ML17334B675

Documents Info Re Three Specific Issues Discussed at 971222 Meeting.Attachment 1 to Ltr Contains Root Cause Analysis & Short Term Assessment Program Development

ML17334B675
Person / Time
Site:	Cook
Issue date:	12/24/1997
From:	Fitzpatrick E INDIANA MICHIGAN POWER CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
AEP:NRC:1260G4, CAL, NUDOCS 9801050374
Download: ML17334B675 (114)

Text

CATEGORY 1 REGULATO INFORMATIOh DISTRIBUTION SYSTEM (RIDS)

ACCESSION NBR:9801050374 DOC.DATE: 97/12/24 NOTARIZED: NO DOCKET FACIL:50-315 Donald C.

Cook Nuclear Power Plant, Unit 1, Indiana M

05000315 50-316 Donald C.

Cook Nuclear Power Plant, Unit 2, Indiana M

05000316 AUTH.NAME AUTHOR AFFILIATION FITZPATRICK,E.

American Electric Power Co., Inc.

+ gp2 RECIP.NAME RECIPIENT AFFILIATION Document Control Branch (Document Control Desk)

I.

SUBJECT:

Documents info re three specific issues discussed at 971222 C

meeting. Attachment 1 to ltr contains root cause analysis short term assessment program development.

A DISTRIBUTION CODE:

IE36D COPIES RECEIVED:LTR i

ENCL I

SIZE: 0 l TITLE: Immediate/Confirmatory Action Ltr (50 Dkt-Other Than Emergency Prepar E

NOTES:

RECIPIENT ID CODE/NAME PD3-3 PD INTERNA

. FILE CENTER 1

EXTERNAL: NOAC COPIES LTTR ENCL 1

1 1

1 1

1 1

1 RECXPIENT XD CODE/NAME HICKMAN,J NRR/DRPM/PECB NRC PDR COPIES LTTR ENCL 1

1 1

1 1

.1 D

U E

N NOTE TO ALL "RIDS" RECIPIENTS:

PLEASE HELP US TO REDUCE WASTE. TO HAVE YOUR NAME OR ORGANIZATION REMOVED FROM DISTRIBUTION LISTS OR REDUCE THE NUMBER OF COPIES RECEIVED BY YOU OR YOUR ORGANIZATION, CONTACT THE DOCUMENT CONTROL DESK (DCD)

ON EXTENSION 415-2083 TOTAL NUMBER OF COPIES REQUIRED:

LTTR 7

ENCL 7

44 Indiana Michigan Power Company 500 Circle Drive Buchanan, Ml 491071395 IItIOIANA MICHIGAN IrQBfM December 24, 1997 AEP:NRC:1260G4 Docket Nos.:

50-315 50-316 U.S. Nuclear Regulatory Commission ATTN:

Document Control Desk Mail Stop 0-Pl-17 Washington, DC 20555-0001 Gentlemen:

Donald C.

Cook Nuclear Plant Units 1 and 2

CONFIRMATORY ACTION LETTER (CAL) SUPPLEMENTAL RESPONSE On December 16,

1997, a public meeting was held with the NRC to discuss issues associated with the NRC's confirmatory action letter dated September 19, 1997.

Subsequent to the

meeting, we were informed that further information regarding three specific issues was needed.

These issues were the root cause analyses we performed for the architect engineering (AE) inspection items and the development of our short term assessment

program, our 10 CFR 50.59

program, and calculations reviewed as part of the short term assessment program.

These issues were discussed with the NRC staff at a

meeting held in Lisle, Illinois on December 22, 1997.

ra AQUA i Jvv.

At that meeting, we agreed to perform additional reviews of design

changes, procedure

changes, and 10 CFR 50.59 screenings to review for the types of problems identified during the AE inspection.

The results of this review will be forwarded to the NRC under separate correspondence.

While the additional 10 CFR 50.59 reviews and our short term assessment represent specific actions taken to ensure that the types of problems found during the AE design =inspection do not affect the operability of other safety systems, we also recognize that operability and maintenance of design basis are continuous processes.

As a licensee, we must continually assess plant and external conditions to assure ourselves that systems remain within their licensing and design

bases, and where instances of degradation or non-conformance are identified, we must expeditiously evaluate operability of potentially affected equipment.

A questioning attitude by our staff ensures that safety reviews, calculations, and procedures are challenged.

As an example, at least,131 condition reports by five different plant organizations have been

issued, since the AE design inspection, to document potential discrepancies of a

type similar to those identified during the inspection.

This includes discrepancies found in the UFSAR.

Additionally, condition reports open at the time of the inspection were reviewed with increased awareness of the design and licensing basis.

'hose 'ondition reports that documented conditions having the potential to adversely impact the design or licensing bases or operability were identified and flagged for resolution prior to entry into a mode where the condition is applicable.

980%050374 971224 PDR ADQCK 050003i5 P

PDRQ IIIIIIIIIIIIIIII,llllilllilllllllllill

U.S. Nuclear Regulatory Commission Page 2

AEP: NRC: 1260G4 This letter dockets the information related to the three specific issues discussed at the December 22,

1997, meeting.

Attachment 1

to this letter contains the root cause analysis and short term assessment program development.

Attachment 2

contains our 10 CFR 50.59 program.

Attachment 3

contains the calculation review program.

Attachment 4 documents the presentation materials for our response to the confirmatory action letter issues that were provided during the December 16, 1997, public meeting.

Sincerely, g-Q4 E.

E. Fitzpatrick Vice President

/vlb Attachments A. A. Blind A. B. Beach MDEQ -

DW & RPD NRC Resident inspector J.

A. Abramson

ATTACHMENT 1 TO AEP:NRC: 1260G4 ROOT CAUSE ANALSYIS AND SHORT TERM ASSESSMENT PROGRAM DEVELOPMENT

Short Term Assessment Program Introduction In Confirmatory Action Letter No. RIII-97-011, the NRC Region III Administrator stated, "Lastly, given the limited scope ofour inspection and its substantial findings, it is necessary to determine the extent of problems and their potential impact on other systems.

It is my understanding, in the short term, you will perform an assessment to determine whether these types of engineering problems exist in other safety related.

systems and whether they affect system operability."

This paper documents the approach taken to develop the short-term assessment program.

In particular, it captures the process used to identify the engineering issues to be addressed and provides rationale for selecting specific short-term actions for each engineering issue.

In keeping with the guidance of the CAL, the short-term assessment is intentionally focused on operability ofsystems within the guidelines of'Generic Letter 91-18, Revision 1

and its attachments and references.

Some root causes identified during the investigation of design inspection findings are not relevant to the operability of safety

systems, and were therefore excluded from the short-term assessment program.

The arguments used to exclude some root causes are not intended to downplay the significance of nonconforming conditions found during the design inspection.

We are committed to addressing these important issues in longer-term programs to assure these kinds of engineering problems are promptly identified, thoroughly evaluated, and resolved.

Development Approach Development of the short-term assessment program is shown in Figure 1. The first task in developing the assessment program was to determine what constituted "these types of engineering problems." This task was accomplished in three steps.

1.

Root causes ofissues identified during the design inspection were identified.

Independent teams comprised ofAEP and contractor personnel conducted root cause evaluations ofthe eight individual CAL items.

Root causes ofother concerns identified during the design inspection, but not addressed in the CAL,were determined within the standard framework ofour corrective action'system.

They were independently reviewed.

Additionally, senior industry peers reviewed all root cause investigation reports.

2.

The root causes were reviewed by a group ofsenior managers and staff in several working sessions.

Implications of the various root causes were identified and Page 1 of 13

Short Term Assessment Program Rev. 2 discussed, with particular attention given to causes with potentially broader implications.

3.

The final step involved evaluating and identifying engineering issues that have the potential to impact operability ofother safety systems.

A total offive issues were identified.

The next task was to identify specific actions necessary to determine whether these five issues were present in other safety systems, and ifthey were, whether operability of the systems was affected.

Action plans were endorsed by senior management and staff and were approved by the Nuclear Safety and Design Review Committee.

Identification of"These Types ofEngineering Problems" Ste s

1 and 2-Root Cause Determination and Consideration ofIm lications Root cause determination (Step

1) and consideration of the implications (Step 2) are described in Appendix A for each of the eight CAL items and other design inspection concerns.

Results are summarized in Tables 1 and 2.

A total of 15 design inspection issues were included in the formal root cause determination (Table 1, Column 1).

Although this is less than the number of findings presented in the NRC's design inspection report, in some cases the issues included in our root cause evaluation encompassed multiple findings.

Twenty-two separate root causes or significant contributors were identified (Table 1,

Column 2. (Although there are 24 entries in the column, two are duplicates and in one case the root cause team did not determine a cause.)

Comparing these causes against a simplified diagram of our change processes, represented in Figure 2, reveals that five processes or sub-processes were involved:

design development, configuration management, design documentation, procedure development, and 10 CFR 50.59 safety reviews (Table 1, Column 3).

Ste 3 Identification ofRelevant En ineerin Issues The process or sub-process associated with each cause was broken down further into a descriptive category to identify where or how the process failed (Table 1, Column 4). Of the 22 causes identified, 13 were considered as potentially affecting operability of other safety systems (Table 1, Column 5).

Ofinterest is the fact that eight ofthe causes that did not potentially affect operability of other safety systems fell under the category of "failure to consider UFSAR as top-tier design basis."

These causes were associated with several processes or sub-processes.

Although not specifically included in short-term assessment

actions, our failure to recognize UFSAR information as design basis will be a focus of our longer-term program.

The 13 causes potentially affecting operability were then grouped under their common category (Columns 1 and 2, Table 2). The five broad engineering issues were:

Page 2 of 13

Short Term Assessment Program Rev. 2 1.

Calculation deficiencies 2.

Adverse effects ofnon-safety related systems on safety related systems 3.

Improper consideration ofinstrument bias 4.

Failure to consider and preserve multiple functional design requirements 5.

Failure to properly apply single failure criteria Identification ofSpecific Assessment Actions The five broad issues, ifconsidered in the absence ofexisting knowledge, could generate an extensive list of follow-up items to ensure that they did not render safety systems at Cook Plant inoperable.

For most of these items, however, substantial documentation or other rationale already existed that provided confidence that these potential follow-up items did not significantly impact other systems.

For example, the failure to consider the Bernoulli effect on RWST level measurement suggested that instrument biases in general might be a concern.

However, this concern was dispelled by a review of instrument calculation procedures and instrument calculations that provides confidence that other biases are recognized and are routinely applied.

Therefore, the scope of new actions to undertake prior to restart was focused on assessing the Bernoulli effect on process measurement.

Some issues, such as improper application of single failure criteria could not be limited.

The implications and factors affecting the potential significance and scope of problems associated with each cause were determined (Column 3, Table 2). Consideration ofthese factors allowed the issues to be focused (Column 4, Table 2).

The final statement ofeach issue approved by the NSDRC is as follows:

1.

Some AEP/Westinghouse analyses were found to contain errors.

2.

Lack of consideration of a credible failure mode on a non-safety related systems interfacing with safety related systems 3.

Lack ofconsideration oflevel instrument bias due to Bernoulli effect 4.

Some containment attributes such as those related to sump performance have not been adequately preserved 5.

Improper application ofsingle failure criteria Short-term assessment actions identified and approved for each engineering issue are summarized in Table 3.

Page 3 of 13

Short Term Assessment Program Rev. 2 Summary Development of the short-term assessment program was thorough and rigorous.

Root causes of the CAL items and other issues identified during the design inspection were evaluated.

Substantial documentation or other rationale existed in many cases to limitthe additional actions required prior to restart, and some of the root causes are more appropriately addressed in the longer-term programs aimed at assuring that these kinds of engineering problems are promptly identified, thoroughly evaluated, and resolved.

This latter group includes human performance deficiencies and organizational weaknesses that were recognized to some extent in all ofthe issues, but were not germane to determining the scope and impact of identified problems on the operability of other safety systems.

Satisfactory completion of the short-term assessment actions, coupled. with the existing information used to determine the scope ofthe assessment, provides reasonable assurance that the kinds of engineering problems found during the design inspection do not affect the operability ofother safety systems.

Page 4 of 13

Figure 1

Short-Term Assessment Program Development Design inspection findings Root causes Root causes that could impact operability Existing knowledge (SSFI, surveillances, procedures, etc.)

Issue 1

Issue 2 Issue 3 Issue 4 Issue 5 Short-term assessment actions Short Term Assessment Program Rev. 2 Page 5 of 13

Iden rk activity Perform work Figure 2 - Simplified nge Process Is it a change' Work control Design Basis Licensing Basis Engineering Basis Design Documenfafion Yes Physical change Type of change Operational change Typical change process Gather information Select tools and methods Technical change Select solution Analyze and develop alternative solutions Administrative change Design or Procedure Oevelopmenf

-10 CFR 50.59 Review Potential regulatory impact

~~Yes Is USQD req'd'?

Yes Is the change a USQ?

Submit under 10 CFR 50.92 Obtain NRC approval No No Short Term Assessment Program Rev. 2 Page 6 of 13 Configuration control Implement change

- Configuration Managemenf

Short Term Assessment Program Rev. 2 Table I - Summary and InitialCategorization ofRoot Causes Design Inspection Finding Idcntificd Root Cause or Contributor Related Process or Sub-proccss Category Operability Implications CALItem I:

Recirculation sump inventory CALItem 2:

Recirculation sump cover venting CALItem 3: 36-hour cooldown CALItem 4:

Switchover from injection to recirculation CALItem 5:

Compressed air overpressure Lack ofthorough engineering review Inadequate design control during initial plant design Improper implementation ofwell defined design expectations Foreign material exclusion (FME) protection not installed Design change not properly incorporated into design documentation Design and licensing basis information not retrieved in a timely manner Design parameters for all system conditions were not described in the UFSAR Analysis used an unverified (and incorrect) assumption ofheat exchangertype Lack ofconsideration of Bernoulli effect on level instrumentation Incorrect application of single failure criteria Failure to identify a non-safety system failure mode that could impact safety system components Design development Design development Configuration management Design development Design documentation Design documentation Design documentation Design development Design development Design development Design development Calculation deficiencies Failure to consider multiple functional requirements Failure to preserve multiple functional requirements Failure to consider multiple functional

'equirements Failure to consider multiple functional requirements Failure to consider UFSAR as top-tier design basis Failure to consider UFSAR as top-tier design basis Calculation deficiency Improper consideration of instrument bias Failure to properly apply single failure criteria Adverse effects of non-safety related systems on safety related systems Yes Yes Yes Yes Yes No No Yes Yes Yes Yes Page 7 of 13

Short Term Assessment Program Rev. 2 Table ISummary and InitialCategorization ofRoot Causes (cont'd)

Design Inspection Finding Identified Root Cause or Contributor Related Process or Sub-process Category Operability Implications

'p CALItem6: RHR suction valve interlock CALItem 7:

Fibrous material in containment CALItem 8: Leak back to RWST during recirculation Lake temperature design basis discrepancies Unit 2 fullcore off-load with concurrent CCW dual train outage Restriction of CCW temperature during Unit 2 full, core off-load Processes in place (at the time) did not emphasize the UFSAR, resulting in an inadequate safety review Design change accomplished via procedure revision Lack ofprocedures for implementing an insulation specification Failure to address sump-plugging potential of fibrous insulation material installed in containment Failure to ensure that plant equipment met assumptions incorporated in licensing basis calculations Failure to recognize a'FSAR value as a design basis parameter Failure to recognize inter-relationships between a UFSAR value and other design aspects 10 CFR 50.59 reviews may be inadequate 10 CFR 50.59 reviews may be inadequate Procedure development Procedure development Configuration management Design development Design development 10 CFR 50.59 safety reviews 10 CFR 50.59 safety reviews 10 CFR 50.59 safety reviews 10 CFR 50.59 safety reviews Failure to consider UFSAR as top-tier design basis Configuration management Failure to preserve multiple functional design requirements Failure to consider multiple functional design requirements Calculation deficiencies Failure to consider UFSAR as top-tier design basis Failure to consider UFSAR as top-tier design basis Failure to consider UFSAR as top-tier design basis Failure to consider UFSAR as top-tier design basis Literally inoperable per T/S, but no effect on functionality No Yes Yes Yes No No (see discussion Iil Appendix A)

No (see discussion in Appendix A)

No (see discussion in Appendix A)

Page 8 of 13

Short Term Assessment Program Rev. 2 Table 1-Summary and InitialCategorization ofRoot Causes (cont'tl)

Design Inspection Finding Identified Root Cause or Contributor Related Process or Sub-process Category Operability Implications

'P RWST minimum volume for Appendix R 2-CD battery cell left on charge for an extended period Code discrepancy in CCW system safety valves Procedures allowing both RHR pumps to run with the RCS vented Misinterpretation ofT/S resulted in failure to translate calculation assumptions and results into operating procedures N/Ano cause determined by root cause team Failure to translate design requirements into operating procedures Failure to translate UFSAR requirements into operating procedures Design development N/A Procedure development Procedure development Calculation deficiencies N/A Configuration management Failure to consider UFSAR as top-tier design basis Yes No (see discussion ill Appendix A)

No No Page 9 of 13

Short Term Assessment Program Rev. 2 Table 2-Implications ofRoot Causes Potentially Affecting Operability Broad Category Calculation deficiencies Adverse effects ofnon-safety related systems on safety related systems Improper consideration of instrument bias IdcntiTicd Root Cause (or Contributor)

Lack ofthorough engineering review (From CALItem 1)

Analysis used an unverified (and incorrect) assumption ofheat exchanger type (From CALItem 3)

Failure to ensure that plant equipment met assumptions incorporated in licensing basis calculations (From CALItem 8)

Misinterpretation of T/S resulted in failure to translate calculation assumptions and results into operating procedures (from RWST minimum volume for Appendix R)

Failure to identify a non-safety system failure mode that could impact safety system components (From CALItem 5)

Lack ofconsideration of Bernoulli effect on level instrumentation (From CAL Item 4)

Implications and Factors Affecting Scope ofReview

~ Involved Westinghouse-AEP interface

~ Systems could not be functionally tested

~ First-of-a-kind design

~ Error occurred almost 30 years ago

~ Involved Westinghouse-AEP interface

~ Original error occurred almost 30 years ago

~ Controls need to be in place to assure that assumptions remain valid

~ End use ofcalculation needs to be understood

~ Controls need to be in place to assure that assumptions remain valid

~ Vulnerability is limited to non-safety related systems that interface with safety systems

~ I&Cprocedure includes other bias terms but not velocity effects

~ Calculation review confirmed that other biases are considered

~ 1993 system-based I&C inspection addressed bias Enginccring Issue Some AEP/Westinghouse analyses were found to contain errors.

Lack ofconsideration ofa credible failure mode on a non-safety related system interfacing with safety related systems Lack ofconsideration of level instrument bias due to Bernoulli effect Page 10 of 13

Short Term Assessment Program Rev. 2 Table 2-Implications ofRoot Causes Potentially Affecting Operability (cont'd)

Broad Category Failure to consider and preserve multiple functional design requirements Identified Root Cause (or Contributor)

Inadequate design control during initialplant design (From CALItem I),

Improper implementation ofwell-defined design expectations (From CALItem I)

Design change not properly incorporated into design documentation (From CALItem 2)

Implications and Factors Affecting Scope ofReview

~ Involved Westinghouse-AEP interface

~ Considered unique case Sump cannot be tested, but relies on analysis for demonstrating adequacy Unlike typical cases where analysis is the only tool, this relies on totally plant-specific assumptions and calculations

~ Error occurred almost 30 years ago

~ Design feature is not functionally tested

~ Minoraspect ofa larger design change

~ Design function was negligible, with no impact on operability

~ Feature was functioning outside its discipline (structural feature performing mechanical function)

~ Feature was not tested or part ofinspection program

~ Other structures with mechanical functions are typically controlled, e.g.

doors acting as HELB barriers

~ Containment is the most notable example ofa system that cannot be functionally tested in its accident response mode

~ Search ofmaintenance work system provides assurance that plant mods are not made via work orders; controls exist to prevent unauthorized mods Engineering Issue Some containment attributes such as those related to sump performance have not been adequately preserved Page I I of 13

Short Term Assessment Program Rev. 2 Table 2-Implications ofRoot Causes Potentially Affecting Operability (cont'd)

Broad Category Cont'd from previous page Failure to consider and preserve multiple functional design requirements Failure to properly apply single failure criteria Idcntificd Root Cause (or Contributor)

Foreign material exclusion (FME) protection not installed (From CALItem 2)

Lack ofprocedures for implementing an insulation specification (From CALItem 7)

Failure to address sump-plugging potential of fibrous insulation material installed in containment (From CAL Item 7)

Incorrect application of single failure criteria (From CALItem 4)

Implications and Factors Affecting Scope ofReview

~ Unprotected vent holes were found by NRC resident during a containment walkdown

~ Recent focus on FME has led to better controls since this problem was identified in 1996

~ Contractor work was not closely supervised by AEP

~ Engineering involvement was minimal

~ This problem was found by NRC inspector during a containment walkdown

~ Interpretation ofactive failure definition may have led to error

~ Systems with crosstie capabilities between trains or units are susceptible Engineering Issue Cont'd from previous page Some containment attributes such as those related to sump performance have not been adequately preserved Improper application of single failure criteria Page 12 of 13.

Table 3 - Short Assessment Plan

Purpose:

To determine whether these issues exist in other safety related systems and ifso, whether they affect system operability Engineering Issue Short Term Scope Deliverables Owner Date 1.

Some AEP/Westinghouse analyses were found to contain errors.

2.

Lack ofconsideration ofa credible failure mode on a non-safety related systems interfacing with safety related systems 3.

Lack ofconsideration oflevel instrument bias due to Bernoulli effect 4.

Some containment attributes such as those related to sump performance have not been adequately preserved 5.

Improper application ofsingle failure criteria

~ Conduct assessment ofWestinghouse analyses

~ Confirm that Westinghouse analyses accurately depict the type ofheat exchanger for CCW, RHR, and CTS systems

~ Confirm that Holtec analyses accurately depict the type ofheat exchanger for SFP cooling system

~ Confirm that AEP internal analyses accurately depict the type ofheat exchanger for these same systems

~ Perform peer review ofcalculations referenced in CR 97-2525, calculations performed in support ofrestart, and representative historic calculations from other safety systems

~ Develop rationale for selecting other non-safety related systems for further FMEA

~ Perform FMEAofcontrol air system

~ Confirm that FMEA on reactor control system adequately covered failure modes

~ Perform FMEAofpressurizer heaters

~ Review safety-related tank level indication

~ Review mid-loop monitoring and RVLIS

~ Perform containment walkdown, focusing on factors like those affecting sump performance, especially items which are not surveilled

~ Resolve containment walkdown questions

~ Clarify definition ofsingle failure and incorporate into procedures

~ Verifythat "failure-to-run" was considered in Westinghouse and AEP analyses

~ Verifythat AFW, ESW, CVCS, 250 v. DC, and electrical distribution system crosstie capabilities have been properly evaluated for use in procedures

~ Assessment report

~ Assessment report

~ Letter from Holtec with confirming memo from Malin

~ CR 97-2316

~ Summary report

~ White paper

~ CR 97-2447

~ White paper

~ White paper

~ White paper

~ White paper

~ Walkdown report

~ Summary report

~ List procedures and revise

~ White paper, with Westinghouse letter

~ White paper, including selection criteria Scope Revision 1 Status Updated 11/5/97 9:30 AM Page13 of13

Short Term Assessment Program APPENDIXA Root Cause Determination and Consideration ofImplications Page A-1

Short Term Assessment Program Rev. 2 Appendix A CALItem 1: Recirculation Sump Inventory Ste 1 Root Cause Determination The problem was defined as "minimum required recirculation sump level to protect against pump vortexing could not be assured for all accident conditions."

(Note - The inability to assure adequate sump level was due in part to potential RWST level instrument bias, which was addressed in another investigation.)

Pertinent facts brought forth in the investigation include:

In late 1967, AEP deviated from Westinghouse's original containment spray system (CTS) design of"a four pump, four heat exchanger configuration per unit" and selected a design that utilized the residual heat removal (RHR) system to supplement CTS.

The CTS design also included the addition of lower volume spray headers for iodine removal capability.

Implications of the spray header additions with respect to system performance were not discussed in design memoranda.

~

A September 1968 document discussing containment drainage indicates that the annulus should be designed to exclude recirculation water.

An October 1968 update to the document notes the need to install drains from the accumulator/fan rooms to the active sump.

It also suggests an alternate discharge from the pipe annulus to the recirculation sump "foruse during recirc mode in case of a leak in the safety system piping within the access tunnel."

These documents reflect an incomplete understanding of the containment,

design, as large amounts of recirculation water would be sprayed into the fan accumulator rooms and subsequently drain through the floor gaps and gratings into the pipe annulus.

A Nuclear Safeguards Design Memo from July 1971 addresses the subject of containment flood-up, including the sequence of flooding various containment compartments during a design basis accident.

The memo mentions that 300 gpm flow will be diverted via the accumulator/fan rooms to the pipe annulus.

The sequence described does not mention entry'of water into the accumulator/fan rooms or pipe annulus until after the lower containment (inside the crane wall),

lower reactor cavity, and seal table area are filled, at which time water spills into the accumulator/fan rooms.

The section of the memo titled "Small Loss-of-Coolant Accident Flood-up" states that the flood-up sequence is the same as the design basis accident case.

The review uses the design basis flood-up scheme to conclude that there will be sufficient NPSH to accomplish the switchover to recirculation phase when needed.

~

In Question 212.29 of FSAR Appendix Q, the NRC requested a detailed description of our calculations for the ECCS pumps during LOCA conditions.

The calculation provided assumes that the entire volume of the RWST from the minimum level to the low alarm level is transferred to the active sump, resulting in flood-up to elevation 602'-10" in containment.

Page A-2

Short Term Assessment Program Rev. 2 Appendix A

~

'The LOTIC computer analysis models the active sump as a fixed volume and the inactive sump as an "overflow" from the active sump.

It does not consider inventory lost to the inactive sump during recirculation.

The simplified modeling is an indication that the LOTIC code was not intended to evaluate containment sump performance.

This root cause determination employed the fault tree method.

The root cause team used a variety of resources, including the original FSAR, early-revision drawings, condition reports, design basis documents and associated reference notebooks, design memoranda, and Westinghouse WCAP documents.

AEP and Westinghouse personnel were consulted as needed.

The team initiallyidentified five contributors to this issue:

1) loss of inventory via CTS flow to accumulator/fan rooms, 2) loss of inventory via stairwells, 3) loss of inventory into the reactor cavity, 4) loss of inventory through unsealed penetrations in the crane wall, and 5) incomplete knowledge regarding the response of plant systems to events requiring operation in the recirculation mode.

The first contributor, loss of inventory via CTS flow to the accumulator/fan rooms, is a consequence ofthe original plant design.

Awareness of CTS flowdiversion is evident in early documents.

However, the drains that were installed to return this diverted water from the accumulator/fan rooms to the active sump are elevated several inches above the floor, and are ineffective due to a competing flow path into the annulus through floor drains, floor grating, and structural gaps.

The team questioned why these competing flow paths were not recognized during design.

Similarly, the team questioned why additional scrutiny ofsmall break LOCA response followingthe Three Mile Island accident did not address containment sump inventory questions, but rather focused only on core response.

Lack of thorough review was identified as a root cause of this contributor.

Change control was also identified as a root cause, specifically with regard to the change from the original Westinghouse design that led to lack ofthorough review.

The second contributor, loss ofinventory via stairwells, was considered by the team to be analogous to the first contributor, and hence had the same cause.

Inventory loss to the reactor cavity was subsequently determined by the team not to be a contributor.

Historically, this aspect of containment inventory has been dealt with appropriately.

Documentation shows that penetrations in the crane wall were intended to be sealed to restrict flow into the annulus.

Failure to seal some of the penetrations resulted from improper implementation ofthe well-defined design expectations.

The team considered this problem not directly related in terms ofcause to the other inventory loss mechanisms under consideration.

(Note Although the root cause team did not include "improper implementation ofwell-defined design expectations" in their summary of root causes, it was identified in their report.

Management considered this a relevant root cause or contributor and included it in the discussions of root causes that could potentially affect operability ofsafety systems.)

Page A-3

Short Term Assessment Program Rev. 2 Appendix A With regard to the fifth contributor, until recently there was incomplete knowledge pertaining to the effect of the inactive sump on recirculation sump inventory during accident scenarios.

The team concluded that, while this condition warrants concern, the cause of this contributor is rooted in the lack of identification of the issue on a more fundamental level.

Since the concern had never been identified, the operations and engineering staff could not be expected to be knowledgeable on the subject.

The root causes associated with CALItem 1 are:

Lack ofthorough engineering review

~ ~

Inadequate design control during initialplant design

~

Improper implementation ofwell defined design expectations Ste 2 - Consideration ofIm lications Lack ofthorough engineering review Design reviews addressing the recirculation sump incorporated simplifying assumptions that were considered bounding, but did not consider the entire range of conditions under which the equipment could be required to function.

For example, small break LOCA concerns were generally considered bounded by large break LOCA analysis.

Assumptions were made that small break LOCA scenarios did not need to be reviewed with respect to recirculation sump performance and that additional evaluations were not needed to supplement the simplified methodology utilized in the LOTIC code to model containment performance for large break scenarios.

Hence the true dynamic nature of recirculation sump level was never recognized.

Lack of thoroughness in reviews of safety related equipment could result in systems being unable to perform their intended function.

Short-term assessment actions were considered necessary to address this concern.

Inadequate design control during initialplant design This concern centered on failure of AEP and Westinghouse to ensure that all design'equirements were met for a system that had shared engineering responsibility.

This

,example is considered unique.

First, the adequacy of containment sump inventory can not be functionally tested.

Unlike other design aspects that rely solely on analyses to demonstrate their acceptability (e.g. evaluating core response during transients using industry-accepted assumptions and analysis techniques), the assumptions and analytical techniques needed to assess sump performance are plant-specific.

The ability to functionally test other interfacing systems and the use of industry-accepted methodologies on other important safety analyses were considered adequate to preclude this cause from affecting other safety systems.

Although specific short-term actions were not identified for this root cause due to the uniqueness of the situation, this was considered another general example of failure to consider multiple functional design requirements ofan SSC, which was addressed in the 'short-term assessment.

Page A-4

Short Term Assessment Program Rev. 2 Appendix A Improper implementation ofmell defined design expectations The expectations for crane wall penetration sealing were clearly defined, but were not implemented.

Although it was recently determined that sealing of the crane wall penetrations was not necessary to ensure adequate inventory, the implications of improperly implementing and maintaining design expectations on SSCs are significant.

Short-term assessment actions were considered necessary to address this concern.

CALItem 2: Recirculation Sump Cover Venting Ste 1 Root Cause Determination The problem was defined as "plant design was changed by plugging the holes in the roof ofcontainment recirculation sump without considering the design and licensing bases for the holes."

Pertinent facts brought forth in the investigation include:

~

The design change, RFC 12-2361, contained a description and reason for boring the holes in the sump cover.

Hole locations were accurately defined on a core bore request sketch in the field installation portion ofthe RFC.

~

The basis for the holes in the Units 1 and 2 sump cover is contained in submittal AEP:NRC:0110, which was a commitment from the FSAR questions and answers.

This correspondence leads the Alden Lab sump model study report.

The vent holes were plugged under job orders in response to condition report investigations in 1996 and 1997.

One of the job orders identified that the holes were assumed abandoned bolt holes.

~

RFC 12-2361 was inadequate in that:

Changes made were not fullyreflected in design documents; the holes were shown on a structural drawing, but not on flow diagrams or system description.

The foreign material exclusion (FME) zone for the sump was relocated upstream when the internal plate was removed and a fine mesh screen was added at the sump entrance.

However, steps were not taken to assure particle retention criteria were maintained for other sump inlets (such as the sump cover vent holes).

~

A search of the computerized licensing database (using FOLIO) for "sump holes" provides an immediate link to AEP:NRC:0110.

FOLIO was not available to system engineers until mid-1997.

The root cause determination employed change analysis, barrier analysis, interviewing, and event and causal factor charting.

The root cause team summarized their findings Page A-5

0

Short Term Assessment Program Rev. 2 Appendix A primarily in terms of human performance issues, but more direct causes can be, derived from their investigation:

The relevant root causes associated with CALItem 2 are:

~

FME protection not installed (considered as another example of "improper implementation ofwell-defined design expectations" noted in CALItem 1)

~

Design change not properly incorporated into design documentation

~

Design and licensing basis not retrieved in a timely manner Ste 2-ConsiderationofIm lications FMEprotection not installed Failure to consider FME requirements in this case occurred nearly 20 years ago.

FME, particularly with regard to recirculation sump performance, has been a,focus area in recent years. In'act, heightened awareness ofthe importance ofFME led to plugging the holes in the sump cover.

No specific short-term efforts were considered necessary to address FME protection. However, this situation was considered an example offailing to implement design expectations and failing to preserve design requirements, which were considered necessary to address in the short-term assessment.

Design change notproperly incorporatedinto design documentation Although the root cause as stated could indicate a fundamental weakness in configuration management, there are reasons for limiting the scope of concern.

First, this was a case where a minor aspect of a larger design change was overlooked in some portions of the documentation.

Safety system operability was not threatened by this oversight.

There is no basis for concluding from this example that functionally significant features have been omitted from design documentation.

Second, this design feature was functioning outside its typical discipline; the holes were a structural feature that was performing a mechanical function. The structural drawings portrayed the holes, but their function (i.e., vent holes) was not indicated.

They were not included on the mechanical flow diagrams.

Finally, a third factor is that this design feature could not be tested and was not included in an inspection program.

While the first point supports a conclusion that operability of safety systems is not threatened by design documentation deficiencies, it was concluded that some additional actions be included in the short-term assessment actions.

l Although it was not designated as a root cause or significant contributor by the investigating team, the management group also discussed the implications of plugging these holes under a maintenance action request.

To provide assurance that there is not a programmatic weakness allowing modifications to be done under a work order, a search of the computerized maintenance work order system was conducted using various key words that could indicate modifications were being done.

No maintenance action requests were found that improperly implemented modifications. The management group concluded that that appropriate programmatic controls to prevent unauthorized modifications are in place.

In the case of the sump cover holes, the system engineer believed that plugging the holes was necessary to return the sump to its intended Page A-6

Short Term Assessment Program Rev. 2 Appendix A configuration and therefore made a conscious (but incorrect) decision that the work was not a modification.

Design atid licensing basis information not retrieved in a timely manner Two facts help mitigate the implications of this cause.

First, the design information in question was a minor aspect of the overall sump modification package and was not properly documented.

Second, the system engineers now have access to FOLIO, which increases the efficiency with which obscure licensing information can be retrieved.

No additional short-term assessment actions were considered necessary.

Cal 3: 36-hour Cooldown Ste 1 Root Cause Determination The root cause investigation focused on two problems.

First, discrepancies were

'identified between the CCW system design temperature of95' contained in the UFSAR and the procedural temperature allowance of 120'.

Second, CCW heat exchanger modeling errors were discovered in the 36-hour cooldown analysis performed by Westinghouse.

For the first problem area, the team found that as early as 1969, the Westinghouse design criteria and functional requirements for the CCW system (transmitted via Westinghouse letter AEW-640) has verbiage describing 95' as the normal operating value, with allowance for operation at 120' during cooldown of the plant.

Review of other documentation and discussions with Westinghouse led the team to conclude that the design basis was intended to allow higher temperature operation during single train cooldown, but the UFSAR contained an incomplete description of the intended design basis.

'For the second problem area, the team found that the CCW heat exchanger, a TEMA-E type procured by AEP, was assumed by Westinghouse to be a counterflow type, which was consistent with CCW heat exchangers typically supplied by Westinghouse.

The root causes associated with CALItem 3 are:

Design parameters for all system conditions were not described in the UFSAR

~

Analysis used an unverified (and incorrect) assumption ofheat exchanger type Ste 2-ConsiderationofIm lications Design parameters forall system conditions were not describedin the UFSAR Failure to totally describe the intended design basis ofthe CCW system in the FSAR led to being outside the design basis by definition, but did not represent a threat to system function or operability. No short-term assessment actions were considered necessary.

Page A-7

Short Term Assessment Program Rev. 2 Appendix A Analysis used an unverified (and incorrect) assumption ofheat exchanger type Using incorrect heat exchanger information in the analysis model could potentially result in a system being unable to perform its intended function.

This instance could also be considered another example of "inadequate design control during initial plant design."

Short-term assessment actions were considered necessary to address this concern.

CALItem 4: Switchover from Injection to Recirculation Ste 1-Root Cause Determination Two problems were investigated.

The first addressed refueling water storage tank (RWST) level instrumentation not reflecting actual RWST level. The second addressed a

procedure-directed alignment where a single active failure of the west residual heat removal (RHR) pump could cause a loss of all high head safety injection pumps duririg transfer to cold leg recirculation.

Pertinent facts for the RWST level problem included:

~

Westinghouse originally designed the system with the level instrumentation located on the RWST.

AEP moved the instrumentation from the tank to the ECCS pump suction piping.

~

Start-up tests did not identify the error introduced by the instrument location, although it should be noted that identification of such errors was not the purpose ofthe testing.

~

AEP did not recognize that relocation of the instruments from the RWST to the pipe introduced significant water velocity induced error in the level measurements, which are used by the operators and provide input to the automatic RHR pump trips.

In 1993, the NRC identified that AEP calculations supporting relocation of the instrument tap had not considered the velocity-induced bias.

~

AEP attempted to address the identified NRC concern. No changes were made to the instrumentation, but in the effort to resolve the issue, two errors occurred:

Only part of the velocity induced error was recognized.

The friction losses associated with elbows and straight sections ofpipe were addressed, but the entrance losses and the dynamic head losses were not addressed.

Only the need to prevent pump damage that could result from operation at too low an RWST level was recognized.

The need to assure that sufficient water was transferred

&om the RWST to the active sump was not recognized.

Therefore, it was concluded that since the friction error made the indicated water level in the RWST appear lower than actual, the error was conservative because it would trip the RHR pumps sooner, thereby Page A-8

Short Term Assessment Program Rev. 2 Appendix A providing even better protection for the RHR pumps.

It was not recognized that the same error was non-conservative with regard to the second purpose of the instrumentation, i.e., to transfer sufficient water from the RWST for long-term core cooling and containment protection.

In that case, the operator would believe more water had been transferred to the sump than actually had been transferred.

~

It has since been determined that locating the level instrument on the process pipe is unacceptable.

The instrumerit tap has been moved and the containment sump levels designated in procedure OHP-4023.ES-1.3 have been revised to provide for proper water levels to protect the pumps from vortexing and ensure adequate water inventory in the sump for long-term cooling.

This root cause determination was conducted using fault tree analysis methodology.

The evaluation team used a variety of resources, including condition reports, design basis documents and notebooks, early-revision drawings, and interviews with AEP personnel.

The team identified four contributors to this problem:

1) using this type of instrumentation in a non-standard location, 2) failure to recognize the physics of the location, 3) incomplete understanding ofthe purposes ofthe instrumentation, and 4) lack ofstrong interdisciplinary reviews.

The first contributor, use of an instrument in a non-standard location, resulted from AEP changing the location of the instrument tap from the tank to the ECCS pump suction piping during the original design of the plant.

Although no documentation could be found describing why the position was changed, some AEP personnel indicated that they believe the instrument was moved to provide better protection from cold weather.

The second contributor, failure to recognize the physics of the instrument location, resulted from relocation ofthe instrument. AEP personnel did not recognize that the pipe location introduced velocity effects not present in the original location.

Therefore, the calculations that supported the relocation made no provisions for the velocity effects.

The plant remained in that condition until 1993 when an NRC inspection identified those velocity effects had not been considered.

Atthat time,'EP revisited the calculations and addressed some, but not all the velocity induced effects The third contributor, incomplete understanding of the purposes of the instrumentation, resulted in some instrument bias not being included in the RWST level setpoint.

Since the velocity friction losses that were identified tend to make the RWST level appear lower than actual, it was decided they were conservative because they would cause the RHR pumps to trip sooner and provide better protection of the RHR pumps from vortexing.

The second, unrecognized purpose is to assure that adequate water is transferred from the RWST for long term cooling of the core and containment.

No changes to the instrumentation or procedure were made.

The plant remained in the same condition until the recent extensive reviews in 1997.

The fourth contributor was lack of a strong interdisciplinary review.

Although the calculations were verified by I&Cpersonnel, interdisciplinary reviews ofthe calculations were not conducted.

Such reviews might have recognized the oversight.

Page A-9

Short Term Assessment Program Rev. 2 Appendix A Pertinent facts related to the problem ofthe procedure configuration where a single active failure ofthe west RHR pump could cause a loss ofall high head safety injection pumps during transfer to cold leg recirculation include:

Procedure OHP 4023.ES-1.3, Rev 1, provided an alignment sequence for switchover from ECCS injection to recirculation phase which established SI pump flow via the west RHR train and CCP flow via the east RHR train prior to isolation ofthe RWST as a suction source for the CCPs.

This sequence does not establish dependence of all high head safety injection on either RHR pump and therefore precludes single failure vulnerability.

~

ES-1.3, Rev 2, provided an alignment sequence for switchover from ECCS injection to recirculation which established both trains of safety injection (SI) pump flow and centrifugal charging pump (CCP) flow simultaneously from the west RHR train, with the RWST suction source for both the CCPs and SI pumps isolated. At this point, the suction source &om the east RHR train would not be available.

This sequence established dependence ofall high head safety injection pumps on the west RHR pump.

The failure of the pump under these conditions could have resulted in the loss ofall high head safety injection pumps.

~

During the time frame of the preparation of ES-1.3, Rev 2 the sequence of switchover from injection to recirculation mode of ECCS and CTS operation was described in Table 6.2-10 ofthe updated FSAR (pages 6.2-52 and 6.2-53).

This sequence provides for establishment ofthe RHR suction source for the CCPs from the east RHR train prior to the isolation of the RWST suction supply.

This sequence does not establish dependence ofall high head safety injection on either RHR pump.

~

The unreviewed safety question determination for ES-1.3, Rev 2 (for both units) is contained in a June 8, 1992 safety review memorandum.

The review is more extensive than many such reviews and discusses a considerable number of open items, but it does not identify or discuss the switchover sequence which resulted in the dependency ofall high head safety injection on the west RHR pump.

~

The definition of "single active failure" contained in Section 6.2 of both the original FSAR and the updated FSAR in effect at the time of the generation of ES-1.3, Rev 2 states that active failure is the "inability of any single dynamic component or instrument to perform its design function when called upon to do so by the proper actuation signal."

The FSAR/UFSAR also states, "Table 6.2-6 summarizes the results of the single failure analysis applied during the injection phase.

All failures during this phase are assumed to be active failures.

It is during this phase that the pumps are starting and automatic isolation valves are required to move.

All credible active failures are considered."

The failures described in Table 6.2-6 for RHR pumps in both the injection and recirculation phases are noted as "failure to start."

This root cause analysis was performed using the fault tree method.

During the root cause investigation of this event, the team consulted a variety of information resources, Page A-10

Short Term Assessment Program Rev. 2 Appendix A including earlier revisions of ES-1.3 and associated safety screenings and safety reviews, condition reports, and the original FSAR, current UFSAR, and intermediate revisions of the UFSAR. AEP personnel were consulted as needed.

The team identified three contributors for additional investigation:

1) definition of "single active failure", 2) development of the procedure revision which directed the improper equipment alignment, and 3) reviews of the procedure revision that failed to identify the problem.

The team considered the definition of "single active failure" with respect to ambiguity and lack of consistency between internal documents, within the UFSAR, and in regulatory documents.

While contributing factors may lie in these

areas, the primary consideration impacting the situation under review was the fact that the ECCS alignment of concern did not appear to be a "single active failure" requiring review under the criteria of the plant's design basis (original FSAR).

Failure to recognize the correct definition contributed to the failure to identify and correct the unacceptable ECCS lineup.

To establish the point at which the unacceptable lineup first appeared, earlier revisions of the ES-1.3 for both units and the UFSAR were examined.

The unacceptable lineup was incorporated into these procedures during revision 2. This revision was intended to make the procedures consistent with the sequence of steps specified in the FSAR for switching to the recirculation mode of ECCS and CTS operation as well as to provide for more inventory transfer from the RWST to the recirculation sump.

The preparer was not able to provide any additional information to provide an understanding of the apparent inconsistency between his intention to incorporate the procedure specified in the FSAR into ES-1.3 and the fact that the procedure and the FSAR do not match.

Proper incorporation of the FSAR steps would have precluded the single failure vulnerability introduced by revision 2.

The root causes associated with CALItem 4 are:

~

Lack ofconsideration ofBernoulli effect on level instrumentation

~

Incorrect application ofsingle failure criteria Ste 2-Consideration ofIm lications Lack ofconsideration ofBernoulli effect on level instrumentation Failing to consider potential biases on instrumentation could potentially result in a system

'eing unable to 'perform its intended function.

Short-term assessment actions were considered necessary to address this concern.

Incorrect application ofsingle failure criteria Failing to properly apply single failure criteria could potentially result in a system being unable to perform its intended function.

Short-term assessment actions were considered necessary to address this concern.

Page A-11

Short Term Assessment Program Rev. 2 Appendix A CALItem 5: Compressed AirOverpressure Ste 1 Root Cause Determination The problem statement focused on why overpressure protection was not provided on the 20-, 50-, and 85-psig control air headers.

Pertinent facts brought forth in the investigation include:

~

The compressed air systems at Cook Plant, including plant air and control air, are of the same design as compressed air systems installed in AEP fossil generating plants during the same time frame.

Bailey Controls Publication G18-2, "Product Instructions for Connecting Tubing and Accessories for Pneumatic Control and Transmission," provides six typical installations for either two or three low-pressure header connections.

Safety valves are provided on pressure vessels but not on the downstream side of pressure regulators.

These arrangements are typical ofthe Cook Nuclear Plant air systems.

~

Information Notice 87-28, "AirSystem Problems at U.S. Light Water Reactors,"

focused on the assumption that safety related equipment would fail to a safe position on loss-of-air or perform its intended function with the assistance of safety related back-up supplies.

Subsequently, Generic Letter 88-14, "Instrument Air Supply Problems Affecting Safety Related Equipment," identified that the performance of air-operated safety related components may not be in accordance with their intended safety function because of deficiencies in design, installation, and maintenance.

The primary focus ofthe GL and AEP's response was to assure that safety related components function under loss-of-air. None of the examples dealt with overpressure events.

Information Notice 88-24, "Failures of Air-Operated Valves Affecting Safety Related Systems," focused on 3-way solenoid valves not operating properly against the supplied air pressure.

~

In accordance with the original FSAR, the design code for the air system vessels is ASME Section VIII. Safety valves are provided as required by code.

The remainder ofthe system is designed in accordance with ANSI B31.1, which does not require safety valves ifthe piping downstream ofthe regulators is designed to withstand the unregulated upstream pressure.

This condition applies to the Cook Nuclear Plant design.

~

The reliabilityofair regulators at Cook Nuclear Plant has been excellent.

The team determined the root cause primarily through document review and personnel interviews. The facts led the team to conclude that the designers ofthe air system did not recognize that overpressure protection was necessary because this was a non-safety related system, the components had a successful history in AEP fossil applications, and the arrangement was typical of industrial applications where high reliability was important. The designers did not recognize all credible failure modes.

The root cause associated with CALItem 5 is:

Page A-12

Short Term Assessment Program Rev. 2 Appendix A

~

Failure to identify a non-safety system failure mode that could impact safety system components Ste 2-Consideration ofIm lications Failure to identify a non-safety system failure mode that could impact safety system components Failing to identify that a non-safety related system could potentially cause the failure of redundant safety related equipment has serious and far-reaching implications. Short-term assessment actions were considered necessary to address this concern.

CAI Item 6-RHR Suction Valve Interlock Ste 1 Root Cause Determination The problem statement focused on the fact that defeating the interlocks for the RHR suction isolation valves prior to venting the RCS to atmosphere places the plant in a condition outside its design basis.

Pertinent facts brought forth during the investigation include:

Information Notice 80-20, "Loss of Decay Heat Removal Capability at Davis-Besse Unit 1 while in a Refueling Mode," and IE Bulletin 80-12, "Decay Heat Removal System Operability," prompted AEP to implement procedure changes in June 1980.

The changes involved removing power from the RHR suction isolation valves gMO-128 and ICM-129) after opening the

valves, which typically occurs at an RCS pressure ofabout 400 psig.

~

The procedure change was accomplished via a Procedure Temporary Change Sheet.

FSAR Section 9.3.2 states, "The suction line valves are interlocked through separate channels of the Reactor Coolant System pressure signals to provide auto>atic closure of both valves whenever the RCS pressure exceeds design pressure of the RHR system."

The same section later states, "Overpressure protection in the RHR system is provided by relief valves discharging to the Pressurizer Relief Tank in the RCS coupled with interlocking ofthe RCS to RHR suction valves to close whenever RCS pressure exceeds design pressure of the RHR system."

~

The AEP response to IE Bulletin 80-12 describes the RHR suction valves having power removed "ifthe RCS is vented to atmosphere," but it does not describe (or preclude) the practice ofremoving power for the entire time RHR is in service.

~

AEP:NRC:1033, response in November 1987 to Generic Letter 87-12, "Loss of Residual Heat Removal while the Reactor Coolant System is Partially Filled,"

discussed the RHR suction valve interlocks as described in the FSAR.

The Page A-13

Short Term Assessment Program Rev. 2 Appendix A response does not note that the isolation valves are opened and deenergized the entire time RHR is in service.

The normal operating procedure was apparently not reviewed when developing this response.

~

AEP:NRC:1033C, response in February 1989 to Generic Letter 88-17, "Loss of Decay Heat Removal Program Enhancements,"

correctly noted that control power is removed &om the RHR suction isolation valves whenever RHR is in service, as suggested by GL 87-12.

~

Low temperature overpressure protection (LTOP) relies on the RHR suction isolation valves being blocked open; however none of the various LTOP reviews identified the conflict with the UFSAR.

The root cause team concluded that the original procedure change was made with good technical justification and attention to actual safety implication. However, the procedures and processes in place did not successfully lead the individuals involved to identify the discrepancy created with the UFSAR and technical specifications.

Secondly, the change made to the plant in 1980 would be covered under the design change process using today's design control program and procedures.

The team concluded that a design change would have given the change more visibilityand would be expected to find the UFSAR and technical specification discrepancies.

The team also expressed concern that a number of formal reviews over the last 17 years provided opportunity for the inconsistency to be noted.

The root causes associated with CALItem 6 are:

~

Processes in place did not emphasize the UFSAR, resulting in an inadequate safety review

~

Design change was accomplished via procedure revision Ste 2-ConsiderationofIm lications Processes in place (at the time) did not emphasize the FSAR, resulting in an inadequate safety review The implications of this cause are mitigated by the fact that engineering reviews were properly performed and the plant was actually configured and operated in the desired manner.

Failure to recognize the inconsistency of the desired configuration with the FSAR led to being outside the design basis, but did not represent any threat to system functionality. No short-term assessment actions were considered necessary.

Design change accomplished viaprocedure revision The implications of this cause are mitigated by the fact that engineering reviews weie properly performed and the plant was actually configured and operated in the desired manner.

Failure to identify the FSAR inconsistency and failure to recognize that the technical specification surveillance was superfluous did not represent any threat to system function or operability.

No short-term assessment actions were considered necessary.

Page A-14

Short Term Assessment Program Rev. 2 Appendix A CALItem 7: Fibrous Material in Containment Ste 1 Root Cause Determination In September 1997, fibrous material was found in an electrical cable tray in the Unit 2 containment.

The purpose of the investigation was to determine why fibrous material was in containment.

Pertinent facts brought forth in the investigation include:

~

Interview information:

From original construction until late 1992, a contractor was used for all plant insulation installation and repair work. The contractor was under the control ofAEP, but was relied upon to plan and execute insulation work with minimal direct supervision.

The AEP thermal insulation specification (DCC-NEMP-450-QCS) was not often used or referenced during planning or installation. Instead, skill-of-the-craft and knowledge ofthe planners was used.

The design specification for fire barrier penetration seals and its implementing procedures allowed noncombustible damming material to remain in place following seal installation.

Based on interview information, the authors of revisions to the design specification were unaware of the concern with fibrous material in containment.

A review of three design change packages for installation of fire stops or fire breaks revealed that the safety reviews did not mention concerns on the use of fibrous material.

~

Interview informa'tion: A January 1989 engineering memo allowed the use of stainless steel mesh to encapsulate blanket-type insulation on a temporary basis in

'ieu of 0.010-inch stainless steel.

The memo provided explicit instructions to replace the temporary insulation with reflective metallic insulation (RMI) at the first convenient outage.

The author intended the memo to be used on a one-time basis for a specific circumstance where pieces of RMI were missing or damaged at the completion of the Unit 2 steam generator replacement.

However, plant personnel continued to use that memo as justification to use mesh-encapsulated blanket insulation when necessary to meet ALARAand production concerns.

A process to remove such "temporary" installations was not implemented, and the thermal insulation specification was not revised to incorporate the practice.

Information Notices 88-28, 90-07, 93-34, 95-06, and 96-59, IE Bulletin 93-02, and Generic Letter 85-22, all dealing with the potential for loss of post-LOCA recirculation capability due to debris blockage, were evaluated by AEP.

The reviews focused on specified insulation materials and did not consider actual plant conditions.

Page A-15

Short Term Assessment Program Rev. 2 Appendix A The team used a combination of event

charting, cause-and-effect

analysis, barrier analysis, interviews, document reviews, and mini-MORT.

The reason fibrous material was introduced to containment was determined to be a lack of procedures implementing the requirements of the thermal insulation specification

, during planning and implementation, coupled with a failure to address the sump plugging potential of fibrous material in the specification itself.

Incomplete evaluation of NRC Information Notices and IE Bulletins resulted in a series of missed opportunities to identify and encapsulate or remove fibrous material.

The root causes associated with CALItem 7 are:

Lack of procedures for implementing the requirements of the thermal insulation specification

~

Failure to address sump-plugging potential of fibrous insulation material installed in containment Ste 2-Consideration ofIm lications Lack ofprocedures forimplementing an insulation specification Failure to have a detailed procedure was considered to be a symptom of the more fundamental concern of failing to recognize and preserve multiple functional design requirements of some installed plant features.

Short-term assessment actions were considered necessary to address this concern.

Failure to address sump-plugging potential offibrous insulation material installed in containment Failing to recognize multiple functional design requirements of SSCs could result in systems being unable to perform their intended function.

Short-term assessment actions were considered necessary to address this concern.

CALItem S: Leak Back to RWST during Recirculation Ste 1 Root Cause Determination The problem was stated as:

Only two of six mini-flow recirculation line valves have leakage verification tests.

Pertinent facts brought forth in this investigation include:

~

Information Notice 91-56, "Potential Radioactive Leakage to Tank Vented to Atmosphere,", was issued to alert the industry of a potential problem resulting from leakage of ECCS recirculation isolation valves to safety injection water storage tanks (RWST at Cook Plant).

Page A-16

Short Term Assessment Program Rev. 2 Appendix A

~

IN 91-56 was assigned to Nuclear Safety and Licensing in AEP's corporate headquarters.

The document trail for IN 91-56 is incomplete, although the team's report includes a chronology ofevents occurring in NSEcL and at the plant.

The team 'concluded that this was a valid issue.

Additional valve testing should have been accomplished, or in its absence, sound engineering basis should have been documented to justify actions or non-actions resulting from review ofIN 91-56. It was evident that the reviewer did recognize that the IN impacted Cook Plant.

Calculations were performed to determine dose received from a postulated leak path back to the RWST. In addition, a change was made to the UFSAR, a test procedure was developed, some valves were tested, and ASME valve categories were revised.

The decisions and actions were not well documented; however, evidence clearly demonstrates that the IN, was evaluated and acted upon.

The relevant root cause associated with CALItem 8 is:

~

Failure to ensure that plant equipment met assumptions incorporated in licensing basis calculations Ste 2-Consideration ofIm lications Failure to ensure that plant equipment met assumptions incorporated in licensing basis calculations Failing to ensure that analysis assumptions are met could potentially result in a system being unable to perform its intended function.

Short-term assessment actions were considered necessary to address this concern.

Lake Temperature Design Basis Discrepancies (CR-97-2196) and Lake Temperature Effect on Control Room Ventilation (CR-97-2390)

Ste 1-Root Cause Determination The problem is defined as allowing the use of a higher, and thus less conservative, maximum lake water temperature value than listed in UFSAR Table 9.5-3.

Pertinent facts brought forth in the investigation include:

~

The weather in 1988 was unprecedented, with both extremely high temperatures and drought.

Actual lake temperature data identified a high lake temperature of 83.9'F on August 17, 1988.

~

Although the effects of higher lake temperature on important plant parameters were evaluated, a comprehensive 10 CFR 50.59 review was not completed to support operation at the higher lake temperature.

All potentially relevant calculations were not reviewed to determine the impact oflake temperature higher Page A-17

Short Term Assessment Program Rev. 2 Appendix A than the UFSAR value of76'. The review did not identify that the UFSAR and other related documents needed to be changed.

The lake temperature value of 76'F is listed in a UFSAR Chapter 9 component data table falls within 10 CFR 50.2 and the recently issued DIR-2300-04 definition of"design bases."

~

Memorandum "Operation at Elevated Essential Service Water Temperature" from D. B. Black dated July 29, 1988 established criteria for evaluating increased ESW temperatures.

The stated criteria was, "Operation of Cook Nuclear Plant with ESW temperatures greater than 76'F is not necessarily precluded (that is, operating is an unanalyzed condition) as long as:

a margin exists between the peak pressure and the design pressure, and; the sensitivity ofthe change in calculated peak pressure due to changes in ESW temperature are known."

~

While analysis has shown that higher temperatures are acceptable for containment heat removal, no single analysis identified and resolved all effects ofthe change in design basis lake temperature.

Design inputs were not "correctly translated into

[all affectedJ specifications, drawings, procedures, or instructions", as required by 10 CFR Appendix B and ANSIN45.2.11.

~

In 1988 when the lake temperature was above (or projected to be above) 76', a reevaluation ofcontrol room HVACfor higher ESW temperature was performed.

The result was that the then-current technical specification control room temperature limit of 120' would not be exceeded at or below 87.5'F lake temperature.

Operability ofthe control room HVAC and decay heat removal was evaluated at the time, but a comprehensive 10 CFR 50.59 review was not found to acknowledge the use of non-conservative higher temperatures or that it was a deviation from the UFSAR. Not all affected ESW heat loads were specifically addressed.

~

A July 29,1988 memorandum from D. B. Black to B. A. Svensson states a prior maximum lake temperature of 79.5' was identified. Based upon interview information, no engineering reevaluations were performed for the earlier high lake temperature condition of79.5' mentioned in the memo.

The root cause investigation was performed by documenting the time-line of related events using an events and causal factors chart.

Identifying, collecting, and reviewing documents associated with the events supported the events and causal factors chart.

Interviews ofinvolved personnel were then conducted.

The root cause of the events is a failure to recognize that deviation from the UFSAR value of76' for ESW temperature constituted a deviation from a design basis value.

Contributing causes include 1) rising standards for UFSAR compliance and design basis definitions were not implemented within the organization and 2) design change Page A-18

Short Term Assessment Program Rev. 2 Appendix A procedures in place at the time of these events did not require or compel considering a change to design basis value as a design change.

The root causes ofthe lake temperature issue are:

~

~

Failure to recognize a UFSAR value as a design basis parameter

~

Failure to recognize interrelationships between a UFSAR value and other design aspects Ste 2-Consideration ofIm lications Failure to recognize a UFSAR value as a design basis parameter This cause is associated with the confusion surrounding justification for plant operation when the lake is above 76'.

It is clear that AEP nuclear generation pexsonnel did not consider all UFSAR values design basis parameters.

This cause is at the heart of concerns raised by the design inspection team.

However, no instances (including investigation of a substantial number of condition reports arising from the UFSAR revalidation efforts, both before and after the design inspection) were noted where failure to recognize UFSAR values as design basis values led to failure to perform technical reviews when warranted.

Failure to recognize UFSAR values as design basis parameters may lead to being outside the plant design basis by definition, but has not been identified as posing a threat to system functionality. No additional short-term assessment actions were considered necessary.

The longer-term pxogram arising from the design inspection willaddress this basic concern.

Failure to recognize interrelationships behveen a UFSAR value and other design aspects This cause is also associated with plant operation when the lake is above 76', but centers on deficiencies in the evaluation of control room instrumentation.

The potential impact of higher control room temperatures on instrumentation life was recognized by AEP and was evaluated.

At the time of the evaluation, the technical specification limit for control room temperature was 120' temperature.

Per the basis of the technical specifications, this limitwas consistent with the continuous duty rating of control room equipment.

Subsequent to these reviews (c.

1992), it,was determined that not all equipment was qualified for continuous duty to 120' and the technical specification limit for normal operation was lowered to 95'.

While it is clear that AEP nuclear generation personnel did not consider all UFSAR values to be design basis parameters, no instances have been noted where this failure led to failure to perform technical reviews when warranted.

No additional short-term assessment actions were considered necessary.

Page A-19

Short Term Assessment Program Rev. 2 Appendix A Unit 2 Full Core Off-load with Concurrent CCW Dual Train Outage (CR-97-2341)

Ste 1-Root Cause Determination The problem was defined as: The dual train CCW outage which had occurred during the 1996 Unit 2 refueling outage did not have a sufficient 10 CFR 50.59 safety evaluation to support it.

Pertinent facts brought forth in the investigation include:

~

The purpose ofthe safety evaluation for this evolution was to evaluate whether or not the configuration represented by a full-core offload for U2R96 represented an unreviewed safety question.

The safety evaluation assumed the unavailability of one train of spent fuel pool cooling to evaluate the adequacy of heat removal in the fullcore offload condition.

~

The SER for the spent fuel pool re-rack states that it is not necessary to assume less than two trains ofspent fuel pool cooling are available.

~

The safety evaluation was supported by calculation N96-01-01 which demonstrated that with a full core offload and only one train of SFP cooling in operation, the spent fuel pool temperature would be maintained less than 150'.

This is within the UFSAR design basis temperature of 159.54'.

~

UFSAR Section 9.4.1 states, "Any spent fuel pool loading scenario which meets the 160' peak bulk pool temperature and 5.74 hours8.564815e-4 days <br />0.0206 hours <br />1.223545e-4 weeks <br />2.8157e-5 months <br /> to boil criteria is acceptable."

~

Based on heat load and the supporting calculation, the spent fuel pool was clearly within the thermal hydraulic design basis with 'this configuration, since it met a peak bulk pool temperature of less than 160' and a minimum boiling time of much longer than 5.74 hours8.564815e-4 days <br />0.0206 hours <br />1.223545e-4 weeks <br />2.8157e-5 months <br />.

~

The shutdown risk assessment dated March 22, 1997 did not completely document how the licensing issues for a dual train CCW outage were addressed.

In particular, it did not address a postulate LOCA on Unit 1 while the Unit 2 dual-train CCW outage was in progress.

~

The shutdown risk assessment did reference abnormal operating procedures designed to provide SFP cooling in the event that CCW cooling was lost.

The investigation concluded that the safety reviewer performed an adequate review ofthe full core offload. During the outage, no condition outside the design basis or licensing basis was incurred.

A risk assessment was performed during the planning of the schedule.

Documentation ofthe licensing issues involving spent fuel pool cooling with a dual train CCW outage in Unit 2 and a postulated LOCA in Unit 1 was not complete.

However, as evidenced by the contingency planning to ensure adequate cooling in the event CCW cooling was lost, the design basis and licensing basis issues were addressed.

The root cause of the failure to fully document the licensing issues during the planning for this evolution was personnel error.

The issues were addressed.

Previously, a Shift Page A-20

Short Term Assessment Program Rev. 2 Appendix A Technical Advisor performed the risk assessment.

The procedure now requires a group including, an operations shift supervisor, a scheduling person, a Shift Technical Advisor, and an engineer from the Safety Analysis group.

Since the safety evaluation and USQD are considered

adequate, no root cause was developed.

The implication that should be addressed, however, is:

~

10 CFR 50.59 reviews may be inadequate Ste 2 Consideration ofIm lications 10 CFR 50.59 reviews may be inadequate The root cause investigation as described above represents the basis for our retraction of the LER associated with this issue and for originally concluding that no short term assessment actions were necessary to address potential 10 CFR 50.59 inadequacies.

Following discussions with NRR and Region III staff on December 22, 1997, we now understand that the change represents an unreviewed safety question due to reduction in

margin, and have agreed to conduct a

self-assessment of safety screenings and evaluations in the short term. This review willlook for unreviewed safety questions and operability concerns.

Note that this additional review is not reflected in Tables 1, 2, and 3.

Restriction ofCCW Temperature During Unit 2 Core Off-load (CR-97-2342)

Ste 1 Root Cause Determination The problem was defined as:

Inadequate safety evaluation performed for establishment ofa 90 degree F upper limitfor CCW during the Unit2 1996 refueling outage.

Pertinent facts brought forth in the investigation. include:

A 10 CFR 50.59 safety evaluation addressing the U2R96 proposed full core offload was issued on March 11, 1996. An addendum was issued on March 20, 1996.

The safety evaluation discussed the Spent Fuel Pool Cooling System heat load analysis, assuming:

1) the existing fuel assembly inventory, 2) a full core offload, 3) a bounding lake temperature for the March/April time frame, 4) a maximum CCW temperature of80.5', and 5) a single train of Spent Fuel Pool Cooling. Addendum 1 revised the CCW temperature to 90.7'.

~

Although the analysis demonstrated that the Spent Fuel Pool temperature remained below the limit of 160',

an Unreviewed Safety Question Determination was performed since the CCW temperature and system cooling capacity was different than that found in the UFSAR (Table 9.4-2). It concluded that although the assumed CCW temperature was less than the UFSAR value, the CCW temperature and the SFPCS heat removal values are nominal design values Page A-21

Short Term Assessment Program Rev. 2 Appendix A and modification of these values on an outage basis does not require a change to the FSAR;

~

The Condition Report was written because the safety evaluation did not recognize the CCW temperature change as a design change, to the SFPCS heat exchanger CCW inlet temperature.

This value is listed in Table 9.4-2 of the UFSAR as 95',

and was to be administratively limited to 90'.

The purpose of the safety evaluation was to assess the acceptability of the SFP heat loads for the Unit 2 refueling outage, based on the analysis and conditions that existed at the time. The CCW temperatures were obtained based on projected SFP heat loads, a bounding lake temperature for March/April and a single train of SFP cooling, and the approved limitingdesign basis temperature of160'.

The investigation concluded that limiting the CCW temperature to 90' maintained the SFP below the maximum design basis temperature of 160';. therefore the probability or consequences of a release from the SFP was not increased.

Since this was a temporary procedure change based on the specific SFP heat removal requirements for the Unit 2 refueling outage, it was not considered a design change and did not require a permanent change to the UFSAR. The USQD performed to address the change adequately covered the temporary change in CCW temperature.

Therefore, it is concluded that the plant was not outside ofits design basis.

Since the safety evaluation and USQD are considered

adequate, no root cause was developed. The implication that should be addressed, however, is:

~

The adequacy ofthe 10 CFR 50.59 review was questioned, although subsequently found to be acceptable Ste 2-Consideration ofIm lications 10 CFR 50.59 reviews may be inadequate The root cause investigation as described above represents the basis for our retraction of the LER associated with this issue and for originally concluding that no short term assessment actions were necessary to address potential 10 CFR 50;59 inadequacies.

Following discussions with NRR and Region IIIstaff on December 22, 1997, we now understand that the change may represent an unreviewed safety question due to reduction in margin, and have agreed to conduct a self-assessment of safety screenings and evaluations in the short term. This review willlook for unreviewed safety questions and operability concerns.

Note that this additional review is not reflected in Tables 1, 2, and 3.

Page A-22

Short Term Assessment Program Rev. 2 Appendix A RWST minimum volume for Appendix R (CR-97-2358)

Ste 1 Root Cause Determination The problem was identified as:

Calculation TH 90-02 determined that the minimum RWST level required to support the other unit's shutdown for Appendix R considerations to be 87,000 gallons.

Operating procedure OHP 4021.018.008 requires the RWST level to be above 10%, which is less than 87,000 gallons.

Pertinent facts brought forth in the investigation include:

Calculation TH 90-02 states, "The 87,000 gallons required is less than both the 90,000 gallons specified in technical specification 3.1.2.7 for Modes 5 and 6 and the 350,000 gallons specified in technical specification 3.5.5 for Modes 1, 2, 3, and 4 (both units)."

~

Technical specification 3.1.2.7 allows the RWST level to fall below 90,000 gallons ifboric acid storage system requirements of 3.1.2.7.a are met. Therefore, it cannot be relied upon to meet the requirements ofcalculation TH 90-02.

Calculation TH 90-02 relied on an incorrect interpretation of the technical specifications that in all modes, the RWST water level would be above the calculated required water level.. It is surmised that TH 90-02 therefore was not distributed or used to revise procedures to maintain the calculated water level.

The root cause ofthis issue is:

Misinterpretation of technical specifications resulted in failure to translate calculation assumptions and results into operating procedures.

Ste 2-Consideration ofIm lications Misinterpretation oftechnical specification resulted in failure to translate calculation assumptions and results into operating procedures This case represents an instance where an individual performed a calculation to determine an operating requirement, found an existing technical specification value that he believed encompassed the new requirement, and stopped.

However, his understanding of the technical specification was incomplete and, in fact, the operating requirement was not necessarily covered under all scenarios.

Subsequent investigation revealed that compliance had always been maintained, albeit accidentally.

Although human performance is the root cause, discussion of the implications of this occurrence resulted in considering it a calculation issue.

Short-term assessment actions were considered necessary to address this concern.

Page A-23

Short Term Assessment Program Rev. 2 Appendix A 2-CD Battery Cell Left on Charge for an Extended Period (CR-97-1821)

Ste 1 Root Cause Determination The problem was defined as: 2-CD battery cell left on charge for an extended period.

Pertinent facts brought forth in the investigation include:

Cell 34 was placed on individual cell charge (ICC) aAer it was discovered on 3une 19 1997 that the cell was below the technical specification minimum voltage of 2.13VDC. The cell was left on charge until August 8, 1997 when it was decided to replace the cell.

~

C&D Vendor Technical Manual,Section VI states, "Minimumacceptable voltage is the point at which plans should be made to provide equalize charge. It does not imply that the battery is malfunctioning or that it willnot provide power ifcalled upon.

Some equipment may not have equalizing potentials available.

In such

cases, a single cell charger with complete AC line protection may be paralleled across the affected cell while still a part ofthe overall battery to provide an over-voltage to that cell. Do not be alarmed ifsuch charging must continue for several weeks, particularly considering the currents actually passing through the cells are very small."

~

IEEE Std 450-1987, Appendix D4 states, "When an individual cell voltage corrected for temperature is below 2.13V, corrective action should be initiated immediately. It can be accomplished by providing an equalizing charge to the entire battery.

However, it is oAen more convenient to apply the equalizing charge to the individual cell."

~

Cell 34 was raised above its minimum technical specification potential (2.13VDC) within the two-hour LCO window.

The charge was planned to continue until it reached 2.5VDC. While the cell reached 2.5VDC on August 8, 1997, it was left on charge to provide additional assurance that the cell would provide satisfactory service until the scheduled battery bank replacement during the outage.

Cell 34 was replaced on August 11, 1997.

The root cause team concluded that, based on standard industry practice and their understanding of the ability of Cell 34 to meet its technical specification requirements, the extended charging was considered satisfactory. No root cause was determined.

Ste 2-Consideration ofIm lications Since the extended charging was considered an acceptable practice, no implications were identified and no short-term assessment items were considered necessary.

Subsequent to the root cause evaluation, we received the design inspection report. The report notes that "there was not adequate evidence to suggest that the battery train could not perform its function without the cell."

However, the report leaves operability of the cell, per technical specification requirements, as an unresolved item.

Since the battery could Page A-24

Short Term Assessment Program Rev. 2 Appendix A perform its overall function, we still conclude that short-term assessment actions are not necessary.

Code Discrepancies in CC% System Safety Valves (CR-97-2437)

Ste 1 Root Cause Determination The problem was defined as manual valves located between the reactor coolant thermal barrier cooling coil and the CCW surge tank reliefvalve do not conform to the applicable B31.1 piping code, which states that an intercepting stop valve cannot be located between the source ofpressure and the pressure reliefdevice credited for protecting the pipe.

Pertinent facts brought forth in the investigation include:

~

UFSAR Section 9.5 states, "The reliefvalve on the component cooling surge tank is sized to relieve the maximum fiowrate ofwater that would enter the surge tank following a rupture of a reactor coolant pump thermal barrier cooling coil. The set pressure assures that the design pressure ofthe CCW system is not exceeded."

Paragraph 122.6.1 of B31.1 states, "There shall be no intervening stop valves between piping being protected and its protective device or devices."

~

There are a total offour manual CCW system valves in each unit that are defined as intervening stop or blocking valves per B31.1.

These valves are in the open position during operation ofthe CCW system.

They are used as isolation valves for maintenance activities during outages.

~

There are no administrative controls in place to prevent them from being inadvertently closed.

B31.1 does not provide guidance on locking or sealing open intervening stop valves.

However, other codes have provided direction.

For example, ASME Section VIII, Appendix A, A-,104(a)

states,

"...a full area stop valve (is acceptable) for inspection and repair purposes only.

When such a stop valve is provided, it shall be so arranged that it can be locked or sealed open and it shall not be closed."

~

The Authorized Nuclear Inspector, the ASME B31 Mechanical Design Technical Committee

Chairman, and an ASME B31 Mechanical Design Technical Committee have stated that ifa valve is sealed open, it would not be considered an intervening stop valve.

~

An operating procedure that controls valve position has been revised to include sealing these valves and periodically verifying they are in the open position.

The investigation could not determine why these valves were not originally administratively controlled as required by B31.1.

The root cause associated with this issue is:

~

Failure to translate design requirements into operating procedures Page A-25

Short Term Assessment Program Rev. 2 Appendix A Ste 2-Consideration ofIm lications Failure to translate design requirements into operating procedures Full conformance with the B31.1 piping code was not met in this case; however, the condition did not cause the CCW system to be inoperable.

Plant procedures did require the valves to be open, but they were not administratively controlled as needed for literal code compliance.

The potential for similar safety valve inconsistencies was evaluated as part of the condition report investigation and found not a concern.

No additional short-term assessment items were considered necessary.

Procedures Allowing'Avo RHR Pumps to Run with the RCS Vented (CR-97-2480)

Ste 1-Root Cause Determination The problem was defined as follows: Chapter 9 ofthe UFSAR (July 1994) states:

"Only one RHR pump will be operated when the RCS is open to atmosphere to prevent damaging both pumps in the unlikely event that suction should be lost." 'Operating procedures for the RHR System do not prevent operation of both RHR pumps when the

'eactor Coolant System is open to atmosphere.

O Pertinent facts brought fourth in the investigation include:

~

UFSAR Section 9.3.3, "System Design Evaluation," states, "Only one RHR pump willbe operated when the RCS is open to atmosphere to prevent damaging both pumps in the unlikely event that suction is lost."

V UFSAR Section 9.3.6.2.a, "Limiting Conditions For Operation,"

states, "A

requirement to have only one RHR pump in operation whenever the RCS is drained to half-loop and vented, has been incorporated into applicable operating procedures."

~

Past procedure revisions showed that a change sheet dated May 18, 1978, added the following precaution to the RHR operating procedure:

"Do not operate both RHR pumps with Reactor Coolant System drained to half-loop. Sufficient suction head is not available for two pump operations."

The investigation could not identify why the FSAR requirements were originally not incorporated into the procedures.

Safety screenings related to subsequent procedure changes did not identify the discrepancy between the UFSAR and plant procedures.

The root cause associated with this issue is:

~

Failure to translate UFSAR requirements into operating procedures Page A-26

Short Term Assessment Program Rev. 2 Appendix A Ste 2 Consideration ofIm lications Failure to translate UFSAR requirements into operating procedures Plant operating procedures allowed operation outside the design basis.

This condition does not cause the RHR system to be inoperable.

No additional short-term assessment actions were considered necessary.

However, this is another example where the UFSAR was not maintained and used as a top-tier design basis document.

The longer-term programs arising from the design inspection willfocus on this basic concern.

Page A-27

ATTACHMENT 2 TO AEP:NRC:1260G4 10 CFR 50.59 PROGRAM

Attachment 2 to AEP:NRC:1260G4 Page 1

10 CFR 50.59 PROGRAM General Descri tion Cook Nuclear Plant's program to evaluate proposed plant and procedures changes and tests or experiments is based on the guidelines provided in NSAC-125 and is in compliance with the requirements of 10 CFR 50.59.

The program described below includes procedures, training, oversight and feedback mechanisms designed to maintain the current licensing basis of the plant.

The quality of the 10 CFR 50.59 screenings and safety evaluations is of the utmost importance to the management of Cook Nuclear Plant.

As a result, improvements have been, and will continue to be made to facilitate the efforts of those performing the screenings and safety evaluations to ensure that program objectives will be achieved.

Some of the most recent program improvements.are:identified

below, a number of which are in direct response'o lessons learned from the architect engineering (AE) desi.gn inspection.

Pro ram ualit The quality of the 10 CFR 50.59 screenings and unreviewed safety question determinations is based on the program's procedures, personnel qualifications, training and oversight.

In addition, interfaces with industry organizations, such as INPO, NEI, and the

NRC, ensure that rising expectations with respect to the performance of 10 CFR 50.59 reviews are implemented.

Procedures Management's expectations and the methodology to be used in implementing 10 CFR 50.59 screening and evaluations are provided through the program's procedures.

Currently, there are three procedures that address the reviews of proposed changes to the facility.

These procedures invoke the guidance provided in NSAC-125 and provide both general and specific direction to safety reviewers.

These.procedures have also been subjected to a number of internal and external inspections and audits over the years and have been revised numerous times to address suggested improvements that increase the quality of the safety reviews.

Lessons learned from Cook Nuclear Plant 10 CFR 50.59s are. also a source of many of the changes made to these procedures.

These changes include, but are not limited to, the need to provide further-guidance, address programmatic shortcomings, ensure consistency in the, level of documentation, or to reinforce management's expectations.

~Trainin To ensure that personnel have the requisite knowledge of the procedures as well as the necessary plant knowledge to successfully implement the 10 CFR 50.59 program, screeners and safety evaluators must meet minimum qualifications.

Management selects candidates to perform screenings and safety evaluations who have demonstrated a

sufficient level of plant knowledge to understand the specifics of the licensing basis and recognize challenges to it.

Candidates are trained on the expectations and methodology contained in the procedures and must demonstrate proficiency by passing a written test before qualifying as either a screener or a safety evaluator.

Once qualified, screeners and safety evaluators must annually re-qualify by attend'ing refresher training and demonstrating a

Attachment 2 to AEP:NRC:1260G4 Page 2

continued proficiency with the process through an annual written re-qualification test.

OversicVht Effectiveness of the 10 CFR 50.59 program is monitored by oversight provided by the plant nuclear safety review committee (PNSRC), the nuclear safety and design review committee (NSDRC),,

audits performed by the performance assurance department, and during NRC inspections.

A discussion of each of these is provided below.

PNSRC As required by technical specifications (T/Ss),

the PNSRC reviews and approves proposed design and procedure changes to ensure that there are no potential unreviewed safety questions and -.that the evaluations are well documented in accordance with plant procedures.

This review is a challenging one for safety evaluators because of the high standards set by the PNSRC.

In this context, the PNSRC review represents an opportunity for a select group of managers to coach the safety reviewers, who are from different parts of the organization, on their expectations.

This has been an effective method to communicate to the reviewers the importance of their responsibility.

NSDRC The NSDRC subcommittee on proposed changes conducts reviews of safety evaluations previously approved by the PNSRC and sample safety screenings of procedure changes.

This provides an additional layer of assurance that 10 CFR 50.59 reviews are completed in accordance with procedures.

Performance Assurance Performance assurance audits the 10 CFR 50.59 program on an annual basis to verify the adequacy and implementation of the safety evaluation program.

10 CFR 50.59 screenings and evaluations are also reviewed as part of other audits, surveillances, and procedure reviews'hese

audits, surveillances and r'eviews determine if:

screenings and evaluations are conducted when

required, screenings adequately identify and - consider source information,.

evaluations adequately answer any screening yes answers and consider source information correctly, evaluations adequately answer the unreviewed safety question determination questions, and the informat'ion is adequate for PNSRC to make safety decisions.

NRC routine inspections conducted by the resident inspector regularly sample 10 CFR 50.59 screenings and evaluations to verify

Attachment 2 to AEP:NRC:126064 Page 3

that proposed changes are processed in accordance with 10 CFR 50.59, and that conclusions reached in these reviews are justifiable and well documented.

Additionally, past special NRC safety inspections on the 10 CFR 50.59 program determined that procedures were well-written and contained detailed instructions and appropriate examples.

Past inspections,

however, have noted some screenings that incorrectly concluded that safety evaluations were not required.

Consequently, procedures and training were strengthened to emphasize the need to clearly document screenings and to make reviewers more sensitive to changes that potentially could impact the UFSAR or design basis.

Recent Im rovements There have been many improvements in the 10 CFR 50.59 program at Cook Nuclear Plant over the past ten years.

Earlier improvements were centered on providing better overall guidance to safety reviewers so that 10 CFR 50.59 reviews would provide the in-depth analysis that was required in a consistent, well documented manner such that 10 CFR 50.59 requirements could be met and our licensing basis could be preserved.

Recent improvements have focused on providing computer search tools, increasing the feedback mechanisms to our safety reviewers, and enhancing existing procedures in a way that provides a greater level of assurance in the quality of our program.

Below are listed program improvements since 1995.

FOLIO Search En ine To facilitate the safety reviewer's task of identifying potential impacts on our current licensing basis due to proposed

changes, computer search engines have been provided over the past two-years.

At Cook Nuclear Plant, the primary search tool is called FOLIO.

FOLIO is a text-searchable computer program.

The current databases that are loaded and available include access to references such as the

UFSAR, design basis documents, various regulatory documents such's bulletins, generic letters and

notices, AEP/NRC correspondence, previous safety review

memos, reportability

, reviews, operability reviews, environmental qualifications list, emergency plan and the final environmental statement.

Each of the data bases is available to a wide portion of the plant population via the company's local area computer network.

Also available is access to the commitment database that provides both a listing of commitments and an automatic link to the parent document where the commitment is located.

This database greatly aids the safety reviewer in finding licensing commitments that may be affected by a proposed design or procedure

change, test or experiment.

The information available via the computer and the databases are continuing to be improved with additional references such as quality assurance program description (QAPD) and the fire protection program manual anticipated to be added in the future.

In addition to FOLIO, the T/Ss are expected to be added to the search engine with word search capability over the next year.

UFSAR Revalidation Effort The principal reference documents used in the 10 CFR 50.59 program are the UFSAR, and the design basis documents (DBDs) that are being generated for many of the plant systems.

A review of the UFSAR has been underway since January 1997 to re-validate the information contained therein.

The changes to the UFSAR resulting from this revalidation will improve the quality of the UFSAR.

In conjunction

Attachment 2 to AEP:NRC:1260G4 Page 4

with the UFSAR re-validation, a review of the completed DBDs will be integrated into future UFSAR reviews that will improve the quality of both the UFSAR and the DBDs.

Improvements in the UFSAR and the DBDs will make the 10 CFR 50.59 program reviews easier to perform with a corresponding increase in quality.

Definin the Desi n and Licensin Bases and Sin le Failures Deficiencies in our personnel's understanding of the design and licensing bases of the plant, as well as the definition of a single failure, were discovered during the recent AE design inspection.

To address this issue, we issued a policy statement and associated directive in November 1997 to define the terms "design basis",

"licensing basis",

and "single failure". In addition, training was provided on the new procedures to ensure that the staff understood the

terms, their importance to maintaining Cook.Nuclear Plant's design and licensing basis, and their relationship to the UFSAR and the 10 CFR 50.59 program.

These efforts were performed: to ensure that past deficiencies in our change process at Cook Nuclear Plant are not repeated.

A review of the condition reports issued since September 15,

1997, indicates that the message has been received throughout our organization.

As of December 18, 1997, at least 131 condition reports, by five different plant organizations, have been issued to document discrepancies of a similar type as those identified during the AE design inspection.

This includes discrepancies found in the UFSAR.

Additionally, condition reports, open at the time the procedures discussed above were implemented, were reviewed with increased awareness of the design and licensing basis.

Those condition reports that documented conditions having the potential to adversely impact the design basis were identified.

These condition reports will be resolved prior to entry into a mode where the condition is applicable.

Desi Basis Chan es as Desi n Chan e

As a result of the recent AE inspection, the plant procedure on design change control was modified to recognize that changes to design basis information must also be treated and processed in the same manner as physical design changes to the facility. This means that changes to design basis information will follow a strict path of rigorous multi-discipline design review and 'erification, including completion of a

safety evaluation, prior to implementation.

Consequently, such changes will be subject to a high level of quality assurance standards that will help ensure design configuration control.

Non-Intent Procedure Chan es As a result of the AE design inspection, plant procedures have been revised to require 10 CFR 50.59 safety-screening reviews of senior reactor operator (SRO) change sheets prior to making the changes effective.

Previously, non-intent procedure changes could be implemented as long as an approved 10 CFR 50.59 screening was performed within fourteen days of the change.

The new procedural requirements direct the SRO to withhold approval of any procedure change sheets unless submitted with an approved safety screening.

This guidance applies to all SRO change sheets.

Attachment 2 to AEP:NRC:1260G4 Page 5

Feedback of Lessons Learned As a result of previous inteinal audits, procedures and standards have been strengthened and training conducted.

This has resulted in a more conservative approach when conducting safety screenings

and, as shown below, has resulted in a dramatic increase in the number of safety evaluations performed.

En ineerin Section 1996 1997 Nuclear Safety Mechanical Structural Electrical 50 50 20 40 160 90 30 60 Total 160 340 Future Planned Im rovements The 10 CFR 50.59 procedure will be revised, following the NEI workshop in January 1998; to reflect the guidelines in NEI 96-07.

This revision will be issued during the first half of 1998.

ATTACHMENT 3 TO AEP:NRC: 1260G4 CALCULATIONALREVIEWS

ATTACitMENT3 to AEP:NRC:1260G4 PAGE i

SUMMARY

The purpose ofour review was to establish confidence that similar issues identified during the AE design inspection did not exist in our calculations.

The approach was to analyze and review calculations for issues similar to those identified in the AE design inspection, such as incorrect assumptions, calculation errors, and process measurcmcnt effect on instrument calculations.

The main focus of our analysis was to look for deficiencies that would result in equipment being inoperable. While thc review revealed both technical and administrative deficiencies, none Icd to any inoperability.

The corrective and preventive action needed to bring our calculations up to today' standards willbe part ofour longer-term actions.

The total number ofcalculations reviewed as a result ofissues raised during the AE design inspection was 324, summarized below.

Pccr Group Reviews (review considered lessons learned from AE design inspection)

System Functional Rcvicws (review considered lessons learned from AE design inspection)

Westinghouse Analyses review (focused on valid assumptions and interface)

IACCalculations (focused on instrument bias and process measurement)

Prc-AE Inspection Existing Calcs 41 20 19 114 Ncw Calcs Total 130 171 20 19 114

.Calc'ulitloii'i':Rev'icw'c'1!ai'.Part'.of:Sho'it'<<'Term'his'cssm'e'uter:-.':::1948';:l'::Ll@HSit~~~

i 130N i324~i~':::.:'::

In addition to these 324 calculation reviews, we also looked at the proccsscs and issues for groups of calculations to establish confidence that these previously completed calculations did not contain similar issues identified by the AE design inspection

. These groups arc summarized below.

Large Bore Piping Reconstitution Program Electrical Calculations (incorporated lessons learned from EDSFI)

.':Calcula'tlons'.Prc'vio'u'sl"': Co'm"'Ictcd<i!'.l",i'l.':.',ll:::M.".::..""'i"':.;:":::."!:;:ll:::";';Pi'i":.:

Total 178 l'289,".F4

ATfACHMENT3 to AEP:NRC:1260G4 PAGE 2 POST AE DESIGN INSPECTION REVIEWS

~

PEER GROUP REVIEW EFFORT The UFSAR Revalidation Project conducted a review ofa number calculations to obtain 1) validation of various parameters, and/or 2) to resolve apparent document discrepancies.

The review of the calculations identified a number ofgeneric issues that called into question thc administrative quality, as well as the technical accuracy, of the calculation results.

Condition rcport CR 97-2525 was initiated to investigate and resolve the issues associated with the quality ofcalculations.

Management evaluation of thc condition rcport (CR 97-2525) revealed that the administrative and tcchnical issues brought out by thc condition rcport were similar to ones identified by thc AE design inspection The issues associated with condition report CR 97-2525 calculations were deemed to potentially impact restart issues. It was decided that all calculations involved in resolution of a restart item would be reviewed, through a Peer Group review eQort, prior,to restart.

A total of 171 calculations were reviewed in this elrort.

The review teams consisted of a functional engineering'manager; an<engineer~m the functional area (but not involved in generating the calculation), and an engineer from outside the functional area.

The Peer Group rcvicw eQort was intended to serve as an interim measure to verify that calculations are performed in accordance with the existing procedure to identify human performance issues, as well as being technically correct.

Long-term improvements are being developed as part of the prcvcntive actions to condition report CR 97-2525.

The Peer Group's instructions placed emphasis on the following seven attributes, in addition to the general procedural requirements:

l.

Assumptions are listed and are correct for purposes ofthc calculation.

2.

References arc listed and are validated to be current.

3.

Purpose and intended use ofthe calculation are clearly stated.

'4.

Models and computations are included for unique calculations.

(Where spreadsheet calculations are used, thc formulas should be printed out and attached to the calculation. For calculations that are repetitive in nature, the standard program used must be identified; inputs and results must be included'in'thc calculation.).

5. Ifinput data is taken from a secondly source, its usc:is clearly,justified,and documented.

(For example, ifa nominal tank volume is taken from a system description or the technical specifications, the calculation must document why it is justified and conservative to use the nominal volume.

Otherwise, the volume should be recalculated from primary source documents such as ccrtificd vendor drawings and then adjusted to provide appropriate conservatism.)

6.

Earlier calculations which are superseded or require revision as a result of the new calculation are clearly identified and the appropriate changes to the earlier calculations have been made.

7.

Allblanks on the cover sheet and design verification forms arc completed or N/A'd Also, experienced contractors provided expert advice on the Peer Group review eQort as well as served as team members on some ofthe Peer Group review teams for these reviews.

ATTACHMENT3 to AEP:NRC: l260G4 PAGE 3

~

REVIEW OF WESTINGHOUSE ANALYSES During the course of the Architect Engineer Inspection, a number of issues came to light that suggested it would be prudent to review the calculations performed for the Donald C. Cook Nuclear Plant by the Westinghouse Electric Corporation for accuracy. An engineering asscssmcnt of the design basis calculations performed by Westinghouse in support of thc Cook Nuclear Plant was performed. That assessment was performed in August and September of 1997.

Three principal areas for review were identified for review during the assessment:

1.

A subset of questions identified regarding the RHR cooldown analysis by the AE Inspection Team was addressed.

2.

The interface between AEP and Westinghouse was addressed.

Thc interface had been identified as a potential problem in recent years.

This item was included in the review to address past concerns and to assess the effectiveness of the. changes implemented in recent years.

3.

A sample of 19 calculation packages was reviewed to.,assess. the. potential.for;additional problem areas in thc calculations performed for the Cook Plant units by Westinghouse.

The engineering assessment of Westinghouse Electric Corporation also responded to specific questions raised by thc AE design inspection team. It did not result in any new observations in this area.

The discussion of interface issues resulted in a number of recommendations for further improvement.

Thc review of calculations performed during the assessment identified only one additional calculation which required revision.

The modification to thc calculation was not related directly to the issues arising from the AE Inspection.

This calculation was the post-LOCA subcriticality calculation which is checked every cycle to ensure that the core willremain subcritical aAer a large break LOCA assuming all control rods do not insert.

The ice mass used in the analysis had to bc increased to a value that bounded plant operation.

Although the cold leg recirculation mode cooling subcriticality requirement continued to be met despite thc increase in ice mass, the hot lcg recirculation cooling mode subcriticality requirement needed credit for the hot leg nozzle gap to demonstrate compliance. Taking credit for the nozzle gap to address this issue is not unusual because nearly all Westinghouse units usc this to address this issue.

Thc long-term containment analysis was

'-known to.have a problem due to the erroneous modeling of the CCW heat exchanger.

For this analysis, margin was identified that compensated for the error.

In general, the participants concluded that the: Westinghouse analyses, are performed with suQicient margin to accommodate identified errors; The. participants noted. improvement in,the interface between Westinghouse and AEP in recent years.

However,.as.expected, improvements in this interface appeared to provide the best opportunity to further improve the reliability of Westinghouse analyses.

Furthermore, the items identified in thc AE inspection which impacted the Westinghouse

'nalyses related to the inadequate functioning of this interface.

The participants concluded that, the analyses performed by Westinghouse remained acceptable and that there existed available margin to address issues identified in thc NRC AE Inspection and in this assessment.

~

SYSTEM FUNCTIONALCALCULATIONREVIEWS To develop confidence in the calculations performed by AEP, a sample of the system functional calculations were reviewed.

This review concluded that there were no system inoperabilities as a result ofcalculation deficiencies.

Multi4isciplinary engineering reviews were conducted, using the Peer Group review guidelines, to verify that the selMed systems are capable of performing their intended safety functions (i.e., there werc no inopcrabilities). The Peer Groups for these calculations also focused on assumption control

ATTACHMENT3, to AEP:NRC:1260G4 PAGE 4 and results/methodology validation.

The reviews included reviews of design basis documents to verify the appropriateness of the design assumptions, boundary conditions, and models (when applicable).. The sample was selected as follows:

0 Ten risk significant systems were selected for inclusion in thc sample population based on the IPE risk significance. This resulted in 139 functionally significant calculations from the followingsystems to select from for the system functional reviews:

Essential Service Water [25 calculations]

Component Cooling Water [8 calculations]

Reactor Protection System/ESFAS

[1 calculation]

Residual Heat Removal System [ 11 calculations]

Emergency Power [7 calculations]

AuxiliaryFcedwater System [32 calculations]

Containment Spray System [18 calculations]

250 VDC [25 calculations]

ECCS

-(Accumulators, Safety Injection.

System, RCS Pressure Relief)

[7 calculations]

CVCS (Charging Pumps) [5 calculations]

0 Twenty calculations 'werc then sclccted from this population of 139 based upon their complexity and potential to contain issues similar to those identified by the AE design inspection team (see Table 3).

~

INDEPENDENTVERIFICATION As an additional verification, an AEP contractor performed an independent review of two safety

'significant calculations from the above population of 191 calculations to identify any common deficiencies/concerns with thc reviewed calculations and to provide an outside contractor's perspective on the AEP calculation process and controlling proccdurc(s).

The contractor reviews identified no inoperabilitics.

PRE-AE DESIGN INSPECTION REVIEWS The scope of our review effort was impacted by calculations.that'had'previously, been performed for programs such as the Large Bore Piping Reconstitution Program, and calculations that.has been upgraded followingthe EDSFI.

~

LARGE BORE PIPING RECONSTITUTION PROGRAM The Large Bore Piping Reconstitution Program (LBPRP), performed pipe stress analysis and pipe support calculations for 2 1/2 inch and larger safety system piping between 1991 and 1997.

There were 178 calculation',packages. which include the pipe stress analysis and pipe stress qualification for 5314 pipe supports for normal, upset and cmergcncy conditions.

The NRC reviewed this program and the calculations being performed in December 1991 and indicated that "the LBPRP is very comprehensive and thorough...[and]... The aggressive use of more rigorous analytical techniques shows a strong commitment to quality."

Also, the review of specific calculations resulted in the conclusion that "No discrepancies were noted while comparing the as-built documentation and computer code inputs".

Forty-five pipe support calculations for the CCW system were subsequently reviewed aAer the AE

ATTACHMENT3 to AEP:NRC:1260G4 PAGE 5 design inspection as part of the Peer Group review effort. The review looked at the issues from the AE design inspection, and the process used in conducting the calculations.

Our review provides reasonable assurance that the pipe supports for safety systems are in compliance with the design bases for these systems.

~

ELECTRICALCALCULATIONS Recognized documentation weakness (in our design basis calculations) identified in the EDSFI conducted in 1992 as well as thc results ofan electrical cnginecring group review of calculations

,pre-EDSFI, lcd to a significant effort to upgrade calculations in the 250 Vdc, 120 Vac, and 4kV systems.

Thc electrical engineering group launched a calculation upgrade program, which revisited design basis calculations to assure thc calculations would meet regulatory and internal staildards.

In all, 111 electrical calculations were revised or developed between 1992 and 1997.

Several reviews" and audits,"pcrformcd on the electrical calculations,'yielded only minor, calculation comments.

In addition, electrical calculations reviewed as part of the system functional calculation review eflort revealed that calculation administrative deficiencies did not cause equipmcnt to be inoperable.

PROBLEMS ANDRELEVANCE

~

The Peer Group reviews of 171 calculations as well as the review of20 system functional calculations, utilizing lessons learned from the AE design inspection, identified a number of administrative and tcchnical deficiencies similar to those identified in the AE design inspection.

Examples of administrative deficiencies included the following:

0 assumptions not clearly defined 0

variables in equation not well defined 0

drawing rcfercnccs do not have revision number 0

calculation purpose not clearly stated 0

references not provided 0

diQicult to followthe calculation flow 0

cover sheets not filledout/completed consistently 0

page numbers not properly recorded Examples oftechnical deficiencies included the following:

0 -

treatment ofinstrument uncertainties was not clearly documented 0

justification for assumed inputs used in some calculations was not documented 0

formula for flowratcs not provided However, although there werc a number of deficiencies identiTied in the reviews (see Table 2), the subsequent reviews revealed that no systems were inoperable.

ATrACHMENT3 to AEP:NRC: l260G4 PAGE 6

~

The review of Westinghouse calculations identified a number of discrepancies which required evaluation. In spite ofthese discrcpancics the review team participants concluded that the analyses of record results remained acceptable with conservatism available to address issues identified by thc AE design inspection.

Subsequent to the analyses review a number of as-found operability analyses were performed to document the effect of the identified discrepancies and issues raised during the AE design inspection.

Analyses using actual plant data that were completed for Unit One cycle 16 and Unit Two cycle 11, confirmed the acceptability of the analyses results and demonstrated that the Cook Nuclear Plant systems remained operablc.

MATRIXOF CALCULATIONREVIE%S PERFORMED le 1

Electrical (273 in calc database)

TOTAL= 3 FUNC. CALC. REVIEW3 Mechanical (1529 in calc database)

I8r,C (330 in IAC database)

(218 system related, and 112 uncertainty)

Structural (2410 in calc database)

Other (526 in calc database)

TOTAL= 54 WESTINGHOUSE ANALYSES18 PEER GROUP REVIEW22 FUNC. CALC. REVIEW14 TOTAL= 145 WESTINGHOUSE ANALYSES1 PROCESS MEASUREMENT. ('97) 114 PEER GROUP REVIEW29 FUNC. CALC. REVIEW1 TOTAL= 116 PEER GROUP REVIEW;- 116 TOTAL= 6 PEER GROUP REVIEW4 FUNC. CALC. REVIEW2

,-'.,Total'.':Numb'er';.'of::.:".Caic':Review's324.','-'-;;,;=",::;,'",;":::;,.;.:

Table 2

~

SHORT TERM ASSESSMKNT PEER GROUP REVIEW OF CALCULATIONS CR 97-2802 CR 97-2809 CR 97-2805 CR 97-2829 CR 97-2842 CR 97-2843 CR 97-2935 CR 97-3057 Pdentt/led during system/'uncttonal revIews)

CR 97-3143 Pdenttfted durlng systemtu notional reviews)

CR 97-3215 Pdentt/led during system functtonal reviews)

Calculations were run on the non-QA DOS PC-based version ofE/PDSTRUDL because ofa software litch in the AM1CROVAXversion.

DC-D-HV-12-ABevaluated the impact ofhigher CCW temperatures on auxiliary building ventilation.

The basis for using an average CCW temperature of 135 F was not documented.

The engineer subsequently documented his basis for the assumption, which was an evaluation by the system engineer ofrelative surface areas and temperatures throughout the system confirming that 135 F was a conservative value to usc in this calculation.

ENSM 970606JJR evaluated the potential forvortexing in the RWST. Set points noted in the calculation did not include instrument uncertainty and it was felt that the potential for the results to bc misapplied by the end user (1&C) was high. The calculation:was clarified with respect to uncertainty.

Pro r use ofthe results b I&Cwas verified.

ENSM 971001CV determined RWST volume required for Appendix R support ofthe opposite unit.

Reference for formula was omitted, basis for assumption that pressure/temperature ramp down linearly over 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> was not provided, and the PORV flowrate taken from the FSAR was not identified as being a conservative value. Formula was confirmed to be correct and all assumptions were reviewed to ensure they were conservative.

PORV flowrate was actually increased for the final calculation, but combined with other refinement ofother assumptions, the original calculation results were shown to be conservative.

HXP 911210AF, Rcv. 2 determined CCW temperatures forRHR cooldown for LBPRP. The calculation was technically acceptable.

However, Rcv. 2 superseded only part ofRev.

1 so both revisions were currently valid. Rev. 2 willbecome a stand-alone calculation that incorporates all of the remainin valid rtions ofRev. 1.

ENSM 970926QSL determined the impact ofa thermal barrier rupture on the CCW system.

Bases for selecting the RCS pressure and for considering 547 F a conservative RCS temperature were not rovidcd. Desi n ressure ofCCW.

stem was not documented.

Results were valid.

ENSM 970929TWF determined CTS flowto the containment annulus via CEQ fan stairwells.

Bases for assumptions were not documented.

Review and refinement ofassumptions and recalculation confirmed that ori inal results were valid.

RS-C-0280 determined short-term maximum pH for containment sump after LBLOCA. The calculated value was 12.97 (for a period of 18 minutes); which is above the -12.9.upper limitfor EQ specifications.

However, removing other overly conservative assumptions'within:the calculations (most notably assuming a 10% reduction in sodium tetraborate from!ice sublimation) willreduce thc calculated value to below 12.9. Additionally, the corrosion affect ofpH 12.97 versus 12.9 for a short riod oftime is not measurablc or si

'cant.

Calculation is bein redone usin ro r assum tions HXP 740226FK and HXP 900629AF both deal with ESW system flowrcquiremcnts.

The review identified potential discrepancies with current values in FSAR Table 9.5-2 and questioned whether the SFP heat exchanger load had been properly considered.

Consequences ofthe discrepancies were determined to be minimal. Calculation NEMP 950612AF had subsequently been performed and confirms that the 1990 calculation results arc stillvalid. Allofthe calculations are being revised a

ro riatel HV 12CC01N veriTied the "adequacy" ofthe CCW emergency ventilation supply fans. Assumptions and methodology were not well documented, and the reviewers raised numerous questions.

Evaluation by HVACcnginccrs subsequently determined that the calculation results werc valid.

Table 3 Syst ctional Reviews Q,::!$:Qkk".PC(%&+~i:,;,

PS-4KVD-003, REV 0 MINIMUMAND MAXIMUMBUS FAULTS 4KV, 600V, AND 480V SYSTEMS PS-4KVP-009, REV 0 4KV RCP UNDERVOLTAGERELAY SETTINGS PS-EDGL-001, REV 0 EDG 1AB STEADY STATE LOADING ANDVOLTAGEDROP 4KV ENSM740501FK1, 5/1/74 HXP721130FK-2 AFWS PUMPS - TECHNICAL SPECIFICATIONS, BY F. KUO, 5/1974 AUXILIARYFEEDWATER PUMP SUCTION - NPSH AVAILABLE, 11/1972 HXP740226FK AFWS NPSH CALCULATION, FEBRUARY 26, 1974 HXP850508AF MAXIMUNALLOWABLEPUMP DEGRADATIONOF THE UNIT 1 PUMP, 1/2/86 HXP910619AF, REV 0 AFW FLOWRATES IN SUPPORT OF SAFETY VALVESETPOINT AFW INCREASE Page 1, 12/24/97

Table 3 Syst notional Reviews NEMH930601AF Pi~i~:ci:"-:@LYNN%!~j%:"j~4~~)iiy',;8)4fA.

DETERMINEAMOUNTOF PUMP DEGRADATIONTHATIS ALLOWED WHICH MEETS SAFETY ANALYSIS FLOW REQUIREMENTS, REV 0, 6/21/93 DCCHV12CC01N CCW PUMP AREA VENTILATION SYSTEM DESIGN, 12/8/89 CCW HXP910419, RO CCW MOVPRESSURE DIFFERENTIAL CCW DCCHV12AE06-N HEAT GAIN CALCULATION,AES SYSTEM, REV 1, JUNE 2, 1992 CTMT SPRAY RD-88-01 RS-C-0280 DOSE TO CONTROL ROOM OPERATORS FOLLOWINGA LOCA SPRAY REV1, NOV28, 1988 SHORT TERM MAXPH FOR CONTAINMENTSUMP IN A LARGE

~pappy BREAK LOCA, AUGUST 31, 1995 HXP890525AF, DATEDJUNE 19, 1989 UNIT 1 WEST CENTRIFUGAL CHARGING PUMP FLOW REDUCING ORIFICE CVCS DCCHV12ES03N, REV 0 LOSS OF HVAC-ESW PUMP ROOM ESW TEMPERATURE, APRIL22, 1991 Page 2, 12/24/97

Table 3 Syst nctional Reviews HXP900627AF DETERMINE ESW PUMP OPERATION DURING FULLPOWER UNITOPERATION, JULY 6, 1990 ESW HXP900629AF ESW FLOW REQUIREMENTS, 6/29/90 ESW NEMP950810AF, REV 0 ECP-1-2-N2-07, 4/27/93, R8 ESW FLOW TO EDGs, AUGUST 18, 1995 MID-LOOP PHENOMENA AND INSTRUMENTATION ESW RHR Page 3, 12/24/97

ATTACHMENT 4 TO AEP:NRC:1260G4 PRESENTATION MATERIALS FOR DECEMBER 16, 1997 PUBLIC MEETING

RESPONSE

TO CONFIRMATORY ACTION LETTER ISSUES

December 16, 1H7

'MERICAN'lECl'RIC POWER

a I

I i This meeting willdiscuss AEP's resolution of issues documented in the NRC's Confirmatory Action Letter of September 19, 1997 and provide reasonable assurance that these issues do not affect the operability of other safety systems.

AEP's conclusion is that Cook Nuclear Plant is ready to resume power'peration pending receipt of necessary technical specificatioh changes and

'ompletion of the resolution plans.

Agenda I.

Introduction Eugene E. Fitzpatrick, executive vice president Nuclear Generation Group, Buchanan II. Confirmatory Action Letter No. RIII97-011 Issues &Resolutions A.C I Issues1 4 San 2

Jeb B. Kingseed, section manager-nuclear safety and analysis Nuclear Generation Group, Buchanan Paul Schoepf, P.E., mechanical systems manager.

Nuclear Generation Group, Cook Nuclear Plant C. nstrument Uncertain es C I

u 9

Stanley K. Farlow, P.E,, manager-I&C engineering, production engineering Nuclear Generation Group, Cook Nuclear Plant III. Short Term Assessment Program A.S ort-Tem ses e t eve e t Joel S. Wiebe, manager-performance engineering &analysis Nuclear Generation Group, Buchanan B. S ort-Te ssess e t Results James A. Kobyra, P.E., chief nuclear engineer Nuclear Generation Group, Buchanan IV. Additional Assurance of Operability of Systems A. Alan Blind, site vice president Nuclear ~neration Group, Cook Nuclear Plant V. Conclusion Eugene E. Fitzpatrick, executive v'ice president Nuclear Generation Group, Buchanan

Resolution ofCALIssues Meeting Resolution ofCALIssues Meeting Gene Fitzpatrick Executive Vice President Nuclear Generation Group American Electric Power Introduction Meeting Overview I.

20 3.

4.

S.

6.

70 8.

Issues or resolution rior lo restart Recirculation sump inventory Recirculation sump venting 36-hour coo!down ES 13 switchover procedure Compressed air overpressurc RHR suction valve interlock Fibrous material Backlcakage to RWST g macaw Resolution ofCALIssues Meeting Issue or discussion riorto restart Instrument uncertainties incorporated into procedures and analyses Short-term assessment riorto restart To determine whether same type engineering problems exist ln other safety-related systems and whether they alfect system operability Jeb Ktn Paul Sehoepf Stan Farlow Joel Wiebe Jim Kobyra AlBlind A enda S I Reetreutatlon Sum lnvenio S4 ES 19 Switchover Procedure SS Baetdeabaae to RWST SZ Reetreulatton Sump Venttnx Hbrous Material In Containment SS Sd.hour Cooldown ttd RHR Suction Valve AutoCtose SS Compressed AirOverpressure itt Instrument Uncertainty Short Term Assessment Development Short Term Assessment Results Additional Assurance ofOperability of Systems Conclusion Reclrculatlon Sump Inventory Con irmoto Action Letter issue Pumps used to coot.the reactor and containment building may not have enough water supply to allow long-term operation ofthe systems Commitment Analysis willbe performed to detnonstratc that the recirculation sump level is adequate to prevent vonexing, or appropriate ntodifications willbe made Reclrculatlon Sump Inventory Issue resolved o Analyses demonstrated emergency core cooling system/containment spray system operability h

'etermined sump level margin above 602'0" exists o Subtititted Tcchnical Specification amendment to credit morc existing icc

+aneajeasr

Recirculation Sump Inventory A~nal sls

'ump configuration

'loNlpaths

'nalyses

'esults gestate Recirculation Sump Inventor

~nal sls

~ Large-brcak loss ofcoolant accident and spectrum ofsmall-brcak loss ofcoolant accidents o Transient analysis o Icc melt credited

'ctive/inactive sumps modeled o Revised ES-1.3

'WST level uncertainty gaatatcase Recirculation Sump Inventory'/

A~nal sir resnlrs o Water level >602'0" for large and small break loss ofcoolant accidents o Technical'Specification amendment Recirculation Sump Inventory Issue resolved o Analyses demonstrated emergency core cooling system/containment spray system operability o Determined sump Icvcl margin above 602'0" exists o Submitted Tech'nical Specification amendment to credit more existing icc k

Jch Ktngsccd Paul Schoepf Stan Fartow Joel Wtebe Jim Kobyra Al Blind Gene pttspatrtck A ende introduction Nl Redreutstton Sum Invento

<<e KS IDSwitchover Procedure ca gc to eg:.'e. Rcdrcutatton Sum p Venting

<<y Hbrous Material ln Contalnmcnt NS 3&curCooldown

<<d RHR Sucdon Valve AutoCtosc irS Comprcsscd AlrOvcrpressure Instrument Unccrtdnty Short Tcrtn Assasmcnt Devdopmcnt Short Tenn Asscssmcnt Resulrs Additional Assurance ofOperability of Systems Conduslon ES-1.3 Switchover Procedure Con rrmoro Afenon Leuer issue Adequacy ofcurrent procedures during switchover &xnthc emergency water supply tank to thc eontahunent sump for long<can post~dent operations Commllmenl Changes to thc cmcrgency~ used forswitchover of the cmcrgency core cooling and containmcnt spray pumps to tbe rcdreutsncu Nanp willbc hnplcmcntaL These changes wi1I provide ssurance there willbe adequate sump volume, withlroper consideration ofinstrument bias and single>>failure criteria

+aatatcasr

ES-1.3 Switchover Procedure ESo1.3 Switchover Procedure issue resolved Implemented changes to ES-1.3 to incrcasc water injection, eliminated single-failure vulnerability, and account forrefueling water storage tank level bias

~noesis Refueling water storage tank level measurement bias

~ Accident analysis assumptions

~ Single-failure ESo1.3 Switchover Procedure Aeuons t

~ Refueling water storage tank level measurement bias

-Flow Induced errors (acoul level > indicjgtcd)

Resolution

'oved refueling pates stomge tank level transmitter tap

'nstrument uncertainty

~~

RRRRRRRRJI'S-1.3 Switchover Procedure Acuons

~ Accident analyses assumptions

-Rceriticality

-Containment pressure

-Long-tenn cooling Resolotloo

'ssumptions satislied ES-1.3 Switchover Procedure ES-1.3 Switchover Procedure Actions

'ingle-failure <g..

-One residual heat removal (RHR) pump supplied high-head emergency core cooling system (ECCS) pumps during transition

'esolution

-New transfer sotuencc ensures no loss ofinjection with single-failure Resolullon summa Eliminated refueling water supply tank level measurement bias

'et accident analyses limitations

~ Considered worst case, credible single active failure

~ Validated procedure and trained operating crews

+ Agggggdggr

Paul Scboepf Stan Fariow Joel Wiebe

-Jim Kobyra AIBlind tAcne Fitzpatrick N

ec feil a oii nip cnbng N7 Fibrous Material ln Containment N3 3ti hour Cooidown Nd RHR Suction Valve Auto<lose Ns Comprcsscd AirOvcrpressure Np Instrument Uncertaint Short Term Asscssmcnt Development Short Term Assessment Results Additional Assurance ofOperability of Systems Conclusion A enda ck Introduction Jcb IGnaseed Nl Rccircutatfon Sump Inventory Ns KS IDSwitchover Procedure Na Backleakaac to RWST Back-Leakage to Refueling Water Storage Tank Con irmato Action Letter issue Scat leak testing ofvalves may not be adequate to identify potential backllow from the containment to thc RWST during the LOCArecirculation phase Commitment Only two ofsix mini-flowrecirculation line valves have leakage verification tests. Justification willbe provided that the total leakage forthe six valves is

<10 gpm to ensure that Part l00 limitsare not exceeded ifcontainmcnt sump water werc to leak back to RWST during a design basis accident

~UCTaic Back.Leakage to Refueling Water Storage Tank r

issue resolved o Included fiowpaths in in-service testing program o Implemented new procedure: seat leakage testing ofvalves at each refueling outage to ensure < 10 gpm total leakage Back-Leakage to Refueling Water Storage Tank A~nal sla

'our back flowpaths

-Leak testing in place fortwo ofthe four paths

-Two paths not included in in.service testing program alcawasr cUcvalc Back-Leakage to Refueling Water Storage Tank Back4.eakage to Refueling Water Storage Tank Actions o Testing progranr results

-Tested valves already included ln testing program

-Added five valves pcr unit to testing program

-Test results issue resolved o Included flowpaths in in-scrvice testing program o Implemented new procedure:

seat leakage testing ofvalves*at each rcfucling outage to ensure < 10 gpm total leakage

Jcb Kln Paul Scboepf Stan Farlow Joel Wlebe Jim Kobyra AlBlind Cene Rtzpatrtctt A enda Introduction Nt Rcdrcutatton Sump lnwntory N4 KS IDSwitchover Procedure W

NX Rcdrculatton Sum Vcntins ibrous tc n

n nmcnt

<<S 36Jiour Coowown tte RHR Suction Valve AutoClose

<<5 Compressed AirOwrpressure

<<p instrument Unccrtatnty Short Term Asscssmcnt Dcvelopmcnt Short Terai Assessment Results Additional Assurance ofOperabNty of Systems Conduslon Reclrculatfon Sump Venting Con irmato Action Letter issue May not be adequate venting ofair underneath the roof

'f the containmcnt building recirculation sump Commitment Venting willbe rcinstallcd in the recirculation sump cover. The design willincorporate forcignmaterial exclusion requirements for thc sump ReclrculaVon Sump Venting

/ssue resolved Reinstalled recirculation sump cover vents with a design that prevents foreign material from entering through thc holes Reclrculatlon Sump Venting

~nial sls

'977/78 Alden Labs study o Vent holes added to sump cover in 1919 as an enhancement Reclrculatlon Sump Venting ReclrculaVon Sump Venting

~nal~ls Holes plugged in4996 and 1997 to address I/4" foreign material exclusion concern

~ctlons

~ Venting reinstalled o Design now incorporates foreign material exclusion provisions

ReclrculaVon Sump VenVng Issue resolved

'einstalled recirculation sump cover vents with a design that prevents foreign material from entering through the holes Stan Farlow Jod Wtsbc Jim Kobyra AlBlind Ceno Hispatrlck I3 hour Cooidowu RHR Suction Valve Auto@toss Is Comprssscdhlrovcrprcssurc Iti Instrument Uncertainty Short Term Asscssmeut Dcvdopmeut Short Term hsscssmcnt Results hddt ttouat Assurauco ofOperability or Systams Coodusiou A enda Cene Htspatrlck Introduction Jab Moesccd II Rcdrcutattoa Sump Inventory I4 ES IDSwitchover Procedure Ia Backtcakaee io RWST Paul Schoe r IT Hbrous Material In Contatnmcut Fibrous Materfal In Containment Fibrous Material In Containment Con irmalo Aclion Lerrer issue Fibrous material in containment building Commllmenl Removal offibrous material from containmcnt building that could clog the recirculation sump willbe complctcd

~nal sos

'nstallation ofcable tray fire stops

-Fibrous material used ai "damming material"

-Installation specification did not require removal of material in containment Fibrous Material In Containment Fibrous Material In Containment Acllons cllons

'emoved fibrctus damming material

-l2 locations in Unit I IS locations In Unit2

-Annulus and lnstnuncnt Room

'eviewed operating experience and regulatory information o Performed extensive walkdowns o Identified and addressed other fibrous insulation

Fibrous Naterfaf ln Contafnment Issue resolved Removed fibrous insulation material from containment building that could clog thc recirculation sump Cene Fttspatrtck Jcb Ktnssced Paul Scboc f Stan Fart ow Joel Wtcbc Jim Kobyrn hl Blind

" Cene Htspatrtck A enda 5n troduction Nt Redrculation Sump Inventory tt4 ES 13 Switchover Procedure

<<S

~ Bacldcakaae to RWST

<<3 Recirculation Sump Ycnttna trt Rbrous tatcrfsl tn Containmcnt

<<3 3@hour Coo!down on ve ttS Comprcsscd Airoverpressure ttp instrument Uncertainty Short Term Assessment Development Sbort Tenn Assasment Rauits Addldonal Assurance ofOperability of Systems Conduston 36.Hour Coofdown 36 Hour Cooldown Can mmata Action Letter issue Calculation needs to be performed that shows one train ofcooling water system is surtcient to rcmove the units from service Commitment Analyses willbc performed that willdemonstrate the capability to cooldown the units consistent with the design bash requiranents and necessary changes to procedures willbc completol Issue resolved Analyses completed to demonstrate 36-hour cooldown capability with onc train ofcooling 36 Hour Cooldown 36.Hour Cooldown

~nal sls o Original Westinghouse performance requirement fornormal cooldown

-Plant canbe eoolcd down in 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> withonc train ofcooling

-Consequence:

cotnponcnt cooling water supply temperature can reach l20F during this evolution

~nial sls

'6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> cooldown analysis revisited for Unit2 uprate

-Design inspection issue: discrepancy in CCW heat exchanger type assumed in uptate cooldown calculation

-Original cooldown calculation contained heat exchanger modeling error

36 Hour Cooldown Actions

~ Demonstrated thermal hydraulic capability for a 36-hour cooldown 36-Hour Cooldown Actions e Component cooling water design temperature increased to 120'F for single train cooldown via deign change

-Equipment evaluations

-Piping evaluations

-Operating procedure change gmnaur 36.Hour Cooldown 36 Hour Cooldown ui ment evaluation Flow balance criteria increased slightly based on NSSS vendor recommendation to preserve heat trarisfer capability during 36-hour cooldown

-Safety injection pumps

-Centrifugal charging pumps

-Residual heat removal pumps Operability not challenged forprevious fiow limits based on GL 91-18

~tt ui ment evaluation cont.

e Planned non-Technical Specification radiation monitor replacement rescheduled - location of new monitors in lower temperature location 36.Hour Cooldown 36-Hour Coofdown

~ e Four minor pipe hanger moditications due to higher stresses associated with increased temperatures

~ Change driven by desire to handle 36-hour cooldown as a "nornial" condition - no changes required ifhandled as emergency condition fssue resolved Confirmed 36-hour cooldown capability with one train ofcooling water

0 0

Gene Htspatrtek Jeb Ktnaseed Paul Schoepf Stan Fartow Joel Wtebe Jim Kobyra At Blind Cene Fitzpatrick A enda introduction Nt Recirculation Sump inventory

<<4 ES 13 Switchover Procedure ea Baetdeakaae to RWST tran Reetreutatton Sump Venttna

<<1-Fibrous htaterhl in Containment ttd R16t Suction Yatve Au~ose Ns ompressed Air erpressure ep instrument Uncertainty Short Term Asussment Development Short Term Assessment Results Additional Assurance ofOperability of Systems Co net uslon Residual Heat Removal Suction Vahte Auto@lose Con u moto Action Letter issue Conflicts bctwcen operating procedures and Tcchnical Specilications forresidual heat removal system Commitment A technical specification change to allow operation in Mode 4 with the residual heat removal suction valves open and power removed is being processed.

Approval ofthis change by NRC willbc required prior to restart

~~ assrewasr rstrra le Residual Heat Removal Suction VaNe Auto@lose Residual Heat Removal Suction Valve Auto@lose Issue resolved Technical Specification amendment approved

'unction dcsigncd originallyto protect residual heat removal system from ovcrpressurc

'perational practice dcfcats thc auto-closure whcncvcr valves are open

-Concern forloss ofdecay heat removal

-Lowtemperature ovetpressure system operation e Impact on Tcchnical Specifications and Final Safety Analysis Report not identified Residual Meat Removal Suction Vahte Auto@lose Residual Heat Removal Suction Valve Auto@lose Actions

'ubmitted Technical Specification amendmcnt

-Removes surveillance requirement for valve a~losure

-Takes credit for low temperature ovetprcssure system protection forraided heat removal system

-Operating procedures, UFSAR and Tcchnical Specifications aligned Issue resolved Tcchnical Specification amendment approved

Gene Fitspatrick Jeb IQngseed Paul Sehoe f Sian Fartow Joel Wiebe Jim Kobyra AlBlind Gene Htspatrtck A Nnda introduction Nt Recirculation Sump fnventosy Ns ES IDSwltebowr Procedure Na Baetdeakage to RWST Ng Recirculation Sump Venting Fibrous Material in Containment NJ 3ts hour Cooldown V

N5 Com ressed AlrOve ressure Np nstrument neerta nry Short Term Assessment Dewtopment Short Term Assessment Results AddMonat Assurance ofOperabpdty of Systems Cond uston Compressed AlrOverpressure Con irmato Action Letter issue Adequacy ofpressure protection forsome components in thc compressed air system from equipment malfunction Commitment Ovcrprcssurc protection willbe provided downstream of thc 20 psig, 50 psig, and 85 psig control air regulators to mitigate the effects ofa postulated failed regulator Compressed AlrOverpressure Issue rei alved

'nstalled redundant, safety-grade reliefvalves and eliminated ovcrpressure potential o Eliminated potential forcommon-mode failure Compressed AlrOverpressure A~nal sls o System design

-Non-safety related

-"Failsafe" on loss ofair

-Activevalves change state on safety grade solenoid valve actuation

-Ovcrprcssurc protection forthe system but not for system loads Compressed AlrOverpressure A~nal sls

'nitial findings'.

-Potential common-mode failure ofequipment resulting from ovcrpressurization

-Many coinponents not rated forfullinitial pressure

-Component failures anticipated Compressed AlrOverpressure Issue resolved

'nstalled redundant safety grade reliefvalves and eliminated overprcssure potential o Eliminated potential forcommon-mode failure

0

Stan Fartow Instrument uncertainty o

bc Jim Kobyra AIBlind rt crm Asscssmcnt opmcnt Short Term Asscssmcnt Results AdditkinalAssurance ofOperability of Systems Cene Htzpatrick Conclusion A endg Cene Htspatrlck Introducdon Jcb Kingsccd gl Rcdrcutadon Sump Inventory gg KS IDSwitchover Procedure gg Backlcakagc to R%ST g2 Rcdrculatton Sump Venting Paul Schoepl ttr Hbrous Material ln Containmcnt g3 3&ear CooMown ttd RHR Suction YalvchutoClose Instrument UncertaInty Con trmoto Action Lc'tter Issue Instrument uncertainties incorporate! into proccdurcs and analyses Comnritment Emergency procedures and other important-to-safety procedures, calculations, or analyses willbc rcvicwed to account for instrument uncertainties lt is understood that resolution ofthis issue requires a long-tenn program continuing beyond restart Qmaicatr Instrument UncertaInty Instrument UncertaInty 4~nal sis

'reas for improvement

-Control usc ofInstrument uncertainties in calculations, procedures, and analysis

-Improve control ofuncertainty calculation inputs

-Process measurement error ca!culations

-Provide training to other disciplines

-Increase number ofparameters under formal control Issue resolution o Program elements

-Control use ofuncertainties

~ Ahninistrative control

~ Paramctcis used to assure Tcchnical Spedgcation ccmp4ancc

'ntegrate with nNmal operating procohimupgrade program that was committed to!n our NRC submittal AEFNRC I260H Instrument UncertaInty Instrument UncertaInty

'rogram ciemontg

-Plant specific methodology

'ethod to calculate Instmmcnt unccrtaindcs Rcfcicnce NRC Branch Tcchnical Posidcn HICB-12

-Review existing calculations w Ebminatc rcplicue caicidations

~ NRC Inspection raccdure 93807 Tralnmg X

o Instrument uncertainties under formal control

-Reactor trip and engineered safety feature actuation system sctpdnts

-Emergency and abnormal opcradng procohucs

-Operations, surveillance and test procedures

-Plant perfamancc data used in analysis

-Scipoints forplant alarms assodatcd withmoaitcdng Tcchnical Specigcation con pllance

lnstmment Uncertainty Actions corn leted

~ Reviewed level instrumentation forvelocity eifcct

~ Reviewed and rcviscd emergency operating procedures forswitchover to recirculation o Reviewed and rcviscd Technical Specification surveillance procedure used by operations

'enerated parameter list forTechnical Specification compliance Instrtrment Uncertainty ctions cpm leted cont.

~ Generated administrative control procedures

~ Reviewed EOP sctpoint documentation

~ Reviewed license bases

~ Addressed related non-programmatic unrcsolvcd issues from the inspection report

~ Complctcd plant spcciific methodology manual Instrlrment Uncertainty ahedule Complete all reviews and calculations in 1998 A enda Gene Htspatrkk introduction Jcb Kluasccd Nt Recirculation Suaip inventory N4 ES lDSwitchover Procedure SS Backteakaae to RWSP

<<S Recirculation Sump Vcndng Paul Scbocpr N

Hbrous titatcrtat ln Contalnuicnt SS 36.hour Cooldosrn e6 RHR Suction Valve Auto%lose Ns Coin pressed AirOvcrprcssure Stan Fartovr 09 tnsrrumcot ncertain Joel Wicbe Short Term Asscssincnt Dcvciopiucnt lla rt erin aleut is AlBlind Additional Assurance or Operability or Ssstccas Gene Htspatrtck Conclusion Development ofShort Term Assessment Corrective action process

-Investigatiori ofissue

-Root cause analy'sis

-Correction ofissue

-Actionto prevent recurrence Development ofShort Tenn Assessment o Purpose ofshort term assessment To determine whether similar issues may exist in other safety systems, and ifthey do, whether they affect system operability

Development ofShort Tenn Assessment Independent root cause analysis teams (CAL issues l-8)

-Root cause analyst

-Outside technical analyst(s)

-Individual knowledgeable ofissue Development ofShort Tenn Assessment

'enior management review ofcauses

-CALitems 1-8

-Causes

-Potential impact on operability

-Identified and discussed implications Result: Five issues with potential to impact operability Development ofShort Tenn Assessment o Root cause ofother design inspection issues

-Root cause analyst

-Outside technical analyst(s) o Allroot causes additionally reviewed by independent senior industry peers Development ofShort Tenn Assessment o Senior management review ofcauses

-Compared to CAL issue causes and short tenn assesQllcnt o Result

-No additional issues were identified

-Some specific actions added Development ofShort Tenn Assessment o Issues with potential to impact operability

-Analyses withptors or incorrect assumptions

-Non-safety related systems failure modes

-Lcvcl instrument bias duc to Bcrnoullieffec

-Containmcnt sump attribute not prescrvcd

-Improper application ofsingle failure criteria, A enda Ceno Htspatrtck Introdncdon Job IQnesccd et Rcrtrcutatlon Sump lnwntory ES IDSsiltcbovcr Procedure ea Backtcakaao to RWST

<<3 Rcrtrcutadon Sump Ycndng Paul Schocpf N

Hbrous htatcrtat ln Containment e3 36@our CooMosrn RHR Suction Yatvo AuorQosc

<<5 Compressed hlrovcrprcssure Stan Fartovr ep Instrument Uncertainty Itl cnt Jins Kobyra Short Term Asscssmcnt Results I

rance o para iyor Systems Ceno Htspatrtck Conduslon

0 0

Short Tenn Assessment Results Short Term Assessment Results c Engineering issues I. Analyses with errors or incorrect assumptions

2. Non-safety related systems failure modes

3. Level instrument bias duc to Bcrnoulli effec

4. Some contalnmcnt attributes not preserved S. Improper application ofsingle failure criteria

'esolution process

-Scope and deliverable

-Operations and engineering management

-Initialresults Indicated further expansion

-Closure defined documented reports Short Tenn Assessment Isragrem 10 root causes withpetanttat opcrabmty kiipact Exit&0kneAdge ISSR, Iavdlsncas, procedures, ate.)

Short Term Assessment Results-Issue Nf

~ Analyses crmts or incorrect assumptions

~nfinn safety analyses ofrecord

-Evaluate heat exchanger modeling

-Dctcrmine extent ofcalculation problems Short Tenn Assessment Results-Issue O1

'hort Tenn Assessment Results-Issue O1

~ Confirmation ofanalyses ofrecord

-Seven pcrsoir team to the NSSS offic

-IWcpthrcvtcwdfUnit I gt 2 analyses

-Minorfindings-Interface assumptions

-Analyses ofrecord-conservative

-ECCS, CTS, RHR, Containment, AFW,CCW

'afety-related heat exchangers will perform their function

-Residual heat removal heat exchanger

-Containment spray heat exchanger

-Component cooling water heat exchanger

-Spent fuel pool heat exchanger

-EDGjacket water and lube oil heat cxchangcrs

~ Counter cow versus TKhfAE

~ Csiculadoas revised

Short Tenn Assessment Results - Issue ¹1 Short Term Assessment Results -Issue ¹1

'ssuring confidence ofAEP calculations Total Reviewed Electrical 273 119 Mechanical 1529 6

Instrument 330 157 Structural 2410 294 Other 526 6

5068 632

'ssuring confidence ofAEP calculations

~ Recent calculation program efforts

-LBPRP

-MOVcalculations

-Electrical distribution calculations

-I&CInstrument uncertainty calculations

~ Peer review

-l71 Design Inspection calculations

-20 functional calculations Short Tenn Assessment Results - Issue ¹1 Short Term Assessment Results-Issue ¹1 Electrical Mechanical Other

'EP functional calculations Total Reviewed 32 3

79 16 28 3

139 22

'eer Review

-Team Inspection-Management involvement

-Additionto thc vcriTication Safety'related systems

-Emergency core cooling water

-Essential service water

-Containment spray

-Auxiliatyfccdwatcr

-Eicctrical distribution

-Chemical volume and control Short Term Assessment Results-Issue ¹1 Short Term Assessment Results -Issue ¹1

~ Peer review results

-Administrative issues

-Technical quest'tons raised (10)

-No effect on system operability We have confidence that AEP calculations are sufficiently conservative to assure system operability

~ Achieved through

-'The peer review results

-Our reconstitution programs

-Conclusion ofsafety system functional inspections performed on the ESW and electrical distribution aystctlls

Short Term Assessment Results-Issue ¹2 Short Tenn Assessment Results - Issue ¹2

'on-safety related system interface

-Effect on safety related system performance

-Selection process forrcvicw

~ Safety &,nan~ety related systems

. 'ignigcauce ofinterface withsafety related systems

~ Potentially unicvtcwed tost/failure modes

-Comparison with maintenance rule risk significance

'on-safety related system evaluations

-Modifiedcontrol air system

-Reactor control system

-Condcnsatc/

fcedwaterrmain stcam

-Circulating water

~

-Non-essential service water

.Electricaldistribution

-Pressuriscr heaters u No adverse effects Short Tenn Assessment Results - Issue ¹2 Short Tenn Assessment Results - Issue ¹3

'onclusion

-Postulated failures ofnon.safety related systems do not affect safety system operability e Appropriate application ofprocess measurement effects

-Team approach with industry consultants

-Compared AEP engineering guides to industry ttandards

-Appropriate process measuremcnt effect Bemoulli effect on level instrumentation

-Non.standard process location

-No guidance in engineering guides Short Tenn Assessment Results-Issue ¹3 Short Tenn Assessment Results - Issue ¹3 Bcmoulli effect on level instrumentation

-Allsafety relet@I level instruments cvalusted

-Condensate storage tank

'fcct is present but iaslgnigcaut

-Mid-loopRCS

'tfcct ls present but iasignigcant

-RVLlS iEtfcct is present and was tuctudot

-Level instruments appropriately account for Bcrnoulli effect bias e Bemoulli effect on level instrumentation

-idcC <<ngineering guide rcviscd

-Calculations account foithe flowinduced effects on process level instruments

Short Tenn Assessment Results - Issue ¹3 Short Tenn Assessment Results-Issue ¹3

'tructures as systems

-Structural and mechanical functions

-Functions may not bc survcilled

'tructures considered

-Containmcnt

-Auxiliarybuilding walls

-Control room complex

-Forebay and discharge vault o AuxiliaryBuildingInterior Walls

-HELBanalyses in 1996

-HELBboundary drawings Containment complex structure

-Structural integrity

-Multiplycompartments

-Interior flowpaths to support ECCS functions Short Tenn Assessment Results - Issue ¹0.,

Short Tenn Assessment Results - Issue ¹5 o Containment attributes

-Multkllsciplineinspection team

-Focused on perfonnance attributes

-Technical and housekeeping questions raised

-Actions were taken to disposition findings

-No new issues raised that affect operability Applicationofsingle failure criteria

-"Ftuiure to run" scenarios are considered ln analyses by both Westinghouse and AEP

-Crossied safety-related system evaluations

-Essential service water system

~ Normsl pocsatkxt

-AFW,CVCS, CCW, ESW, clectricat distribution o Emergency crossde Short Tenn Assessment Results o Conclusion

-Results firmlysupport our conclusion, there exists reasottabie assurance that the problems ofthe type found during the Design Inspection do not impact operability ofthe other safety systems A enda Cene Htrpstrkk latroductloa Jcb Klnasccd Nl Rcctreutsttoa Sump Inventory N4 ES LS Switchover Procedure NS Boctdcoksae to RWST Ns Recirculation Sump Ycnttna Paul Schocpf rrr Hbrous Mstcrtst la Contsfnmcnt NS SAeor Cooldown N6 RHR Suction ValveAu~

NS Compressed AlrOvcrprcssure Stoa Farhnr NN lastnuncnt Unccrtslnty Joel Wlebe Short Tenn Asscssmcnt Development AlBlind s~

• ddt~A ~orOp r Mttyol S

toms

Cene HtspaMk Jcb IQngsced Paul Schocpf Stan Farfow Joel Wcbe Jim Kobyra AlBUnd A endN Introduction Nl Rcclrculadon Sump Inventory N4 KS IDSwitchover Procedure NN Backlcakage to RWST NI Rcclrculadon Sump Vcndng Ny Hbrous MatcrhLI ln Containment N3 36-hour CooMown Nd RHR Sucdon Valve AuloClose NS Comprcsscd AirOverpressure NP Instrument Uncertainty Short Torus Asscssmcnt Dcvelopmcnt Short Term Assessment Results Addidonal Amuran<<e ofOpcrabiUty of S

terna Conclusion

I r

/

~

,8 t

~4 h at' it V%p C'y

'V

~t S

"i C

'1<

0

I Confirmatory Action Letter Issue 1

Re i u

it Tt ittttt ttt g

N J>>U 8

inactive Sump 6t2' Active Sump 602-10'g8'-g

'6IO'4'eactor Cavity 1

11 1'umps used to cool the reactor and containment building may not have enough water supply to allow long-term operation of the systems.

AEP Commitment Analyses willbe performed to demonstrate that the 'recirculation sump level is adequate to prevent vortexing, or appropriate modifications willbe made.

I

~

~

('ontainmcnt Spr~y t(;rS) t~nvcr tfppcsc Cont.

(oritI:

Nozdcs Nozzle Uquld I'",.:., Steam Reactor,'ti(YS C

S Resolution

~ Analyses demonstrated emergency core cooling system/containment spray system operability.

~ Determined that sump level willremain above 602'0" throughout long-term recirculation phase.

~ Submitted Technical Specification amendment to credit more existing ice mass and other contributing sources of water in sump inventory calculations.

vh vh Fan stalnveU Accumuhtor Rooms Inactive Sump Nozzle ice via Melt RelueUng and Canal Condensed Orahs Steam Active Sump Reactor Cavity 4>>t 47z>>Y

I

~

r I

Confirmatory Action Letter Issue 4 I

R i

tt i tt t.ower

('.ont.

Nor~los

tfppcr, Cttntri-Noxztcs' rett.llnlttclltspnly t( 1st hmnnutators tcc Steam ttcactor li('('8

(.out;ult Systrnn

('undcnscr rs t(WZt'g~+Ltt Current procedures implementing switchover from the Refueling Water Storage Tank (RWST) to the containment sump may not be adequate for long-term, post-accident operations.

via vta Fan stairwell Accumulator Rooms inactive Sump via Melt Refueling and Canal Condensed Drains Steam Uqutd 8reaft Flow Active Sump Reactor Cavity Nozzle Flow tce r

g asltarcaN steers re JOWLS AEP Commjtment Changes to the emergency procedure used for switchover of the emergency core cooling and containment spray pumps to the recirculation sump willbe implemented.

These changes willprovide assurance there willbe adequate sump volume, with proper consideration of instrument bias and single failure criteria.

Resolution

~ Prepared, validated and trained all operating crews on revisions to ES-1.3 "Transfer to Cold Leg Recirculation". '

Revision reasonably assures an adequate recirculation sump level and eliminates the potential single failure vulnerability that existed during the transition from injection to recirculation phase.

~ RWST water level tap was relocated to account for the bias that may have existed.

~ The RWST, recirculation sump, ECCS and CTS pumps are operable with ES-1.3

. Revision 5.

I '

I I

Confirmatory Action Letter Issue S Wa W T

'-F R i Tl i ii Testing of Mini-FlowRecirculation Lines may not be adequate to assure that back-leakage to RWST willnot exceed acceptable levels during a design basis accident.

AEP Commitment Only two of six mini-flowrecirculation line valves have leakage verification tests.

Justification willbe provided that the total leakage for the six valves is less than 10 gallons per minute (gpm) to ensure that Part 100 limits are not exceeded ifcontainment sump water were to leak back to the RWST during a design basis accident.

Resolution

~ Testing of the valves not previously tested showed that total leakage for these paths back to the RWST was well below 10 gpm value in the UFSAR.

~ Included affected flow paths in the In-Service Testing program.

~ Implemented new procedures: seat leakage testing of valves at each refueling outage to ensure < 10 gpm total leakage.

Crane Wal O'Venl

<S) sra'irrsni Hears B. IOS'4' Coarse 4 Fino Screen r i

~

rQ~~

Confirmatory Action Letter Issue 2 T

I Venting of air underneath the roof of the containment building recirculation sump may not be adequate.

AEP Commitment Venting willbe re-installed in the recirculation sump cover. The design will incorporate foreign material exclusion requirements for the sump.

To AHA and CTS <

Surrisn (2> I8'ncs Aeo'ro Sranp 7

+aaacsnic POWER Resolution

~ Venting has been reinstalled in the

~

recirculation sump cover in both TTnits.

~ Vents incorporate screening to satisfy the

'oreign material exclusion requirements.

~ Recirculation sumps have been returned to their approved design configuration.

Reeeelea san eu p COneammenl Wae CI<<ls was Qo 0

Confirmatory Action Letter Issue 7 l

1 I

11 Fibrous material located in containment buildings may clog the recirculation sump.

AEP Commitment Removal of fibrous material from containment that could clog the recirculation sump willbe completed.

Resolution

~ Containment inspections were conducted in Units 1 and 2.

~ identified and removed unencapsulated fibrous insulation materials from 12 locations in Unit 1, 15 locations in Unit 2, in the aiuxulus and instrument rooms.

sxeaeI xi I't Recolor II

/

Suction Valves PIee<<ee Reeee veeme Valve +

Preeevu<<

peo Iee locales Reeeluil Heel Removal Pump Rexecu<<

Heel Renoval Exonanp<<

CCW Heel Pxlnenp<<

CIeeneel seInee ee<<<<

Confirmatory Action Letter Issue 3 1

1 lf Calculation needs to be performed that shows, one train of cooling water is sufficient to remove the units from service.

AEP Commitment Analyses willbe performed that will demonstrate the capability to cool down the units consistent with design basis requirements and necessary changes to procedures willbe completed.

Resolution

~ Thermal hydraulic analysis concluded that a single train of residual heat removal/component cooling water/essential service water is capable of cooling down the reactor coolant system in 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

~ Operating procedure revisions were made to reflect a higher maximum component cooling water supply temperature limit (increased to 120'F).

Four pipe supports were also modified.

Preccverxer Precerxe Acier valvee Verve axcvrie rcxacae Aepavri Hear eerxrvai Pvrep

• Confirmatory Action Letter Issue tl lH I

R V

Conflicts between operating procedures and Technical Specifications for Residual Heat Removal Suction Valve Autoclosure Interlock.

f Aeacccr I

Svceea Varvec Aeaacr Ccccarc Puntp Aecxarel r

Heal Aervxrval Heal Kxcaarper CCV/

Heal fxcrraeger Ivrvveer Cornea Welvr AEP Commitment ATechnical Specification change to allow operation in Mode 4 with the RHR suction valves open and power removed is being processed.

Approval of this change by the NRC willbe required prior to restart.

Resolution

~ Submitted a proposed Technical Specification change to the NRC that eliminates the need for the RHR Suction Valve Autoclosure interlock when in a shutdown cooling configuration. The Technical Specification change has been approved by the NRC.

~ 200 Air Confirmatory Action Letfer Issue 5 Overpressure protection for some components served by the compressed air system may not be adequate in the event of a postulated air regulator failure.

1000, ~

Alr '

Supply

/Valve 500 Alr AEP Commifmenf Overpressure protection willbe provided downstream of the 20 psig, 50 psig, and 85 psig control air regulators to mitigate the effects of a postulated failed regulator.

AeCrIarcr 050 Atr Q AacrAIcur Resolution

~ Installed redundant, safety-grade relief valves on all of the control headers (20 psig, 50 psig, and 85 psig) and eliminated overpressure potential.

~ Eliminated potential for common-mode failure due to overpressurization.

~ Safety related systems and components supported by the control air system are operable.

Confirmatory Action Letter Issue g 1

I I

1 I

Need to incorporate instrument uncertainties into procedures and analyses.

AEP Commitment Emergency procedures and other important-to-safety procedures, calculations, or analyses willbe reviewed to account for instrument uncertainties.

Resoiution

~ Actions completed

- Reviewed level instrumentation For velocity effect.

- Reviewed and revised emergency operating procedures for switchover to recirculation.

- Reviewed and revised technical specification surveillance procedure used by Operations.

- Generated parameter list for technical specification compliance.

- Generated Administrative control procedures.

- Reviewed EOP Setpoint Documentation.

- Reviewed License Bases.

- Addressed all related non-programmatic Unresolved Issues from the inspection report.

- Completed Plant Specific Methodology Manual.

~ Continuing Actions

- Developed a plan to:

- control instrument uncertainty and incorporate it into procedures, calculations, and analyses.

- complete reviews, training, and calculations by December 1, 1998.

- Checklist, based on current NRC guidelines, willbe used to review existing and future instrument uncertainty calculations.

- Developing a plant specific methodology manual to calculate instrument uncertainties; manual willbe an expansion of existing engineering guide.

- Developing administrative controls to ensure that instrument uncertainties are considered whenever procedures, calculations and analyses are developed or revised.

-'ntegrating instrument uncertainty program with the upgraded normal operating procedure and emergency operating procedure reviews.

Purpose To assess whether issues similar to the eight listed in the confirmatory action letter (CAL) may exist in other safety systems, and ifthey do, to determine whether they affect system operability.

Roof Cause Analysis of other Oesign Inspection Issues Root causes of other issues raised during the design inspection that were not included in the CALwere also reviewed.

'oot Cause Investigation and Evaluation ol CALissues Independent teams comprised of AEP Nuclear Generation Group and outside technical analyst(s) conducted root cause evaluations of the eight CAL issues.

Independent Review by Senior Industry Peers Allfinal root cause analyses were reviewed by independent senior industry peers.

Senior Management Review and Action A group of senior managers and staff reviewed the root causes of the CALand AE issues.

Action plans were developed to further assess those issues that had the potential to create operability concerns in other systems.

Identified Five Engineering Issues Senior management endorsed action plans for five engineering issues identified for short-term assessment that had both generic implications and were deemed likely to affect safety-related system operability.

~ Some analyses were found to contain errors and incorrect assumptions.

~ Some containment attributes, such those related to sump performance, were not adequately preserved.

~ Failure to consider a credible failure mode on a non-safety-related system interfacing with a safety-related system.

~ Failure to consider level instrument bias due to Bernoulli effect.

~ improper application of single failure criterion.

Evaluation and Revietv Each engineering issue was evaluated and reviewed by experienced teams of engineering and management personnel.

Each evaluation considered existing system assessments, design assessments, safety analyses and reports.

These documents helped focus review efforts in specific areas of vulnerability.

Conclusion The short-term assessment provides reasonable assurance that issues of the type found during the design inspection do not impact the operability of other safety systems at Cook Nuclear Plant.

s li.

X X

X X

'X X

X X>>

X,X X.,-'X HA 'flA X

X X

X X

X ZX.'

X>>

X X

X X

X X

X X

X X

X g urn~

CISCTRK Charts Matrices represent a series of critical reviews condu'cted to provide reasonable assurance that safety systems willperform their intended functions. Included in the matrices are short term assessments conducted after the design inspection and previously performed safety system functional inspections (SSFI). These reviews were performed by the NRC, contractor, and AEP Nuclear Generation Group staffs.

Conclusion Matrices firmlysupport the conclusion that there is reasonable assurance that the safety systems are capable of fulfillingtheir intended design function.

XX x>>

NA, X"

"X'X

,X

=,x

X>>

X X

-"X' X

X X

X X

X X

X X

X X

X X

X X

X X

X X

JkllRKIJP tltCTtIC PONCE

0