ML17331B092

WCAP-13801,

"Setpoint Methodology for Protection

Systems,

D.

C.

Cook Unit ¹2," August

1993, contained

the instrument

loop

uncertainty calculations for the

RPS

and

ESFAS instrumentation

channels,

including. the main steam flow high/feedwater flow low mismatch trip

channel.

The main steam flow transmitters

(for the main steam

flow/feedwater flow mismatch channels)

are located inside containment

and would be exposed

to the adverse

environment created

by a steam line

break accident

inside containment.

(b)

The team determined that the D.

C.

Cook instrument loop error analysis

and setpoint

program is governed

by the procedures

and industry design

guidelines specified in Section 3.6.3 of this report.

setpoint methodology,

identified in WCAP-13801, required that

an

environmental

allowance bias error (due to accident

environment effects)

be applied to the instrument loop uncertainty calculation, if

applicable.

In response

to the team's

concern,

the licensee

stated that the

methodology considers

certain

RPS

and

ESFAS instrumentation

channels

to be diverse

(backup) to "primary" channels;

only the

"primary" channels

incorporate

environmental

allowances

(EA) into the

setpoint calculations to account for the effects of harsh

environments.

Diverse

(backup)

channels,

such

as the main steam flow high/feedwater

flow low mismatch trip, did not include

an

EA for bias errors

due to

adverse

environments.

The licensee

stated that this was consistent

with

the accident analysis,

and that this was not

a safety concern.

This

issue is considered

to be

an inspection followup item pending further

review and evaluation

by the Office of Nuclear Reactor Regulation

(NRR)

(315/93012-OIC(DRS);

316/93012-01C(DRS) ) .

The team

was concerned that the

use of containment

pressure

to detect

a

steam line break inside containment,

rather than steam line high flow,

did not conform to

IEEE 279-1968, "Criteria for Nuclear

Power Plant

Protection

Systems."

Section 4.8, which requires that, "to the extent

feasible

and practical, protection

system inputs shall

be derived from

signals

which are direct measures

of the desired variables."

Since

containment

pressure

is not

a direct variable for the steam line break

accident

inside containment

(high steam flow in

a single affected

steam

line is the direct variable),

the team determined that there

appeared

to

be

some

measure of feasibility and practicality for the licensee

to use

the direct variable to detect

steam line break.

The containment

pressure

channel

(whose transmitters

are located outside

containment)

was considered

the "primary" protection

channel for

detecting

secondary

steam piping breaks inside containment.

The main

steam flow high/feedwater

flow low mismatch

was considered

a diverse

channel

to the steam generator

(SG) low-low trip channel.

In addition,

the team determined that since the steam flow transmitters

were located inside containment,

they would sense

high steam flow

associated

with a steam line break inside containment,

and would be

exposed

to

a harsh

environment created

by the steam line break inside

containment,

However,

the team noted that

EA terms

due to harsh

environments

were not incorporated into the setpoint calculation.

~

3.3

Based

on the above considerations,

this issue is considered

to be

an

inspection followup item pending further review and evaluation

by the

Office of Nuclear Reactor Regulation

(NRR) (315/93012-01D(DRS);

316/93012-01D(DRS)).

Condensate

Stora

e Tank

CST

Level Channels - Function for

Accident Miti ation

The Condensate

Storage

Tank

(CST) is designed to provide

a water source for

large changes

in steam cycle inventory caused

by load transients,

system

draining or blowdown,

and startup

and shutdown activities during plant normal

operation.

During design basis accidents,

such

as loss of main feedwater,

steam line break'r loss of AC power to plant auxiliaries,

the

CST provides

the primary water source to the auxiliary feedwater

pumps.

The electronic

CST level channels

(1-2-CLI-113 and 1-2-CLI-114) are required

to meet the guidelines of Regulatory

Guide 1.97 for Type D, Category

1,

variables.

3.3.1

Set oint Calculation

and Basis

The team observed that setpoint calculation

E.C.P.

1-2-C1-01,

"Condensate

Storage

Tank Level," Revision 9,

used

Foxboro Model

N-E11GM-HSAA1 instead of

models

E13DM-HSAHl and

N-E13DM-HAH1-BHL for the determination of the sensor

uncertainty terms.

The licensee

stated that the correct performance

data

was

used in the setpoint calculation;

however,

the calculation listed the wrong

model

number

and failed to contain the actual transmitter

performance

documentation.

The licensee

issued

a condition report to track this

discrepancy

and committed to revise the E.C.P.

The team considered this to be

a calculation

weakness.

3.3.2

Instrument

Loo

Errors

Due to Seismic Effects not Addressed

The team found that setpoint calculation

E.C.P.

No. 1-2-C1-01,

"Condensate

Storage

Tank Level", dated August 1993, for the

CST electronic level channels

1, 2-CLI-113 and

1, 2-CLI-114 did not address

the bias errors

due to seismic

effects.

The team noted that the

UFSAR identifies

CST level as"a "type D"

variable (i.e.,

a variable that provides information to the operator to

indicate operation of safety systems

and for manual functions).

Regulatory

Guide 1.97,

" Instrumentation for Light Water Cooled Nuclear

Power Plants to

Assess

Plant

and Environs Conditions During and Following an Accident,"

Revision 3, identified

CST water level

as

a "type D" Category

1 variable which

require seismic qualification so that the instrumentation

continues to perform

within required

accuracy following a seismic event.

The team determined that the licensee

did not possess

supporting technical

evaluations

and

had not assessed

the impact of seismic events

on instrument

channels.

Errors associated

with the seismic events

have not been

analyzed

in

the setpoint calculations.

The licensee

agreed

to strengthen

the design guide in the discussion

of

seismic effects

and to define what specific plant conditions

and instrument

loop functions should

be considered for inclusion into the calculations.

Per

NRC request,

the licensee

performed

a preliminary assessment

which indicated

that after the event transmitters

are restored to normal

accuracy,

with

extreme errors of +0.28X/-0.21K of span,

based

on seismic testing.

Although

the calculation would need to be revised to accommodate

the seismic error,

sufficient margin remained

between the actual

setpoints

and the required

setpoints.

Additionally, Westinghouse

has also stated that the Reactor

Protection

System

(RPS)

and Engineered

Safeguard

Feature Actuation System

(ESFAS) equipment typically experiences

an error, but returns to normal

accuracy

based

on seismic testing experience.

This issue is considered

an inspection followup item pending further review

and evaluation

by the Office of NRR (315/93012-01E(DRS);

316/93012-01E(DRS)).

3.4

Essential

Service Water

Pum

Flow and Dischar

e Pressure

Channels

Function for S stem Monitorin

The Essential

Service'Water

(ESW) System provides the cooling water under all

operating

modes

and accident conditions for the component cooling water

(CCW)

heat exchangers,

the emergency diesel

generator

coolers,

the containment

spray

heat exchangers

and the control

room air conditioning condensers.

It also

provides

an emergency

supply of water to the auxiliary feedwater

pumps in the

event the condensate

storage

tanks are emptied or unavailable.

All four

Probabilistic Risk Assessment

pumps receive

a Safety Injection (SI) start signal during

a

DBA and are shared

by both units.

The team reviewed the

ESW east

pump flow channel

(1-WFA-701)

and the discharge

pressure

channel

(1-WPA-701).

This instrumentation

was classified

as

BOP by

the licensee.

0

3.4. 1

Set oint Calculation

and Basis

The team identified the following discrepancies

in E.C.P. setpoint

calculations

No. 1-2-W7-04, "Essential

Service Water Instrument Sensitivity

Review," Revision

1,

and

No. 1-2-W7-02, "Essential

Service

Water Flow Mismatch

Alarm Setpoints,"

Revision 2:

(1)

E.C.P.

No. 1-2-W7-02 indicated that the alarm setpoint for

ESW header

lE

flow mismatch

(1-WFA-701) was changed

from 10X to

25%%d (less

conservative).

However,

a detailed

basis for the flow alarm

and the

basis for the setpoint

change

had not been provided in the calculation.

(2)

The team determined that calculations

No.

1-2-W7-02

and

No.

1-2-W7-04

were unauditable

because

the calculations

did not contain supporting

documentation (i.e., the calculations

did not have vendor data sheets

and Westinghouse

data).

Also, the setpoint calculations did not account

for sensor

and rack measurement

and test equipment uncertainty

terms

(SMTE and

RMTE).

(3}

E.C.P.

No.

1-2-W7-04 did not account for uncertainties

with respect

to

hydrostatic

head

and line loss

between

the pressure

transmitter

and its

process

tap connection.

Also, the setpoint for the

ESW pump discharge

pressure

alarm was chosen

based

on engineering

judgement.

In addition,

the

team was concerned

as to why the

ESW flow mismatch

alarm

(WFA-?01

and

WFA-703) had

been recently defeated.

The licensee's

(PRA) Report indicated that loss of

ESW is

an

6

analyzed

event

and restoration of flow to one

ESW header is required within

one hour.

Also,'he

UFSAR (page 9.8-27) stated that the

ESW system

was

equipped with flow alarms and/or indicators which signify losses

from the

supply headers.

Although indication in the control

room would be available,

the team was concerned

that potentially valuable information to the operators

has

been lost with the removal of the control

room annunciators.

Therefore,

the team questioned

the basis for the setpoint

change

and the subsequent

disconnection of the mismatch alarm.

In response

to the above concerns,

the licensee

stated that the

instrumentation

and alarm functions were considered

nonsafety related, that

the

ESW flow and

pump discharge

pressure

instrumentation

was not critical to

the operation of the plant during normal or DBA conditions,

and that the

flow and pressure

alarms

and indication were not identified in the plant

Emergency Operating

P'rocedures

(EOPs).

In addition, the team was informed

that the

ESW flow mismatch

alarm was defeated

by Plant Nodification PH-676 due

to nuisance

alarms in low flow conditions

and obsolete electronic equipment

causing

increased

maintenance

and decreased reliability of the alarm.

The

licensee

had concluded that the E.C.P. calculation did not need to be

comprehensive

with respect

to setpoint uncertainties.

The team was concerned

over the apparent

loss of necessary

information to the

operator.

The team could not identify specific requirements

with respect to

the basis for classifying the

ESW instrumentation

loops

as nonsafety related.

However, the team informed the licensee that omissions,

errors,

and lack of

supporting documentation

were additional

examples of calculation weaknesses.

Hain Turbine Control Oil Pressure

Switch

Function for Turbine

Control

and Reactor Protection

The team reviewed the Unit 81 main turbine control oil pressure

switch

instrumentation

(I-LPS-90).

This pressure

switch senses

low EHC control oil

pressure

and provides

a signal to the reactor trip system.

3.5.1

Set oint Calculation

and Basis

The team noted that pressure

switch I-LPS-90 did not have

a setpoint

calculation or analysis to substantiate

the setting,

The licensee

informed

the team that the setpoint

was based

on the vendor's

recommendation.

This was

acceptable

to the team.

3.6

Refuelin

Water Stora

e Tank

Level Channels

Function for

Accident Hiti ation

The Refueling Water Storage

Tank

(RWST) provides

a means of storage

and

transfer of water for refueling operations

and

a source of water for the

Emergency

Core Cooling System

(ECCS).

During design basis

accidents,

the

supplies

low concentration,

borated water to the safety injection system,

residual

heat

removal

system,

centrifugal charging

system,

and containment

spray system.

The

RWST for each unit has

two level instrumentation

channels

(ILS-950 and

ILS-951) which provide recording

and indication, level alarms

(high, minimum,

low, and low-low) and

a low-low level trip of the

RHR pumps.

The differential

pressure

transmitters

used with these

level channels

are located in the

'ipe

tunnel.

The

RWST level channels

are required to meet the guidelines of

Regulatory

Guide 1.97 for Type A, Category

1, variables.

3.6. I

Set oint Calculation

and Basis

The team identified the following discrepancies,

errors

and omissions

in

E.C.P. Calculation

No. 1-2-I9-03,

"RWST Level/RHR Pumps Interlock," Revision

10,

and its associated

design drawings

and technical

data:

(1)

The uncertainty.

values for the

RWST level transmitters

(ILS-950 and ILS-

951)

wer e based

on vendor performance

data sheets for Foxboro "N-E13"

series transmitters rather than the installed Foxboro model

E130M-HSAHl

transmitters.

Justification for use of "N-E13" series transmitter

performance

data

was not provided in the calculation.

In response

to

the team's

concern,

the licensee

performed

an equivalency evaluation

which demonstrated

that the N-E13 and

E-13 series transmitters

were

functionally identical.

The licensee

informed the team that E.C.P.

No.

1-2-I9-03 will be revised to resolve this issue

and incorporate

the

appropriate

evaluation.

(2)

(3)

Calculation

E.C.P.

No. 1-2-I9-03 determined

the uncertainty for process

measurement

effects,

due to water height

and density values,

using

licensee

selected

worst case transmitter elevation of 599'" (i.e., the

lowest elevation of Units ¹1

and ¹2 transmitters

or the largest

span).

When questioned

by the team,

the engineer

could not provide

justification for selecting elevation 599'".

The team observed that

instrument piping drawing 1-5568C-2, and installation drawing 1-2-19-03,

Revision

10,

showed the transmitters

installed at different elevations

below 599'3".

In response

to the team's

concern,

the licensee

walked

down the installation

and determined that Unit ¹1 transmitters

were

installed at elevation

599'

1/2" (1-ILS-950)

and 599'

1/2" (1-ILS-

951),

and Unit ¹2 transmitters

were installed at elevation 599'" (2-

ILS-950 and 2-ILS-951).

Consequently,

instrument loop uncertainty

calculation

E.C.P.

No 1-2-I9-03 used incorrect data in the determination

of the process

measurement

effect error.

The licensee

generated

a

Condition Report to document

the elevation discrepancies

and revise the

installation drawings

and E.C.P.

No. 1-2-I9-03.

The team noted that the

RWST level transmitters,

ILS-950 and ILS-951,

use

an impulse line with connection directly off the 24" diameter safety

injection suction pipe.

The team determined that

RWST level instrument

loop setpoint calculation E.C.P.

No. 1-2-I9-03 did not account for the

error effects of the velocity head of the

ECCS

pump flow (safety

injection and residual

heat

removal

pumps) during design basis

accidents'

In response

to the team's

concern,

the licensee

generated

a condition

report to document this issue.

The licensee

also prepared

a preliminary

assessment

which showed that although the calculation will change,

sufficient margin remains

between

the actual setpoints

and the required .

setpoints.

The team determined that the findings noted

above did not have

a significant

impact

on safety;

however,

the team examined only a small

sample of the

instrument loops at D.

C.

Cook and

was concerned

with the number of problems

in the small

sample.

noted

~

3.6.2

Sensin

Line Slo es

and

Bend Radii

(4)

The team identified that flow diagram OP-1-5144-13,

"Containment Spray

System Unit O'I," incorrectly showed

RWST level transmitter

ILS-950 as

having

a minimum level alarm at elevation 638'l".

However, the team

determined that the correct setpoint value was 637'".

It

In addition, Installation drawing 1-2-I9-03, Revision

10,

showed

a 36"

required separation

between

the

RWST level transmitters,

ILS-950 and

ILS-951.

Instrument piping drawing 1-5568C-2

shows only 28" separation.

The licensee

performed

a walkdown of the transmitters

and determined

that the transmitters

were separated

by greater than 36".

The licensee

generated

a Condition Report to document

and resolve the setpoint

and

as-built discrepancy

on the drawings.

The design control errors discussed

in items

(1) through

(4) above,

are

considered

to be examples of a violation of 10 CFR 50, Appendix B, Criterion

III (315/93012-02(DRS);

316/93012-02(DRS)).

The team identified that the instrument

impulse lines routed

from the tap

connection to the

RWST level transmitters

(ILS-950 and ILS-951) were not

sloped

downward to the transmitter

and instrument piping drawing 1-5568C-2 did

not specify requirements

for sloping impulse lines.

The licensee

performed

a walkdown and confirmed that the lines were not

sloped.

The licensee

stated that lack of line slope will not adversely affect

the ability of these transmitters

to sense

level

as long as the lines are

filled and vented.

The team verified that the licensee's

calibration

procedure

required filling and venting the lines prior to placing the

transmitters

back into service.

The team also noted that sensing line slopes

and

bend radii were not depicted

in the sensing line routing drawings

reviewed

by the team.

Consequently,

gases

trapped

in wrongly sloped pressure

measuring

sensing lines could cause

response

times to increase

and incorrect

bend radii

may result in sensing line

failures.

The team informed the licensee that the lack of instrument line slope

requirements

was not consistent

with industry installation good practices.

3.6.3

Instrument

Loo

Errors

Due to Accident Environments

not Addressed

The team found that the setpoint calculation for RWST level channels

ILS-950

and

ILS-951

(No. 1-2-I9-03) did not address

the impact of the

HELB environment

and the resultant

bias errors associated

with the instrument cable insulation

resistance

degradation effects.

In fact, the team noted that E.C.P.

No. 1-2-

I9-03 incorrectly stated that the

RWST instrument

loops are located in a

"mild" environment.

The team determined that the instrumentation

cables for

transmitters

ILS-950 and ILS-951,

shown

on Conduit and Cable

Plan Drawing 1-

1437A-55,

were routed through

a high energy line break

(HELB) environment

area.

The

HELB environment,

defined

as

a harsh

environment

by the

environmental qualification (Eg) program, is caused

by a postulated

steam

generator

blowdown accident at the 633'levation of the auxiliary building.

The

UFSAR stated that during

a

SG blowdown, the steam

blowdown cools the

reactor

coolant

and the high pressure

delivery of RWST borated water

by the

centrifugal

charging

pumps reestablishes

adequate

shutdown margin.

Procedure

NESP 19.04,

"Engineering Control Procedures,"

required instrument

loop error analyses

to be in accordance

with Engineering

Guide EG-IC-004,

"Instrument Setpoint/Uncertainty."

Engineering

Guide EG-IC-004 required that

the error effects associated

with accident

environments (i.e., high

temperature

steam,

pressure

and radiation)

be accounted for in the loop

uncertainty calculation, if applicable.

Similarly, Westinghouse

setpoint

methodology presented

in WCAP-13801,

"Setpoint Methodology for Protection

Systems,

Donald

C.

Cook, Unit 2," dated August 1993, required that

an

environmental

allowance bias error

(due to accident

environment effects)

be

applied to the instrument loop uncertainty calculation, if applicable.

In

addition, ANSI/ISA-S67.04-1988,

"Setpoints for Nuclear Safety-Related

Instrumentation" delineates

consideration

of accident

environmental effects.

Regulatory

Guide

1. 105,

"Instrument Setpoints for Safety Related

Systems,"

Revision 2, endorses

ISA S67.04.

Finally, Regulatory Guide 1.97,

"Instrumentation for Light Water Cooled Nuclear

Power Plants to Assess

Plant

, and Environs Conditions During and Following an Accident," Revision 3, states

that instrumentation for Category

1

and

2 variables require environmental

qualification

and instrumentation for Category

1 require seismic

qualifications

so that the instrumentation

continues

to perform within

required accuracy following a design basis accident.

The licensee

contended that cable degradation

errors would not be present

under conditions for which the alarms or interlocks associated

with the

level channel

are required.

Further,

the licensee

stated that the safety

analysis

and licensing basis require

assessment

of environmental

errors which

are

a direct result of design basis

events for safety system setpoints

associated

with reactor trip and safeguards

actuation.

The

D.

C.

Cook

setpoint methodology for protection

systems

incorporates

environmental

allowances for all functions that are credited in the plant safety analysis

for design basis

events,

where cables

and transmitters

could

be potentially

exposed to harsh

environments,

inside or outside containment.

For post-

accident monitoring (as

opposed

to protection functions), in conjunction with

the Westinghouse

Owner's

Group

(WOG) Emergency

Response

Guidelines

(ERGs),

provisions

were

made to accommodate

environmental

allowances for cable

and

transmitters

associated

with harsh

environments

inside containment only.

The

10

0

- team determined. that there

was

no provision in the

ERGs to account for the

effect on instrument readings

due to line breaks

outside containment.

The

licensee

stated that this methodology

was

used

because

there are

many diverse

instruments,

not exposed to the accident

environment,

which would function

under line break conditions outside containment;

that harsh

environmental

conditions

due to accidents

are generally of short duration;

and the resulting

errors associated

with harsh

environments

outside containment

are often small

and insignificant.

Although the team agreed that for the setpoint in question

the errors would generally

.be small,

we were concerned that these

issues

had

not been

addressed

by the licensee prior to the team's inquiry.

The team concluded that the assessment

of environmental

effects should

have

been

accounted for in the setpoint calculations.

This issue is considered

an

inspection followup item pending further review and evaluation

by the office

of NRR (315/93012-01F(DRS);

316/93012-01F(DRS) ) .

3.7

Desi

n Guides

and Criteria

The team noted that the licensee

lacked

adequate

design standards,

design

criteria and design specifications for instrument

component installations.

For example:

There were

no drawings which show the installation or routing of

instrument

sensing lines.

There

was

no specification for minimum dew point requirements

of

instrument air which supplied

pneumatic

instruments.

Although there

was

no safety related

pneumatic

instruments,

a number of instruments

were

used

by the licensee

to satisfy Regulatory

Guide 1.97 requirements.

There

was

no design specification for determination of instrument

sensing line piping ovality.

Also, the team noted that corporate

engineers

were not always

aware of which

specifications,

industry codes,

standards,

guides, etc., to use during

preparation

and review of I&C calculations

and modifications.

Inadequate

identification of applicable

codes,

standards,

industry guides etc.

was

evident in engineering

design

documents

that were reviewed

by the team.

In

response

to the team's

concern,

the l,icensee

stated that efforts were underway

to improve access

to pertinent information.

The licensee

also stated that

a

Design Basis Reconstitution

Program

was underway.

3.8

Measurin

and Test

E ui ment

and Labelin

of I&C Com onents

The inspectors

noted that the licensee's

control of measuring

and test

equipment

(M&TE) was very good.

The team found that

M&TE issue control,

accuracy,

storage

and the intervals for calibration were adequate

and within

vendor recommendations

and

damaged

or out of tolerance

M&TE instruments

were

adequately

controlled.

Also, labeling of I&C components

was excellent.

11

3.9

Instrument Calibration

and Testin

The team reviewed the calibration

and functional tests,

surveillance tests,

and response

time tests

associated

with the instrument loops reviewed.

The

test procedures

were user friendly and incorporated

clear

acceptance criteria.

The procedures

incorporated

the correct Technical Specification

(TS) setpoint

values,

and the instrument channel/system

response

times fulfilled TS

requirements

and were equal to or conservative

to the values

assumed

in the

accident analysis.

The team concluded the instrument testing program

was

good.

4.0

Review of I&C Modifications and Desi

n Control

Based

on 'the review of 10

I&C modifications, the team concluded that the D. C.

Cook program for controlling plant modifications associated

with I&C was

generally good;

however,

several

weaknesses

were identified during review of

I&C modifications.

4.1

Modifications MM-003 and

MM-210

(a)

MM-003:

Installation of Permanent

Test

Gau

es

The team noted that both units'ast

and west containment

spray

pump inservice

test

(IST) suction

gauge isolation valves were signed off as being closed,

but

were not independently verified closed.

The pressure

gauges

were not

seismically qualified which made the isolation valve the pressure

boundary.

~

In response,

the licensee

added

an independent verification step to the

affected

IST procedures.

This was acceptable

to the team.

(b)

MM-210:

S ent Fuel Pit Hi

h

Low Level Alarm

0

Annunciator Procedure

12-OHP 4024. 134,

Drop 2, initiating device

RLA-500

(63-1

SFPL)

was changed

to RLA-501

(63X SFPL) instead of adding

RLA-501

to the device list.

0

Annunciator Procedure

1-OHP 4024. 105,

Drop 27,

had

an incorrect

initiating device.

c

Drawing OP-12-98315-6

contained deficient labeling for Annunciator-Drop

27 and the relay table for 63-SFPL.

In response,

the licensee

corrected

the annunciator

procedures

and issued

a

condition report to track the drawing revision.

The team verified the wiring

'onfiguration

was correct in the field and concluded

the annunciator

procedures

setpoint value,

window description

and operator actions

were

unaffected

by the identified discrepancies.

12

4.2

Review of Tem orar

Modification to Hain Feedwater

Pum

I

The team identified that the licensee failed to perform

a 10 CFR 50.59

evaluation.

In addition, the team was concerned

with the licensee's

design

implementation of nonsafety related

temporary modification 2-93-015.

Due to

mode control, the licensee

initiated

a temporary modification to install two I/I (current to current)

converters

in the east

and west main feed

pump speed control circuits.

The

I/I converters

were installed

between the main feed

pump pressure

setters

and

the auto/manual

control stations.

The modification would correct the problem

with the automatic

mode

and provide ground fault isolation between

the

pressure

setters

and the hand(auto stations.

Mork under job order

(JO)

A0041043

was started

on August 6,

1993,

and completed

on August 10.

On

August 27,

1993,

one of the two I/I converters failed which produced

a minimum

speed

signal to the east

main feed

pump.

The reduction in feedwater flow

caused

a low-low steam generator

level which resulted in the Unit 2 reactor

trip.

The team evaluated

the circumstances

associated

with the failure of the I/I

converter.

The team concluded that measures

were not established

to assure

adequate

design

implementation

and review of temporary modification 2-93-015.

The team identified the following:

.

The D. C.

Cook Onsite Safety Review Committee does not evaluate

nonsafety related

temporary modifications which have the potential for

causing

a reactor trip or challenging

a safety system.

During the temporary modification design process,

the

IKC engineer

failed to refer to the Foxboro I/I converter vendor manual.

The

engineer

instead referred to another

D. C.

Cook instrumentation

drawing

which had

no relation to the terminal connections of the I/I converters.

Consequently,

the engineer specified the wrong input and output terminal

connections

on the design drawings.

The engineer failed to specify the required

100

ohm voltage drop

resistor

across

the input for the I/I connector.

The nameplate

on the

I/I converter specifically stated that for correct resistor size,

the

vendor manual

must

be reviewed (the licensee's

original installation

drawing did not specify any resistor).

The

I8C supervisor

performed

two separate

independent

reviews

and signed

off on the drawings

and the modification package,

even

though the

installation drawings

and the temporary modification package

contained

the above design errors.

The incorrect input and output connections

to the I/I converters

were

subsequently

identified during calibration;

however,

the engineer still

did not refer to the vendor manual

to verify the input and output

connections.

13

Unable to calibrate

the I/I converter,

licensee

personnel finally

discovered that the

100

ohm resistor

was missing.

The licensee failed to document

on

a job order or condition report that.

the above deficiencies

were encountered.

The

IEC engineer that provided the design input for the temporary

modification was not trained in Foxboro instrumentation.

There was

no training on troubleshooting of vendor supplied

components

such

as the pressure

setter in the speed control. circuitry.

The licensee

lacked adequate

interconnection

design drawings which

depicted

the circuitry of the pressure

setter.

The licensee's

failure to perform

a 50.59 evaluation

was due to the plant

engineers'verly

restricted interpretation of the main feed

pump speed

control

system which was described

in the

UFSAR.

The team noted that all five

sections of the safety evaluation

screening checklist were marked

"no"

including the section which asks whether the modification is

a change to the

plant

as described

in the

UFSAR.

Section

10.5. 1. 1 of the

D.

C.

Cook

UFSAR

stated that the variable

speed turbine driven main feedwater

pumps were

designed to provide the required

feedwater to the steam generators.

10 CFR 50.59 states

that the licensee

must include

a safety evaluation

providing the bases

for determining that the change did not involve an

unreviewed safety question.

The licensee

stated that the failure of the I/I converter

was determined to

have the

same effect as the failure of the hand/auto station already in the

circuit.

Although this statement

was basically correct,

the team determined

that the licensee failed to perform

a safety evaluation

and include

a written

evaluation

which provided the bases for the determination that the change did

not involve an unreviewed safety question.

The licensee

stated that failure of the east

main feed

pump speed control

circuit was directly related to failure of the I/I converter.

Consequently,

failure of the I/I converter,

which had not previously been part of the speed

control circuit, resulted

in a significant plant transient.

On September

10,

1993, the licensee

removed the I/I converter

from the speed control circuit.

By failing to recognize that the

speed control

system

was described

in the

UFSAR, the licensee

concluded that

10 CFR 50.59

was not applicable,

therefore,

no safety evaluation

was performed.

The licensee's

failure to perform

a

safety evaluation is considered

to be

a violation of 10 CFR 50.59 (315/93012-

03(DRS); 316/93012-03(DRS)).

4.3

Field Walkdown Ins ection

The team observed

during field walkdown inspection,

that instrument

sensing

line 2-FFS-257,

associated

with the auxiliary feedwater

system,

was not

supported

over

a span of about

10 feet.

The licensee's

hanger specification

14

,

required that the line be supported

over

a span not to exceed six feet.

The

licensee

wa's in the process of performing

a calculation to determine

whether

the sensing line installation

was adequate.

Pending review of the

calculation, this item is considered

unresolved

(315/93012-04(DRS);

316/93012-.

04(DRS)).

5.0

En ineerin

and Technical

Su

ort

The team evaluated

D.

C. Cook's

I8C engineering

and technical

support

capability.

The team reviewed the licensee's

programs for temporary

modifications, plant modifications

(PHs), request for change

(RFC),

and minor

modifications

(HHs}, engineering interfaces,

document

and drawing control,

discrepancy

management,

safety evaluations

(10 CFR 50.59), test development

and control,

manual operator actions,

and maintenance.

In addition, the team

reviewed root cause

analyses

and training programs for engineers

and

interviewed corporate

and plant

I8C engineers.

Overall, the team concluded that the extent

and quality of engineering

and

technical

support

was good.

The engineering staff was generally competent

and

very experienced.

Permanent

modifications reviewed generally contained

good

design control, well documented

safety evaluations

and adequate

post

modification testing.

However, the team

was concerned

with the design control

and implementation of temporary modification 2-93-015

as discussed

in Section

4.2 of this report.

Communication

between

engineering

and other groups

appeared

to be effective.

However,

some of the engineers

that interfaced with

the team were not aware of I&C plant design

requirements

and could not explain

the technical

content in their response

to team concerns.

Also, there

appeared

to be

a lack of coordination

between

the

Eg engineering

group

and the

I&C engineers

that perform setpoint calculations.

5.1

En ineerin

Staff Trainin

The team was informed that there were

23 engineers

in AEP's Nuclear

Engineering Electrical

Instrumentation

(NEEI) Department in Columbus,

Ohio.

Their primary involvement for several

years

has

been associated

with the

reactor protection

system

(RPS/ESFAS)

Foxboro H-Line instrumentation

upgrade

program for the D.C.

Cook nuclear

power plant.

The

I8C engineers

who were

interviewed

had substantial

engineering

experience

and appeared

to have

positive attitudes.

In addition, the

I8C corporate

engineers

appeared

to be

involved with the detailed instrumentation

and control design activities at

the plant.

The team reviewed selected

I&C engineer's

training program, training records

and work .experience.

In addition, the team conducted

interviews

and technical

discussions

with selected

I8C engineers.

The team determined that

I&C plant

system

and component

engineers

were not trained

on existing or old plant

instrumentation,

design

and troubleshooting.

This fact may have contributed

to the poor design effort and implementation of temporary I/I converter

modification 2-93-015.

In addition,

the

team determined that there

appeared

to be

a need for guidance

and training of corporate

I&C engineers

in the use

of the various specifications,

industry codes

and standards

such

as sloping

requirements,

impulse line support criteria, accident

analyses,

etc.

15

5.2

Safet

Evaluation Screenin

Process

The team noted that procedure

No.

PHP 1040.SES.OOI,

Revision 0, "Safety

Evaluation Screening,"

did not stress

that the second

reviewer perform an

independent

evaluation.

The screening

preparer identifies during the

screening

process

the applicable references/justification.

A safety

evaluation

was not required if all of the questions

were answered

"no".

In response,

the licensee

provided the initial and continuing training lesson

plans

used to teach the safety evaluation

screening

process.

The lesson

plans

contained instructions that both the original screening

preparer

and the

reviewer are to perform independent

screening

evaluations.

In addition, the

licensee

indicated they would revise procedure

No.

PHP 1040.SES.OOI

to stress

that both reviewers

must perform an independent

evaluation.

This was

acceptable

to the team.

5.3

Review of Licensee Self Assessment

Pro

ram in the

I&C Area

The team reviewed

ILC related audits

and surveillances

performed in the last

two years.

The team noted that in preparation for the SBICI, the licensee

had

hired

a contractor to evaluate

and assess

the various

I&C areas.

The audit

and surveillance

performed in Hay-June

1993, identified some similar findings

to the ones identified by the team.

The team considered

the self-initiated

SBICI a positive management initiative.

However,

the team noted that except

for the SBICI preparation

audit, very little similar audit activity was

performed in the

I&C area relative to the setpoint

program.

The licensee

informed the team that this audit activity has

been recently

added to the

audit schedule.

6.0

Ins ection Followu

Items

Inspection followup items are matters

which have

been discussed

with the

licensee,

which will be reviewed further by the team,

and which involve some

action

on the part of NRC or licensee

or both.

Followup items disclosed

during the inspection

are discussed

in Sections

3. 1, 3.2, 3.3

and 3.6 of this

report.

7.0

Unresolved

Items

Unresolved

items are matters

about which more information is required

in order

to ascertain

whether they are acceptable

items, violations or deviations.

Unresolved

items disclosed

during this inspection

are discussed

in Section 4.3

of this report.

8.0

Exit Meetin

The team conducted

an exit meeting

on September

28,

1993, at the

D. C. Cook

Nuclear

Power Plant, to discuss

the major areas

reviewed during the

inspection,

the strengths

and weaknesses

observed

and the inspection results.

licensee

representatives

and

NRC personnel

in attendance

at this exit meeting

are documented

in Appendix A.

The team also discussed

the inspection report's

likely informational content with regard to documents

reviewed 'by the team

J

during the inspection.

The licensee identified the proprietary documents

and

the team agreed to handle this information accordingly.

The licensee

considered

EG Instrument

Loop Setpoint Hethodology Guide EG-IC-004;