the Mode 1 EDG unavailability model contributed 2.8% to EDG unavailability. Thus, for Mode 5 EDG unavailability was estimated as 13.6 days per year.

The effect of increasing the time interval between performance of the subject surveillances was estimated as follows. The failure data for the relays were modified by linearly scaling the nominal data by the ratio of the assumed surveillance interval to the nominal surveillance interval based on guidance contained in NUREG/CR-4550 (Volume 1, Revision 1, page 8-7). In other words, for an assumed surveillance interval of 30 months, the nominal failure data was multiplied by a factor of 30/18 or 1.67.

Similarly, for an, assumed surveillance interval of 42 months, the nominal failure data was multiplied by a factor of 42/18 or 2.33.

The result of this approach was an estimated increase in EDG

to AEP:NRC:1322 Page 11 unavailability of 2.2% to 13.9 days per year, if the surveillance interval was increased from 18 months to 30 months. The estimated increase in EDG unavailability was 4.0% to 14.1 days per year, if the surveillance interval was increased from 18 months to 42 months. These numbers show that increasing the EDG surveillance test interval leads to very small increases in EDG unavailability. The impact would be expected to be significantly lower if a more detailed repiesentation of the load-shedding circuitry was developed or credit was taken for the possibility of operator recovery actions.

Plant Shutdown Safet and Risk Mana ement T/S 3.8.1.2 requires a single offsite power supply and a single EDG to be operable in Modes 5 and 6. This requirement is observed by administrative policies for reducing shutdown risk (when not possible the T/S Action statements are complied with).

Administrative policies require the T/S requirements to be supplemented in Mode 5 and 6 when RCS inventory is below specified minimums ~ When these specified minimums are not met, T/S requirements are supplemented by requiring an additional offsite source or an additional EDG to be available. When in Mode 5 and Mode 6 with reduced RCS inventory, an additional offsite source and an additional EDG are required to be available. I&M's policies for plant shutdown safety and risk management have been reviewed relative to the subject deferrals and are not impacted.

Si nificance of the Deferred Surveillance Re uirements The following is a restatement of each deferred surveillance requirement and a discussion of its significance in Modes 5 and 6:

4.8.1.1.2.e.4. Simulating a loss of offsite power by itself, and:

a) Verifying de-energization of the emergency busses and load shedding from the emergency busses, b) Verifying that the diesel starts on the auto-start signal, energizes the emergency busses with permanently connected loads within 10 seconds, energizes the auto-connected shutdown loads through the load sequencer and operates for greater than or equal to 5 minutes while its generator is loaded with the shutdown loads. After load sequencing is completed, the steady state voltage and frequency of the emergency busses shall be maintained at 4160 + 420 volts and 60 + 1.2.Hz during the test.

This surveillance test simulates a loss of offsite power (LOOP).

Following this LOOP simulation, the EDG would automatically start and load. lf proper load shedding did not take place, an EDG could be overloaded as soon as it energized the emergency busses.

Improper load sequencing could cause a momentary overload. The likelihood of either of these occurrences is considered very low based on PRA assessment of the relay failure rates, periodic calibration of the relays and the results of the last two 4 '.1.1.2.e ~ 4 surveillance tests for each EDG. Review of the tests indicated that load shedding of non-safety loads or sequencing of safety loads had not resulted in an EDG test to AEP:NRC:1322 Page 12 failure. In one instance, for the unit 2 CD EDG, the Group C4 pressurizer heaters failed to load shed. The fault was determined to be in the breaker and not in the load shed relay. The additional load represented by these heaters did not result in exceeding the available capacity on this machine and would not have resulted in loss of the EDG during an actual LOOP.

In the unlikely event that an auto start of an EDG was unsuccessful, approved procedures exist to manually start the EDGs and manually start required loads.

Based on review of the testing and availability of appropriate procedures, I&M concluded that a loss of offsite power in Modes 5 and 6 would result in a successful automatic or manual start and load of the EDGs.

4.8.1.1.2.e.6. Simulating a loss of offsite power in conjunction with a Safety Injection actuation test signal, and by:

a) Verifying de-energization of the emergency busses and'oad shedding from the emergency buses, b) Verifying that the diesel starts on the auto-start signal, energizes the emergency busses with permanently connected loads within 10 seconds, energizes the auto-connected emergency (accident) loads through the load sequencer and operates for greater than or equal to 5 minutes while its generator is loaded with the emergency loads. After load sequencing is completed, the steady state voltage and frequency of the emergency busses shall be maintained at 4160 + 420 volts and 60 + 1.2.Hz. The voltage and frequency shall be maintained within these limits for the remainder of this test, and c) Verifying that all automatic diesel generator trips, except engine overspeed and generator differential, are automatically bypassed upon loss of voltage on the emergency bus andlor Safety Injection actuation signal.

This test is similar to 4.8.1.1.2.e.4, above, in that the load shedding function is repeated and safety loads are sequenced on.

However, in the load sequencing with a concurrent safety injection actuation signal (SIAS), more loads are picked up and the CTS pumps are started. This results in the maximum EDG load. In Modes 5 and 6, starting of the CTS pumps is not required or permitted. Additionally, in Modes 5 and 6, a valid SIAS is not credible and the SIAS actuation logic is not required to be operable. Therefore, the full load sequence demonstrated by this test is unlikely to occur in Modes 5 and 6. On a LOOP, in Modes 5 and 6, the EDG would respond as described in surveillance 4.8.1.1.2.e.4 above.

4.8.1.1.2.e.8. Determine that the auto-connected loads to each diesel generator do not exceed 3500 kw.

This test confirms that all safety related loads automatically connected to the EDGs under emergency conditions do not exceed the continuous duty rating of the EDG. The importance of this

Attachment 1 to AEP:NRC:1322 Page 13 testing in Modes 5 and 6 is greatly reduced. While in Modes 5 and 6 below 200'F, most of the emergency core cooling system pumps and the CTS are maintained in a configuration to preclude automatic actuation.'herefore, due to the limited number of safety loads required to be operable in Modes 5 and 6, there is adequate assurance that EDG capacity would not be exceeded by the auto-connected loads.

4.8.1.1.2.e.9. Verifying the diesel generator's capability to:

a) Synchronize with the offsite power source while the generator is loaded with its emergency loads upon a simulated restoration of offsite power.

b) Transfer its loads to the offsite power source, and c) Be restored to its standby status.

The offsite power supply is considered to be the preferred power source during accident mitigation with the EDGs acting as the backup emergency supply. In case of an Engineered Safety Features actuation in which the offsite power source was not available, the EDG would be supplying the emergency loads. Upon restoration of the offsite power supply, it is required that the emergency loads can be transferred back to the preferred supply, while running, to permit placing the EDG back in a standby lineup.

Based on past experience and the completed test procedure reviews for this test, I&M does not anticipate a problem with paralleling the EDGs under any conditions. Additionally, the significance of this capability under the current plant conditions is greatly reduced. Cooling capability for removal of decay heat is an important safety function in modes 5 and 6. However, interruptions in decay heat removal cooling are recognized by T/S 3/4.4.1.4 and 3/4.4.1.5 (Cold Shutdown-Loops Filled and Cold Shutdown-Loops Not Filled, respectively) for up to one hour.

the offsite power supply was lost for a sustained period and If

'ecay heat removal was in progress using an EDG, it would not be essential (upon restoration of offsite power) that a running residual heat removal (RHR) pump be transferred back to the offsite power supply without interruption. If necessary, the pump could be secured while the EDG was placed back in a standby lineup and then reenergized from offsite power.

Decay heat removal during refueling operations is addressed by T/S 3/4.9.F 1 (Residual Heat Removal and Coolant Circulation),

which requires at least one residual heat removal (RHR) loop in operation at all times. Typically, the conditions for a refueling are set very soon after plant shutdown, with decay heat loads at design maximum values and reduced time to reach 200'F cooling was lost. For the current situation of 18-months of if shutdown, T/S 3/4.9.8.1 is extremely conservative. If a loss of offsite power required a period of decay heat removal using the EDG for power, and then offsite power was restored, technically acceptable, if necessary, it would be to interrupt RHR for a short time while the EDG was placed back in standby. A temporary interruption of RHR is recognized, for up to 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> per 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> period, when moving fuel near the reactor pressure vessel hot legs.

Although it is technically acceptable and permitted by the T/Ss to interrupt cooling for a short time in modes 5 and 6, I&M has to AEP:NRC:1322 Page 14 concluded, based on previous testing, that RHR could be transferred back to offsite power without interruption.

Based on the above, the benefit from performing surveillance 4 '.1.1.2.e.9 is to ensure the specific capabilities of the EDG are verified prior to the next entry into Mode 4.

4.8.1.1.2.e.10. Verifying that with the diesel generator operating in a test mode while connected to its test load, a simulated Safety Injection signal overrides the test mode by:

a) Returning the diesel generator to standby operation ,and b) Verifying the emergency loads are serviced by offsite power.

The benefit of performing this testing at the current time is greatly minimized because the receipt of a valid SIAS actuation signal in Modes 5 and 6 is not credible, and the SIAS actuation logic is not required to be energized in Modes 5 and 6.

4.8.1.1.2.e.ll. Verifying that the automatic sequence timing relays are OPERABLE with each load sequence time within plus or minus 5% of its required value and that each load is sequenced on within the design allowable time limit.

In the current conditions, the only loads that automatically start on a LOOP are the non essential service water (NESW),

auxiliary feedwater (AFW), essential service water (ESW), and component cooling water (CCW) pumps (AFW would typically be precluded from starting when RHR is used for decay heat removal).

Starting of these loads out of sequence could result in a temporary overload of the EDG but this is very unlikely due to the number of loads that would not start in the current condition. In addition, past performance of this surveillance has not disclosed significant problems with the load sequencing relays. As previously discussed, these relays are within their current calibration intervals, and the HFA relays will be appropriately tested prior to declaring the EDGs operable. Based on this, I&M is confident that the EDGs would not be challenged by load sequencing problems.

Re ulator Precedence Generic Letter (GL) 91-04, "Changes in Technical Specifications Surveillance Intervals to Accommodate a 24-Month Fuel Cycle," was published April 2, 1991. The purpose of the GL was to provide guidance to licensees wishing to take advantage of improvements in reactor fuels to increase the duration of the fuel cycle for their facilities. The staff included in its guidance in GL 91-04 the following statement:

The NRC staff has reviewed a number of requests to extend 18-month surveillances to the end of a fuel cycle and a few requests for changes in surveillance intervals to accommodate a 24-month fuel cycle. The staff has found that the effect on safety is small because safety systems use redundant electrical and mechanical components and because licensees perform other surveillances during plant operation that confirm that these systems and components can perform their safety functions. Nevertheless, to AEP:NRC:1322 Page 15 licensees should evaluate the effect on safety of an increase in 18-month surveillance intervals to accommodate a 24-month cycle. This evaluation should support a conclusion that the effect on safety is small. Licensees should confirm that historical plant maintenance and surveillance data support this conclusion.

The 24-month interval described by GL 91-04 involves permanent extensions of the 18-month interval during periods of reactor operation when the importance of the surveillances is increased.

The specific EDG surveillances addressed by this T/S change request will, be performed if granted, be suspended prior to entry into mode 4.

during the outage but will Additional regulatory precedence is established in NUREG-1431.

T/S SR 3.8.2.1 of NUREG-1431 includes a note stating that the subject SRs need not be performed on an operable diesel in Modes 5 and 6. The reason for this is described in the bases and is generally to preclude the operable diesel from being rendered inoperable during performance of SRs, and preclude deenergizing a required 4160 V ESF bus or disconnecting a required offsi:te circuit during performance of SRs. With limited A.C. sources available, a single event could compromise both the required circuit and the EDG.

The Salem Generating Station Unit Nos. 1 and 2 (DPR-70 and DPR-75), were involved in an extended outage similar to the current outages for Cook units 1 and 2. This resulted in an amendment request to permanently extend the surveillance intervals for all Mode 5 and 6 EDG surveillances that are permitted to be extended by the ITS (this includes each of the surveillances in this amendment request). The justification provided for the amendment relied primarily on the ITS Bases for the deferrals. The amendment was approved as Amendment Nos. 212 and 192.

Administrative and Editorial Chan es Previous submittal AEP:NRC:0433Q involved an administrative change that affects unit 2 T/S page 3/4.8-9. Because I&M expects that the current request will be approved prior to AEP:NRC:0433Q, this administrative change is duplicated in this submittal. The change involves deletion of reference to T/S 4.0.8. T/S 4.0.8 allowed extensions for certain surveillances required to be performed on or before August 13, 1994, and designated as 18-month or 36-month surveillances (or required as outage-related surveillances under the provisions of T/S 4.0.5). T/S 4.0.8 also affected the initiation date established during the unit 2 1994 refueling outage. Each affected surveillance is modified by a note stating that the provisions of T/S 4.0.8 are applicable.

These extensions were granted to accommodate scheduled work at the time. Unit 2 surveillances are now scheduled in accordance with the applicable T/Ss. Therefore, for unit 2, T/S 4.0.8 is deleted from SR 4.8.1.2 because it no longer applies.

For unit 1 only, an editorial correction is made to the action statement to add a missing "or". between the words "CORE ALTERATIONS" and "positive reactivity changes." The "or" is properly included in the unit 2 T/S and this editorial correction to AEP:NRC:1322 Page 16 will make the unit 1 and unit 2 T/S SR 4.8.1.2 identical. The correction is not intended to change the meaning.

Conclusions The proposed amendment involves deferral of certain surveillance requirements when shut down. It does not reduce the required operable power sources of the LCO, does not increase the allowed outage time of any required operable power supplies, and does not reduce the requirement to know that the deferred SRs could be met at all times. Deferral of the testing does not by itself introduce a potential failure mechanism or significantly increase the probability of EDG failure on demand. The monthly EDG starts, fuel level checks, and fuel transfer pump checks will continue to be performed to provide adequate assurance that the EDGs will be available if needed. The single and full load rejection tests of T/S SR 4.8.1.1.2.e.2 and 4.8.1.1.2.e.3 will be performed prior to declaring the EDGs operable. This testing demonstrates proper governor response and provides assurance that a dropped load during a manual or automatic loading sequence does not result in loss of the EDG. 'herefore, it is concluded that the required A.C. sources will remain available if needed, and risk to public health and safety in Modes 5 and 6 is not increased.

Based on the above, the A.C. electrical power systems would continue to perform their function following an accident as determined previously. Therefore, there would be no change in the types or significant increase in the amounts of any effluents released offsite. Further, because the request is for deferring normally performed SRs, it was concluded that the changes have no impact on individual or cumulative occupational radar.ation exposure.

G. Impact of the Proposed Changes Both unit 1 EDGs are inoperable due to expiration of the surveillance interval, plus extension, of the subject surveillances of T/S SR 4.8.1.1.2.e. 1&M is performing the required actions and, it has been shown that safety is not significantly reduced by deferral of the subject SRs. If the amendment is not approved, the EDGs must remain inoperable until plant conditions can support the required testing. Inoperability of the EDGs will severely impact outage flexibility and prolong the duration of maintenance activities without a compensating increase in safety. Reduction in the duration of maintenance activities is a component of minimizing shutdown risk.

The potential outage duration and scope for unit 2, including the possibility of emergent work, may result in a similar impact to Unit 2. The change is requested for unit 2 in anticipation of this potential impact. It has been shown that safety is not significantly reduced by deferral of the subject SRs.

The administrative change to unit 2 and the editorial correction to unit 1 have no impact.

to AEP:NRC: 1322 Page 17 H. Schedule Requirements I&M requests approval of this request as soon as possible to permit returning the unit 1 EDGs to an operable status.