2CAN112302, Submittal of Amendment 31 to Safety Analysis Report

Submittal of Amendment 31 to Safety Analysis Report

ML23324A017
Person / Time
Site:	Arkansas Nuclear
Issue date:	11/16/2023
From:	Pehrson D Entergy Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation
Shared Package
ML23324A046	List: 2CAN112302, Submittal of Amendment 31 to Safety Analysis Report
References
2CAN112302
Download: ML23324A017 (56)

Text

SECURITY RELATED INFORMATION SAR SECTION 2.8 OF ENCLOSURE 1 TO BE WITHHELD FROM PUBLIC DISCLOSURE IN ITS ENTIRETY IN ACCORDANCE WITH 10 CFR 2.390.

UPON SEPARATION FROM ENCLOSURE 1, THIS DOCUMENT IS DECONTROLLED.

Doug E. Pehrson S) entergy Site Vice President Arkansas Nuclear One Tel 479-858-3110 10 CFR 50.4(b)(6) 10 CFR 50.59(d)(2) 10 CFR 50.71 (e) 10 CFR 54.37(b) 2CAN112302 November 16, 2023 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

SUBJECT:

Amendment 31 to the ANO Unit 2 Safety Analysis Report Arkansas Nuclear One, Unit 2 NRC Docket No. 50-368 Renewed Facility Operating License No. NPF-6 In accordance with 10 CFR 50.71 (e) and 10 CFR 50.4(b)(6), enclosed is Amendment 31 of the Arkansas Nuclear One, Unit 2 (ANO-2) Safety Analysis Report (SAR). Included with this update are the current ANO-2 Technical Requirements Manual (TRM) and the current ANO-2 Technical Specification (TS) Bases. The TS Bases file also includes the Table of Contents which outlines the contents of both the TSs and the TS Bases, since the Table of Contents is revised by the licensee under 10 CFR 50.59. Pursuant to 10 CFR 50.71 (e)(4), these documents are being submitted within six months following the previous ANO-2 refueling outage (2R29) which ended May 23, 2023. Summaries of changes to the ANO-2 TRM and TS Bases are included in Attachments 1 and 2 of this letter for the period beginning April 27, 2022, and ending November 16, 2023.

In accordance with NEI 98-03, "Guidelines for Updating Final Safety Analysis Reports,"

Appendix A, Section A6, a list and short description of information removed from the SAR should be included with each SAR update submittal. For t~is reporting period, information was not removed from the SAR meeting the criteria of either Appendix A, Sections A4 or AS, of NEI 98-03, that would require reporting in accordance with NEI 98-03, Appendix A, Section A6.

Associated in part with the post September 11, 2001 response related to security sensitive information, Entergy has reviewed the ANO-2 SAR and determined that the items in the following paragraph contain information required to be withheld from public disclosure with respect to NRC Regulatory Issue Summary (RIS) 2015-17, "Review and Submission of Updates Entergy Operations, Inc., 1448 SR 333, Russellville, AR 72802 SECURITY-RELATED INFORMATION - WITHOLD UNDER 10 CFR 2.390

• DOCUMENTS TRANSMITTED HEREWITH CONTAIN SENSITIVE; UNCLASSIFIED INFORMATION. WHEN SEPARATED FROM ENCLOSURE 1, THIS DOCUMENT IS DECONTROLLED.

SECURITY RELATED INFORMATION SAR SECTION 2.8 OF ENCLOSURE 1 TO BE WITHHELD FROM PUBLIC DISCLOSURE IN ITS ENTIRETY IN ACCORDANCE WITH 10 CFR 2.390.

UPON SEPARATION FROM ENCLOSURE 1, THIS DOCUMENT IS DECONTROLLED.

2CAN112302 Page 2 of 4 to Final Safety Analysis Reports; Emergency Preparedness Documents, and Fire Protection Documents."

The following information is located on SAR Pages 2.8-1 through 2.8-10:

SAR Section 2*.8.1, "Flood Related Information" SAR Section 2.8.1.1, "Probable Maximum Flood Combined with Wind Wave Action" SAR Section 2.8.1.2, "Probable Maximum Flood Combined with Ozark Dam Failure" SAR Section 2.8.1.3, "Probable Maximum Flood on Streams and Rivers" SAR Section 2.8.1.3.1, "Probable Maximum Precipitation" SAR Section 2.8.1.3.2, "Precipitation Losses" SAR Section 2.8.1.3.3, "Runoff Model" SAR Section 2.8.1.3.4, "Probable Maximum Flood Flow" SAR Section 2.8.1.3.5, "Water Level Determinations" SAR Section 2.8.1.3.6, "Coincident Wind Wave Activity" SAR Section 2.8.1.3.7, "Site Drainage System" SAR Section 2.8.1.4, "Potential Dam Failures (Seismically Induced)"

SAR Section 2.8.1.5, "Design Basis for Subsurface Hydrostatic Loadings" SAR Section 2.8.2, "Additional Natural Gas Pipeline Information" SAR Section 2.8.3, "Additional New Fuel Storage Information" The above is consistent with currently redacted information from the ANO-2 SAR (reference ML22124A153, ANO-2 SAR Amendment 30). Entergy requests the aforementioned information be withheld from public disclosure in accordance with 10 CFR 2.390. Accordingly, a complete version and a redacted version of the ANO-2 SAR are included on the enclosed compact disc (CD).

In accordance with 10 CFR 54.37(b), after a renewed license is issued, the SAR update required by 10 CFR 50. 71 (e) must include any systems, structures, and components (SSCs) newly identified that would have been subject to an aging management review or evaluation of time-limited aging analyses in accordance with 10 CFR 54.21. The SAR update must describe how the effects of aging will be managed such that the intended function(s) in 10 CFR 54.4(b) will be effectively maintained during the' period of extended operation. For this reporting period, no new SSCs that would have been subject to an aging management review or evaluation of time-limited aging analyses in accordance with 10 CFR 54.21 were identified.

SECURITY-RELATED INFORMATION -WITHOLD UNDER 10 CFR 2.390 DOCUMENTS TRANSMIT1EDHEREWITH CON:Y-AIN SENSITIVE, UNCLASSIFIED INFORMATION. WHEN SEPARATED FROM THE SENSITIVE INFORMATION, THIS DOCUMENT IS DECONTROLLED.

SECURITY RELATED INFORMATION SAR SECTION 2.8 OF ENCLOSURE 1 TO BE WITHHELD FROM PUBLIC DISCLOSURE IN ITS ENTIRETY IN ACCORDANCE WITH 10 CFR 2.390.

UPON SEPARATION FROM ENCLOSURE 1, THIS DOCUMENT IS DECONTROLLED.

2CAN112302 Page 3 of 4 A summary of the 10 CFR 50.59 evaluations during the reporting period is normally included with the required SAR submittal or within 30 days thereafter. Attachment 3 contains a summary of the 10 CFR 50.59 evaluations performed for ANO-2 over the aforementioned reporting period. Attachment 4 includes a copy of the evaluations. includes a list of SAR pages that were updated during the period begin1,1ing April 27, 2022, and ending November 16, 2023.

If you have any questions or require additional information, please contact Riley Keele, Manager, Regulatory Assurance, at 479-858-7826.

The information contained in the above Licensing Basis Documents accurately reflects changes made since the previous submittal. The changes to these documents reflect information and analyses submitted to the Commission, prepared pursuant to Commission requirements, or made under the provisions of 10 CFR 50.59. I declare under penalty of perjury that the foregoing is true and correct. Executed on November 16, 2023.

Sincerely,

~ ~

DEP/mar

Enclosures:

1. ANO-2 SAR Amendment 31 - Un-redacted Version (CD-ROM)

2. ANO-2 SAR Amendment 31- Redacted Version (CD-ROM)

3. ANO-2 TRM (CD-ROM)

4. ANO-2 TS Table of Contents and TS Bases (CD-ROM)

Attachments to cover letter:

1. Summary of ANO-2 TRM Changes

2. Summary of ANO-2 TS Bases Changes

3. Summary of ANO-2 10 CFR 50.59 Evaluations

4. 10 CFR 50.59 Evaluations- From April 27, 2022 through November 16, 2023

5. List of Affected SAR Pages SECURITY-RELATED INFORMATION-WITHOLD UNDER 10 CFR 2.390 DOCUMENTS TRANSMITTED HEREWITH CONTAIN SENSITIVE, UNCLASSIFIED INF.ORMATION. WHEN SEPARATED FROM THE SENSITIVE INFORMATION, THIS DOCU!\llENT IS DECONTROLLED.

SECURITY RELATED INFORMATION SAR SECTION 2.8 OF ENCLOSURE 1 TO BE WITHHELD FROM PUBLIC DISCLOSURE IN ITS ENTIRETY IN ACCORDANCE WITH 10 CFR 2.390.

UPON SEPARATION FROM ENCLOSURE 1, THIS DOCUMENT IS DECONTROLLED.

2CAN112302 Page 4 of 4 cc: NRC Region IV Regional Administrator NRC Senior Resident Inspector - Arkansas Nuclear One NRC Project Manager - Arkansas Nuclear One Designated Arkansas State Official SECURITY-RELATED INFORMATION -WITHOLD UNDER 10 CFR 2.390 DOCUMENTS TRANSMITTED HEREWITH CONTAIN SENSITIVE, UNCLASSIFIED INFORMATION. WHEN SEPARATED FROM THE SENSITIVE INFORMATION, THIS DOCUMENT IS DECONTROLLED.

Attachment 1 2CAN112302 Summary of ANO-2 TRM Changes 2CAN112302 Page 1 of 1 Summary of AN0-2 TRM Changes The following changes to the Arkansas Nuclear One, Unit 2 (ANO-2) Technical Requirements Manual (TRM) were implemented in accordance with the provisions of 10 CFR 50.59.

Because these changes were implemented without prior NRC approval, a description is provided below:

Revision Section Summary 3.0.5, 3.0.6, B 3.0.5, LBDCR 22-007 - "Renumber TRO 3.0.6 to TRO 3.0.5 87 B 3.0.6 in order to match ANO-2 TS Amendment 327" TR 4.7.8.1, LBDCR 23-008 - "Four TROs that were relocated to 88 4.7.9.1.a, 4.7.9.1.b, the TRM from TS still reference the SFCP" 4.9.5 Acronyms LBDCR License Basis Document Change Request SFCP Surveillance Frequency Control Program TR Test Requirement TRO Technical Requirements for Operation .

TS Technical Specifications I

• Attachment 2 2CAN112302 Summary of ANO-2 TS Bases Changes 2CAN112302 Page 1 of 1 Summary of AN0-2 TS Bases Changes The following changes to the Arkansas Nuclear One, Unit 2 (ANO-2) Technical Specification (TS) Bases were implemented in accordance with the provisions of 10 CFR 50.59 and the Bases Control Program of ANO-2 TS 6.5.14. Because these changes were implemented without prior NRC approval, a description is provided below:

Revision Section Summary TS Amendment 329, "Adopt TSTF-541 'Add 85 B 4.7.6.1.2.b Exceptions to SR for Valves and Dampers Locked in the Actuated Position"'

TS Amendment 330, "Adopt TSTF-554 - Revise 86 B 3.4.6.2 Reactor Coolant Leakage Requirements" Acronyms SR Surveillance Requirement TS Technical Specifications TSTF Technical Specification Task Force

Attachment 3 2CAN112302 Summary of ANO-210 CFR 50.59 Evaluations 2CAN112302 Page 1 of 1 Summary of 10 CFR 60.59 Evaluations 60.59 # 50.59 Summary 2022-001 Engineering Change EC-93352 "Temporary Modification to provide Core Operating Limit Supervisory System (COLSS) 'A' Reactor Coolant Pump (RCP) 'A' Speed Signal to Core Protection Calculator (CPC) 'B' "

2022-003 Engineering Change EC-88912 "ANO 2 Install Microprocessor Relay & Activate Out of Step Function and Loss of Field with Two Zones of Protection" 2023-001 Engineering Change EC-94021 "ANO-2 Steam Generator Tube Rupture Dose Analysis"

Attachment 4 2CAN112302 10 CFR 50.59 Evaluations - From April 27, 2022 through November 16, 2023 (39 Pages)

ANO 50.59 Evaluation 2022-001 ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet1 of15 I. OVERVIEW/ SIGNATURES 1 Facility: AN0-2 Evaluation#/ Rev.#: FFN-2022-001 Proposed Change I Document: EC-93352, TMOD to provide COLSS 'A' RCP 'A' Speed Signal to CPC 'B' Description of Change: Due to intermittent failure of 'A' Reactor Coolant Pump (RCP) rotational speed sensor input to the 'B' Core Protection Calculator (CPC) (protection system), the primary RCP speed cable and sensor currently used as input to the Core Operating Limits Supervisory System (COLSS) (monitoring system) will be used to support RCP speed input to the 'B' CPC channel.

A temporary modification is developed as a compensatory measure to allow the use of one of the RCP speed sensors, cable, and transmitter, currently providing input to the COLSS, as input to the 'B' CPC through the CPC transmitter enclosure located at the secondary shield wall inside containment.

It should be noted that the alternate RCP speed signal from the 'A" RCP to COLSS currently has a manually substituted value (892 rpms). This temporary modification will disable the primary RCP speed signal from the 'A" RCP to COLSS such that it will also require a manually substituted value.

Summary of Evaluation: There are several instances where the proposed temporary modification is contradictory to statements in the SAR. A Licensing Basis Document Change Request has not been submitted as the next scheduled SAR periodic update is to occur after 2R29 and this temporary modification will be removed prior to the scheduled update. The deviations from the SAR are evaluated in this 10 CFR 50.59.

These deviations have been evaluated as acceptable These deviations are:

1. SAR Section 8.3.1.2.5, Regulatory Guide 1. 75 (February 1974) Appendix 1 conformance discussion for paragraph 4.6.2 states that there are no non-Class 1E circuits that are considered associated circuits. This proposed temporary modification labels 2SE-6121A, 2I238C, and 2ST-6121A as associated circuits with CPC 'B' green channel. It is noted that the RG 1.75 App-1 paragraph numbers also directly correspond to the IEEE 384-1974 section numbers.

2. SAR Section 7.7.1.3.3.1 states COLSS receives RCP speed signals from all four RCPs. With implementation of this proposed temporary modification and the current failure of the RCP 'A' COLSS 'B' speed signal, COLSS will have no live speed signals from the 'A' RCP.

1 The printed name should be included on the form when using electronic means for signature or if the handwritten signature is illegible. Signatures may be obtained via electronic authentication, manual methods (e.g., ink signature), e-mail, or telecommunication. Signing documents with indication to look at another system for signatures is not acceptable such as "See EC"_or "See Enterprise Asset Management (EAM) Application." Electronic signatures from other systems are only allowed if they are included with the documentation being submitted for capture in ebb (e.g., if using an e-mail, attach it to this form; if using Enterprise Asset Management (EAM) Application, attach a screenshot of the electronic signature(s);

if using Corrective Action Program (CAP) Application, attach a copy of the completed corrective action) .

EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM

3. Throughout the SAR there are discussions of the required seismic qualification of Safety-Related instrumentation. With the implementation of this temporary modification, the RCP 'A' CPC 'B' input speed signal will utilize non-seismically installed cables.

4. Throughout the SAR there are discussions of the requirements for the separation and identification of Class 1E circuits. This proposed temporary modification will utilize a non-Class 1E circuit to input to the Class 1E 'B' CPC. This circuit meets the separation requirements from the other channels of Class 1E redundant circuits, but it is not labeled as described in the SAR and is not physically separated from non-Class 1E instrumentation and control circuits.

Due to intermittent failure of 'A' Reactor Coolant Pump (RCP) rotational speed sensor input to the 'B' Core Protection Calculator (CPC) (protection system), the primary RCP speed cable and sensor currently used as input to the Core Operating Limits Supervisory System (COLSS) (monitoring system) will be used to support RCP speed input to the 'B' CPC channel.

A temporary modification is developed as a compensatory measure to allow the use of one of the RCP speed sensors, cable, and transmitter, currently providing input to the COLSS, as input to the 'B' CPC through the CPC transmitter enclosure located at the secondary shield wall inside containment.

It should be noted that the alternate RCP speed signal from the 'A" RCP to COLSS currently has a manually substituted value (892 rpms). This temporary modification will disable the primary RCP speed signal from the 'A" RCP to COLSS such that it will also require a manually substituted value.

The 'B' CPC channel is placed in bypass, as allowed by the AN0-2 Technical Specifications (TSs), when intermittent failures of the 'A' RCP speed sensor occur. The concern is when a surveillance to be performed on one of the other three channels, the

'B' CPC channel must be placed in a tripped status to allow the channel under surveillance to be placed in bypass. This leaves the system in a one-out-of-two reactor trip configuration.

The proposed temporary modification will utilize the output of the COLSS transmitter on the biological shield wall. A temporary cable will then be routed to the 'B' CPC transmitter enclosure and landed on the terminal block to connect to the CPC input. There are no changes proposed to the CPCs or COLSS hardware or software; therefore, there are no impacts on the uncertainties used in the calculations performed in the CPCs and COLSS and the resulting values are not impacted. The COLSS and CPCs remain independent of each other.

A manually substituted value will be provided as input ~o COLSS for the primary 'A' RCP speed indication. The alternate RCP speed indication from the 'A" RCP also has a manually substituted value. This will leave both inputs to COLSS with manually substituted values for the 'A' RCP speed.

EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 3 of 15 Design Function The function of the RCP speed sensors is to provide inputs to COLSS and CPCs to calculate the RCS flow rates and to provide the CPC RCP speed trip. Flow rates are used in the calculation of primary calorimetric power and Power Operating Limits (POL).

The CPC RCP speed trip is credited in the SAR Chapter 15 events which produce a loss of RCP flow. Each RCP has six speed sensor outputs (two outputs to COLSS and four outputs to the CPCs per RCP). COLSS has two inputs from each RCP with one designated as a primary and the other as an alternate.

Per SAR Section 7. 7.1.3.1, COLSS is not required for plant safety since it does not initiate any direct safety-related function during anticipated operational occurrences or postulated accidents. COLSS serves to monitor reactor core conditions in an efficient manner and provides indication and alarm functions only to aid the operator in maintenance of core conditions within the Limited Condition for Operation (LCO) given in the TSs. COLSS is not relied upon for SAR Chapter 15 post-accident mitigation. COLSS performs sensor validity checks on measured input parameters by checking sensor input against the sensor range and deviations between like sensors monitoring the same variable. SAR Section 7.7.1.3.1 provides the following options for dealing with non-valid sensors:

A. Automatic replacement of the failed sensor by a redundant sensor (when available).

B. Automatic algorithm alteration for certain functional inputs by the generation of software flags when no redundant sensors are available.

C. Substitution of like sensors plus penalty factors (performed under administrative contr9I).

D. Substitution of constants for selected COLSS inputs (performed under administrative control).

Option D above provides an option to substitute a failed sensor input with a constant.

Procedure OP-2105.013, "COLSS Operations," provides the administrative controls necessary to allow the substitution of COLSS RCP speed input with constants if a sensor is found to be faulty.

CPC Portion EC-78244 replaced the entire RCP Shaft Speed Sensor system in 2R27 (Spring 2020).

The EC replaced all 24 of the probes, the extension cable, the proximitor, the signal processing assembly including the regulator, the pulse shaper, and the power supply.

The EC installed components that are technically classified as both safety related (CPCs) and non-safety related (COLSS); however, the EC utilized the same physical nuclear qualified equipment for both CPC and COLSS.

It should be noted that this temporary modification impacts only the 'A' RCP speed input signal to the 'B' CPC. All the other inputs to this channel are not impacted. No other hardware change to the CPCs or COLSS is being proposed. This modification does not EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 4 of 15 impact any of the software or data (i.e., input validity check algorithm, the pump curves, or the uncertainties) stored in the CPCs or COLSS.

With the installation of this temporary modification, the 'B' CPC channel will be returned to an operable status (i.e., perform its safety function) with respect to the intermittent speed sensor failures described above. This one input to one channel of the CPCs will not be conforming to its original design following installation of the temporary modification. The non-conformance is due to the fact the RCP speed signal is originally designed to be seismically qualified from the sensor to the CPC. The routing of the cable used in this temporary modification is a non-seismically qualified pathway.

The Reactor Protective System (RPS) consists of sensors calculators, logic, switchgear, and other equipment necessary to monitor selected Nuclear Steam Supply System (NSSS) conditions and to effect reliable and rapid reactor shutdown (reactor trip) if any one or a combination of the monitored conditions reach a limiting safety system setting.

The system functions are to protect the core (fuel design limits) and Reactor Coolant System (RCS) pressure boundary for anticipated operational occurrences (AOOs).

These same features include the capability of the RPS to operate, if need be, with up to two channels out of service (one bypassed and another tripped) and still meet the single failure criteria. The only operating restriction while in this condition (effectively one-out-of-two logic) is that no provision is made to bypass another channel for periodic maintenance. The system logic must be restored to at least a two-out-of-three condition prior to removing another channel for maintenance.

Various pressures, levels, and temperatures associated with the NSSS, and the containment building are continuously monitored to provide signals to the RPS trip bistables. All protective parameters are measured with four independent and isolated process instrument channels. A typical protective channel consists of a sensor and transmitter, instrument power supply and current loop resistors, indicating meter and/or recorder, and trip bistable/calculator inputs. The status of each trip parameter is checked at the bistable level of the RPS. When a parameter reaches its respective trip value, the bistable logic generates contact opening signals to the logic matrices.

The wiring and components of each channel are physically and electrically separated from that of other like protective channels to provide independence. The output of each transmitter is typically an ungrounded current loop which has a live zero. The nuclear instruments provide a pulsed and current signal. The RCP speed sensors provide a pulsed signal. Signal isolation is provided for computer inputs and control board indicators. Each channel is powered from a separate vital bus.

The design function of the CPC is to monitor pertinent reactor core conditions and to provide an accurate, highly reliable means of initiating a reactor trip whenever the minimum core departure from nucleate boiling ratio (DNBR) approaches the design limit or peak local power density (LPD) approaches the fuel design limit, during reactor operation.

Four independent CPCs are provided, one in each protection channel. Calculation of DNBR and LPD is performed in each CPC, utilizing the input signals described below.

EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 5 of 15 The DNBR and LPD so calculated are compared to trip setpoints for initiation of a low DNBR trip or a high LPD trip.

A 2-out-of-4 coincidence of like trip signals is required to generate a reactor trip signal. A fuel design limit on DNBR is specified to protect the fuel cladding as discussed in Sections 4.4 of the ANO-2 SAR and the TSs. The RPS provides a trip on low DNBR, which ensures that this Specified Acceptable Fuel Design Limit (SAFDL) is not exceeded for AOOs. Since DNBR cannot be directly measured, it is calculated as a function of several physical parameters. One of these physical parameters is core coolant mass flow rate.

The mass flow rate is obtained in the RPS using the pump speed inputs from the four RCPs, and the core inlet and outlet temperatures. The flow rate through each RCP is dependent upon the rotational speed of the pump and the pump head. This relationship is typically shown in pump characteristic curves. Flow changes resulting from changes in the loop flow resistance occur slowly due to core crud buildup, increase in steam generator resistance, etc. Calibration of the pump speed signal, relating pump rotational speed to flow, is performed periodically.

Flow reductions associated with pump speed reductions are more rapid than those produced from loop flow resistance changes. The pump rotational speed signal is converted to a pump flow using mathematical relationships based on pump characteristics and periodic loop flow calibrations. For those flow transients discussed in Chapter 15 of the SAR, these mathematical relationships are shown to produce a conservative value of flow relative to the flow calculated with the pump transient. The loop flow rates (normalized to design flow rates) calculated for each pump are summed to give a normalized core mass flow rate.

These signals are transmitted to the CPCs which compute the flow rate. Adequate separation between probes is provided. The temporary RCP speed sensor circuit will not be routed in conformance with SAR Section 8.3.1.4.3 as the non-safety related COLSS RCP speed signal cable will is run in non-safety related cable trays and conduits with non-safety related cables. This non-safety related COLSS RCP speed signal cable will become an "Associated Circuit" of CPC 'B', Green Train as discussed in IEEE 384-1974, Sections 4.5 and 4.6. The non-safety related cables routed with the COLSS RCP speed signal cable have been evaluated and determined that they are all low-level instrumentation and control cables, and none are safe-shutdown or constitute a safety channel. The IEEE 384-1974, Section 4.6.2, specifically states that non-Class 1E instrumentation and control circuits are not required to be separated from associated circuits. Each channel is powered from a separate vital AC bus. This assures the independence of the redundant speed signals and RPS channels. SAR Sections 7.1.2.3 and 8.3.1 .4.4 discuss specific labeling requirements for safety-related cables, conduits, and cable trays. The COLSS cables, conduits, and cable trays within the 0-ring will not conform to these labeling requirements. As these cables and trays are inaccessible at power and this temporary modification is not expected to remain installed past the next ANO-2 refueling outage (Spring 2023), it is acceptable that these cables and trays do not meet the specific labeling requirements for safety related equipment.

A low DNBR trip, Variable Overpower Trip (VOPT), or RCP low speed trip will be initiated in the event of flow reduction transients caused by pump speed changes such as the 4-EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 6 of 15 pump loss of coolant flow and the single RCP shaft seizure (see SAR Section 15.1.5).

Anticipated flow reductions due to changes in the coolant loop resistance or pump wear occur more slowly and are small in magnitude. These reductions are monitored using instrumentation which is not part of the RCP speed sensing system.

This method for measurement of coolant mass flow rate satisfies Section 4.8 of IEEE 279-1971. It also satisfies the below listed design bases for the anticipated transients and postulated accidents considered in Chapter 15.

Each RCP has four independent, separate proximity sensors mounted in the RCP motor housing. The rotational speed of the RCP is measured by locating the proximity sensor near a disc that is attached to the shaft of the RCP motor. The disc has holes drilled at equidistant locations about its circumference. As the disc rotates, the proximity pickup senses the absence of metal at the location of each hole.

The signal processing equipment associated with the proximity sensor channel converts the signals from the sensor to voltage levels that correspond to the presence and absence of metal. Each voltage pulse that corresponds to a disc hole passing the probe is then conditioned to a standard pulse of fixed duration and voltage magnitude by the pulse shaping unit. The pulse output of the pulse shaping unit is conditioned by a "divide by N" circuit and is then utilized as an input to the CPC. This processing equipment also checks the input to see if it is in range or out of range. If the signal is out of range a sensor failure alarm is generated.

Each scanning device produces a voltage pulse signal, the frequency of which is proportional to pump speed. One revolution of the RCP shaft results in the production of 44 distinct pulses. The expected pulse amplitude is 10 volts. The pulse width is a function of the RCP speed. The expected pulse width at an operating speed of 891 rpm is 0.57 millisecond and the time between successive pulses will be 1.52 milliseconds.

Category 1 instrumentation and electrical equipment supplied by Combustion Engineering (CE) is designed such that it can meet the seismic qualification requirements established in IEEE 344-1971.

A CE Topical Report, CENPD-182, "Seismic Qualification of CE Instrumentation and Electric Equipment" was submitted in December 1975. The seismic qualification program, upon which CENPD-182 is based, was intended to satisfy the methods presented in Standard Review Plan (NRC NU REG 0800), Section 3.10. This plan is divided into two sections, the first section referencing IEEE Standard 344-1971 and the second section referencing IEEE Standard 344-1975. This topical report presents a summary of the CE seismic qualification program utilized to demonstrate the seismic design adequacy of the instrumentation and control equipment supplied by CE.

The CPCs are seismically qualified; therefore, the CPC system is expected to be operable before, during, and after a seismic event. The safety-related features of seismic Category I equipment must operate as necessary to perform the intended function. By original design (as discussed in the topical report), the RCP speed sensors, cabling, etc.,

(inputs to the CPCs) were also installed as seismic Category I components.

EN-Ll-101 R21

ATTA CHM ENT 9.1 50.59 EVALUATION FORM Sheet 7 of 15 Each of the four redundant CPCs provides a contact opening to the RPS at the bistable level. A failure of one of the CPCs in the tripped condition will cause the reactor trip logic to revert to a 1-out-of-3 coincidence. Three intact calculators would remain to monitor the input parameters of which only one is required to operate to affect a reactor trip (since the failed channel would already be tripped). If the failed channel is bypassed, then the reactor trip logic becomes 2-out-of-3. In this instance, the system can tolerate another single failure and still initiate a valid reactor trip. In summary, a single failure of the CPC that results in a failure to initiate a reactor trip will not cause loss of functional capability since only two of the three remaining channels are required to affect a reactor trip.

The COLSS consists of process instrumentation and algorithms used to continually monitor the limiting conditions for operation on:

A. Peak linear heat rate (LHR).

B. Margin to Departure from Nucleate Boiling (DNB).

C. Total core power; and, D. Azimuthal tilt.

The COLSS continually calculates DNB margin, peak LHR, total core power, and azimuthal tilt magnitude and compares the calculated values to the TS Limiting Condition for Operation on these parameters. If an LCO is exceeded for any of these parameters, a COLSS alarm is initiated, and operator action is taken as required by the TSs. The COLSS is not seismically qualified, or safety related.

While the RPS functions to initiate a reactor trip at the specified limiting safety system settings, the COLSS is not required for plant safety since it does not initiate any direct safety-related function during anticipated operational occurrences or postulated accidents. The TSs define the LCO required to ensure that reactor core conditions during operation are no more severe than the initial conditions assumed in the safety analyses and in the design of the low DNBR and high LPD trips. The COLSS serves to monitor reactor core conditions in an efficient manner and provides indication and alarm functions to aid the operator in maintenance of core conditions within the LCOs given in the TSs.

When COLSS is out of service, certain TS action statements become applicable including reducing reactor power the unit (TS 3.2.1 ).

If the proposed modification fails (i.e., the RCP speed indication from COLSS to the 'B' CPC channel fails) in a seismic event, that channel will provide a trip signal as designed.

The proposed modification does not impact any of the other three channels of CPCs or any other inputs to the 'B' CPC channel. Because failure of the COLSS RCP speed sensor would result in a trip of the 'B' CPC channel, the design function and the TS requirements of the CPC are maintained.

COLSS Portion One of the algorithms performed in COLSS is the reactor coolant volumetric flow rate.

The margin to DNB is a function of the reactor coolant volumetric flow rate. RCP rotational speed signals and pump differential pressure signals are monitored by COLSS (SAR 7. 7.1.3.3.1) and used to calculate the volumetric flow rate.

EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 8 of 15 There are two COLSS RCP speed sensors for each RCP. Sensor validity checks are performed by COLSS on those measured input parameters used in the COLSS calculations. The validity checks consist of checking sensor inputs against the following criteria:

A. Sensor out of range; and, B. Deviations between like sensors:

If one of the two sensors' input is determined to be non-valid, it is automatically replaced by the redundant sensor's input.

However, the speed sensor input from the RCP speed sensors is used by COLSS to determine if the RCP is running only (value received meets sensor validity checks).

COLSS assumes a fixed pump RPM set to a nominal value of 892 after the pump has been positively determined as running.

Substituting a fixed value into COLSS will therefore not affect the accuracy of COLSS or the results of a COLSS calculation while all four RCPs are running. In the event of a loss of any of the RCPs at power the CPC will generate a Reactor Trip signal, shutting down the reactor. The COLSS function of monitoring proximity to LPD and DNBR will no longer be required at this point. Moreover, calculations performed by COLSS are not relied upon until MODE 1 above 20% of Rated Thermal Power based on Technical Specification 3/4.2 "Power Distribution Limits" at which point all four Reactor Coolant Pumps must be running.

As described in FSAR Section 7.7.1.3 COLSS is not required for plant safety since it does not initiate any direct safety-related function during AOOs or postulated accidents.

The COLSS calculations allows efficient reactor monitoring but is not essential for the safety of the plant and is not relied upon to mitigate any accidents as described in the SAR. Therefore, this temporary modification allows substituting RCP speed inputs with a constant will not adversely impact the UFSAR Chapter 15 events or the COLSS design function. Additionally, COLSS is not a safety related system and COLSS remains functional with a substituted value for RCP speed input.

This temporary modification does not apply or alter any method of evaluation of a design function as described in the SAR. However, because a non-seismically qualified RCP speed signal (COLSS input) will temporarily be used as input to the 'B' CPC, the modification is conservatively considered adverse to the method of performing or controlling the design function of the CPCs; therefore, a 10 CFR 50.59 evaluation has been performed.

Is the validity of this Evaluation dependent on any other change? D Yes ~ No If "Yes," list the required changes/submittals. The changes covered by this 50.59 Evaluation cannot be implemented without approval of the other identified changes (e.g., license amendment request). Establish an appropriate notification mechanism to ensure this action is completed. N/A EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 9 of 15 Based on the results of this 50.59 Evaluation, does the proposed D Yes ~ No change require prior NRC approval?

Digitally signed by Robert W. Clark Robert W. ON; cn=Robert W. Clark, c=US, o=ANO, ou=Regulatory Assurance, Clark email=rclark@entergy.com Preparer2:

Date: 2022.07.07 07:05:13-05'00' Name (print) /Signature/ Company/ Department/ Date Rhouis Eric Allen

~1))4D 0->r., ~ 2022.07.07 Reviewer2: Rhouis Eric Allen/ - 08:44:14 -05'00' /Entergy/ DE-l&C / 7/7/2022 Name (print) /Signature/ Company / Department/ Date Independent N/A Review3:

Name (print)/ Signature/ Company I Department/ Date Responsible Digitally signed by Manager Concurrence:

ft :---- - Scott Kerins Date: 2022.07.07 12:46:26 -05'00' Name (print) /Signature/ Company / Department/ Date Digitally signed by Michael Hall 50.59 Program Coordinator Concurrence:

Michael Ha 11 ON: cn=Michael Hall, c=US, o=Entergy, ou=ANO Regulatory Assurance, email=mhall1 O@entergy.com Date: 2022.07.07 12:49:35 -05'00' Name (print) / Signature / Company/ Department/ Date OSRC: Brian Patrick/ OSRC Chairman/ signed in Asset Suite on 7/7/2022. See EC in AS or Final EC package in eB.

Chairman's Name (print) / Signature / Date [GGNS P-33633, P-34230, & P-34420; W3 P-151]

OSRC-2022-006 OSRC Meeting #

2 Either the Preparer or Reviewer will be a current Entergy employee.

3 If required by Section 5.1 [2].

I' EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 10 of 15 II. 50.59 EVALUATION [10 CFR 50.59(c)(2)]

Does the proposed Change being evaluated represent a change to a method of D Yes evaluation ONLY? If "Yes," Questions 1 - 7 are not applicable; answer only ~ No Question 8. If "No," answer all questions below.

Does the proposed Change:

1. Result in more than a minimal increase in the frequency of occurrence of an D Yes accident previously evaluated in the UFSAR? ~ No BASIS:

The CPCs, as a core protection system, provide two trip signals out of several potential trip signals to mitigate accidents evaluated in the ANO-2 SAR based on process inputs, including the RCP speed for each RCP. These process inputs and the CPCs are not initiators for any accident evaluated in the SAR.

The monitoring system, COLSS, does not initiate any automatic protection actions and is not an initiator for any accident. The loss of COLSS is an anticipated operating occurrence.

The proposed temporary modification does not require any changes to plant equipment or modes of operation. The initiators to accidents previously evaluated in the ANO-2 SAR are not affected and the probability of an accident is not increased due to the proposed temporary modification. This temporary modification does not impact the frequency of occurrence of an accident previously evaluated in the SAR.

• i I EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM

2. Result in more than a minimal increase in the likelihood of occurrence of a D Yes malfunction of a structure, system, or component important to safety !Zl No.

previously evaluated in the UFSAR?

BASIS:

The proposed temporary modification will route a cable from one of the two 'B' RCP speed sensors that is currently used by COLSS to the 'B' CPC channel using a routing that is not seismically qualified. This modification does not impact any internal hardware of the CPCs or COLSS. The software and data stored in the CPCs and COLSS is not altered by this modification. No other input signals to the

'B' CPC channel are impacted.

The algorithm for the input validity checks is not altered by this modification. The pump-specific curve and uncertainties stored in the CPCs and COLSS that are used in the calculations performed by the CPCs and COLSS are not impacted by this modification.

The RCP speed probe generates a sinusoidal waveform. The waveform has a specific amplitude and triggers a count in the pulse counter card at a certain voltage threshold on the either the rising or falling edge of the signal. The sinusoidal nature of the signal is generated by a proximity sensor on the RCP, but the voltage source is generated by the proximitor on the outside of the -Ring wall.

A seismic event causing a false signal in the cable is not considered to be credible due to the requirement of having to match the waveform and the signal amplitude to match an operating RCP. In addition, the loss of the speed signal will result in a trip being generated by the CPC channel; therefore, the non-seismicity of the COLSS related RCP speed signal will not prevent the CPC from performing its design function.

COLSS is not required for plant safety since it does not initiate any direct safety-related function during AOOs or postulated accidents. The COLSS calculations allows efficient reactor monitoring but is not essential for the safety of the plant and is not relied upon to mitigate any accidents as described in the SAR. Therefore, this temporary modification allows substituting RCP speed inputs with a constant will not adversely impact the SAR Chapter 15 events or the COLSS design function.

Additionally, COLSS is not a safety related system and COLSS remains functional with a substituted value for RCP speed input.

No other changes in the assumptions concerning the SSC important to safety availability or failure modes were made in the proposed change. The SSCs will be maintained and operated within the licensing basis for ANO-2 and does not impact the design function of the CPCs. Based on the above discussion, the proposed temporary modification will not result in more than a minimal increase in the '

likelihood of an SSC important to safety malfunctioning.

l*

EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM

3. Result in more than a minimal increase in the consequences of an accident D Yes previously evaluated in the UFSAR? ~ No BASIS:

The CPC core protection design function of tripping to mitigate accidents evaluated in the ANO-2 SAR is assured. The proposed temporary modification does not prevent the CPCs or COLSS from performing their associated design functions credited in the SAR. The proposed modification does not alter any assumptions or inputs to any radiological dose calculations. The results of the radiological dose calculations remain the same.

No changes in the-radiological release rate I duration and no new release mechanisms result due to the.installation of the proposed temporary modification and no impact to any of the radiation release barriers will occur due to the implementation of the proposed change. Based on the above, the proposed temporary modification will not result in more than a minimal increase in the consequences of an accident previously evaluated in the SAR.

I

4. Result in more than a minimal increase in the consequences of a D Yes malfunction of a structure, system, or componept important to safety ~ No previously evaluated in the UFSAR?

BASIS:

The proposed temporary modification will restore one channel of CPC to an operable status with respect to the intermittent failures of the 'B' RCP speed signal and not impact the operability of COLSS. The proposed change does not conform to the original design for the CPCs (RCP speed signal input raceway seismically qualified); however, performance of the CPC channel design function is assured.

This temporary modification allows substituting RCP speed inputs with a constant will not adversely impact the SAR Chapter 15 events or the COLSS design function.

Additionally, COLSS is not a safety related system and COLSS remains functional with a substituted value for RCP speed input. The loss of COLSS is an anticipated operating occurrence. When COLSS is out of service, certain TS action statements become applicable.

The proposed temporary modification does not alter any SSC that would introduce a new accident initiator or failure mechanism that has not already been considered in the SAR. Because the CPC will continue to provide appropriate trip signals as designed and because the malfunction of any CPC channel as considered in the SAR is not altered, and the loss of COLSS is considered an AOO, the temporary modification will not result in more than a minimal increase in the consequences of a malfunction of an SSC important to safety previously evaluated in the SAR.

EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 13 of 15

5. Create a possibility for an accident of a different type than any previously D Yes evaluated in the UFSAR? * ~ No BASIS:

The CPC process inputs and the function of the CPCs are not accident initiators.

The loss of an RCP speed input to the CPCs will result in a trip of that channel of the CPCs as designed.

The loss of COLSS is an AOO. When COLSS is out of service, certain TS action statements become applicable.

The proposed temporary modification does not alter any SSC that would introduce a new accident initiator or failure mechanism that has not already been considered in the SAR. The possibility for an accident of a different type than any previously evaluated in the SAR will not be created by the introduction of the proposed change.

6. Create a possibility for a malfunction of a structure, system, or component D Yes important to safety with a different result than any previously evaluated in ~ No the UFSAR?

BASIS:

This temporary modification impacts the CPCs and COLSS. CPCs are important to safety while the COLSS is not safety related. The proposed modification does temporarily modify the design of one RCP speed signal input to one channel of the CPCs. The proposed modification utilizes a cable routing through a non-seismically qualified pathway. The CPC system is itself remains seismically qualified. No other input signals to the 'B' CPC channel are impacted by the proposed temporary modification.

If the proposed modification fails (i.e., the RCP speed indication to one CPC channel fails) in a seismic event, that CPC channel will provide a trip signal as designed.

The proposed modification does not impact any of the other three channels of CPCs or any other inputs to this channel. There ~re no other credible new failures introduced by the proposed change.

The CPCs and COLSS are independent of each other. A failure of COLSS will not impact the design function of the CPCs as described in the SAR. Furthermore, the failure of one CPC channel to is designed safety tripped state will not result in any adverse affect or prevention of a reactor trip with respect to the 2 out of 4 channel trip logic. Therefore, the proposed change will not create the possibility for a malfunction of an SSC important to safety that has a different result than those already evaluated in the SAR.

EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 14 of 15

7. Result in a design basis limit for a fission product barrier as described in D Yes the UFSAR being exceeded or altered? ~ No BASIS:

The CPCs are designed to protect the fuel from reaching or exceeding the design basis limits of the fuel. With the implementation of this temporary modification, the CPCs will continue to perform as designed. This proposed modification does not impact any of the fission product barriers.

COLSS will continue to monitor the parameters associated with the core and alert the operators to any challenges to the fuel. The fission product barri'ers are not impacted by the proposed changes to COLSS.

The proposed temporary modification does not result in a SAR described design basis limit for a fission product barrier being exceeded

\

or altered.

8. Result in a departure from a method of evaluation described in the UFSAR D Yes used in establishing the design bases or in the safety analyses? ~ No BASIS:

With the implementation of the proposed temporary modification, there are no changes to the CPC or COLSS hardware or software. The DNBR, LPD, RCS mass flowrate calculations will continue to be performed in accordance with the design and licensing basis.

This temporary modification does use a cable routing that is partially not seismically qu~lified. The CPCs are a seismically qualified system. As discussed previously, if this cable was to fail and the RCP speed signal was lost to the 'B' CPC, the CPC would still perform its design function of providing a channel trip as described in the SAR. In accordance with the guidance provided in NEI 96-07, "Guidelines for 10 CFR 50.59 Implementation," Revision 1, this does not constitute a departure from a methodology of evaluation described in the SAR.

The accidents described in the SAR that credit a CPC trip are not impacted by this proposed temporary modification.

COLSS is not required for plant safety since it does not initiate any direct safety-related function during AOOs or postulated accidents. The COLSS calculations allows efficient reactor monitoring but is not essential for the safety of the plant and is not relied upon to mitigate any accidents as described in the SAR.

The proposed temporary modification does not result in a departure from a method of evaluation described in the SAR used in establishing the design bases or in the safety analyses.

EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 15 of 15 If any of the above questions is checked "Yes," obtain NRC approval prior to implementing the change by initiating a change to the Operating License in accordance with NMM Procedure EN-Ll-103.

• I EN-Ll-101 R21

ANO 50.59 Evaluation 2022-003 ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 1 of 13 I. OVERVIEW/ SIGNATURES 1 Facility: Arkansas Nuclear One Unit 2 Evaluation # / Rev. #: FFN-2022-003 Proposed Change I Document:

"ANO 2 Install Microprocessor Relay & Activate Out of Step Function and Loss of Field with Two Zones of Protection" / EC 88912 Description of Change:

The subject Engineering Change replaces the existing original equipment manufacturer (OEM) electromechanical Loss of Field (LOF) protective relay with two new redundant multi-function microprocessor-based protective relays to perform the protection needed for the main generator.

The new multi-function relays are configured to provide redundancy for individual protection functions, i.e., for Loss of Field and newly added Out of Step (OOS), in a two-out-of-two arrangement.

EC 88912 adds the new OOS generator protection function as an enhancement that provides an added level of protection that wasn't accounted for previously based on Transmission requirements.

The purpose of OOS relaying is to separate two areas of a power system, or two interconnected systems, when synchronism is lost to avoid equipment damage or a system-wide shutdown (i.e.,

blackout).

Summary of Evaluation:

Process Applicability Determination (PAD)

A PAD was performed to assess the ANO Unit 2 LOF upgrade and addition of the OOS protection function for EC 88912. The results of the PAD identify that the following portions of the change require additional evaluation:

• Added 00S Protective Function

• Added 2 out of 2 Logic This evaluation is based on the following issues:

Addition of OOS Protective Function:

The Main Generator Protection System is comprised of various protective relays to reduce the risk of damage to the Main Generator by leading to a unit shutdown (i.e., generator trip and subsequent turbine trip at a minimum with a reactor trip possible depending on other plant conditions such as plant power).

An LOF relay is included in the generator protection package to protect the rotor from damage during under-excited operation. The existing non-safety related electromechanical LOF relay is being replaced with two redundant digital microprocessor-based relays enabling a two-zone protection scheme which satisfies IEEE Standard C37.102-2006. Each of the two new relays employs the two-zone protection scheme. The zone 1 setting is more restrictive and trips through a 0.08-sec timer. It provides fast clearing on loss of field, and it is secure against swings. The zone 2 setting is wider and drives a 0.50-sec timer to detect partial loss of field and provide backup to the zone 1 setting. Relay timer setpoint will be determined in accordance with the criteria in NERC Standard PRC-026-1. This ensures that a plant trip does not occur during a stable power swing under non-fault conditions. The time delays allow the system to restore itself to a steady-state condition. This will align ANO Unit 2 with the North American EN-Ll-101 R21

Electric Reliability Corporation (NERC) standard PRC-026-1 "Relay Performance During Stable Power Swings".

The LOF relay provides an output to Generator Lockout Relays 286-G2-1, 286-G2-2, and 286-G2-8 to trip the generator and turbine on a LOF event. The LOF relay also provides an output to drive the GEN FIELD LOSS EXCITATION TRIP computer point through an interposing relay.

The replacement digital microprocessor-based relays also include the OOS protection function. OOS is a condition where a generator experiences a large increase in the angular difference of the Electro Motive Force (EMF) with other generators or portions of a system to which it is connected, usually following a major power system disturbance. OOS protection continually measures generator terminal bus voltage to identify changes which may indicate conditions that would likely lead to loss of synchronism, i.e.,

differences between generator output frequency and transmission line frequency due to generator pole slippage. The generator protection OOS function is set to operate to isolate equipment in order to limit the extent of damage when operating conditions exceed equipment capabilities or stability limits (steady and transient). As such, the OOS function is solely to protect the generator. The OOS function employs a one-zone of protection scheme with different settings than the LOF relay to ensure that a plant trip does not occur during a stable power swing under non-fault conditions. The newly added OOS function is an enhancement that provides added generator protection. The added OOS function has no impact on accident mitigation or the consequences of an accident.

Based on the guidance of NEI 96-07 Appendix D, the PAD has determined that the relay replacement is considered a simple digital upgrade replacement and is not considered an adverse change. Therefore, the upgrade to a digital relay is not considered to adversely affect the function of the generator protection scheme and is not further evaluated.

Addition of 2 out of 2 Logic:

The existing OEM electromechanical LOF relay provides a single output to trip the Generator Lockout Relays. The replacement digital microprocessor-based relays perform the same function for both the LOF and the OOS functions utilizing a two out of two trip logic scheme, requiring two LOF trip signals or two

. OOS trip signals in order to trip the Generator Lockout Relays.

The existing contact arrangement is a normally open contact that closes on a loss-of-field condition to energize the lockout relays. This modification adds two digital microprocessor-based relays {i.e., one primary and one backup), similar in function to the existing relay, to duplicate the number of contacts to energize the lockout relj:1ys. The replacement LOF/OOS relays retain the same lockout relay trip scheme with redundancy such that both relay's output contact closure are required to energize the lockout relays to trip the generator (i.e., 2-out-of-2 {2oo2) arrangement). This arrangement ensures that a functional failure of the relay will not result in a spurious trip, as it is not a fail-safe relay. During normal operating conditions, the existing electromechanical LOF relay output contact remains open, but has a vulnerability of not closing when required to provide LOF protection. CALC-ANOC-SE-15-00001 identifies that the failure mode of interest for the LOF relay is for it to spuriously trip due to setpoint drift, i.e., output contact closes when not intended to. The non-fail-safe trip scheme is mitigated by installing bypass switches in parallel with the trip contacts of each relay. Through the use of new bypass switches installed by this EC on the same panel, either relay's trip contacts may* be bypassed if that respective relay fails. This ensures that a trip can still occur if a fault condition exists. The bypass switch allows the failed relay to be placed

• in a "tripped" condition, while the remaining operable relay continues to provide protection, Le., in a one~

out-of-one (1001) condition or half-trip state, while the failed relay is repaired/replaced. This scenario is the same as the existing condition. This ensures that a trip can still occur if a fault condition exists and ensures that a functional failure of one relay does not result in a spurious trip.

Other possible failure modes of the existing electromechanical relay include an open coil and stuck output contacts. Either of these would cause a failure of the relay to operate under an actual LOF/OOS condition. Digital microprocessor-based relays do not have the risk of setpoint drift as the setpoint is EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 3 of 13 configured and maintained by internal software, resulting in a high accuracy of 0.1 %. Per the vendor information there is a low likelihood of a failure. The vendor's OOS relay has extensive applicable operating history and is used throughout the industry. There is reasonable assurance that the relatively simple digital architecture is stable and performs as required. Unlike electromechanical relays, digital microprocessor-based relays do not operate with coils, and as such, there is no possibility of an open/short coil condition. Furthermore, based on vendor information, the relay employs a loss of potential function such that if an input from a CT/PT is lost (or if a blown fuse occurs), it is detected and prevents operation, i.e., it does not initiate a generator trip. Therefore, an internal failure of the relay or loss of external inputs would not cause a trip condition under any circumstance, thus eliminating this as a cause for a spurious trip. The worst case scenario would be a loss of trip function. However, this modification adds bypass switches, which mitigates this unlikely condition. Through the use of new bypass switches installed by this EC on the same panel, either relay's trip contacts may be bypassed if that respective relay fails. This ensures that a trip can still occur if a fault condition exists.

The protective relay upgrade does not change plant operating parameters that would result in an increased challenge to systems, structures or components (SSCs) important to safety, or the frequency of any accident described in the SAR.

No new failure modes that could cause a plant transient or a turbine/generator trip were identified for the replacement relay. The protective relay upgrade reduces the number of failure modes and adds redundancy while maintaining the existing design function of generator protection. Failure modes associated with the existing electromechanical relay (such as open coil and stuck output contacts) are eliminated with the new digital microprocessor-based relay.

Based upon this evaluation this modification can be implemented without license amendment.

EN-Ll-101 R21

Is the validity of this Evaluation dependent on any other change? D Yes t8J No If "Yes," list the required changes/submittals. The changes covered by this 50.59 Evaluation cannot be implemented without approval of the other identified changes (e.g., license amendment request). Establish an appropriate notification mechanism to ensure this action is completed. __________________________________

Based on the results of this 50.59 Evaluation, does the proposed change D Yes [gj No require prior NRC approval?

Preparer2 :

Al Evans/ 1\-)Z.\JaM.A I Kinectrics / Civil-Structural / 11/3/2022 Name (print) /Signature/ Company I Department I Date R. Eric Allen / ,Q.l,.m<i,, 1m, ~ ~;; ~t~~ ~:~~:59-os*oo* /Entergy/ DE-l&C / see digital signature I I Reviewer2 :

Name (print) /Signature/ Company I Department I Date Independent Review3: N/A Responsible Manager /11-3-22 Concurrence:

Name (print) / Signature / Company I Department I Date

• Digitally signed by Michael Hall 50.59 Program Coordinator Concurrence:

M ICh aeI Ha 11 DN: _cn=Michael Hall, c=US, o=Entergy, ou=ANO Regulatory Assurance, erna1l=rnhall10@entergy.com Date: 2022.11.04 11:49:18 -05'00' Name (print) /Signature/ Company I Department I Date OSRC: See AS / See AS / See AS Chairman's Name (print) / Signature / Date [GGNS P-33633, P-34230, & P-34420; W3 P-151]

OSRC-2022-01 5 OSRC Meeting #

1 The printed name should be included on the form when using electronic means for signature or if the handwritten signature is illegible. Signatures may be obtained via electronic authentication, manual methods (e.g., ink signature), e-mail, or telecommunication. Signing documents with indication to look at another system for signatures is not acceptable such as "See EC" or "See Enterprise Asset Management (EAM) Application."

Electronic signatures from other systems are only allowed if they are included with the documentation being submitted for capture in eB (e.g., if using an e-mail, attach it to this form; if using Enterprise Asset Management (EAM) Application, attach a screenshot of the electronic signature(s); if using Corrective Action Program (CAP)

Application, attach a copy of the completed corrective action).

2 Either th'e Preparer or Reviewer will be a current Entergy employee.

2 3 If required by Section 5.1 (2]. Either the Preparer or Reviewer will be a current Entergy employee.

EN-Ll-101 R21

II. 50.59 EVALUATION [10 CFR 50.59(c}(2)]

Does the proposed Change being evaluated represent a change to a method of D Yes evaluation ONLY? If "Yes," Questions 1 - 7 are not applicable; answer only Question 8. tgj No "if "No," answer all questions below.

Does the proposed Change:

1. Result in more than a minimal increase in the frequency of occurrence of an D Yes accident previously evaluated in the UFSAR? tgj No BASIS:

The new OOS generator protection feature has been evaluated to assure that it will not more than minimally increase the frequency of the main generator and turbine trip.

The ANO Unit 2 SAR Chapter 15 identifies the main generator and turbine trip to occur due to the following initiating events and transients:

SAR Section 15.1.7: "Loss of External Load and/or Turbine Trip" SAR Section 15.1.9: "Loss of all Normal and Preferred AC Power to the Station Auxiliaries" SAR Section 15.1.29: "Turbine Trip with Coincident Failure of Turbine Bypass Valves to Open" SAR Section 15.1.33: "Turbine Trip with Failure of Generator Breaker to Open" The added OOS function is an enhancement that provides added generator protection. The replacement digital microprocessor-based relays perform the same function for both the LOF and the 00S.

Addition of OOS Protective Function The existing OEM electromechanical relay is classified as a Single Point Vulnerability (SPV) due to the possibility of setpoint drift to a point where an unanticipated trip could occur. Other possible failure modes include an open coil and stuck output contacts. Either of these would cause a failure of the relay to operate under an actual LOF condition. Digital microprocessor-based relays do not have the risk of setpoint drift as the setpoint is configured and maintained by internal software, resulting in a high accuracy of 0.1 %. Per the vendor Product Quality Report QDA-8004, the Mean Time Between Failures (MTBF) is 870 years (7,621,200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br />) with an annualized failure rate of 0.11 %. Thus, the likelihood of a failure is very unlikely. The vendor's OOS relay has extensive applicable operating history and is used throughout the industry. There is reasonable assurance that the relatively simple digital architecture is stable and performs as required. Unlike electromechanical relays, digital microprocessor-based relays do not operate with coils, and as such, there is no possibility of an open/short coil condition. Furthermore, based on vendor information, the relay employs a loss of potential function such that if an input from a CT/PT is lost (or if a blown fuse occurs), it is detected and prevents operation, i.e., it does not initiate a generator trip. Therefore, an internal failure of the relay would not cause a trip condition under any circumstance, thus eliminating this as a cause for a spurious trip. The worst case scenario would be a loss of trip function. However, this modification adds a redundant relay along with bypass switches, which mitigates this unlikely condition. The bypass switch allows the failed relay to be placed in a "tripped" condition, while the remaining operable relay continues to provide protection, i.e., in a one-out-of-one (1oo1) condition or half-trip state, while the failed relay is repaired/replaced. This scenario is the same as the existing condition. This ensures that a trip can still occur if a fault condition exists and ensures that a functional failure of one relay does not result in a spurious trip.

The existing electromechanical relay was susceptible to failure modes not applicable to the new digital microprocessor-based relay (such as open coil and stuck output contacts). The redundancy added by the EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 6 of 13 new relays, combined with the ability to test them on line with relatively low risk, results in similar to higher reliability than the electromechanical relay it replaced. The OOS function provides additional generator protection, higher reliability with built-in fault tolerance and does not cause a generator trip upon failure.

The added OOS function provides generator protection by initiating a generator trip (and subsequent turbine trip at a minimum with a reactor trip possible depending on other plant conditions such as plant power) if a valid fault were to occur. The frequency of generator trips would be no more of a minimal increase than if it were not installed, as the other protective relays (e.g., Backup Impedance Relay (221 ))

would have provided the same level of protection and result in a generator trip albeit later in time. The Backup Impedance (Generator Distance Backup Protection) (221) relay is set up to reach the 22KV winding of the Main Transformer, providing back up protection for faults in the leads between the Generator and the transformer. It provides back up protection for the Generator from external faults not cleared by the ANO Switchyard 500 kV primary relaying.

Addition of 2 out of 2 Logic This modification adds additional trip inputs to the existing Generator Lockout Relays trip scheme. While the apparent potential for a spurious trip from the existing electromechanical relay seems to increase as a result of this EC due to the increase in trip initiators, the existing contact arrangement is a normally open contact that closes on an LOF (or OOS) condition to energize the lockout relays. The replacement LOF/OOS relay retains the same lockout relay trip scheme with redundancy such that both relay's output contact closures are required to energize the lockout relays to trip the generator (i.e., 2oo2 arrangement).

This arrangement ensures that a functional failure of the relay will not result in a spurious trip, as it is not a fail-safe relay. This modification is being implemented to reduce the potential of a spurious trip during a stable power swing under a non-fault condition (as described by NERC PRC-026-1) by incorporating a time delay. This allows the system to restore to a steady state condition before a trip would occur. For each protection circuit, the relays are divided between separate output contacts that are wired in series.

The redundant LOF outputs are wired in series with the primary LOF outputs, providing a 2 out of 2 trip logic. For the OOS function, two normally opened contacts (one from each relay) are wired in series to also provide a 2 out of 2 trip logic. A new annunciator window "GEN LOF/OOS RELAY LOSS OF POTENTIAL" (2K02-E3) is added to provide Operations an alarm on either a loss of power to the relay or a loss of voltage input, which is indicative of a faulted relay. Through the use of new bypass switches installed by this EC on the same panel, either relay's trip contacts may be bypassed if that respective relay fails. This ensures that a trip can still occur if a fault condition exists. The bypass switch allows the failed relay to be placed in a "tripped" condition, while the remaining operable relay continues to provide protection, i.e., in a one-out-of-one (1001) condition or half-trip state, while the failed relay is repaired/replaced. This scenario is the same as the existing condition. This ensures that a trip can still occur if a fault condition exists and ensures that a functional failure of one relay does not result in a spurious trip.

The new relays use three phase current inputs and three phase voltage inputs, as opposed to only two phase current and voltage inputs used by the existing relay. This reduces the potential for an unintended trip. Additionally, the digital relay has an adjustable time delay, which allows the relay to withstand stable power swings during non-fault conditions. The trip output scheme is a normally open contact that closes on a fault condition, and thus a failure of the relay itself will not cause a trip.

The existing relay is wired using two potential transformer (PT) inputs, and two current transformer (CT) inputs. The replacement primary LOF/OOS relay is wired using three PT inputs (one per phase) plus ground and utilizes three CT inputs (one per phase) plus ground. The replacement redundant LOF/OOS relay utilizes the same input scheme but is tapped off of separate PTs and CTs, thus eliminating any potential operational failures due to failure of upstream components (i.e., PTs/CTs). The redundant LOF/OOS outputs are wired in series (one output contact from each relay) to provide the zone protection scheme described above. Power to both the primary and redundant relays is provided by the existing Group I protective relaying power source 125VDC Panel 2021 CKT 20. A functionally redundant set of protective relays (Group II) exist powered from a separate source. A separate set of contacts are wired to EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 7 of 13 an existing auxiliary relay (for LOF) and a new auxiliary relay (for OOS) that will drive the existing LOF computer point and a new dedicated computer point for OOS, respectively.

Conclusion This evaluation finds the new design to provide an enhancement to the reliability with respect to the generator protection system. The protective relay upgrade reduces the number of failure modes and adds redundancy while maintaining the existing design function of generator protection. This improves the generator protection reliability and minimizes the probability of spurious turbine/generator trips.

The added OOS function, along with the redundant 2oo2 arrangement, assures that a single relay will neither result in loss of necessary generator protection, nor will failure of an individual relay cause the generator to trip or cause a plant transient. The existing relay is not fault tolerant and does not provide fault detection and failure response capability.

In conclusion, there is a sufficiently low likelihood that the new relays will result in an increase in the frequency of occurrence of an accident previously evaluated in the SAR.

2. Result in more than a minimal increase in the likelihood of occurrence of a D Yes malfunction of a structure, system, or component important to safety previously [2] No evaluated in the UFSAR?

BASIS:

The generator protection function is not credited for any ANO Unit 2 Chapter 15 SAR transient or accident analyses. The worst-case malfunction of the upgraded protective relays remains a main generator and turbine trip.

No new failure modes that could cause a plant transient or a turbine/generator trip were identified for the replacement relay. The protective relay upgrade reduces, the number of failure modes and adds redundancy while maintaining the existing design function of generator protection. Failure modes associated with the existing electromechanical relay (such as open coil and stuck output contacts) are eliminated with the new digital microprocessor-based relay. Unlike electromechanical relays, digital microprocessor-based relays do not operate with coils, and as such, there is no possibility of an open/short coil condition. The replacement relay has extensive applicable operating history and is used throughout the industry. There is reasonable assurance that the relatively simple digital architecture is stable and performs as required.

Electromechanical relays, compared to digital microprocessor-based relays, are more susceptible to contact chatter as a result of being subjected to seismic events or vibration. The relay upgrade relies on solid state outputs and does not employ mechanical means to close contact outputs. The replacement relay withstands vibration, electrical surges, fast transients, and extreme temperatures, meeting stringent industry standards. This reduces the likelihood of malfunction.

A concern with electromechanical relay failure is due to the possibility of setpoint drift to a point where an unanticipated trip could occur. Digital microprocessor-based relays do not have the risk of setpoint drift compared to existing electromechanical relays as the setpoint is configured and maintained by internal software, resulting in a high accuracy of 0.1 %. Per the vendor Product Quality Report QDA-8004, the Mean Time Between Failures (MTBF) is 870 years (7,621,200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br />) with an annualized failure rate of 0.11 %. Thus, the likelihood of a failure is very unlikely and not more than a minimal increase of malfunction due to setpoint drift.

EN-Ll-101 R21

Electromechanical relays are more susceptible to failure because the mechanism that closes the contact (coil) is constantly being applied voltage and the resistance of that coil has the possibility of changing overtime. This is not the case with the replacement relay.

The generator protection scheme for these relays relies on a normally open contact to close to energize the Generator Lockout Relays when fault conditions exist. This arrangement ensures that a functional failure of the relay will not result in a spurious trip, as it is not a fail-safe relay. The addition of a 2oo2 redundant trip scheme provides added reliability to protect the generator during faults without increasing the malfunction of the generator, i.e., initiating a trip. Thus the likelihood of occurrence of a malfunction has not more than minimally increased with the relay upgrade as it functions similarly.

The replacement relay utilizes added three-phase PT and CT inputs compared to only two phases for the existing relay, which improves reliability. Power to the redundant relays is provided by the existing Group I protective relaying power source, similar to the existing relay .. Since ANO 2 already provides a functionally redundant set of Generator Lockout Relays (Group 11), powering the primary and redundant replacement relays from the same power source is considered acceptable.

Failure modes are bounded by the existing analysis. The addition of a protective device would not cause more than a minimal increase in the likelihood of a malfunction of the generator.

This modification improves the generator protection reliability and minimizes the probability of spurious turbine/generator trips. The upgrade has eliminated failure modes of the existing relay.

Conclusion With the failure likelihood introduced by the added OOS function and 2oo2 logic being sufficiently low, there is not more than a minimal increase in the likelihood of occurrence of a malfunction of an SSC important to safety previously evaluated in the SAR.

This evaluation finds the new design to provide an enhancement to the reliability of the new system with respect to the original generator protection system. By increasing the number of redundant relays and adding an OOS protection function, the change increases redundancy and reliability, eliminates multiple failure modes and this modification will reduce the potential for spurious turbine/generator trips and equipment failures.

3. Result in more than a minimal increase in the consequences of an accident D Yes previously evaluated in the UFSAR? [g] No BASIS:

The turbine/generator trip function is not credited for any ANO Unit 2 Chapter 15 SAR transient or accident analyses.

The turbine/generator has no function for accident mitigation or limiting the consequences of an accident.

Also, the function and performance of the generator protection, as described in the SAR, is not being changed.

The existing electromechanical LOF relay is being replaced with one of similar functionality with an added OOS protection function. Redundancy is added such that any one of two redundant relays can provide necessary generator protection during fault conditions, while ensuring that a plant trip does not occur during a stable power swing under non-fault conditions.

EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 9 of 13 The modified 2oo2 trip scheme configuration provides two independent relays for generator protection, which adds reliability.

The relay upgrade and added OOS protection function has no impact on the radiological consequences of an accident. /

As described in SAR Sections 15.1. 7 and 15.1.9, the unit is designed to withstand the effects of loss of electric load or electric power. This section, along with Sections 15.1.29 and 15.1.33, describe that a turbine trip is assumed to be a result of the accident/transient in the accident analyses. These accident analyses address the worst-case conditions and are bounding scenarios.

Conclusion The protection relay upgrade and addition of an 00S function does not result in more than a minimal increase in the consequences of an accident previously evaluated in the ANO Unit 2 SAR.

EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 10 of 13

4. Result in more than a minimal increase in the consequences of a malfunction of a D Yes structure, system, or component important to safety previously evaluated in the [gJ No UFSAR?

BASIS:

The relay upgrade is a reliability enhancement to the existing generator protection system described in the SAR. The protection relay upgrade does not change the function or performance requirements for the system as described in the SAR. The generator protection OOS function is set to operate to isolate equipment in order to limit the extent of damage when operating conditions exceed equipment capabilities or stability limits (steady and transient). As such, the OOS function is solely to protect the generator. The relay upgrade does not increase any plant operating parameters that would result in increased challenges to components important to safety. There are no new interface requirements with SSCs important to

• safety that function to limit the consequences of an accident established by this upgrade.

The turbine/generator trip function is not credited for any ANO Unit 2 Chapter 15 SAR transient or accident analyses. As described in SAR Sections 15.1.7 and 15.1.9, the unit is designed to withstand the effects of loss of electric load or electric power. This section, along with Sections 15.1.29 and 15.1.33, describe that a turbine trip is assumed to be result of the accident/transient in the accident analyses.

These accident analyses address the worst-case conditions and are bounding scenarios.

Conclusion The protection relay upgrade does not result in more than a minimal increase in the consequences of a malfunction of an SSC important to safety previously evaluated in the SAR.

• I EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 11 of 13

5. Create a possibility for an accident of a different type than any previously evaluated D Yes in the UFSAR? [8] No BASIS:

Impact on Existing Accident Analysis Applicable safety analyses identified and their related ANO SAR sections include:

• Loss of External Load and/or Turbine Trip - SAR Section 15.1. 7

• Loss of all Normal and Preferred AC Power to the Station Auxiliaries - SAR Section 15.1.9 The current safety analysis states that the unit is designed to withstand the effects of loss of external electric load or electric power, and that the unit has been designed to accommodate a loss-of-load condition without a reactor trip depending on the initial reactor power and the number of turbine bypass valves in the automatic mode. The turbine trip function is not credited for any ANO Unit 2 Chapter 15 SAR transient or accident analyses. Therefore, the turbine trip remains the worst-case result of the accident/transient of the current bounding Chapter 15 accident analyses related to the main turbine and generator.

The only output interface that the protective relays have to SSCs is to the Generator Lockout Relays 286-G2-1, 286-G2-2, and 286-G2-8 that trip the generator. Power to the redundant relays is provided by existing 125VDC Panel 2D21. Breakers are provided upstream of the protective relays to limit currents that would protect other 2D21 loads and upstream sources in the event of a short circuit.

The protective relay upgrade does not involve any new operating interfaces or parameter changes that would impact systems associated with initiation of an accident (reactivity control, reactor pressure boundary, or core cooling) other than the currently analyzed turbine trip event. No new system-level hazards or failure modes have been identified that would create a possibility for an accident of a different type or impact plant SAR analyses.

No new failure modes that could cause a plant transient or a turbine/generator trip were identified for the replacement relay. The protective relay upgrade reduces the number of failure modes and adds redundancy while maintaining the existing design function of generator protection. Failure modes associated with the existing electromechanical relay (such as open coil and stuck output contacts) are eliminated with the new digital microprocessor-based relay. Unlike electromechanical relays, digital microprocessor-based relays do not operate with coils, and as such, there is no possibility of an open/short coil condition. Digital microprocessor-based relays do not have the risk of setpoint drift compared to existing electromechanical relay as the setpoint is configured and maintained by internal software, resulting in a high accuracy of 0.1 %. The replacement relay has extensive applicable operating history and is used throughout the industry. There is reasonable assurance that the relatively simple digital architecture is stable and performs as required.

The protection relay upgrade, addition of an OOS function and added 2oo2 trip scheme has the probability of initiating a spurious generator or turbine trip which is an analyzed event. Therefore, this evaluation determines that the results of potential relay upgrade failures are enveloped by the current SAR Chapter 15 analyses.

This evaluation finds the new design to provide an enhancement to the reliability of the new system with respect to the original generator protection system. By increasing the number of redundant relays and adding an OOS protection function, the change increases redundancy and reliability, eliminates multiple failure modes and this modification will reduce the potential for spurious turbine trips and equipment failures.

EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 12 of 13 Conclusion Therefore, the ANO Unit 2 protection relay upgrade does not create a possibility for an accident of a different type than any previously evaluated in the ANO Unit 2 SAR.

6. Create a possibility for a malfunction of a structure, system, or component D Yes important to safety with a different result than any previously evaluated in the ~ No UFSAR?

BASIS:

The protection relay upgrade does not change the function or performance requirements of the generator protection system as described in the SAR such that the components important to safety are required to function in a different manner than currently analyzed. The worst-case malfunction of this upgrade remains a turbine trip.

There are no new interfaces with SSCs important to safety created by the addition of redundant protective relays. New power to the added redundant relay is provided by existing 125VDC Panel 2D21. A breaker is included in the design to provide isolation and to limit the potential for disturbance to all other loads from that panel in case of high fault current. Interfaces with adjacent SSCs important to safety have been identified with the appropriate requirements being included in the design, such as separation and seismic 11/1 qualification analysis. No other interfaces were identified through which the protection relay upgrade could adversely impact any other equipment or functions.

No new failure modes that could cause a plant transient or a turbine/generator trip were identified for the replacement relay. The protective relay upgrade reduces the number of failure modes and adds redundancy while maintaining the existing design function of generator protection. Failure modes associated with the existing electromechanical relay (such as open coil and stuck output contacts) are eliminated with the new digital microprocessor-based relay.

The turbine trip function is not credited for mitigating any ANO Unit 2 Chapter 15 SAR transient or accident analyses.

Conclusion This evaluation finds the new design to provide an enhancement to the reliability of the new system with respect to the original generator protection system. By increasing the number of redundant relays and adding an OOS protection function, the change increases redundancy and reliability, eliminates multiple failure modes and this modification does not create a possibility for a malfunction of an SSC important to safety with a different result than any previously evaluated in the SAR EN-Ll-101 R21

7. Result in a design basis limit for a fission product barrier as described in the D Yes UFSAR being exceeded or altered? [gj No BASIS:

The generator is not credited with functioning to maintain any fission product barrier. The generator is not changing plant responses or consequences of, therefore there would not be any changes to fission product barriers. The function of the generator protection system is unchanged by the upgrade and no new interfaces with systems that form fission product barriers are created. The protection relay upgrade does not change the operating or design conditions of any system such that the challenge to a barrier is increased.

SAR Section 5.2.1.5 discusses design transients evaluated for fission product barrier (RPV and RCS system) and includes consideration for turbine trips from full load. By increasing the number of redundant relays and adding an OOS protection function, the change increases redundancy and reliability, eliminates multiple failure modes and this modification will reduce the potential for spurious turbine/generator trips and equipment failures.

Conclusion The protection relay upgrade does not result in a design basis limit for a fission product barrier as described in the SAR as being exceeded or altered.

8. Result in a departure from a method of evaluation described in the UFSAR used in D Yes establishing the design bases or in the safety analyses? [gl No BASIS:

The proposed protection relay upgrade provides an enhancement to the reliability with respect to the generator protection system. The protective relay upgrade reduces the number of failure modes and adds redundancy while maintaining the existing design function of generator protection. This improves the generator protection reliability and minimizes the probability of spurious turbine/generator trips. The new system is based upon the current design and digital control strategy improvements.

Conclusion The ANO Unit 2 protection relay upgrade does not affect a method of evaluation described in the SAR and used in the safety analyses or to establish a design basis.

If any of the above questions is checked "Yes," obtain NRC approval prior to implementing the change by initiating a change to the Operating License in accordance with NMM Procedure EN-Ll-103.

EN-Ll-101 R21

ANO 50.59 Evaluation 2023-001 ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 1 of 8 I. OVERVIEW/ SIGNATURES 1 Facility: ANO Unit 2 Evaluation# FFN-2023-001/ Rev.# 0 Proposed Change I Document: ANO-2 Steam Generator Tube Rupture Dose Analysis (EC94021)

Description of Change:

As described in ANO-2 UFSAR Section 15.1.18, the Steam Generator Tube Rupture (SGTR) accident involves the rupture of a single steam generator tube allowing transport of reactor coolant into the main steam system. Radioactivity contained in the reactor coolant will mix with shell side water in the affected steam generator. With a Loss of Offsite Power, this radioactivity is released to the environment through the Atmospheric Dump Valves or Main Steam Safety Valves.

The current doses from a SGTR accident for ANO-2 are calculated in CALC-08-E-0024-04, Rev. 0 as modified by the markup in EC-93855. As documented in CR-ANO-2-2022-00436, Westinghouse identified several potential non-conservatisms in the SGTR accident dose analysis. The dose analysis was performed without using inputs from the steam generator transient analysis, which resulted in different values between the two such as tube break flow rate and break flow flashing fraction which impact the concentration effluents in the steam releases. The current SGTR accident dose analysis utilized a 240 gpm break flow rate and a 5% flashing fraction. The steam generator transient analysis showed that the initial values where higher that the assumed values early in the event and dropped below these values later in the event. Both these inputs have been updated with time dependent values calculated in the steam generator transient analysis, CALC-97-E-0204-05, which is an existing analysis.

The SGTR accident dose analysis has been updated to correct the break flow rates and flashing fractions in EC 94021. The updated break flow rates and flashing fraction values are input parameters provided by Entergy and are not part of a specified method of evaluation as discussed in the AST SER to Amendment 293. As a result of the changes, the offsite and control room radiological doses have increased in some cases for ANO-2.

The control room envelope is shared between ANO-1 and ANO-2. The acceptance criteria is the same for both units with the dose equivalent 1-131 and primary-to-secondary leak rate limits based on dose calculations using the requirements of 10 CFR 50.67 and the guidance in RG 1.183 which satisfies 10 CFR Part 50, Appendix A, GDC 19. The bounding GDC-19 control room envelope dose for an SGTR radiological analysis is limited by ANO-1 and the bounding analysis for control room habitability is unaffected.

Summary of Evaluation:

The condition identified in CR-ANO-2-2022-00436 regarding the flashing fractions has been corrected.

As documented in the markup to CALC-08-E-0024-04 in EC 94021, the offsite and control room doses remain within their acceptance limits but have increased above their current values. As determined in this 50.59 evaluation, the increase in dose is not more than a minimal increase in the consequences of an accident previously evaluated in the UFSAR.

Is the validity of this Evaluation dependent on any other change? D Yes ~ No 1 The printed name should be included on the form when using electronic means for signature or if the handwritten signature is illegible. Signatures may be obtained via electronic authentication, manual methods (e.g., ink signature), e-mail, or telecommunication. Signing documents with indication to look at another system for signatures is not acceptable such as "See EC" or "See Asset Suite." Electronic signatures from other systems are only allowed if they are included with the documentation being submitted for capture in eB (e.g., if using an e-mail, attach it to this form; if using Asset Suite, attach a screenshot of the electronic signature(s); if using PCRS, attach a copy of the completed corrective action).

1

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 2 of 8 If "Yes," list the required changes/submittals. The changes covered by this 50.59 Evaluation cannot be implemented without approval of the other identified changes (e.g., license amendment request). Establish an appropriate notification mechanism to ensure this action is completed.

Based on the results of this 50.59 Evaluation, does the proposed change D Yes ~ No require prior NRC approval?

Preparer2 : Christopher Walker/ ESL / Nuclear Analysis Christopher Walker, f; Digitally signed by Christopher Walker,

\cwa1ke6@entergy.com cwa1ke6@entergy.com ,;1--tme

2023.03.21 09,14,01 -os*oo*

Name (print) / Signature / Company / Department / Date Reviewer2 : Edward F Bauer/ ESL / Nuclear Analysis Digitally signed by Frank Bauer Frank DN: cn=Frank Bauer, c=US, o=Nuclear Analysis, ou=ESI, Bauer email=ebauer@entergy.com Date: 2023.03.2111:45:01 -05'00' Name (print) / Signature / Company / Department I Date Independent N/A Review3 :

Name (print) / Signature / Company / Department / Date .

Responsible Manager Scott Stanchfield/ ESL/ Nuclear Fuels Design Concurrence: Digitally signed by Scott Stanchfield

~~~ DN: cn=Scott Stanchfield, c=US,

~C email=sstanch@entergy.com Date: 2023.03.22 11 :40:32 -05'00' Name (print) /Signature/ Company/ Department/ Date 50.59 Program Michael Hall / EOI / Licensing, ANO Coordinator Digitally signed by Michael Hall Concurrence:

Michael Hall DN: cn=Michael Hall, c=US, o=Entergy Operations Inc.,

ou=ANO Regulatory Assurance, email=mhall1 O@entergy.com Date: 2023.03.22 13:55:54 -05'00' Name (print)/ Signature/ Company I Department I Date Br *1an Patr*1ck OSRC: {'

\Digitally signed by Brian Patrick

//---Bate: 2023.03.23 10:09:32 -05'00' ul Chairman's Name (print) / Signature I Date OSRC-2023-007 OSRC Meeting #

2 Either the Preparer or Reviewer will be a current Entergy employee.

3 If required by Section 5.1(2].

2

II. 50.59 EVALUATION (10 CFR 50.59(c)(2)]

Does the proposed Change being evaluated represent a change to a method of D Yes evaluation ONLY? If "Yes," Questions 1 - 7 are not applicable; answer only Question 8. ~ No If "No," answer all questions below.

Does the proposed Change:

1. Result in more than a minimal increase in the frequency of occurrence of an accident previously D Yes evaluated in the UFSAR? ~ No BASIS:

This change only updates the ANO-2 SGTR dose calculation for the non-conservative tube break flow and flashing fractions identified in CR-ANO-2-2022-00436. This calculation makes no changes to the plant design or operation and consequently has no impact on the precursors of a SGTR event. Consequently, this change will not result in more than a minimal increase in the frequency of occurrence of an accident previously evaluated in the USAR.

2. Result in more than a minimal increase in the likelihood of occurrence of a malfunction of a D Yes structure, system, or component important to safety previously evaluated in the UFSAR? ~ No BASIS:

This change only updates the ANO-2 SGTR dose calculation for the non-conservative tube break flow and flashing fractions identified in CR-ANO-2-2022-00436. There are no plant modifications required to support this change such that the precursors to any malfunction of equipment important to safety are not affected by this calculation. Consequently, this change will not result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety previously evaluated in the UFSAR.

3. Result in more than a minimal increase in the consequences of an accident previously D Yes evaluated in the UFSAR? r;gj No BASIS:

This change only updates the ANO-2 SGTR dose calculation for the non-conservative tube break flow and flashing fractions identified in CR-ANO-2-2022-00436. Due to the higher flashing fraction applied in this evaluation, the offsite and control room doses have increased relative to the current licensed values.

Consistent with Regulatory Guide 1.183, Revision 0, there are two SGTR cases evaluated for ANO-2: the case of a pre-existing iodine spike and the case of an accident-induced iodine spike.

The resulting chanf;les in the SGTR doses for the EAB, LPZ and Control Room for both these cases are listed bel.ow and compared to the current calculated dose values.

3

EC 94021 Markup to CALC-08-E-0024-04 Rev. 0 SGTR Dose Analysis - Pre-Existing Spike Case I

l ' j l I -.~ ......,,,..

~.-

., ' *~*

Dose'{Rem TEDE}

• hclusio.11

Low .. ,.

. . Contr9I '**

Dose Location;,

.. Area . Popllla((on ... Ret~renc~

Roor:n .'

' Bo'undary Zorie *  : '

CALC-08-E-0024-04 Rev. 0 Current Doses 2.75 0.13 0.38 EC-93855 markup LBDCR 22-041 {SAR Table 15.1.18-8)

New Doses 3.31 0.16 0.81 EC-94021 EC 94021 Markup to CALC-08-E-0024-04 Rev. 0 SGTR Dose Analysis - Accident-Induced Spike Case i

-.-~. .

' 'Dqse

. ,, (Rem TEPE.} .

• Exclusion . . lo'!'f

.' Co~.trol : ' I ',

Do~e L9catiori

• Area Population Re,ference

• ' .Room *

.Boundary

• Zone CALC-08-E-0024-04 Rev. 0 Current Doses 2.02 0.10 0.18 EC-93855 markup LBDCR 22-041 (SAR Table 15.1.18-8)

New Doses 2.01 0.10 0.21 EC-94021 As shown above, the accident dose*consequences reported in EC-94021 are predicted to increase. This comparison illustrates the margin reduction due to the change and must be evaluated under NEI 96-07 guidelines, Rev. 1 to determine if it is more than minimal. Section 4.3.3 of this guideline states that:

'~n increase in consequences from a proposed activity is defined to be no more than minimal if the increase ( 1) is less than or equal to 10 percent of the difference between the current calculated dose value and the regulatory guideline value (10 CFR 100 or GOG 19, as applicable), and (2) the increased dose does not exceed the current SRP guideline value for the particular design basis event."

Because ANO-2 has performed a full limplementation of the AST methodology, the equivalent AST-based regulatory values for onsite and offsite receptors are given in 10 CFR 50.67(b)(2). The regulatory limits from 10 CFR 50.67(b)(2) are 25 rem Total Effective Dose Equivalent (TEDE) for offsite receptors and 5 rem TEDE for control room personnel. The SGTR acceptance criteria for an AST plant are given in Regulatory Guide (RG) 1.183 instead of the NUREG-800 Standard Review Plan.

4

As shown below, the resulting changes in margin resulting from the increased tube break flow and flashing fractions are all less than 10 percent of the current margin and are below regulatory limits for both SGTR cases. Because the reduction in margin is less than 10% and the calculated doses are below the acceptance criteria given in RG 1.183, this change is acceptable because it meets the guidelines of NE! 96-07 and does not need to be submitted under 10 CFR 50.90.

EC 94021 Markup to CALC-08-E-0024-04 Rev. 0 SGTR Dose Analysis Pre-Existing Spike Case Dose (Rem TEDE)

Exclusion Low Control Dose Location Area Population Reference Room Boundary Zone CALC-08-E-0024-04 Rev. 0 Current Doses 2.75 0.13 0.38 EC-93855 markup LBDCR 22-041 (SAR Table 15.1.18-8)

Regulatory Limit 25.00 25.00 5.00 10CFR50.67 Maximum Increase 10% of margin between current 2.225 2.487 0.462 Allowed under 50.59 dose and regulatory limit Table 6 of Reg Guide 1.183 (same Acceptance Limit 25.00 25.00 5.00 as regulatory limit for Pre-Existing Spike SGTR)

New Doses 3.31 0.16 0.81 EC-94021 Change in Dose 0.56 0.03 0.43 New doses minus current doses Dose Increase Not More YES YES YES than Minimal Section 4.3.3 of NEI 96-07, Rev. 1 Dose Less than YES YES YES Acceptance Limit 5

EC 94021 Markup to CALC-08-E-0024-04 Rev. 0 SGTR Dose Analysis - Accident-Induced Spike Case Dose (Rem TEDE)

Exclusion Low Control Dose Location Area Population Reference Room Boundary Zone CALC-08-E-0024-04 Rev. 0 Current Doses 2.02 0.10 0.18 EC-93855 markup LBDCR 22-041 (SAR Table 15.1.18-8)

Regulatory Limit 25.00 25.00 5.00 10CFRS0.67 Maximum Increase 10% of margin between current 2.298 2.490 0.482 Allowed under 50.59 dose and regulatory limit Table 6 of Reg Guide 1.183 (10% of Acceptance Limit 2.50 2.50 5.00 offsite regulatory limit for Accident-Induced Spike SGTR}

New Doses 2.01 0.10 0.21 EC-94021 Change in Dose -0.01 0.00 0.03 New doses minus current doses Dose Increase Not More YES YES YES than Minimal Section 4.3.3 of NEI 96-07, Rev. 1 Dose Less than YES YES YES Acceptance Limit Therefore, the changes to the ANO-2 SGTR dose analysis have been shown to meet the "not more than minimal" criteria of 10 CFR 50.59 (c)(2) as determined using NEI 96-07 guidance in Section 4.3.3.

4. Result in more than a minimal increase in the consequences of a malfunction of a structure, D Yes system, or component important to safety previously evaluated in the UFSAR? [8J No BASIS: The design basis analyses discuss malfunctions of safety related structures, systems, or components important to safety. The SGTR represents the worst-case malfunction of the RCS pressure boundary for primary-to-secondary system leakage. The changes in consequences due to the tube break flow and flashing fraction are discussed in Criterion 3 above for the SGTR dose analysis.

On these bases, it is concluded that this update to the SGTR dose analysis will not result in more than a minimal increase in the consequences of a malfunction of a structure, system, or component important to safety previously evaluated in the USAR.

6

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 7 of 8

5. Create a possibility for an accident of a different type than any previously evaluated in the D Yes UFSAR? IX! No BASIS:

Updating the tube break flow and flashing fractions used in the design basis SGTR analysis does not involve any plant design or operating changes. Therefore, the change does not create the possibility for a different type of accident than any previously evaluated in the USAR. No plant physical or operating changes are involved in the su~ject change.

On these bases, this update to the dose analysis will not create a possibility for an accident of a different type than any previously evaluated in the USAR.

6. Create a possibility for a malfunction of a structure, system, or component important to safety D Yes with a different result than any previously evaluated in the UFSAR? IX! No BASIS:

Updating the tube break flow and flashing fractions used in the design basis SGTR analysis does not involve any plant design or operating changes. Therefore, the change does not create the possibility for a malfunction of a structure, system, or component important to safety with a different result than any previously evaluated in the USAR. No plant physical or operating changes are involved in the subject change.

On these bases, this update to the dose analysis will not create a possibility for a malfunction of a structure, system, or component important to safety with a different result than any previously evaluated in the USAR.

7. , Result in a design basis limit for a fission product barrier as described in the UFSAR being D Yes exceeded or altered? IX! No BASIS:

For the SGTR dose analysis, the NRC guidance requires the assumption that two design basis fission product barriers (RCS and fuel cladding) are failed and that source terms are released into the secondary system. Updating the SGTR dose calculation makes no plant physical or operating changes and has no impact on any fission product barrier.

On these bases, it is concluded that this update to the dose analysis will not result in a design basis limit for a fission product barrier as described in the USAR being exceeded or altered.

8. Result in a departure from a method of evaluation described in the UFSAR used in establishing D Yes the design bases or in the safety analyses? IX! No BASIS:

The method of evaluation for this update to the SGTR dose analysis are unchanged from those applied in the current analysis. The updated break flow rates and flashing fraction values are input parameters provided by Entergy and are not part of a specified method of evaluation as discussed in the AST SER to Amendment 293. The doses were evaluated using the NRG-approved RADTRAD 3.03 methodology.

7

Therefore, this update to the SGTR dose analysis does not represent a departure from a method of evaluation described in the USAR used in establishing the design bases or in the safety analyses.

If any of the above questions is checked "Yes," obtain NRC approval prior to implementing the change by initiating a change to the Operating License in accordance with NMM Procedure EN-Ll-103.

8

Attachment 5 2CAN112302 List of Affected SAR Pages 2CAN112302 Page 1 of 1 List of Affected SAR Pages The following is a list of SAR pages revised in Amendment 31 to support corrections, modifications, implementation of licensing basis changes, etc., as described in the Table of Contents of each SAR chapter (reference Enclosure 1 of this letter). Information relocated from one page to another in support of the aforementioned revisions is not considered a change; therefore, these pages are not included in the following list. In addition, pages associated with the individual Table of Contents are not listed below as related revisions are administrative only changes.

Cover Page 9.2-6 3.8-25 9.2-22 4.2-13 9.7-38 4.2-18 Figure 9.5-8 4.4-7 Figure 9.2-1A 4.6-12 10.4-18 4.7-6 10.4-19 4.7-14 13.1-1 4.7-22 Figure 13.1-1 Figure 4.3-1 15.1-119 Figure 4.3-1A 15.3-9 Figure 4.3-1C 15.3-107 Figure 4.3-1D 15.3-108 Figure 4.3-1 E 18.1-1 Figure 4.3-2 18.1-5 Figure 4.3-3 Figure 4.3-4 Figure 4.3-5 Figure 4.3-6 Figure 4.3-7 Figure 4.3-8 Figure 4.3-9 Figure 4.3-10 5.2-25 5.4-4 6.2-11 6.2-43 6.7-64

Enclosure 1 2CAN112302 ANO-2 SAR Amendment 31 - Un-redacted Version (CD Rom)

(4296 Pages)

Enclosure 2 2CAN112302 ANO-2 SAR Amendment 31 - Redacted Version (CD Rom)

(4296 Pages)

Enclosure 3 2CAN112302 ANO-2 TRM (CD Rom)

(157 Pages)

Enclosure 4 2CAN112302 ANO-2 TS Table of Contents and TS Bases (CD Rom)

(151 Pages)