ML17326B540

Responds to Recommendations Made in 880808 Generic Ltr 88-14 Re Instrument Air Supply Sys Problems

ML17326B540
Person / Time
Site:	Cook
Issue date:	02/24/1989
From:	Alexich M INDIANA MICHIGAN POWER CO. (FORMERLY INDIANA & MICHIG
To:	Murley T NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
AEP:NRC:1075, GL-88-14, NUDOCS 8903090088
Download: ML17326B540 (57)

Text

glcELZRATED DI~BU'IloN DEMo~s~oN SY) TEM REGULATORY INFORMATION DISTRIBUTION SYSTEM (RIDS)

ACCESSION NBR:8903090088 DOC.DATE: 89/02/24 NOTARIZED: YES DOCKET FACIL:50-315 Donald C. Cook Nuclear Power Plant, Unit 1, Xndiana & 05000315 50-316 Donald C. Cook Nuclear Power Plant, Unit 2, Indiana & 05000316 AUTH. NAME AUTHOR AFFILIATION ALEXICH,M.P. Indiana Michigan Power Co. (formerly Xndiana & Michigan Ele RECIP.NAME RECIPIENT AFFILIATION MURLEY,T.E. Document Control Branch (Document Control Desk)

SUBJECT:

Responds to recommendations made in 880808 Generic Ltr 88-14 NOTES:

re instrument air supply sys problems.

DISTRIBUTION CODE: A048D COPIES RECEIVED:LTR OR/Licensing Submittal: Equipment Qualification $ ENCL l SIZE'ITLE:

RECIPXENT COPIES RECXPIENT COPIES ID CODE/NAME LTTR ENCL ID CODE/NAME LTTR ENCL PD3-1 LA 1 0 PD3-1 PD 1 0 STANG,J 1 1 INTERNAL: ARM/DAF/LFMB 1 0 NRR/DEST/ADE 8H 1 0 NRR/DEST/MEB 9H 1 1 NRR/DEST/SGB 8D 1 1 STRACT 1 1 OGC/HDS1 1 1 G FXLE Ol 1 1 RES/DSXR/EIB 1 1

\

EXTERNAL: LPDR 1 1 NRC PDR 1 1 NSIC 1 1 h

D NAZE TO ALt'RIDS" RECIPIEÃZS'LEASE S

HELP US 'IQ REDUCE WASTE! CXNZACZ 'IHE DOQJMEÃZ CNfZR3L DESKi ROOM Pl-37 (EXT. 20079) TO ELQGZATH YOUR NAME FROM DISKKBUTXON LISTS FOR DOCUMEWZS YOU DON'T NEEDE TOTAL NUMBER OF COPIES REQUIRED: LTTR 14 ENCL 10

4 I"'( +('gjb

Indiana Michigan Power Company P.O. Box 16631 Columbus, OH 43216 INWAlNA NECMSAN PQWM AEP:NRC:1075 Donald C. Cook Nuclear Plant Units 1 and 2 Docket Nos. 50-315 and 50-316 License Nos. DPR-58 and DPR-74 INSTRUMENT AIR SUPPLY SYSTEM PROBLEMS AFFECTING SAFETY-RELATED EQUIPMENT U.S. Nuclear Regulatory Commission Document Control Desk Washington, D. C. 20555 Attn: T. E. Murley February 24, 1989

Dear Dr. Murley:

Generic Letter 88-14, "Inst:rument Air Supply System Problems Affecting Safety-Related Equipment," was issued on August, 8, 1988.

The Generic Letter Eollows up on an earlier NRC transmittal, NRC

'Information Notice 87-28 Supplement 1, which identified concerns related to the adverse effects on safet:y-related equipment from instrument air system failures. Generic Letter 88-14 was issued

. to request that each licensee review the earlier NRC transmittals and perform a design and operations veriEication of its inst:rument:

air systems. The purpose of this letter is to provide t:he response to Generic Letter 88-14 with respect to Donald C. Cook Nuclear Plant. Responses to each of the Generic Letter's recommendations are provided in the attachments to this letter.

Specifically, Attachment 1 provides a brief description oE Cook Nuclear Plant's compressed air system (including the control/instrument air system) and the separate diesel generator air system. Attachment 2 is the response to Recommendation No. 1 involving the air quality oE the control air system. Attachment 3 provides the response to Recommendation No. 2 that includes a description of system maintenance practices, emergency procedures and training. Finally, At:tachment 4 addresses Recommendation No. 3 regarding veriEication of design and testing of the control air system.

A review of the attachment:s will demonstrate that emphasis has been placed on the, quality and reliability of the air systen>s at the Cook Nuclear Plant. It: is believed that the existing practices and improvements regarding the compressed air systems are responsive to the NRC's concerns as expressed in Generic Letter 88-14.

S90305'00SS PDR S90224 o<<

P ADOCK 050003i5 l PDC (

Dr. T. E. Murley AEP:NRC:1075 This letter is submitted pursuant to 10 CFR 50.54(f) and, as such, an oath of affirmation is enclosed.

Sincerely, M. . Alexi Vice Presid nt ldp Attachments cc: D. H. Williams, Jr.

W. G ~ Smith, Jr. - Bridgman R. C. Callen G. Charnoff A. B. Davis NRC Resident Inspector - Bridgman G. Bruchmann

COUNTY OF FRANKLIN Milton P. Alexich, being duly sworn, deposes and says that he is the Vice President of licensee Indiana Michigan Power Company, that he has read the foregoing Response to NRC Generic Letter 88-14, "Instrument Air Supply Problems Affecting Safety-Related Equipment," and knows the contents thereof; and that said contents are true to the best of his knowledge and belief.

Subscribed and sworn to before me this Z day of 198+.

NOTARY PUBLIC BARBARA AMM SKWLQ '.~

AZZORHEY AT LAYS VOTARY NVSLIC STATE OR OHIO

$ + COIIIAtfSSIOH HAS HO EXPIRATIOItI DATQ RCTIOII 147.03 A. C, d 4-Ey 4

, '-.<j I' r,

lh

. J

,W II ~ p) 1 " P gpss

'ac~~

h r

Pfh

, pie~

v.,

Qv I'

ATTACHMENT 1 TO AEP:NRC:1075 DESCRIPTION OF THE COMPRESSED AIR SYSTEM AT THE COOK NUCLEAR PLANT

I to AEP:NRC:1075 Page 1 COMPRESSED AIR SYSTEM CAS A brief description of the compressed air system, which includes the control air system (also known as the instrument air system), is provided in this attachment for a better understanding of this response to Generic Letter 88-14. A simplified schematic diagram of the CAS for both units of the Cook Nuclear Plant is attached. In addition, the air system for the emergency diesel generators, which is a separate system from the plant's CAS, is described at the end of this attachment.

The intended functions of the CAS are:

1. The system must provide reliable compressed air supplies for control and instrument air requirements.

2. The system must provide adequate compressed air capacity for:

a ~ General Plant Service

b. Control C. Instrumentation Testing

e. Containment Penetration and Weld Channel Pressurization System Respiratory protection in the containment per compressed gas association commodity Spec. G-7.1 1966 and OSHA Standards and Interpretations 1910.134.

3. The system should provide a continuous supply of compressed air to vital systems under both normal and abnormal conditions, although no credit is taken for the system in the Cook Nuclear Plant's Final Safety Analysis Report.

B. Com onent and S stem Desi n

1. Compressors and Associated Equipment The CAS is designed to provide a reliable supply of compressed air for all plant uses. The CAS has two, oil-free, constant speed, 3-stage, motor-driven centrifugal plant air compressors (PACs) that provide about 1500 scfm of compressed air each at a discharge pressure of 100 psig at an inlet temperature of 90 0 F. During normal operation, only one PAC is in operation, supplying the demand for all plant air (including breathing air) and control/instrument air for the

Ia fl II' ~ L~

1 I to AEP:NRC:1075 Page 2 entire plant. A 100% reserve capacity is, therefore, provided by the standby PAC. To prevent problems associated with moisture 'and oil in the CAS, the compressed air must be relatively moisture- and oil-free. In addition to using "oil-free" compressors, each compressor has been provided with an aftercooler, which includes a moisture separator.

The aftercooler maintains the temperature of the compressed air that is supplied to the receivers below 95 F. The increased air moisture content, resulting from aftercooling, is removed by a cyclone-type separator. A plant air receiver is located downstream of each aftercooler. The air receivers accommodate sudden or unusually heavy demands for compressed air and prevent compressor surge ~

The two "oil-free" control air compressors (CACs), one per unit, are constant speed, motor-driven, double acting, water cooled, vertical, reciprocating compressors that provide about 317 scfm of compressed air at a discharge pressure of 100 psig with an air inlet temperatur'e of 70 F. Each CAC is also capable of supplying air to the containment penetration and weld channel pressurization system for its unit. Each CAC discharges through an aftercooler to a wet control air receiver. If both plant compressors are unavailable, low air pressure at each unit's wet control air receiver will automatically start both CACs. The CACs will run at a regulated, constant speed until stopped by the operator.

The CAS has two parallel 100% capacity dry control air receivers and upstream strings of prefilters, air dryers, and after filters, thus assuring clean, dry air for instrument and control air usage. Each dryer consists of dual adsorption towers filled with a silica gel desiccant. The compressed air is dried as it passes through the desiccant be'd of the adsorption tower. Two parallel 5-micron prefilters and two parallel 5-micron after filters are located before and after each dryer to prevent contamination of the dryer desiccant (moisture and pipe scale carry-over) and to protect the instruments and controls against desiccant dusting.

The control air system includes sufficient storage capacity to supply the control and instrument air requirements with the equivalent of approximately 5 minutes of control air output. Additionally, certain vital control valves within the containment are each equipped with a local receiver tank with enough capacity to activate the valve. Also, with operator action, all air compressors and their dryers can be supplied with electric power from normal, offsite and emergency sources.

N II g

I Sp ~ =,

~ QN I

V 4

~v,t Jlfp fQ S l, 1

C C

~ 7 +

4 \ ~ ~

.- i LI I I ~ 4 to AEP:NRC:1075 Page 3

2. Compressed Air Distribution System Compressed air is supplied to Units 1 and 2 through an air distribution system located in the turbine, auxiliary, and containment buildings. This distribution system consists of a shared plant air ring header extending throughout the turbine building, a pair of parallel plant air headers in the auxiliary building, and a plant and control air header in each containment. One PAC, plant air receiver, and plant air aftercooler is located in each unit. Each plant air receiver supplies its own plant air header in the auxiliary building; however, the shared turbine building plant air header may be supplied from either plant air receiver. The turbine building ring header, in turn, supplies compressed air to the s'tandby plant air header in the auxiliary building. Since these distribution headers are parallel and have hose connections in essentially the same location, one unit's header may be isolated from the CAS without affecting the availability of plant air to the auxiliary building.

Compressed air is then delivered to the header branches that feed the services requiring compressed air (e.g.,

screenhouse, service, turbine and auxiliary buildings).

Redundant containment isolation valves are provided on the instrument and control air headers going into both containments.

3. Piping, Valves and Pressure Vessel Design All CAS equipment, piping, and valves are Seismic Class III with the exception of the Seismic Class I portion at the containment penetrations.

CAS equipment (e.g., receiver, dryer tanks, aftercoolers, and filter housings) has been designed and built in accordance with the ASME Boiler and Pressure Vessel Code, Section VIII'riteria.

4. Cooling Water for Compressed Air System The non-essential service water system (NESW) provides cooling water for the CAS. Two or three of the four pumps of the NESW system are normally operated to provide service water to the two units, with one or two pumps held in standby. All four pumps are able to take suction from either the Unit 1 or Unit 2 circulating water intake or discharge tunnels. Thus, if the tunnels of one unit are out of service, NESW supply to both units is ensured. Following a loss of all off-site power, the NESW pumps are automatically started after the emergency diesel generator power becomes available. Under these conditions, the pumps are primarily used to supply cooling water to the CACs in order to restore

i H

to AEP:NRC:1075 Page 4 control and instrument air service. All motor-operated valves on the NESW systems are operated from the station battery system. Cross-ties between the pumps permit any one pump to supply the initial blackout requirements for both units. The flexibility of design indicated above ensures a ready supply of cooling water to the Control Air System components.

The plant air quality complies with the OSHA standards for respiratory use. Compressed air for respiratory use inside containment is provided within the containment pipe annulus.

At this location, fittings are provided for connecting air masks to the plant air system.

D. Maintenance and Testin The plant also has an active inservice testing (IST) program under which safety-related valves are periodically tested.

The portion of the IST program relevant to GL 88-14 is discussed later in this submittal. Safety-related, air-operated valves are only used at the Cook Nuclear Plant when the failure mode is also the desired post-accident condition.

II. EMERGENCY DIESEL GENERATOR STARTING AIR SYSTEM The intended functions of the starting air system (SAS) for the emergency diesel generators (EDG) are:

1. The system must provide redundant compressed air for starting the diesel engine of the EDG.

2. The system must provide adequate compressed air capacity for:

a. The engine of the EDG to start, accelerate up to speed, and be ready to accept EDG load within from the initiation of the start signal ten'econds Other compressed air needs, i.e., control air and power for pneumatically operated valves in the system and for the flywheel air jack (turning gear).

d kl 4'

I 4fh N p ~

4P t ll ' I< v ~

~

'lo 4 'I I s ~ ~

'I ' tf A

f I I >) r

~

\

I ~ ~ ~

I 1 A "> %o t

t 1'Si

\

k to AEP:NRC:1075 ~

Page 5 B. Com onent and S stem Desi n

1. Compressors and Associated Equipment and Air Distribution System Each engine has its own SAS that is totally independent of the plant CAS. Each system consists of two redundant air supply trains having a compressor, receiver, starting air supply valve and controls. Each supply train is capable of starting the engine. The two trains are cross-tied at the engine starting air manifolds. There is a check valve at the end of each train just upstream of the cross-tie line to prevent backflow should one supply train fail. Each train supplies air through an air-operated starting supply valve and a check valve. Additionally, an air-operated turbo jet assist valve enables the "fast" start of each engine on demand. The air supply to the turbo jet assist valves is through pressure regulators. The jet assist valves automatically open for the fast start.

As stated earlier, two starting air supply trains serve each engine. Each train consists of an air receiver to store the pressurized starting air and a motor-driven air compressor to maintain the air receiver pressure within a range of 220 and 240 psig. There is a cross-tie containing a manual valve between the two compressor discharge pipes. This valve is normally closed to isolate the two starting air supply trains. If, however, one of the air compressors is out of service, the valve will be opened by operator action to keep both air receivers properly pressurized.

The above redundancies in the compressors and their associated equipment as well as the supply and distribution lines of the SAS ensure adequate starting air for the EDGs.

Finally, since the emergency diesel generators are normally in a standby mode, the supporting starting air system compressors are operated only to maintain the associated air receivers charged to full pressure to ensure a fast starting capability. Given this intermittent operation, syst: em air quality testing is not appropriate and is, therefore, not addressed in Attachment 2. Further, since diesel generator operability is addressed in the technical specification surveillance requirements, the maintenance practices for the dryers and compressors are included in the plant's Preventive Maintenance Program. They are, therefore, not described further in Attachment 3. The starting air supply valves and turbo jet assist valves described above are further discussed in Section C.5 of Attachment 4.

II U~

to AEP:NRC:1075 Page 6

2. Piping, Valves and Pressure Vessel Design The equipment and instrumentation in the starting air system is supplied by the diesel engine manufacturer, and is arranged and maintained in accordance with the manufacturer's recommendations.

The system equipment and piping are Seismic Class I. The exceptions are (1) the air compressors and their discharge piping to the first check valves, and (2) the line from the air jack to its root valve, which are Seismic Class III.

3. Electrical Power Supply The only motors requiring electrical power in the diesel engine starting air" system are the two air compressors serving each engine. The compressors are not needed during an engine start-up.

The several solenoid valves within the Worthington engine control module receive their power from the 250-volt DC circuit that supplies the diesel engine I control bus. This 250-volt DC circuit remains energized during a blackout. The solenoid valves control the air signals to the starting air supply valves, jet-assist valve, and throttle shutdown cylinder. These air signals control the starting and stopping of the engine.

r

'I II

~ !%~A I' V II II II i'

I t

Spy $3>AI

<<g)~'S~ >l~

~

gi .l x l

.,a4

<I:

LN,,

/I g l

~ t

~ 4 Vt

~ ~

r I

ATTACHMENT 2 TO AEP:NRC:1075 RESPONSE TO RECOMMENDATION 41 OF GENERIC LETTER 88-14 to AEP:NRC:1075 Page 1 I'ECOMMENDATION ¹1 - "Verification by test that actual instrument air quality is consistent with the manufacturer's recommendations for the individual components served."

II. RESPONSE

~Summa'anufacturers assume that their equipment will be provided with instrument quality air (in accordance with ANSI/ISA S 7.3-1975). Periodic sampling for dewpoint and hydrocarbons, combined with the filter arrangement and periodic delta-P monitoring in the plant and control air systems ensure that air of the proper quality is being supplied for

'afety-related equipment, as well as for important balance-of-plant equipment. Consistent with ANSI/ISA S 7.3-1975 and associated Regulatory Guide 1.68.3,- elements of the air quality program include:

i) maximum allowable moisture content, ii) maximum entrained particle size, iii) maximum allowable oil content, iv) awareness of possible corrosive or toxic contamination entering the air system.

A. Deweoint ANSI/ISA S 7.3 allows the dewpoint to be as high as 18 F below the minimum temperature to which any part of the instrument air system is exposed at any time of the year.

Presently, air moisture is sampled at the Cook Nuclear Plant at the dry control air receiver tanks weekly. The dewpoint values have been satisfactory with respect to ANSI/ISA' 7.3, based on performance and test records available at the Cook Nuclear Plant.

In addition, the existing "Air Dryer Performance Test Procedure" uses the moisture content in the air at rated flow and pressure to determine equipment status, maintenance needs and operating efficiency of the instrument/control drying system. A modified program, which has been under development since the summer of 1988 and informally implemented, has been successful in identifying air dryer components susceptible to failure. This "Dryer Monitoring Program," which includes regularly scheduled replacement of certain components and the weekly dewpoint monitoring, will result in planned maintenance on the dryers rather than reactive maintenance.

The Air Dryer Performance Test Procedure will be revised to become the Dryer Performance Monitoring Program, thereby moving the emphasis away from "acceptance" testing and towards enhancement of reliability.

t

.I I

t N

1 v

t I

4 to AEP:NRC:1075 Page 2 B. Particle Size ANSI/ISA-S 7.3 specifies that "the maximum particle size in the air stream at the instrument shall be three (3) micrometers (microns)." The two trains of control air dryer after-filters at the Cook Nuclear Plant have a rated particle retention size of five (5) microns. There is no filter bypass. Additionally, pressure reducing station filters located downstream of the after-filters are rated as "removing 988 of all particulate matter greater than 0.07 microns." The control air to containment does not pass through this additional set of filters. An engineering analysis comparing instrument orifice sizes and dryer post-filter sizes was, however, completed in response to INPO SOER 88-01. This determined that the five-micron rating of the after-filters was adequate for protecting air quality for the air-operated equipment inside containment.

Particulate sampling is not currently being performed. Based on an engineering review of the maintenance history at Cook Nuclear Plant, documented in response to NRC IE IN 87-28, particulate sampling is not considered to be warranted at this time. Monthly differential pressure (delta-P) measurements are, however, being taken across the dryer after-filters as part of the Preventive Maintenance (PM)

Program. Higher than normal readings would be indicative of unusual particulate or other loading of these filters. This program calls for the periodic monitoring and changeout of filter elements (including those in the pressure reducing stations) on a scheduled basis, before any significant deterioration can. occur.

Pre- or after-filters would be replaced if filter delta-P as found during monthly testing approaches 12" H O. The plant has not observed/recorded any evidence thai the delta-P across these filters had ever approached 12" H 0.

The dryer desiccant charge is replaced on an annual basis' This preventive maintenance is considered adequate to prevent particulate carryover into the CAS, based on manufacturers'ecommendations.

By way of specific operating history, the after-filters were replaced in April 1988 as part of the PM program, and delta-P monitoring was instituted to track the "loading" of the dryers and filters. The differentials started out at, and remained at, between 1 and 2 inches of water, with no apparent loading of the filters after 8 months of operation.

4

~ N II V ~

h V *St << ~

~ I to AEP:NRC:1075 Page 3 Future operating history and test data of filter loading will be used to adjust the current monitoring program, as necessary.

The Cook Nuclear Plant dryers are of the down-flow design, which tends to compact the desiccant rather than keep suspension. This design feature results in minimizing it in desiccant dusting from the dryers and subsequent loading of the after-filters. The plant site has not observed/recorded any evidence of contamination of the control air system from desiccant carryover.

C. Oil H drocarbon Content Both sources of instrument/control air (the 2 centrifugal plant air compressors and the 2 reciprocating control air compressors - one for each unit) are of the "oil-free" type.

The discharge of the plant air compressors is sampled on a monthly basis. This is performed in accordance with an established plant procedure to verify that the plant air system meets the requirements of OSHA CG A Type 1, Class D, "Breathing Air Supply." Analysis is performed by an offsite laboratory. The maximum allowable combined oi), mist, and hydrocarbon level under this Standard is 5mg/m The maximum level of oil content allowable in the instrument/control air system per ANSI/ISA S 7.3 is 1 ppm (w/w). The composite oil, mist and hydrocarbon content of the plant air3has been analyzed to date as typically less than 0.2 mg/m (- 0.16 ppm w/w). Since control air is drawn from the plant air system without the introduction of additional contaminants, it follows that the oil content in the control air stream also complies with the Standard. The plant's sampling procedure requires notificatign of the Plant Technical Engineering Department if the 5 mg/m limit for breathing air is exceeded, so that the necessary corrective actions could be taken. No evidence exists of this limit having been exceeded.

D. Corrosive or Toxic Contamination The air compressor intakes are located in the turbine building. Test results confirm that significant levels of contaminants are not entering the air stream.

0 r ~ s k

I l,e a

ATTACHMENT 3 TO AEP:NRC:1075 RESPONSE TO RECOMMENDATION C2 OF GENERIC LETTER 88-14

II I h,

ll I't

& <i~

'I

~ . \

4 q ~ ji II ~

I'A to AEP:NRC:1075 Page 1 I. RECOMMENDATION ¹2 - "Verification that maintenance practices, emergency procedures and training are adequate to ensure that safety.-related equipment will function as intended on loss of instrument air."

II. RESPONSE

~Sunun az The maintenance practices, emergency procedures and training at the Cook Nuclear Plant are considered adequate to ensure that safety-related equipment will function as intended on loss of instrument or control air.

A. Maintenance Practices Maintenance and post-maintenance activities must be adequate to ensure that safety-related equipment will function as required on loss of air. This requires that (1) maintenance on safety-related equipment and components be controlled, and (2) post-maintenance testing verify appropriate failure modes when considered necessary.

To satisfy these requirements at the Cook Nuclear Plant, a Job Order or approved instruction/procedure is required for all work on safety-related or safety-interface components. A Job Order is" initiated whenever corrective maintenance (repair) is necessary for equipment, as well as when initiating modifications to equipment. A supervisory review by the department initiating the Job Order is also required to determine if the activity, or affected equipment, is Technical Specification (T/S) related. If so, the Job Order is appropriately marked to document the T/S impact and required post-maintenance testing. This information is again reviewed in the department assigned to accomplish the repairs or modification. Completion of required post-maintenance testing is also documented and attached to the Job Order itself.

r Post-maintenance/modification testing requires the coordination of several groups, generally Operations (OPS),

Instrument & Control (I&C), and Maintenance personnel. For situations dealing with air-operated, safety-related valves, Cook Nuclear Plant's operators use a special "Operations Standing Order" (OSO) that delineates actions to ensure proper inservice inspection timing for valves, both for routine and post-maintenance testing. This OSO also delineates specific examples of work after which post-maintenance testing is required. The Cook Nuclear Plant I&C Department's written policy is that "Post-Maintenance Testing shall be used to verify that equipment is repaired, operates correctly, and performs its desired function." The

I g R -+If to AEP:NRC:1075 Page 2 policy also addresses temporary and permanent modifications and requires that post-modification testing be performed depending on the work/adjustments made. A design change implementation also often entails pose-installation testing of safety-related equipment and components. The existing design process identifies all test requirements in accordance with a control valve specification for the fail-safe testing after a design change is performed. Routine fail-safe testing is performed in accordance with appropriate surveillance procedures. These procedures are derived from the Technical Specifications or the second ten-year Inservice Testing Program submitted to the NRC in 1987.

B. Emer enc Procedures Expected system and plant responses to a loss of instrument air are provided in the Cook Nuclear Plant emergency operating procedures for loss of control air and annunciator response procedures for plant systems. These emergency procedures include both automatic and required manual responses expected upon a reduction in control air system pressure. In addition, operating procedures for each unit specifically address responses to a loss of control air.

These procedures list symptoms of air supply loss and identify the failure positions of key air-operated valves upon a complete air loss. In addition, the procedures direct operator action to trip the unit and begin a cooldown when the 100 psi control air header decreases to 80 psig.

Subsequent operations are in accordance with the established emergency procedures for "Reactor Trip or Safety Injection" and "Reactor Trip Response" as applicable.

The combination of the existing emergency and operating procedures is considered to adequately address GL 88-14 in relation to the functioning of safety-related equipment on loss of instrument air.

C. T~ra1nin Emphasis on the importance of the instrument air system has been included in training for Maintenance (Mechanical Maintenance) personnel by including the recommendations of INPO's SOER 88-01 in a related lesson on Plant Air Systems.

The importance is also stressed in the system training lesson plan for I&C personnel, which also includes specific problems of air systems mentioned in SOER 88-01 and NRC IN 87-28.

Operator training (utilizing INPO SOER 88-01 and NRC IN 87-28) has sensitized the Cook Nuclear Plant's operators to the importance of air systems and illustrated problems caused when air systems are contaminated or neglected. This training also serves to familiarize the operators with the to AEP:NRC:1075 Page 3 expected plant responses on a loss of air. Non-licensed plant operators, operators preparing to take an NRC licensing exam and licensed operators in the requalification program participated in classroom training in 1988 on loss-of-air.

Simulator training on a loss-of-air scenario is planned for 1989.

ATTACHMENT 4 TO AEP:NRC:1075 RESPONSE TO RECOMMENDATION ¹3 OF GENERIC LETTER 88-14.

C I~

~,

to AEP:NRC:1075 Page 1 I. RECOMMENDATION ¹3: "Verification that the design of the entire instrument air system including air or other pneumatic accumulators is in accordance with its intended function, including verification by test that air-operated safety-related components will perform as expected in accordance with all design-basis events, including a loss of the normal instrument air system. This design verification should include an analysis of current air-operated component failure positions to verify that they are correct for ensuring required safety functions.

II. RESPONSE

~Summau The functions and design of the CAS and the emergency diesel generator starting air system at the Cook Nuclear Plant are described in Attachment 1 to the letter. The operating history of systems as well as the results of inservice or surveillance testing, indicate that the systems and their individual components can be expected to perform their intended safety-related functions. Further, the safety-related, air-operated valve failure positions have been verified to be correct during development of the Inservice Testing Program. The description of testing practices represent current commitments and may be changed to address future changes to the requirements without changes to this submittal in response to NRC GL 88-14.

A. Function of Air S stems The CAS is designed with flexibility and reliability in mind, but it is not essential for the fulfillment of any safety function described in the Updated Safety Analysis Report.

The functions of the CAS and the emergency diesel generator startup air system are described in Attachment 1.

B. Desi n of Air S stems The design of the CAS and the SAS are described in Attachment 1. As indicated therein, the systems are capable of fulfilling their intended design functions. The SAS design was initially verified by'pre-operational testing.

Operability is demonstrated by the monthly running of the diesel generators in accordance with Technical Specification requirements.

The CAS has also performed well with no significant events attributable to failure of the control air system. The design and operation of "oil-free" compressors, filters, dryers, and receivers has contributed to a reliable air supply system. The use of welded stainless steel piping and

~ I h

~

f ~ t

\ . I It I I f V

jf Vt 4 ~

i V j~

II I

~ 4 I VV -J ~ f . I

~ j Vl I ~

~

' ~

j ~ I V V 4 ~ ~

\~ V\ ~ I

~ 4, VV 4~ V~

VL- ~ V to AEP:NRC:1075 Page 2 brazed copper tubing in the instrument and control air system has also reduced the risk of corrosion products adversely affecting the air system downstream of the filters.

C. Desi n Verification Testin This section identifies the types of testing performed on the CAS and the emergency diesel generator starting air system for the purpose of verifying that the systems can perform as intended. Included is a description of the pre-operational testing, preventive maintenance, fail-safe testing and inservice testing programs as applicable to these systems.

1. Pre-operational Testing Cook Nuclear Plant performed rapid and slow bleed down tests on the CAS in January 1975 and December 1977 on Units 1 and 2, respectively, with the results meeting the requirements of U.S. NRC Regulatory Guide 1.80. Testing was conducted in accordance with the Plant Loss of Instrument Air Pre-Operational Test Procedures.

2. Preventive Maintenance Program The PACs, CACs, control air dryers, pre- and after-filters, and individual control air header filters are included in the plant's Preventive Maintenance Program. The program identifies the one- and five-year inspection requirements of the equipment as well as the relevant maintenance procedure.

The one-year maintenance requirements are based on the manufacturer's technical manual and include 17 distinctive steps for inspection of the various parts and associated control functions of the CAC and 26 steps for the PAC. The five-year inspection/maintenance requires complete disassembly and inspection of components. The most recent inspection/preventive maintenance performed on the various CAS equipment is as indicated below.

Air Com ressors Control Air Dr er S stem

~Annual 1 Five Year M~onthl A~nnuall Pre- and Individual Suction After- Header CAC PAC CAC PAC Filter Filters Filters Ul 10/21/88 3/18/88 2/4/87 11/18/86 1/24/89 4/12/88 4/12/88 U2 10/28/88 1/21/89 12/11/87 12/9/87 1/19/89 5/4/88 5/4/88

,) I', '4 lt I

I' t

kI t It I

to AEP:NRC:1075 Page 3 In addition, a specific Operations Head Instruction requires monthly running of the standby CACs and the PAC for four hours (if not previously run during the month) to check mechanical operations.

3. Fail-Safe Testing of Safety-Related Pneumatic Equipment Fail-safe testing of virtually all of Cook Nuclear Plant's

'air-operated, safety-related pneumatic equipment is accomplished either as a result of the Inservice Testing/Inspection (ISI) Program or the Technical Specification (TS) surveillance testing program. The few exceptions are discussed under the Section C.5 below. With respect to testing frequency, ASME Section XI requires

'quarterly testing of a valve's safety function under the fail-safe condition. The Cook Nuclear Plant's containment isolation valves are, for example, tested under this quarterly frequency; however, Technical Specifications impose a monthly test frequency for most of the valves within Section XI.

The safety-related, air-operated valves and dampers at Cook Nuclear Plant fail to their actuated position when air is removed from (or lost from) the pneumatic actuators.

Fail-safe testing is accomplished by de-energization of a control air solenoid associated with each particular component. When the solenoids are de-energized, component motion to the actuated position is checked and timed (timing only applies to valves in the IST program). Cook Nuclear Plant's ISI personnel review and trend valve timing data determine which valves are not properly operating. These valves then undergo testing at an increased frequency or are repaired, if required. Fail-safe testing is also completed following any maintenance activity that potentially impacts valve performance. This was discussed earlier under Maintenance Practices in Attachment 3.

The plant's discrepancy reporting and job order system address the preventive and corrective actions with respect to failures of other pneumatic equipment. Failure positions of equipment other than valves, (e.g., air-operated dampers) were verified separately for this Generic Letter under C.6 below.

4. Inservice Testing Program This section provides a description of the Inservice Testing Program that applies to the concerns of Generic Letter 88-14.

Specifically, the testing program and test results for the air-operated valves, dampers and accumulators are presented.

In addition, exceptions to the performance of fail-safe testing on certain air-operated equipment are provided following this section.

'I It I 1 I 4 s II to AEP:NRC:1075 Page 4

a. Valve Testing (General)

The Inser'vice Test Program (ISTP) for valves, as submitted to the NRC for the second ten-year inspection interval (Reference AEP:NRC:0969H dated October 5, 1987), commenced on August 23, 1985, and July 1, 1986 for Units 1 and 2, respectively. This valve test program is in accordance with Subsection IWV of Section XI of the 1983 edition of the ASME Boiler and Pressure Vessel Code through summer 1983 addenda, except for specific relief requests identified in the valve summary sheets of the program. The program includes the testing of all valve types (e.g., relief, safety, check, butterfly, gate, globe, diaphragm, etc.), and provides for the different valve actuator types (self-actuated check or relief, motor operated, air operated, solenoid operated, etc.). A valve summary sheet is used to identify the unique valve number as well as the valve position during both normal and post-accident plant operation. The sheets also indicate the primary test required by the code, the actual test performed, and the Technical Specification operating mode.

The discussion that follows applies only to air-operated safety-related valves as addressed by GL 88-14.

b. Valve Testing: Specific Response to Generic Letter 88-14 In order to respond to GL 88-14, a list of the safety-related air-operated valves in the Cook Nuclear Plant (188 in Unit 1 and 190 in Unit 2) was developed by reviewing the appropriate Cook Nuclear Plant drawings and updated FSAR Section. These valves were segregated according to the following:

1) Valves necessary to mitigate the consequences of postulated design bases accidents.

2) Valves expected to change position in response to a postulated accident as a result of an engineered safety features (ESF) actuation and not merely serve as a pressure boundary (such as pressurizer or steam generator PORVs). Note that, with a few exceptions, the fail-safe (loss of air) position is the "actuated" position, and these are discussed in C.5 below.

The safety-related, air-operated valves at Cook Nuclear Plant fail to their actuated position when air is removed from (or lost from) the pneumatic actuators. Periodic fail-safe testing is accomplished by de-energization of a control air

5 I

to AEP:NRC:1075 Page 5 solenoid associated with each particular component as discussed earlier in Section C.3 of this attachment. This type of approach confirms the fail-safe function upon loss of power. It can also be concluded that this method verifies the loss of control air safety function by isolating the control air inlet flow path to the component and bleeding off air in the component actuators. Cook Nuclear Plant's ISI personnel review and trend valve timing data and determine which valves are not operating as expected. These valves then undergo testing at an increased frequency or are repaired as necessary. In specific response to the Generic Letter, the Cook Nuclear Plant's ISI personnel also reviewed the existing practice for evaluating the test results, and the bases for terminating increased frequency of surveillance.

The review took into account significant performance attributes such as (1) control air solenoid valve conditions, (2) actuator diaphragm conditions, (3) limit switch adjustments, (4) actuator stem/valve stem coupling security, and (5) test parameters (including speed). This review by ISI personnel concluded that operating experience for the control air system has not indicated a problem to date due to valves failing to move to the safe condition on loss of air. However, the

'Cook Nuclear Plant has noted that ASCO solenoid valves have failed on occasions and it is recognized that this is an industry problem (reference: NRC IN 88-43), attributable to the valve diaphragm hardening. The Cook Nuclear Plant has a replacement program for these valves, by which they are rebuilt to ensure the proper functioning of these valves.

c. Valve Test Results Unit 1 With the exception of seal leak testing on 10 valves scheduled for testing during the refueling outage in 1989 and those identified later under "Exceptions to Fail-Safe Testing," all 188 Unit 1 safety-related, air-operated valves were tested last in November 1988 (176 valves) and January 1989 (remaining 12 valves). Additionally, the latest testing of the diesel generators and their supporting startup air systems was conducted in February 1989 (D/G AB on February 20, 1989, and D/C CB on February 9, 1989).

V VVVV ~ g l v 11 V 14 I I 1 9 ~

to AEP:NRC:1075 Page 6 Unit 2 All 190 Unit 2 valves (with the exception of those discussed under "Exceptions to Fail-Safe Testing" ) were last tested in March 1988 (50 valves), April 1988 (2 valves) and during the Steam Generator Replacement outage (138 valves).

Additionally, the latest testing of the diesel generators (D/Gs AB and CD) and supporting startup air systems was conducted on February 13 and 20, 1989, respectively.

5. Exceptions to Fail-Safe Testing of Safety-Related Equipment and Components The safety-related equipment and valves identified below are not fail-safe tested. The reasons and justifications for these exceptions are discussed below:

Virtually all of the safety-related, air-operated equipment fails to a safe position via solenoid action. The only exceptions are valves WRV-721 through -728; 1 and 2 XRV-221,

-222, and -226 and -227; 1 and 2 ZRV-220 and -225; and 1 and 2 CRV 470. The three-way regulating valves (WRV-721 through WRV-728) are located in the essential service water supply lines to the emergency diesel generators air aftercoolers.

They regulate water flow to maintain the temperature at which the aftercooler air*discharge thermostatic controller has been set. These valves are normally open and fail-safe open.

They remain in service following an ESF actuation to regulate water flow. The valves cannot be stroke timed because they are thermostatic valves whose position is controlled by process fluid temperature and there is no external control available. A code relief request note on the testing requirements was submitted to the NRC under the inservice testing (IST) program for valves as an attachment to .our letter to the NRC, AEP:NRC:0969, dated October 5, 1987.

It was discussed during this review for GL 88-14, that the valves WRV-721 through -728 have not been fail-safe tested as stated in the IST program for valves. Appropriate corrective action is being taken to evaluate and rectify this deficiency.

The reasons for the code relief request are that (1) these valves function only as regulating valves and not open/closed valves, (2) these valves are demonstrated operable during diesel generator testing (diesel generators are tested on a staggered basis every 31 days per Technical Specification 4.8.1.1.2), and (3) these valves are demonstrated operable during-diesel generator 24-hour runs performed each refueling outage. The valves will be "fail-safe" -tested during refueling outages. These valves on Unit 2 (WRV-722, 724, 726 and 728) were last tested for proper functioning in

', p ~ II to AEP:NRC:1075 Page 7 January 1989 during the refueling outage. The valves on Unit 1 (WRV-721, -723, -725 and -728) were last tested for proper functioning in January 1989 during the diesel generators'onthly surveillance running.

Additionally, the following air-operated valves are tested, as required by the code, under the Inservice Testing Program for valves, for oper'ability (i.e., exercised full stroke) every three months but are not fail-safe tested for the .

reasons discussed below. Also, a code relief request for not performing the required stroke time testing of 10 seconds was made under the Cook Nuclear Plant's Inservice Testing Program for valves submitted to the NRC in October 1987 (letter to the NRC, AEP:NRC:0969).

The EDG turbo assist valves, XRV-220 on engine AB of each unit and ZRV-225 on engine CD of each unit are normally closed and fail closed. They are required to open when the EDGs start since turbo jet assist is necessary to satisfy the fast start (10 seconds) capability of the EDGs, Testing of the turbo assist valves to verify their safety-related actuation is, therefore, conducted when the EDGs are Technical Specification surveillance tested on a 30-day staggered test basis. Given that the safety function of the turbo assist valves is to open, no fail-safe testing is necessary for these valves. In addition to the code required operability test stated above, these valves are also exercised (with fail-safe actuators) every three months in compliance with the code. These code tests were last performed on a staggered basis on both valves of both engines in January 1989.

The EDG starting air supply valves, ZRV-221 and XRV-222 on engine AB of each unit and XRV-226 and XRV-227 on engine CD of each unit. These normally closed valves fail "as-is" and are demonstrated operable on every other EDG Technical Specification surveillance test, (see Section 4.8.1.1.2).

The testing for each valve is conducted during the EDG start by isolating the accumulator associated with each of these valves on an alternating basis once per quarter. If valves were to fail in other than the closed direction, the these EDG would start. For these reasons, and since these valves fail "as-is", no fail-safe testing is performed. The code required operability testing of these valves every three months, as stated above, was last performed as follows:

Unit 1, AB diesel engine in November 1988, and CD engine in January 1989.

Unit 2, AB diesel engine in January 1989, and CD engine in November 1988.

CJ I

t

'p p

p Il ~ 'I t

h

'I t ~ t<

p h il tt h

Il C N p h

hip>'k t p t I

p t

4' P I I I L i p to AEP:NRC:1075 Page 8 Component cooling water valves 1 and 2 CRV-470. A code relief request (AEP:NRC:0969H) has been made under the IST valve program for air-operated valves 1- and 2-CRV-470, which are located in the component cooling water (CCW) return from the letdown heat exchanger of each unit. These valves control the temperature of the letdown flow leaving the heat exchanger. These valves cannot be "fail safe" tested nor stroke timed since no control switches are installed to perform those tests. These valves are full stroke exercised quarterly. These valves were last full stroke exercised in January 1989 and December 1988 on Units 1 and 2, respectively.

An additional piece of equipment for which fail-safe testing is not performed is the governor for the turbine driven auxiliary feedwater pump (TDAFP). Although fail-safe testing on this equipment is not performed, the TDAFPs are exercised monthly in Modes 1, 2, and 3 using the associated unit's TDAFP test procedures. In addition, any controlability problems with the governor could be overcome by using the control room tripping capability and/or local manual control.

Motor-operated valves (MOVs) in the discharge of this pump would also enable the operators to 'throttle the TDAFP flow to the steam generators. All these factors were evaluated as a result of the NRC's IE Inspection Reports 50-315/86-13 and 50-316/84-15, and fail-safe testing of this component was not considered warranted.

6. Safety-Related, Air-Operated Dampers Testing There are 12 safety-related, air-operated dampers which are surveillance tested on a monthly basis in accordance with a Plant Operation Head Technical Specification Surveillance Test Procedure. These include six dampers (3 for each train 1-HVAES-1Dl through 1D3 and 1-HVAES-2Dl through 2D3) for Unit 1 in the auxiliary building ESF ventilation system. Six other dampers serve a similar purpose for Unit 2. The first two in each train are normally open and bypass the charcoal filters, and fail-safe to close. The third damper (i.e.,

1-HVAES-1D3 and 1-HVAES-2D3), which is normally closed, is on the face of the charcoal filter on each train and it fails safe open. The dates that these dampers were last tested are January 15 and January 28, 1989, for Units 1 and 2, respectively.

7 ~ Pneumatic Accumulators Design Verification In response to NRC IN 87-28, a review was conducted of air-operated valves equipped with air accumulator bottles.

The review took into account pre-operational test procedures for loss of instrument air (both units), the plant's previous safety-related design changes, system descriptions, flow

O I I lj I ~

I l H I U

~ I I '

, jj i I I II, I'

H 4 U U . U H

H ~ I

gP Attachment 4 to AEP:NRC:1075 Page 9 diagrams, physical drawings and AEPSC's response to NRC IN 85-35 (" Failure of Air Check Valves to Seat" ). Both safety-related and non safety-related accumulators were identified during the review.

The system valves identified as having permanently installed, non safety-related air accumulators were: condenser steam dump valves (URVs); feedwater regulating valves (FRVs); non essential service water (NESW) supply and return containment isolation valves (WCRs); ice condenser glycol supply and return containment isolation valves (VCRs); and containment ventilation supply and exhaust containment isolation valves (VCRs). Upon loss of control air, the above valves go to their fail-safe position which is closed. The URVs are non safety-related. Since the safety function of the FRVs, WCRs, and VCRs is to close, the air accumulators do not provide back-up to perform that safety function. The concerns of Recommendation ¹3 to Generic Letter 88-14, therefore, do not apply to these valves.

The review also included verification of the adequacy of safety-related air-operated valves for the functioning of pressurizer power operated relief valves PORVs while in Mode 5 for low temperature/overpressurization protection (LTOP) of the reactor vessel and the RCS. One set of safety-related air-operated valves, NRV-152 and -153 (pressurizer power-operated relief valves (PORVs)) are equipped with backup air accumulators as well as with air storage receivers. The operability of the PORV accumulators is verified periodically in accordance with .Technical Specification requirements.

Air storage receivers were also identified on the emergency diesel generator starting air system, which is described in Attachment 1. The starting air system is tested periodically in conjunction with emergency diesel generator testing required by the Technical Specifications.

The review conducted for NRC IN 87-28 concluded that the non safety-related air receivers provided in the plant are adequate for operational consideration. Further, the LTOP redundant air supply is considered adequate to assist the PORVs to open within the required LTOP stroke time and remain functional during or after an OBE (operational basis earthquake). Finally, the emergency diesel generator starting air system receivers are of an adequate design as verified by pre-operational testing and functionality of the system is demonstrated by the monthly surveillance testing.

.) to AEP:NRC:1075 Page 10 D. Verification of Correct Failure Positions The inservice testing program for valves contains both failure and safety positions of all air-operated, safety-related valves in flow paths associated with engineered safety feature systems. These valve positions were verified correct during development of the program.

I 1

d

"'-". p 1 4

'.t