ML17334A586
| ML17334A586 | |
| Person / Time | |
|---|---|
| Site: | Cook  |
| Issue date: | 12/02/1997 |
| From: | Fitzpatrick E INDIANA MICHIGAN POWER CO. |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| References | |
| AEP:NRC:1260G3, CAL-RIII-97-11, NUDOCS 9712090057 | |
| Download: ML17334A586 (31) | |
Text
CATEGORY 1 REGULA Y INFORMATION DISTRIBUTI SYSTEM (RIDS)
ACCESSION NBR:9712090057 DOC.DATE: 97/12/02 NOTARIZED: NO DOCKET ¹ FACIL:50.-315 Donald C.
Cook Nuclear Power Plant, Unit 1, Indiana M
05000315 50-31'6 Donald C.
Cook Nuclear 'Power Plant, Unit 2, Indiana M
05000316 AUTH.hAÃE AUTHOR AFFILIATION FITZPATRICK,E.
RECIP.NAME RECIPIENT AFFILIATION Document Control Branch (Document Control Desk)
SUBJECT:
Forwards info which supports basis for util's assertion that DCP is ready to resume full power operation,per 970919 CAL RIII-97-011.
DISTRIBUTION CODE:
IE36D COPIES RECEIVED:LTR ENCL SIZE:
TITLE: Immediate/Confirmatory Action Ltr (50 Dkt-Other Than Emergency NOTES:
T Prepar E
RECIPIENT ID CODE/NAME PD3-3 PD INTERNA FILE CENT COPIES LTTR ENCL 1
1 RECIPIENT ID CODE/NAME HICKMAN,J NRR/DRPM/PECB COPIES LTTR ENCL 1.
1 0
'EXTERNAL: NOAC NRC PDR 1
1 D
U N
NOTE TO ALL "RIDS" RECIPIENTS:
PLEASE HELP US TO REDUCE WASTE. TO HAVE YOUR NAME OR ORGANIZATION REMOVED FROM DISTRIBUTION LISTS OR REDUCE THE NUMBER OF COPIES RECEIVED BY YOU OR YOUR ORGANIZATION, CONTACT THE DOCUMENT CONTROL DESK (DCD)
ON EXTENSION 415-2083 TOTAL NUMBER OF COPIES REQUIRED:
LTTR 7
ENCL 7
Indiana Michigan Power Company 500 Circle Drive Buchanan, Ml 491071395 IItIOIAIM NlmISAN PMM'ecember 2,
1997 AEP: NRC: 126 0G3 Docket Nos.:
50-315 50-316 U.S. Nuclear Regulatory Commission ATTN:
Document Control Desk Mail Station 0-Pl-17 Washington, D.C. 20555-0001 Gentlemen:
Donald C.
Cook Nuclear Plant Units 1 and 2
RESPONSE
TO CONFIRMATORY ACTION LETTER No. RIII 97-011 NRC ARCHITECT ENGINEER (AE) DESIGN INSPECTION AUGUST 1997 This letter describes the basis for our assertion that Cook Nuclear Plant is ready to resume full power operation, pursuant to the September 19,
- 1997, confirmatory action letter (CAL) from Mr. A. B. Beach.
Based on the actions we have
- taken, we have reasonable assurance that our safety related systems are operable.
Attachment 1 provides an executive summary of CAL responses and the short term actions taken.
Attachment 2 provides information regarding the eight specific issues in the letter from Mr. Beach that we agreed to resolve prior to restart.
For each item one through eight, we have provided a synopsis of the issue and actions taken to resolve the issue and provide reasonable assurance of conformance with applicable regulations and our operating licenses.
Attachment 3 describes an expanded, long term program for use of instrument uncertainty in our design, engineering, and operations activities.
Attachment 4 provides a description of the short term assessment program developed and performed at Cook Nuclear Plant.
This attachment describes how we developed the
- program, the general results of the assessment, and why it supports our assertion that both Cook Nuclear Plant units are ready to resume full power operation.
Attachment 5 provides a listing of commitments that have been established as a result of certain issues identified in the CAL and short term assessments.
No other statements should be considered to be regulatory commitments.
We understand a public meeting will be held, during which we will have the opportunity to respond to issues raised during the AE design inspection and presented in the CAL.
97%20'tr0057 97i202 POR AOaCV, 0S0003'IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII'8 l
U.S. Nuclear Regulatory Commission Page 2
AEP:NRC:1260G3 We recognize the importance of the issues raised by the AE design inspection and will continue to improve and pursue excellence in our programs to maintain the design and licensing basis of our plant.
We are fully committed to operating and maintaining our plant in a safe manner and in compliance with NRC requirements.
Sincerely, E.
E. Fitz atrick Vice President
/vlb Attachments A. A. Blind A. B. Beach MDEQ -
DW & RPD NRC Resident Inspector J. A. Abramson
ATTACHMENT 1 TO AEP:NRC:1260G3 EXECUTIVE
SUMMARY
Attachment 1 to AEP:NRC:1260G3 Page 1
EXECUTIVE
SUMMARY
In response to the issues raised during the recent architect engineer (AE) design inspection and communicated to us in the NRC's September 19, 1997, confirmatory action letter (CAL), we have taken actions to resolve each issue and have performed a short term assessment to provide reasonable assurance that these issues did not adversely impact the operability of other safety systems at Cook Nuclear Plant.
The eight CAL issues listed below were reviewed, and actions taken to provide assurance of safety system operability prior to restart of Cook Nuclear Plant units.
1.
Recirculation Sump Inventory/Containment Dead Ended Compartments 2.
Recirculation Sump Venting 3.
Thirty-Six Hour Cooldown, With One Train of Cooling 4.
ES-1.3 (Switchover to Recirculation Sump)
Procedure 5.
Compressed Air Overpressure Issues 6.
Residual Heat Removal Suction Valve Interlock 7.
Fibrous Material in Containment 8.
Refueling Water Storage Tank Mini-flowRecirculation Lines To provide reasonable assurance of compliance with our design and licensing bases requirements, technical specification amendments, plant modifications, and analyses have been performed or initiated, and will be completed prior to restart.
A ninth
- issue, instrument uncertainties incorporated into procedures and analyses, will be discussed with the NRC further, prior to restart of either unit.
An expanded instrument uncertainty program has been developed to address this issue and will continue beyond the restart.
Because of the importance and potential implications of the AE design inspection, senior management reviewed formal root cause analyses of the eight CAL issues requiring action prior to restart, to determine their potential effect on safety related system operability.
Issues that had both generic implication and were deemed likely to affect safety related system operability were identified for additional assessment in the short term.
Short term assessments were performed on the following issues.
Some analyses found to contain assumptions.
errors and incorrect Some containment attributes such as those related to sump performance not adequately preserved.
Lack of consideration of a credible failure mode on a non-safety related system interfacing with safety related systems.
Attachment 1 to AEP:NRC:1260G3 Page 2
Lack of consideration of level instrument bias due to Bernoulli effect.
S.
Improper application of single failure criteria.
Action plans were implemented to review and resolve potential adverse impacts on safety related system operability resulting from these issues.
All of the short term action plans have been completed.
While the short term assessment results identified engineering
- issues, none challenged operability.
The assessment provides reasonable assurance that issues of the type found during the AE design inspection do not impact the operability of other safety systems at Cook Nuclear Plant.
The results of previously conducted safety system functional inspections and recent reanalysis of UFSAR Chapter 14 accidents further support the conclusion that the systems inspected are capable of fulfillingtheir intended safety function.
In conclusion, it is our assertion that Cook Nuclear Plant is ready to resume full power operation, and will do so consistent with high standards of safety in both operational policies and safety equipment capabilities.
ATTACHMENT 2 TO AEP:NRC:1260G3 SPECIFIC RESOLUTION OF TECHNICAL ISSUES IN THE CONFIRMATORY ACTION LETTER
Attachment 2 to AEP:NRC:1260G3 Page 1
CONFIRMATORY ACTION LETTER ISSUE NO.
1 Recirculation Sum Invento Containment Dead Ended Cpm artments Commitment Analyses will be performed to demonstrate that the recirculation sump level is adequate to prevent vortexing or appropriate modifications will be made.
Resolution Results of the analyses performed demonstrate that the active sump level will remain above the minimum required to prevent vortexing of the residual heat removal (RHR) and containment spray pumps as they draw water from the recirculation sump.
The analyses included consideration of the large break loss-of-coolant accident (LBLOCA) and a spectrum of small break loss-of-coolant accidents (SBLOCAs).
Because ice melt was credited in, the
- analyses, a
technical specification (T/S) change was submitted in our letter AEP:NRC:0900K, dated October 8,
- 1997, to allow consideration for existing ice mass and other contributing sources of water in sump inventory calculations.
Because the credited ice mass exceeds the current T/S lower limit, both the total ice condenser and individual basket ice mass lower limits were increased.
Back round During the AE design inspection, a concern was raised regarding the adequacy of containment recirculation sump water level following a postulated LBLOCA or SBLOCA.
This issue stemmed from the initial results of a calculation revision that indicated uncertainty as to whether a minimum active sump level would be maintained throughout the recirculation phase.
The calculation was being revised as a
result of questions raised during the inspection regarding the modeling of dead ended (inactive) sump areas within the containment.
The refueling water storage tank (RWST) level bias, addressed in CAL issue no.
4, further complicated this issue.
A key consideration in the calculation was whether ice melt rates for SBLOCAs would offset effects of active sump water diversion to these dead ended containment areas through the containment spray system (CTS).
This issue was the basis of our decision to shut down Cook Nuclear Plant units 1 and 2 on September 9,
1997.
A~nal ses Postulated LBLOCA and a
spectrum of SBLOCAs were analyzed to determine the adequacy of dynamic active sump level, long term containment integrity, and recriticality for cold and hot leg recirculation.
These analyses considered the effects of relocating the RWST level tap (see CAL issue no. 4), increasing the minimum ice
- mass, and changing operating procedures.
A proposed T/S amendment, AEP:NRC:0900K, dated October 8,
- 1997, was submitted to allow consideration for existing ice mass and other contributing sources of water in sump inventory calculations.
Because the credited ice mass exceeds the current T/S lower limit, both the total ice condenser and individual basket ice mass lower limits were increased.
Analyses
- results, presented in our submittal AEP:NRC:0900K, indicate that sufficient active sump water level is available to
Attachment 2 to AEP)NRC:1260G3 Page 2
preclude vortexing or air entrainment to the RHR and containment spray pumps throughout the long term cooling (recirculation) phase of a
postulated accident.
- Further, the accident analyses acceptance limits regarding recriticality and long term containment integrity are met.
Conclusion Results of the analyses conclude that there will be sufficient water inventory throughout the period that the emergency core cooling system (ECCS) and CTS pumps are taking suction from the recirculation sump.
CONFZRMATORY ACTZON LETTER 1SSUE NO.
2 Recirculation Sum Ventin Commitment Venting will be reinstalled in the recirculation sump vent cover.
The design will incorporate foreign material exclusion requirements
,for the sump.
Resolution Vents have been reinstalled in the recirculation sump cover in both units.
The vents incorporate screening to satisfy the foreign material exclusion requirements.
The recirculation sumps have been returned to their approved design configuration.
Back round As a result of the recirculation sump model testing in the 1970's, a number of changes were made to the original recirculation sump design.
One of the minor changes was the addition of five three-quarter inch vent holes.
Although not needed for sump operability, these vents were installed to enhance venting of air trapped under the sump roof.
During recent
- outages, the holes were found to bypass the sump screen and were subsequently closed to satisfy sump foreign material exclusion requirements (i.e., greater than one-quarter inch particulate retention).
~Anal sis While these vent holes are not necessary to assure operability of the recirculation sump, they were reinstalled in the sump cover in accordance with commitments made to the NRC in 1979.
Foreign material exclusion requirements for these vents were incorporated.
Conclusion The recirculation sumps, in both units, have been returned to their approved design configuration.
Attachment 2 to AEP:NRC:1260G3 Page 3
CONFZRMATORY ACTXON LETTER XSSUE NO.
3 Thirt -Six Hour Cooldown With One Train of Coolin Commitment Analyses will be performed that will demonstrate the capability to cooldown the units consistent with design basis requirements and necessary changes to procedures will be completed.
Resolution The thermal hydraulic analysis concluded that the reactor coolant system can be cooled down with a single train of RHR/component cooling water (CCW)/essential service water (ESW) in 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.
Operating procedure revisions were made to reflect a higher maximum CCW supply temperature limit and four pipe supports were modified.
Back round The original thermal hydraulic analysis for the CCW system demonstrated that cooldown from hot standby to cold shutdown could be completed in 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> using a single train of cooling with a maximum CCW supply temperature of 120'.
This analysis had been reperformed in recent, years.
During the AE design inspection, discrepancies in analysis inputs (namely, CCW heat, exchanger model and RHR heat exchanger flows) were identified in the cooldown calculation.
Additionally, the potential for a CCW supply temperature excursion to 120' during an emergency cooldown was recognized and incorporated in plant procedures.
The FSAR.and UFSAR reflected only the normal-. operating temperature of 95'.
During the AE design inspection, the reference to 120' was removed from the plant cooldown procedures and the CCW temperature was limited to 95' to be consistent with the design basis as described in the UFSAR.
A~nal ala The CCW heat exchanger modeling error and RHR heat exchanger flow inputs were corrected and the reanalysis indicates that a single train 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> cooldown could be achieved with a
CCW supply temperature of 120'.
The CCW system design basis has been changed under the provisions of 10 CFR 50.59 to reflect the potential for supply temperature to elevate to 1204 F during a single train 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> cooldown.
The effects of higher temperatures on safety-related components served by CCW during a postulated single train 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> cooldown were evaluated and generally found to be acceptable.
Flows to some components were increased slightly to accommodate higher temperatures and plant operating procedures were revised to reflect the higher maximum CCW temperature.
Had we chosen to treat this as an emergency condition, which would have been consistent with the definitions in UFSAR table 2.9-1, no piping modifications would have been required due to the higher stresses allowed for emergency conditions.
- However, we conservatively chose to classify the CCW temperature excursion during a single train 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> cooldown as a normal design condition
1
) +
~
~ ~
Attachment 2 to AEP:NRC:1260G3 Page 4
with regard to piping system
- design, and therefore, four piping supports required modification.
Conclusion Analysis confirmed that a single train of RHR/CCW/ESW is capable. of cooling down the reactor coolant system in 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.
CONFIRMATORY ACTION LETTER ISSUE NO.
4 ES-1.3 S~itchover to Recirculation Sum Procedure Commitment Changes to the emergency procedure used for switchover of the emergency core cooling and containment spray pumps to the recirculation sump willbe implemented.
These changes willprovide assurance there will be adequate sump
- volume, with proper consideration of instrument bias and single failure criteria.
Resolution ES-1.3, Revision 5,
was
- prepared, validated, and all operating crews trained on its use.
This revision reasonably assures an adequate recirculation sump level and eliminates the potential single failure vulnerability that existed during the transition from injection to recirculation.
The RWST water level tap was relocated to negate the adverse velocity effects that may have resulted in significant bias in the RWST level reading.
A dynamic analysis of recirculation sump inventory was performed using ES-1.3, revision 5, that demonstrated the recirculation sump level would be maintained above the minimum vortex height throughout the recirculation phase of accident mitigation.
The RWST, recirculation
Back round During the AE design inspection, a number of issues were addressed relative to in-progress changes to Emergency Operating Procedure OHP 4023.ES-1.3, Revision 4.
This procedure would be used to direct the switchover from the injection to recirculation mode of operation in response to a postulated loss-of-coolant accident.
The plant could have been vulnerable to a single active failure of a
RHR pump that could adversely affect the performance of the centrifugal charging and safety injection pumps during a SBLOCA.
This vulnerability only existed for a short duration, estimated to be less than 15 minutes, during the accident mitigation sequence while transitioning from injection to recirculation.
A related issue is the RWST level instrument bias and the distribution of RWST water once inside the containment.
The RWST level tap, located on the ECCS pump suction piping, is a non-standard configuration.
The flow in the pipe during the injection phase results in lower indicated RWST level.
This had the potential of reducing the water volume transferred from the tank to the containment.
The problems regarding distribution of RWST water once inside the containment are discussed under CAL issue no.
1.
Attachment 2 to AEP:NRC:1260G3 Page 5
A~081 sls The analyses performed for this CAL issue were the same as presented in our response to CAL issue no.
1.
ES 1.3 was revised to assure delivery of adequate water to the containment to meet safety analysis requirements and to eliminate the single failure concerns identified during the inspection.
Analyses were performed to demonstrate that there is sufficient containment water level to meet accident analysis requirements and preclude vortexing or air entrainment of the RHR and containment spray pumps throughout the recirculation phase of a
postulated loss-of-coolant accident (LOCA).
The RWST level instrument velocity bias was eliminated when the level tap was relocated to a static location.
The revised ES-1.3 was validated on the plant simulator and all licensed operating crews have been trained on its use.
Conclusion ES-1.3, Revision 5, that eliminated the potential single failure vulnerability, was conditionally approved pending the receipt of the proposed T/S and bases changes submitted in AEP:NRC:0900K.
Analyses results show that there will be sufficient water in the recirculation sump throughout the recirculation phase of accident mitigation and that ECCS and CTS pump performance will not be adversely affected.
CONFIRMATORY ACTION LETTER ISSUE NO.
5 Cpm ressed Air Ove ressure Commitment Overpressure protection will be provided downstream of the 20 psig, 50 psig, and 85 psig control air regulators to mitigate the effects of a postulated failed regulator.
Resolution A design change was implemented to install redundant overpressure relief capability on all of the control air headers (20 psig, 50 psig, and 85 psig)
Safety related systems and components supported by the control air system are operable.
Back round Questions were raised during the AE design inspection regarding the lack of overpressure protection on the 20 psig, 50 psig, and 85 psig control air headers.
The questions stemmed from the configuration of the control air system's central pressure regulation, and whether a potential existed for a single non-conservative failure of both trains of safety related equipment served by the headers should an overpressure condition occur due to regulator failure.
The initial investigation determined that numerous components on individual headers were not rated for the full system initial pressure, and that this postulated failure mode was not considered in the original design.
p s ~
Attachment 2 to AEP:NRC:1260G3 Page 6
A~nal sis A failure modes review of the control air system design at the component level was performed for safety related components.
The review concluded the as-found configuration of the non-safety related control air system was inconsistent with the general design criteria relative to single failure protection.
The original design considered a loss of control air and positioned the safety related components to their "fail safe" positions.
- However, a
single failure of a pressure regulator on the 20 psig header could partially misposition several safety related valves including both of the RHR heat exchanger outlet valves.
A design change was implemented to install redundant safety relief valves on each of the twenty control air pressure regulating stations.
Conclusion The results of our review concluded that a potential existed for a single failure of a
pressure regulator to cause valves to misposition and adversely affect system flow.
Safety valves have been installed to address the potential overpressure condition.
Therefore, failure of the control air system due to the lack of overpressure protection will not result in safety related system inoperability.
CONFIRMATORY ACTION LETTER ISSUE NO.
6 Residual Heat Removal Suction Valve Interlock.
Commitment A T/S change to allow operation in mode 4, hot standby, with RHR suction valves open and power removed is being processed.
Approval of this change by the NRC will be required prior to restart.
Resolution A proposed T/S amendment was submitted under AEP:NRC:1278 that eliminates the need for the RHR suction valve interlocks when in a shutdown cooling configuration.
Back round The RHR system suction valves from the reactor coolant system (RCS) are interlocked through separate channels of RCS pressure signals to provide automatic closure in the event RCS pressure exceeds RHR system design pressure.
During shutdown conditions, these interlocks are effectively defeated by removing power to the valves to prevent a loss of RHR cooling due to inadvertent valve closure.
The interlocks are unnecessary in this configuration as overpressure protection is provided by the low temperature overpressure protection system (LTOP).
While this configuration improved the reliability of the RHR system during shutdown conditions, and the surveillances of the interlocks were performed in accordance with T/Ss, the removal of power to the valves was not in compliance with T/S requirements.
Attachment 2 to AEP:NRC:1260G3 Page 7
Conclusion The RHR system was always provided with overpressure protection by the LTOP
- system, even when the suction valve interlock was effectively defeated.
A proposed T/S amendment has been submitted to allow continued operation in this configuration during shutdown conditions.
CONFIRMATORY ACTION LETTER ISSUE NO.
7 Fibrous Material in Containment Commitment Removal of fibrous material from containment that could clog the recirculation sump will be completed.
Resolution Fibrous insulation material that could clog the recirculation sump is being removed.
Back round Fibrous insulation was identified in cable trays in the containments by an NRC inspector.
Subsequent research identified the use of Fiberfrax as damming material for cable tray fire stops in 27 containment locations (12 in unit 1 and 15 in unit 2).
These cable trays are in the annulus and instrument
- rooms, which do not
-communicate freely with the active volumes of the containment sump.
A~nal sis Containment inspections were conducted in each unit.
These inspections identified locations where fibrous insulation (Temp-Matt) was installed in configurations in which the material could potentially be transported to the recirculation sump screen during the recirculation phase of a postulated LOCA.
- Some, but not all, of this material was encapsulated with a stainless steel jacket.
Unencapsulated fibrous insulating materials have been removed from the lower containment (active sump) in both units.
Fiberfrax used in the cable tray fire stops has also been removed in both units.
A few known locations have encapsulated Temp-Matt insulation. Most of this encapsulated Temp-Matt is on the main steam and feedwater pipes inside the steam generator enclosures.
UFSAR accident analyses for main steam and feedwater line break accidents do not utilize the recirculation sump to mitigate the consequences.
Encapsulated Temp-Matt covering the pressurizer safety valves in both units and under the unit 2 pressurizer is also being removed.
Conclusion Fibrous insulation materials identified during the containment inspections were or will be removed, or determined not to represent an impact to the containment recirculation sump.
p
~ ~
Attachment 2 to AEP:NRC:1260G3 Page 8
CONFIRMATORY ACTION LETTER ISSUE NO.
8 Refuelin Water Stora e Tank MiniflowRecirculation Lines Commitment Only two of six miniflow recirculation -line valves have leakage verification tests.
Justification will be provided that the total leakage for the six valves is less than 10 gpm to ensure 10 CFR Part 100 dose rates are not exceeded if containment sump water were to leak back to the RWST during a design basis accident.
Resolution Testing was performed on the valves that were not previously tested for potential leakage back to the RWST.
The test results showed that the total leakage for these paths back to the RWST was well below the 10 gpm value in the UFSAR.
Back round During the AE design inspection, questions were raised regarding the adequacy of surveillance testing related to valves in flowpaths back to tanks vented to atmosphere during the recirculation phase of a LOCA.
There are eight valves in four flow paths that provide a boundary to the RWST during the recirculation phase of a LOCA.
Two of the previously tested valves are on the safety injection minimum flow line to the RWST.
The third valve is the RHR return valve to the
The five valves not previously tested are at the suction to the safety injection and charging pumps.
The results of these tests indicated that no seat leakage existed for five of the six valves and that leakage from the sixth valve was insignificant (worst case in unit 2 - 0.46 gpm) when compared to the allowable leakage rate (10 gpm).
Requirements to perform seat leakage testing for these valves have been added to our ISI program.
Conclusion Based on the as-found test results, the total leakage for these paths back to the RWST was well below the 10 gpm value in the UFSAR.
Requirements to perform enhanced seat leakage testing for the identified valves have been added to our ISI program.
ATTACHMENT 3 TO AEP:NRC:1260G3 SPECIFIC RESOLUTION OF INSTRUMENT UNCERTAINTY ISSUE IN THE CONFIRMATORY ACTION LETTER
Attachment 3 to AEP:NRC:1260G3 SPECIFIC RESOZUTZON OF INSTRUMENT UNCERTAINTY ISSUE Page 1
Instrument Uncertaint Inco orated into Procedures and Anal ses Emergency procedures and other important-to-safety procedures, calculations, or analyses will be reviewed to account for instrument uncertainties.
Implementation of an expanded instrument uncertainty program willprovide the methodology for performing the review.
This program is scheduled for completion in 1998.
Instrument Uncertaint Pro ram - Descri tion An expanded instrument uncertainty program has been developed to address the instrument uncertainty issues raised during the AE design inspection and generic industry issues.
The expanded program was discussed with the NRC on November 10, 1997.
The scope of the program will include:
reactor trip and engineered safety feature actuation system setpoints, emergency and abnormal operating procedure operator decision
- points, operations and test procedures used to verify technical specif ication (T/S) compliance, 4.
plant performance data used in safety analyses, and 5.
setpoints for plant alarms associated with monitoring T/S compliance.
A plant specific methodology manual will be developed to specify methods used to calculate instrument uncertainties.
This manual will be an expansion of the existing engineering guide for calculating instrument uncertainties.
Branch technical position HICB-12, "Guidance on Establishing and Maintaining Instrument Setpoints", will be used as a reference in developing the manual.
This manual will be used in preparation of new instrument uncertainty calculations and calculation revisions.
Uncertainty calculations will be reviewed using a checklist based on the methodology manual and guidance from NRC inspection procedure
- 93807, "Systems Based Instrumentation and Control Inspection".
This review will check that process measurement effects are considered in these calculations.
It will also check that the existing calculations meet current NRC guidelines.
Administrative controls are being developed to.
assure that instrument uncertainties are considered in development or revision of procedures, calculations, and analyses.
This program expansion will be integrated with the normal operating procedure upgrade program that was committed to in our submittal AEP:NRC:1260H, dated September 15, 1997.
Both programs will be completed in 1998.
Attachment 3 to AEP:NRC:1260G3 Page 2
Current Pro ram Status Since September, many of the initial program activities have been completed.
The level instrument taps on the refueling water storage tank have been relocated to eliminate the velocity-induced errors.
Other level indications have been reviewed to provide reasonable assurance that there are no other significant velocity induced errors.
Over twenty uncertainty calculations have been generated or revised.
The operations department shiftly surveillance procedure has been revised to incorporate instrument uncertainties into acceptance criteria for T/S related parameters.
A critical parameters list containing parameters related to T/S compliance or operability of T/S systems has been generated.
Revisions to the existing "as found reportable" program procedures utilizing this list are scheduled to be completed by January 15, 1998.
These revisions are designed to assure that the instrument uncertainty program will be integrated in the procedure revision cycle, thus assuring that the program remains current.
The instrument uncertainty program is being integrated with the normal operating procedure rewrite and with the emergency operating procedure review.
An internal audit of the program is scheduled for February, 1998.
ATTACHMENT 4 TO AEP:NRC:1260G3 SHORT TERM ASSESSMENT PROGRAM
Attachment 4 to AEP:NRC:1260G3 Page 1
SHORT TERM ASSESSMENT PROGRAM Short Term Assessment Pro ram Develo ment Because of the importance and potential implications of the AE design inspection, a further assessment to determine the extent of similar issues was considered essential prior to restart of the Cook Nuclear Plant units.
Specifically, an assessment was conducted to determine whether similar issues may exist in other safety related systems, and if they do, whether they affect system operability.
The first task in the assessment was to categorize the types of issues found during the inspection.
This task was accomplished in three steps.
~
Independent teams comprised of our nuclear generation group and contractor personnel conducted root cause evaluations of the eight individual confirmatory action letter (CAL) issues.
Causes that indicated a generic implication with a potential for direct impact on operability were identified for further evaluation.
Each of these root cause evaluations received at least one additional independent review.
~
The root causes identified by the eight teams were then reviewed by a group of senior managers and staff in several working sessions.
Implications of the various root causes were identified and discussed, with particular attention given to causes with potentially broader implications.
~
The final step involved evaluating and identifying issues that have the potential to impact operability of other safety systems'he following issues were identified and addressed:
~
some analyses found to contain errors and incorrect assumptions, some containment attributes, such as those related to sump performance, not adequately preserved, lack of consideration of a credible failure mode on a non-safety related system interfacing with safety related
- systems, lack of consideration of level instrument bias due to Bernoulli effect, and
~
improper application of single failure criteria.
The next task was to identify specific actions necessary to determine whether these five issues were present in other safety
- systems, and if they were, whether operability of the systems was affected.
Action plans were endorsed by senior management and staff and were approved by the nuclear safety and design review committee.
Concurrent with development and implementation of the short term assessment program described
- above, other questions raised during the AE design inspection that had not been included as CAL issues were being resolved under our corrective action program.
The investigations and root cause determinations associated with these
Attachment 4 to AEP:NRC:1260G3 Page 2
issues were reviewed by senior management and compared to the CAL item short term assessment program.
The issues reviewed in this manner included:
~
lake temperature design basis discrepancies, lake temperature effect on control room ventilation, unit 2 full core off-load with concurrent component cooling water (CCW) dual train outage, restriction of CCW temperature to 90' during unit 2 full core off-load, refueling water storage tank (RWST) minimum volume for Appendix R,
~
2-CD battery cell left on charge for an extended period,
~
code discrepancies in CCW system safety valves, and
~
procedures allowing both RHR pumps to run with the reactor coolant system vented, that conflict with the UFSAR.
No additional issues that would adversely impact system operability were identified during this review.
- However, some specific actions were added to the existing short term assessment program to ensure concerns were adequately enveloped.
Short Term Assessment Pro ram Results En ineerin Issue No.
1 Some analyses were found to contain errors and incorrect, assumptions.
The action plan to address this issue consisted of three principal activities.
- First, during the AE design inspection, we sent a
seven-member team to the Westinghouse offices to review the analyses of record for both Cook Nuclear Plant units.
A broad based sample of calculation packages was reviewed and questions resolved with the analysts.
The intent was to provide reasonable assurance that the errors found in the unit 2 uprating analysis were not indi:cative of a problem in our Westinghouse analyses.
Although the team identified some discrepancies, the overall conclusion was that the analyses results remain acceptable.
None of the findings resulted in
- system, structure, or component inoperability.
A second effort concentrated on the specific concern related to improper modeling of the CCW heat exchangers in the cooldown analysis.
While at Westinghouse, the same team confirmed that other major safety related heat exchangers had been modeled correctly in our Westinghouse analyses.
We confirmed that Holtec International, who performed the analysis of record for the spent fuel pool cooling system, correctly modeled the SFP heat exchanger.
Our analyses were also reviewed to determine if safety related heat exchangers had been properly modeled.
This review concluded that three heat exchangers were incorrectly modeled in our analyses.
Specifically, the CCW heat exchanger,
C t ~
Attachment 4 to AEP:NRC:1260G3 Page 3
diesel generator jacket water cooler, and diesel generator lube oil cooler were modeled as counterflow heat exchangers, when in reality they are TEMA-E design.
This is the same circumstance identified for the original cooldown analysis.
Review indicated that these additional heat exchangers were still capable of performing their function despite the modeling error.
These reviews of vendor and our own analyses allow us to conclude with reasonable assurance that incorrect heat exchanger modeling did not impact operability of safety systems at Cook Nuclear Plant.
The third action plan addressed the more generic concern with the quality of our calculations by using a peer review process.
Peer groups made up of engineering management and experienced engineering personnel of diverse backgrounds reviewed a total of 191 calculations.
Of this total, 171 were calculations performed or reviewed to support resolution of AE design inspection findings.
These were focused primarily on the CCW system and various aspects of emergency core cooling system (ECCS) performance, including RWST and containment volume related calculations.
Another 20 calculations were chosen from previous calculations for the auxiliary feedwater (AFW),
- CCW, chemical volume and
- control, containment spray, essential service water, residual heat removal, and electrical distribution systems.
It should be noted that 143 of the 171 calculations associated with resolutions of AE inspection findings were either structural calculations or instrument loop uncertainty calculations.
Both types are repetitive in nature, follow an established
- format, and have fairly standard assumptions.
Few problems were identified in these calculations.
Twenty-eight of the 171 and all of the 20 historic calculations from other systems were performance-type calculations.
Some administrative and minor technical concerns were identified, but in no case did the concerns affect operability of any components or systems.
En ineerin Issue 2
Lack of consideration of a credible failure mode on a non-safety related system interfacing with a safety related system.
This issue was selected for evaluation based on our failure to consider the impact of control air system over-pressurization on safety system components served by control air during the initial design of the control air system.
The action plan consisted of three parts:
- 1) performing additional failure modes review of the control air system,
- 2) identifying other non-safety related systems that warrant a short term failure modes review, and 3) performing failure modes and effects review of selected systems.
In addition to the detailed evaluation of possible effects of over-pressurization performed in conjunction with CAL issue no. 5, other credible failure modes for the control air system were revisited.
The review considered complete loss of air, partial loss of air, and underpressurization.
~
Loss of air was the clearly stated failure mode in the original design, and the recent review concluded that safety systems were adequately protected against this occurrence in that all components go to a fail-safe position on loss of air.
Attachment 4 to AEP:NRC:1260G3 Page 4
~
The review of partial loss of air (e.g.
- losing the 20 psig header but not the 50 psig header) determined that the original design had considered the loss of either the motive or signal air to a device.
Loss of either air supply will place the device in its fail-safe position.
However, in one
- instance, we discovered that a recent design change had not preserved this concept.
The design change to modify the safety related fan dampers resulted in the bypass and charcoal bed inlet dampers being supplied by two separate air supply headers.
Given the normal configuration of these
- dampers, (i.e.,
bypass damper-open, charcoal bed inlet dampers-closed),
a failure of the bypass damper air supply would have resulted in the damper closing and no flow path through the safety related fan unit.
A design change to correct this situation was implemented.
No other concerns due to partial loss of air were identified.
~
Review of underpressurization effects confirmed that, if affected at all, devices will move toward their fail-safe positions when supply pressures of either motive or signal air fall below minimum required values for their called upon positions.
Further protection is provided by underpressure alarms on the 100 psig air supply and by procedural guidance for operators to manually trip a unit if the air supply pressure drops to 80 psig and unit conditions are unstable.
Based on the recent control air system modifications and the additional review of failure modes on the control air system, we have reasonable assurance that single failure of a control air system component will not result in common mode failure of redundant safety related equipment.
Other non-safety related systems that interface with safety related systems include reactor
- control, non-safety related electrical distribution, main
- steam, condensate and feedwater, circulating water, non-essential service water, and pressurizer heaters.
These systems were screened to determine if there was a basis for performing a more in-depth review.
The screening considered how the non-safety related system interfaced with safety related equipment and whether there was any credible failure mode that would render safety related components inoperable.
Zf so, further review was warranted to ensure that common mode failures had been adequately addressed.
Using this approach, the reactor protection system and the pressurizer heaters were selected for review as part of the short term assessment.
The pressurizer heater system design was reviewed for potential adverse impact on the pressurizer system itself.
Failure modes addressed were open circuit, short circuit, and high or low voltage.
The review concluded that these failure modes were adequately accounted for in the system design.
No concerns were identified.
The reactor control system was selected for review because many of the inputs are derived from the safety related reactor protection system and because the system was replaced in 1992 by an upgraded digital system.
Prior failure modes analyses and other documentation for both the reactor control system and the reactor protection system were reviewed.
The reports indicate that an adequate and thorough review of the reactor control system.was previously performed using accepted industry guidance, and that no
Attachment 4 to AEP:NRC:1260G3 Page 5
new failure modes were introduced by the replacement of the original system with a digital one.
The review concluded that the design of the reactor control system adequately addresses credible failure modes.
In
- summary, the reviews described above provide reasonable assurance that single failure of a
non-safety related system component at Cook Nuclear Plant will not result in common mode failure of redundant safety related equipment.
En ineerin Issue 3
Lack of consideration of level instrument bias due to the Bernoulli effect.
A review was performed of the potential operational impact of flow induced errors on all safety related level instrument installations.
The list was refined based on the type of level instrument, the installed location on the
- piping, and the anticipated flow velocities.
Three safety related instrument loops were identified where potential flow induced errors may exist.
These were the condensate storage
- tank, the mid-loop RCS level instruments, and the reactor vessel level indication system.
No adverse impacts on system operability were identified related to any of these level instrumentation configurations.
En ineerin Issue 4
Some containment attributes, such as those related to sump performance, have not been adequately preserved.
This issue was approached by an effort that was designed around the walkdowns of both containments by individual members of a multi-disciplinary team.
The team included our employees as well as contractors with extensive containment, design and nuclear steam supply system experience.
Appropriate follow-up actions were taken to resolve or disposition the questions raised by each person.
Prior to the walkdowns, the team was given an overview of the containment functions, briefed on the containment concerns raised during the AE design inspection, and on subsequent findings by NRC Region III personnel.
The team looked for potentially adverse conditions, including those
- that, could pose a
challenge to recirculation sump performance (for example, foreign material or degraded coatings).
Results of the walkdown confirmed previously raised issues relative to the recirculation sump design, including effective sump screen area and definition of credible debris impacts to the sump.
These particular issues are addressed in conjunction with CAL issue no.
7 regarding fibrous material in containment.
Other design questions posed as a result of these walkdowns were assessed and determined not to represent a challenge to performance of the containment systems.
Material condition issues noted as a result of the walkdowns will be dispositioned under the plant work control process.
The walkdowns did not result in any additional operability concerns with respect to recirculation sump performance or other design attributes of the containment.
Attachment 4 to AEP:NRC:1260G3 Page 6
En ineerin Issue 5
Improper application of single failure criteria.
After the AE design inspection team identified the improper application of single failure criteria in the revision of our procedure for switchover of the ECCS system to recirculation configuration, action was taken to establish further guidance for application of the single failure criteria for Cook Nuclear Plant.
Appropriate personnel have been trained on this guidance.
With this guidance as the standard, system design and operation documents were reviewed.
Of particular interest was the postulated "failure to run" that precipitated the issue with our ECCS switchover procedure.
Westinghouse and our technical reviewers have concluded that both AEP and Westinghouse designed systems accommodate single active failure to run, start, or stop without loss of redundancy.
A contributing factor to the ECCS switchover procedure issue (see CAL issue no.
4) was the aspect of the design that crossties the ECCS system trains through a
common recirculation suction source for the intermediate and high head injection pumps.
We performed a review of other safety systems with crosstie capabilities, either between trains or between units, to provide reasonable assurance that single failure criteria have been appropriately considered and that procedures allowing the use of the crossties have been properly evaluated.
Systems reviewed were AFW, essential service
- water, chemical and volume
- control, CCW, and electrical distribution.
Procedures allowing use of unit crossties for AFW,
an Appendix R
fire) where equipment on one unit is needed to supply services to the other, emergency-affected unit. If such a condition were to
- occur, a
T/S limiting condition for operation (LCO) would be entered for the equipment supplying services to the other unit, and the appropriate action statements would be followed.
The ESW systems are normally operated with unit crossties
- open, such that a unit 1 pump feeds one train, and a unit 2 pump feeds the other train.
This mode of operation poses no concerns to system operability except in the event of certain emergency conditions that would, as described above, necessitate entry into a LCO action statement.
Although the review of system and unit crosstie capabilities identified that some supporting documentation was incomplete or missing, further review confirmed that the systems when crosstied in accordance with existing procedures were operable.
In some
- cases, procedure enhancements to ensure conservative use of safety system crosstie capabilities will be implemented.
Other than intended entries into a LCO action statement to mitigate an emergency situation, no operability concerns were identified with the use of safety system crossties.
Previous Safet S stem Functional Ins ections SSFIs The results of extensive functional inspections of safety systems previously conducted were reviewed, with the AE design inspection
Attachment 4 to AEP:NRC:1260G3 Page 7
issues in mind, to augment our short term assessment program.
Although the inspection names have varied somewhat, each has been based on a version of NRC Inspection Procedure
- 93801, "Safety System Functional Inspection," which, in its current revision, has two stated objectives:
~
"To assess the operational performance capability of selected safety systems through an in-depth, multi-disciplinary engineering review to verify that the selected systems are capable of performing their intended safety functions.
Generic safety significant findings are pursued across the system boundaries on a plant-wide basis."
"To determine the program-related root cause for identified performance deficiencies and analyze the implications of these deficiencies on the licensee's quality assurance program."
The results of previous SSFI type inspections were reviewed to provide additional assurance that safety systems are operable.
As shown in the following table, functional inspections of most major safety systems were conducted prior to the recent NRC AE design inspection.
Safety System Inspections Conducted Inspection Auxiliary Feedwater SSFI Essential Service Water SSFZ Ventilation SSFZ Electrical Distribution System Functional Znspection Containment Spray System SSFZ Component Cooling Water SSFI Service Water System Operational Performance Inspection System Operational Performance Inspection Covering Centrifugal Charging Pump Portion of ECCS,
- CVCS, and RHR Systems Date Jul-Aug 1987 Jun-Jul 1990 Oct 1991 Feb-Mar 1992 Jun 1992 Sep-Oct 1993 May 1995 Nov-Dec 1996 Performed By AEP/WESTEC NRC" AEP/ERCE AEP/OGDEN AEP/CYGNA NRC AEP/CYGNA SSFIs previously performed concluded that the systems were capable of fulfillingtheir intended design function.
(Note: during the first SSFZ conducted on AFW, a discrepancy was identified in fuse breaker coordination.
As documented in the licensee event report associated with the discrepancy, the issue was not considered to represent a significant risk to public health and safety.)
The results of these in-depth inspections provide additional confidence as to the operability of safety related systems at Cook Nuclear Plant.
Attachment 4 to AEP:NRC:1260G3 Page 8
Recent UFSAR Accident Regnal sis Additional confidence regarding the ability of safety systems to perform their intended functions is provided by the fact that significant portions of UFSAR Chapter 14, accident analyses (LOCA and non-LOCA), have been reanalyzed by Westinghouse as part of our programs to allow 30%
steam generator tube plugging in unit 1
(1995) and a 5% increase in thermal power for unit 2 (1996).
Conclusion While the short term assessment results identified engineering
- issues, none challenged operability.
These results firmly support our conclusion that there exists reasonable assurance that problems of the type found during the AE design inspection do not impact the operability of other safety systems.
This conclusion is further supported by the results of functional inspections of safety systems previously conducted that concluded the systems inspected were capable of fulfillingtheir intended safety function, and the fact that significant portions of the UFSAR Chapter 14, accident analyses (LOCA and non-LOCA), have been reanalyzed recently.
ATTACHMENT 5 TO AEP:NRC:126083 COMMITMENTS
Attachment 5 to AEP:NRC:1260G3 Page 1
The following are specific commitments associated with this response to the confirmatory action letter.
No other statements should be considered to be regulatory commitments.
We will implement revision 5 to procedure OHP 4023.ES-1.3, Transfer to Cold Leg Recirculation, upon receipt of technical specification amendments proposed in letter AEP:NRC:0900K (see attachment 2, issue no. 4).
2.
We will implement an expanded instrument uncertainty program, integrated with the normal operating procedure upgrade program.
The program will be completed in 1998 (see attachment 3).
Temp-Matt insulation covering the pressurizer safety valves in both units and under the unit 2 pressurizer will be removed (see attachment 2, issue no. 7).
'f(
0 4
hq 0