ML050910247

WNA-LI-00038-FPL-NP, Rev 1, Licensing Input for Deletion of Steam / Feedwater Flow Mismatch Reactor Trip.

ML050910247
Person / Time
Site:	Turkey Point
Issue date:	02/21/2005
From:	Jurczak J, Suggs C, Vaughn Thomas Westinghouse
To:	Office of Nuclear Reactor Regulation
References
WNA-LI-00038-FPL-NP, Rev 1
Download: ML050910247 (31)

Text

Westinghouse Non-Proprietary Class 3 Florida Power & Light Turkey Point Units 3 & 4 Licensing Input for Deletion of Steam / Feedwater Flow Mismatch Reactor Trip WNA-LI-00038-FPL-NP Revision 1 February 2005

Westinghouse Non-Proprietary Class 3 Florida Power & Light Turkey Point Units 3 & 4 Licensing Input for Deletion of Steam 1 Feedwater Flow Mismatch Reactor Trip WNA-LI-00038-FPL-NP Revision 1 February 2005 APPROVALS Function Name and Signature Date Authors Authors C.W. Suggs Principal a j~Asnn Engineer, Des A"'212112005 1/' /120 Reviewed V. M. Thomas Principal Engineer.

/t, z -,7 esign-Basis Engineering ,

t-'-_ 2/21/2005 Approved J. A. Jurczak 2/21/2005 Manager, Design BasinnM7eeee;?- _ __

Westinghouse Electric Company, LLC P.O. Box 355 Pittsburgh, PA 15230-0355

© 2005 Westinghouse Electric Company LLC All Rights Reserved

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam I Feedwater Flow Mismatch Reactor Trip LIST OF CONTRIBUTORS/REVIEWERS Name Date Edward M. Monahan 8/19/04 Seenu J. Srinivasan 8/19/04 REVISION HISTORY RECORD OF CHANGES Revision Revision Made By Description Date 0 C. W. Suggs Initial Issue 01/11/05 1 C.W. Suggs Correction to LCO reference, page 3-2. 02/21/05 DOCUMENT TRACEABILITY & COMPLIANCE Created to Support the Following Document(s) I Document Number I Revision I

[None I I i DETAILED RECORD OF CHANGES Revision Date

Description:

Rev 0: Initial issue. 1/2005 Rev 1: Update to include LCO reference correction. 2/2005 WNA-LI-00038-FPL-NP, Rev. I i Ii

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam / Feedwater Flow Mismatch Reactor Trip TABLE OF CONTENTS Section Title Page LIST OF CONTRIBUTORS/REVIEWERS ............................... i TABLE OF CONTENTS .............................. ii GLOSSARY OF TERMS ............................... v REFERENCES .............................. vi SECTION 1 PURPOSE AND SCOPE OF DOCUMENT ................................................ 1-1 SECTION 2 CHANGE DESCRIPTION ................................................ 2-1 SECTION 3 LICENSING EVALUATION ................................................ 3-1 3.1 OVERVIEW ................................................ 3-1 3.2 LICENSING BASIS ................................................ 3-2 3.3 EVALUATION OF NON-LOCA EVENTS .................. .............................. 3-3 3.4

SUMMARY

OF EVALUATIONS ................................................ 3-10 3.5 SAFETY ANALYSIS EVALUATION ........... ..................................... 3-11 SECTION 4 MEDIAN SIGNAL SELECTION FUNCTION CONSIDERATIONS ........................ 4-1 4.0 OVERVIEW ................................................ 4-1 4.1 APPLICATION CONSIDERATIONS ................................................ 4-2 4.1.1 Median Signal Selection Functional Design & Certification ................................ 4-2 4.1.1.1 Operational Description ................................................ 4-2 4.1.1.2 Functional Fault Tolerance and Alarming ................................................ 4-2 4.1.1.3 Configuration Certification ................................................ 4-3 4.2 PLATFORM CONSIDERATIONS ................................................ 4-3 4.2.1 Median Signal Selection Quality and Reliability ................................................ 4-3 4.2.2 Median Signal Selection Failure Considerations ................................................ 4-4 4.2.2.1 Consequences of Failures ................................................ 4-4 4.2.2.2 Duration of Failures ................................................ 4-4 4.2.2.3 Diagnostics ................................................ 4-5 4.2.2.4 Test Capability ................................................ 4-5 4.2.3 Independence of Safety-Related and Nonsafety-Related Inputs to the Median Signal Selection Function ................................................ 4-6 WNA-LI-00038-FPL-NP, Rev. 1 ii

I Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam / Feedwater Flow Mismatch Reactor Trip SECTION 5 WESTINGHOUSE NUCLEAR SAFETY ADVISORY LETTER, NSAL-96-004, CONTROL AND PROTECTION INTERACTION .................................. 5-1 SECTION 6 CONCLUSION .............................................. 6-1 WNA-LI-00038-FPL-NP, Rev. I IIIi

Florida Power &Light Licensing Input for Deletion of Turkey Point Units 3 &4 Steam / Feedwater Flow Mismatch Reactor Trip ACRONYMS AND TRADEMARKS The following abbreviations and acronyms are defined to allow an understanding of their use within this document.

Acronyms Definition FF Feedwater Flow FPL Florida Power & Light FWCS Feedwater Control System l&C Instrumentation and Control LAR License Amendment Request MSS Median Signal Selection OTAT Overtemperature Delta Temperature PTN Plant Turkey Point SF Steamline Flow SG Steam Generator RPS Reactor Protection System All other product and corporate names used in this document may be trademarks or registered trademarks of other companies, and are used only for explanation and to the owners' benefit, without intent to infringe.

WNA-LI-00038-FPL-NP, Rev. I IV

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam / Feedwater Flow Mismatch Reactor Trip GLOSSARY OF TERMS The following definitions are provided for the special terms used in this document.

Termn Definitions None.

WNA-LI-00038-FPL-NP, Rev. I v

Florida Power &Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam / Feedwater Flow Mismatch Reactor Trip REFERENCES Following is a list of references used throughout this document.

1. Not used.

2. Florida Power & Light Turkey Point Units 3 and 4, Westinghouse Functional Logic Diagrams, 883D988 Sheets 2 and 13.

3. FPL, Turkey Point Units 3 and 4, Reactor Trip Signals Functional Logic Drawing, 561 0-T-1, Sheet 2, Revision 20.

4. FPL, Turkey Point Units 3 and 4, Steam Generator Caused Reactor Trip and Safety Injection Signals Functional Logic Drawing, 5610-T-L1, Sheet 19, Revision 23.

5. Turkey Point Units 3 and 4, Design Basis Document, Reactor Protection System and Engineered Safety Features Actuation System, 5610-049-DB-001, Rev. 11.

6. Turkey Point Units 3 and 4 Accident Analysis Design Basis Document, Module 10.0, "Loss of Normal Feedwater Flow," Revision E.

7. Turkey Point Units 3 and 4 UFSAR, Chapter 1, Rev. U4C21

8. Turkey Point Units 3 and 4 UFSAR, Chapter 7, Rev. U4C21

9. Turkey Point Units 3 and 4 UFSAR, Chapter 14, Rev. U4C21

10. Turkey Point Units 3 and 4 Plant Technical Specifications, Through Amendment Nos. 224 and 221

11. FPL Purchase Order 00071279, Revision 004.

12. Westinghouse Offer NA-MKTG-04-39, dated February 24, 2004.

13. Westinghouse Offer NA-MKTG-04-48, dated March 16, 2004.

14. Westinghouse Nuclear Safety Advisory Letter, NSAL-96-004, Control and Protection Interaction, 8/14/96.

WNA-LI-00038-FPL-NP, Rev. 1 vi

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam / Feedwater Flow Mismatch Reactor Trip

15. FPL Letter ENG-LCM-04-256, 12/17/04, "PTN 3 Engineering Evaluation PTN-ENG-SEIJ 073 for Section 4.2 Platform Considerations for Westinghouse Licensing Report WNA-LI-00026-FPL Regarding Steam/Feedwater Flow Mismatch Reactor Trip"

16. FPL Letter ENG-LCM-04-251, 12/15/04, 'PTN 3 Design Configuration Documents for Feedwater Control Sensor Segregation" (Last Page of Front Matter)

WNA-LI-00038-FPL-NP, Rev. I vii

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam I Feedwater Flow Mismatch Reactor Trip SECTION 1 PURPOSE AND SCOPE OF DOCUMENT The purpose of this document is to provide licensing input for the deletion of the steam / feedwater flow mismatch (low feedwater flow) reactor trip function at Turkey Point Units 3 and 4.

This report provides the following information:

• A description of the change

• A discussion of the median signal selection function and the hardware requirements

• Licensing justification for deletion of the steam I feedwater flow reactor trip function (Last Page of Section 1)

WNA-LI-00038-FPL-NP, Rev. 1 1 -1

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam / Feedwater Flow Mismatch Reactor Trip SECTION 2 CHANGE DESCRIPTION The current design at Turkey Point Units 3 and 4 for the narrow range steam generator (SG) level input into the feedwater control system utilizes a dedicated level channel selected by the operator via a two-position switch on the main control board. The two-position switch selects either a non-safety-related SG water level signal or an isolated SG water level signal from the safety-related protection system as input to the feedwater control system for each steam generator. With the use of the protection grade level signal as an input to the feedwater control system, the steam /

feedwater flow mismatch reactor trip function provides a mechanism to prevent an adverse control / protection interaction involving the protection grade SG level signals.

To maintain the current level of functional performance of the reactor protection system (RPS) following the elimination of the steam / feedwater flow reactor trip function, the feedwater control system must be altered to eliminate the potential for an adverse control / protection interaction, involving the SG level signals. For Turkey Point Units 3 and 4, this will be accomplished by including a Median Signal Selection (MSS) function in the feedwater control system. The MSS function will select the median (middle) value of the three steam generator narrow range level input channels (three isolated SG water level signals from the protection system) and provide that value to the feedwater control system. The MSS function will prevent an adverse control and protection system interaction mechanism involving the steam generator low-low water protective functions by providing functional isolation between the RPS and the feedwater control system.

(Last Page of Section 2)

WNA-LI-00038-FPL-NP, Rev. 1 2-1

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam / Feedwater Flow Mismatch Reactor Trip SECTION 3 LICENSING EVALUATION 3.1 OVERVIEW For plants that share one or more SG water level channels per loop between the protection and control systems, the steam / feedwater flow mismatch reactor trip function was included in the reactor protection system logic to address potentially adverse interactions between control and protection systems.

If the SG level channel that is selected for main feedwater control fails high, then the feedwater control system will reduce or eliminate feedwater flow to the affected loop, thereby causing level in that SG to fall. If the channel is also one of the safety-related channels, a second level channel must also be assumed to fail. This leaves only one remaining SG level channel. Given this scenario, the Low - Low SG Level 2 out of 3 reactor trip logic cannot be satisfied.

The steam / feedwater flow mismatch reactor trip logic can be satisfied with one operable SG level channel. Thus, even with the required second failure, the one remaining operable SG water level channel would satisfy the reactor trip logic. This trip requires a steam / feedwater flow mismatch signal coincident with a low SG water level signal to eliminate the potential for a spurious actuation in the event that one of the SG level protection channels fails low.

A median signal selection function for SG water level will be included in the main feedwater control system to address potentially adverse control / protection system interaction. The median signal selection function selects the median SG water level indication to be used for main feedwater control. This eliminates the scenario where a single SG water level channel failing high can cause a reduction in feedwater that will eventually require protection action. Thus, through implementation of the median signal selection function, the potential for an adverse control / protection interaction for the low-low SG level protection function is eliminated. With the elimination of the potentially adverse control - protection interaction, the steam / feedwater flow mismatch reactor trip is no longer needed.

WNA-LI-00038-FPL-NP, Rev. 1 3-1

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam / Feedwater Flow Mismatch Reactor Trip 3.2 LICENSING BASIS Turkey Point Units 3 and 4 UFSAR Chapter 1 states that the steam I feedwater flow mismatch reactor trip is one of several trip functions provided to back up primary trip functions for specific accident conditions and mechanical failures. Chapter 7.2 states that the steam / feedwater flow mismatch reactor trip is provided to address equipment failure.

Turkey Point Units 3 and 4 UFSAR Chapter 7.2 describes the steam / feedwater flow mismatch reactor trip as the means required to address the potential for a control-protection interaction of the steam generator water level control of feedwater flow and the low-low steam generator reactor trip function due to equipment failure of the SG level channel used for control. No other basis is provided for inclusion of the reactor trip.

Two events in the Turkey Point Units 3 and 4 UFSAR Chapter 14 list the steam / feedwater flow mismatch reactor trip as potentially providing protection. Loss of Normal Feedwater (Section 14.1.1 1) and Loss of Non-Emergency A-C Power to the Plant Auxiliaries (Section 14.1.12) each list the function as the second of two available reactor trip functions. Although the steam / feedwater flow mismatch reactor trip is listed, it is not credited in the analysis. In both of these cases the accident analysis acceptance criteria are met with the Low-Low SG Water Level reactor trip as the credited reactor trip. The steam / feedwater flow mismatch reactor trip is not required to be available as a backup to the low - low SG level reactor trip function, since no single failure can disable the credited low - low SG level reactor trip function. The steam / feedwater flow mismatch reactor trip is not credited for any of the Chapter 14 events.

The steam / feedwater flow mismatch reactor trip is included in Technical Specification LCO 3.3.1, Reactor Trip Instrumentation as Function 12. The associated allowable and trip setpoint values are provided in Technical Specifications Table 2.2-1, Reactor Trip System Instrumentation Trip Setpoints. The function is included to mitigate the effects of equipment failures which can potentially cause an adverse control - protection interaction.

WNA-LI-00038-FPL-NP, Rev. I 3-2

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam I Feedwater Flow Mismatch Reactor Trip 3.3 EVALUATION OF NON-LOCA EVENTS Each of the non-LOCA accident analyses described in Chapter 14 of the Turkey Point UFSAR was reviewed to confirm that the steam / feedwater flow mismatch coincident with steam generator water level - low reactor trip is not credited in the analyses. Based on this review, it is concluded that the proposed change has no effect on the accident analyses. This review is summarized below for each event.

1. UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY BANK WITHDRAWAL FROM A SUBCRITICAL CONDITION Event Definition: A rod cluster control assembly (RCCA) bank withdrawal accident is defined as an uncontrolled addition of reactivity to the reactor core caused by withdrawal of one or more RCCA banks, resulting in a power excursion. This could occur with the reactor either subcritical, at hot zero power, or at power.

Plant Operating Conditions: The plant is assumed to be operating at the no-load reactor coolant average temperature with a power level of 1x10-9 of nominal.

Effect of Proposed Change: This is a fast transient that is terminated by the Power Range High Neutron Flux trip function. The secondary side of the plant does not come into play and the steam / feedwater flow mismatch trip function is not modeled. Therefore, this proposed change has no effect on this accident scenario and the conclusions of the UFSAR remain valid.

2. UNCONTROLLED CONTROL ROD ASSEMBLY WITHDRAWAL AT POWER Event Definition: This event is defined as the inadvertent addition of positive reactivity to the core caused by the uncontrolled withdrawal of an RCCA bank(s) while at power.

Plant Operating Conditions: Initial power levels of 100, 80, 60, and 10 percent of nominal Rated Thermal Power are analyzed. For all cases analyzed, the results show that integrity of the core is maintained by the reactor protection system (RPS) as the departure from nucleate boiling (DNBR) remains above the safety analysis limit value.

Effect of Proposed Change: In this scenario, the reactor trip is provided by the automatic actuation of the first primary side reactor protection signal reached: either overtemperature delta WNA-LI-00038-FPL-NP, Rev. I 3-3

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam / Feedwater Flow Mismatch Reactor Trip temperature (OTAT) or power range high neutron flux. The steam / feedwater flow mismatch reactor trip function is not credited as a primary or backup trip for this event. Therefore this proposed change has no effect on this accident scenario and the conclusions of the UFSAR remain valid.

3. ROD CLUSTER CONTROL ASSEMBLY (RCCA) DROP Event Definition: The dropped RCCA accident is initiated by a single electrical or mechanical failure which causes any number and combination of rods from the same group of a given bank to drop to the bottom of the core.

Plant Operating Condition: The analysis is performed with the plant at full power.

Effect of Proposed Change: There is no reactor trip credited in the analysis. The steam I feedwater flow mismatch reactor trip function is not credited for this event as either a primary or backup trip. Therefore, this proposed change has no effect on this accident scenario and the conclusions of the UFSAR remain valid.

4. CHEMICAL AND VOLUME CONTROL SYSTEM MALFUNCTION Event Definition: This event is the inadvertent dilution of the reactor coolant system (RCS) boron concentration. This event is caused by a chemical and volume control system (CVCS) malfunction or faulty operator action. The limiting scenario considered is the inadvertent opening of the primary water makeup control valve and failure of the blend system, either by controller or mechanical failure, resulting in the addition of unborated water into the RCS.

Plant Operating Condition: The analysis is performed for an inadvertent dilution of the RCS for power operation (mode 1), startup (hot zero power) and refueling modes of plant operation.

Effect of Proposed Change: In Mode 1, the power and temperature rise will cause the reactor to reach the OTAT trip setpoint resulting in a reactor trip if the plant is operating in manual rod control. In Mode 2, the power range high neutron flux (low setpoint) function provides the trip.

In the refueling mode, the reactor trips are not required to be operable. The steam / feedwater flow mismatch function is not credited as a primary or backup trip. Therefore, this proposed change has no affect on this accident scenario and the conclusions of the UFSAR remain valid.

WNA-LI-00038-FPL-NP, Rev. 1 3-4

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 &4 Steam / Feedwater Flow Mismatch Reactor Trip

5. STARTUP OF AN INACTIVE REACTOR COOLANT LOOP Event Definition: The inadvertent startup of an idle loop while operating in an N-1 loop condition results in the sudden introduction of colder water into the core from the idle loop which could cause an unplanned reactivity insertion and power increase.

Plant Operating Condition: N/A. See below.

Effect of Proposed Change: The Turkey Point Technical Specifications preclude operation of the plant with one or more loops out of service. Therefore, this event no longer applies and has been removed from the plant's licensing basis. The proposed change therefore has no effect on this accident scenario.

6. EXCESSIVE FEEDWATER FLOW AND REDUCTION IN FEEDWATER ENTHALPY INCIDENT Event Definition: This event is defined as an increase in feedwater flow to one or more of the steam generators or a decrease in feedwater temperature. This event will result in an increase in the heat transfer rate from primary to secondary in the steam generators and a consequential reduction in primary system temperature and pressure. The transient responses for an excessive feedwater flow event to one steam generator were analyzed for four cases: two cases at hot full power (one case with automatic rod control and one without) and two cases at hot zero power (one case with automatic rod control and one without).

Plant Operating Condition: This event is analyzed at power levels corresponding to zero and full load.

Effect of Proposed Change: For full power conditions, feedwater isolation and turbine trip (with a subsequent reactor trip signal on turbine trip) occur on the high-high steam generator water level signal. For the zero power case, there is no reactor trip credited in the analysis; however, the reactor may be tripped by the power range high neutron flux trip (low setting). The steam /

feedwater flow mismatch function is not credited as a primary or backup trip. Therefore, the proposed change does not invalidate the results of the analysis and the conclusions of the UFSAR remain valid.

WNA-LI-00038-FPL-NP, Rev. I 3-5

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 &4 Steam / Feedwater Flow Mismatch Reactor Trip

7. EXCESSIVE LOAD INCREASE INCIDENT Event Definition: An excessive load increase event is defined as a rapid increase in the steam flow that causes a power mismatch between the reactor core power and the steam generator load demand. The reactor control system is designed to accommodate a 10% step-load increase or a 5% per minute ramp load increase in the range of 15 to 100% power. Any loading rate in excess of these values may cause a reactor trip by the reactor protection system.

Plant Operating Condition: The event is analyzed at full power conditions and assuming a 10%

step load increase.

Effect of Proposed Change: Although the RPS is assumed to be operable, a reactor trip does not occur in this analysis. Therefore, this proposed change has no effect on this accident scenario and the conclusions of the UFSAR remain valid.

8. LOSS OF REACTOR COOLANT FLOW A) Flow Coastdown Accidents Event Definition: The loss of flow incident can result from a mechanical or electrical failure in a reactor coolant pump (RCP), or from a fault in the power supply of these pumps.

Plant Operating Condition: The plant is assumed to be operating at full power. Bounding analyses are performed at full power since this is the most conservative condition in terms of potential consequences, specifically a more limiting minimum DNBR.

Effect of Proposed Change: The low primary coolant loop flow, RCP undervoltage, RCP underfrequency, and RCP breaker position reactor trip functions provide the necessary protection for this event. The steam / feedwater flow mismatch function is not credited as a primary or backup trip. Therefore, this proposed change has no effect on this accident scenario and the conclusions of the UFSAR remain valid.

WNA-LI-00038-FPL-NP, Rev. 1 3-6

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam / Feedwater Flow Mismatch Reactor Trip B) Locked Rotor Accident Event

Description:

The design basis reactor coolant pump shaft seizure event is defined as an instantaneous seizure of a single RCP rotor which results in a rapid reduction in reactor coolant loop flow.

Plant Operating Condition: This event is analyzed assuming that the plant is operating at maximum reactor coolant pressure and temperature, and maximum power when the event occurs.

Effect of Proposed Change: The reactor trip is initiated by low primary coolant loop flow. The steam / feedwater flow mismatch function is not credited as a primary or backup trip. Therefore, this proposed change has no effect on this accident scenario and the conclusions of the UFSAR remain valid.

9. LOSS OF EXTERNAL ELECTRICAL LOAD Event Definition: The loss of external electrical load and/or turbine trip event is defined as a complete loss of steam load from full power without a direct reactor trip, or a turbine trip without a direct reactor trip.

Plant Operatinq Condition: The analysis assumes a complete loss of steam load from full power with no credit taken for the direct reactor trip on turbine trip.

Effect of Proposed Change: Protection for this event is provided by the OTAT, high pressurizer pressure, or low-low steam generator water level signals. The steam / feedwater flow mismatch function is not credited as a primary or backup trip in this analysis. Therefore, this proposed change has no effect on this accident scenario and the conclusions of the UFSAR remain valid.

10. LOSS OF NORMAL FEEDWATER FLOW Event Definition: The design basis loss of normal feedwater event is defined as a reduction in the capability of the secondary system to remove heat generated in the reactor core.

WNA-LI-00038-FPL-NP, Rev. I 3-7

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 &4 Steam / Feedwater Flow Mismatch Reactor Trip Plant Operating Condition: A complete loss of main feedwater flow is assumed to occur from 102% of Rated Thermal Power. Maximum initial RCS temperature and pressure conditions are assumed.

Effect of Proposed Change: Protection for this event is provided by the low-low steam generator water level and the steam / feedwater flow mismatch trip functions. However, the steam / feedwater flow mismatch function is not credited in the analysis. Therefore, the steam /

feedwater flow mismatch function can be removed and the conclusions of the UFSAR remain valid.

11. LOSS OF NON-EMERGENCY AC POWER TO THE PLANT AUXILIARIES Event Definition: A complete loss of non-emergency AC power may result in the loss of all power to the plant auxiliaries: i.e., the RCPs, condensate pumps, etc. The loss of power may be caused by a complete loss of the offsite grid accompanied by a turbine generator trip at the station, or by a loss of onsite non-emergency AC distribution system.

Plant Operating Condition: The plant is initially operating at 102% of rated thermal power.

Maximum initial RCS temperature and pressure conditions are assumed.

Effect of Proposed Change: Protection for this event is provided by the low - low steam generator water level and the steam / feedwater flow mismatch trip functions. However, the steam / feedwater flow mismatch function is not credited in the analysis. Therefore, the steam I feedwater flow mismatch function can be removed and the conclusions of the UFSAR remain valid.

12. RUPTURE OF A STEAM PIPE Event Definition: A rupture of a steam pipe is assumed to include any accident which results in an uncontrolled steam release from a steam generator. Such a release may result from either the opening of a steam generator relief or safety valve, or from a steam system pipe break.

Plant Operating Condition: The analysis assumes that the reactor is initially at hot shutdown conditions.

WNA-LI-00038-FPL-NP, Rev. I 3-8

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam / Feedwater Flow Mismatch Reactor Trip Effect of Proposed Change: Protection of this event is provided by the overpower reactor trips (neutron flux and delta-T) and the reactor trips occurring in conjunction with receipt of the Safety Injection Signal. The limiting zero power analysis does not specifically credit the reactor trip system. Only the Engineered Safety Features Actuation System (ESFAS) is needed to limit the consequences of the analyzed events. Elimination of the steam / feedwater flow reactor trip function has no effect on this event and the conclusions of the UFSAR remain valid.

13. RUPTURE OF A CONTROL ROD MECHANISM HOUSING - RCCA EJECTION Event Definition: This event is an assumed failure of a control rod mechanism pressure housing such that the RCS pressure would eject the control rod and drive shaft.

Plant Operating Condition: Both full and zero power cases are analyzed.

Effect of Proposed Change: The reactor will trip on either the power range high neutron flux low setpoint, or the high setpoint. The steam / feedwater flow mismatch function is not credited as a primary or backup trip. Therefore, this proposed change has no effect on this accident scenario and the conclusions of the UFSAR remain valid.

WNA-LI-00038-FPL-NP, Rev. 1 3-9

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam / Feedwater Flow Mismatch Reactor Trip 3.4

SUMMARY

OF EVALUATIONS The following evaluations were completed in support of this change:

1. LOSS OF COOLANT ACCIDENT (LOCA) AND LOCA-RELATED EVALUATIONS The following LOCA related analyses are not adversely affected by the deletion of the steam /

feedwater flow mismatch reactor trip:

1. Large and small break LOCA

2. Reactor vessel and loop LOCA blowdown forces (the LOCA blowdown forces are analyzed at 100% power, thus reactor trip is not a relevant input to this analysis) 3 Post-LOCA long term core cooling subcriticality

4. Post-LOCA long term core cooling minimum flow and hot leg switchover to prevent further boron precipitation This change does not affect the normal plant operating parameters, the safeguards systems actuation or accident mitigation capabilities important to LOCA, or the assumptions used in the LOCA related accidents. Nor does it create conditions more limiting than those assumed in these analyses.

2. NON-LOCA RELATED EVALUATION Each of the non-LOCA accident analyses described in Chapter 14 of the Turkey Point UFSAR was reviewed with respect to the effect of eliminating the reactor trip function on steam /

feedwater flow mismatch. Based on this review, it is concluded that the proposed change has no effect on the accident analyses. This review is summarized above in Section 3.3, Evaluation of Non-LOCA Events.

It is concluded that the non-LOCA safety analyses presented in Chapter 14 of the UFSAR are not adversely affected by deletion of the steam / feedwater flow mismatch reactor trip.

Additionally, normal plant operating parameters, accident mitigation capabilities, and assumptions used in the non'-LOCA transients are not adversely affected. This change will not WNA-LI-00038-FPL-NP, Rev. 1 3-10

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam I Feedwater Flow Mismatch Reactor Trip create conditions more limiting than those considered in the current non-LOCA analyses.

Therefore, the deletion of the steam I feedwater flow mismatch reactor trip does not alter the conclusions presented in the UFSAR.

3. MAIN STEAMLINE BREAK (MSLB) MASS AND ENERGY RELEASE Deletion of the steam / feedwater flow mismatch reactor trip does not affect either the inside or outside containment MSLB mass and energy release, or the calculations for the steam mass release used as input to the radiological dose evaluation. For this event, High Containment Pressure initiates safety injection and the safety injection signal produces a reactor trip signal.

The steam / feedwater flow reactor trip function is not credited for this event. Deleting the reactor trip does not affect the normal plant operating parameters, input assumptions including accident mitigation capabilities, results, parameters or conclusions of the MSLB mass and energy release analyses and calculations. Therefore, the conclusions presented in the UFSAR remain valid with respect to MSLB mass and energy release rates and steam mass release calculations.

4. STEAM GENERATOR TUBE RUPTURE (SGTR) EVALUATION The deletion of the steam / feedwater flow mismatch reactor trip does not affect the SGTR analysis methodology or assumptions. For this event, Low Pressurizer Pressure initiates safety injection and the safety injection signal produces a reactor trip signal. The steam / feedwater flow reactor trip function is not credited for this event. Deleting the reactor trip does not alter the current SGTR event analysis results. Thus, the conclusions presented in the UFSAR remain valid with respect to the SGTR event.

3.5 SAFETY ANALYSIS EVALUATION The Turkey Point Units 3 and 4 UFSAR Chapter 14 analyses were reviewed. No events in the Turkey Point Units 3 and 4 UFSAR Chapter 14 credit the steam /feedwater flow mismatch reactor trip function. Since this reactor trip function is not explicitly assumed in any accident analysis, elimination of this trip will not affect any analysis results.

As discussed in UFSAR Chapter 7 and as evidenced by not having been credited in UFSAR Chapter 14, the sole purpose for the steam / feedwater flow mismatch reactor trip was to address the potential for an adverse control / protection system interaction.

WNA-LI-00038-FPL-NP, Rev. I 3-11

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam I Feedwater Flow Mismatch Reactor Trip The addition of the SG Level median signal selector for the feedwater control eliminates the need for the steam / feedwater flow mismatch reactor trip function. This change prevents the potential for an adverse control / protection system interaction involving the SG level signals.

(Last Page of Section 3)

WNA-LI-00038-FPL-NP, Rev. I 3-12

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 &4 Steam / Feedwater Flow Mismatch Reactor Trip SECTION 4 MEDIAN SIGNAL SELECTION FUNCTION CONSIDERATIONS 4.0 OVERVIEW To support the elimination of the adverse control / protection interaction between the main feedwater control system and the low-low SG water level reactor trip, various aspects of the MSS function are addressed by this report. These aspects which are covered in the sections that follow include:

Application Considerations:

1. A demonstration of the functional adequacy of the MSS in preventing the adverse control and protection system interaction mechanism. This discussion also includes the functional response of the MSS function to a given failure mechanism and configuration certification.

Platform Considerations:

1. A discussion of quality and reliability showing that the function is implemented to support a low failure probability including the use of components with low failure rates. The discussion addresses the design and implementation process and operating experience.

2. A discussion regarding potential failure modes that may impact the MSS function including power supply failure, component failure, and communication device failure.

3. Requirements regarding function reliability such as MSS failure detection, indication, and test capabilities.

4. A discussion of the Median Signal Selector function's ability to withstand faults originating in the control system that could also affect a protection channel.

WNA-LI-00038-FPL-NP, Rev. 1 4-1

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam I Feedwater Flow Mismatch Reactor Trip 4.1 APPLICATION CONSIDERATIONS 4.1.1 Median Signal Selection Functional Design & Certification 4.1.1.1 Operational Description The MSS receives three isolated narrow range level input signals designated as A, B, and C for each steam generator. The algorithms are configured to select the high value between A and B, B and C, and C and A which are then designated as D, E, and F. Next, the low value between D and E is selected and designated as G. Finally, the low value between G and F is selected. This output value is the median of the three input signals. For example, suppose that A, B, and C are signals representing 30%, 40%, and 50% of steam generator level. After the [

Iac.e.f. This signal representing 40% level is now forwarded to the algorithms for feedwater control. Thus, the MSS will always select the median of three input signals, [

]axc 4.1.1.2 Functional Fault Tolerance and Alarming acef WNA-LI-00038-FPL-NP, Rev. I 4-2

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam / Feedwater Flow Mismatch Reactor Trip a,c,e,f 4.1.1.3 Configuration Certification In order to enhance the reliability of the MSS, a formal activity known as Configuration Certification is undertaken as input to FPL's verification and validation testing to minimize design errors and provide overall assurance that the specified functional requirements are implemented in the hardware and software as a system.

Configuration Certification is accomplished via: a,c 4.2 PLATFORM CONSIDERATIONS Information within this section dealing with platform considerations is incorporated as per Reference 15.

4.2.1 Median Signal Selection Quality and Reliability Since the median signal selector function is integral to the basis for steam flow/feedwater flow trip elimination, continued ability of the function to serve in this role is contingent on its ability to select the median signal. Therefore, steps have been taken to ensure the reliability of the signal selection function. Further, the design provides the capability for complete unit testing that provides unambiguous determination of credible system failures.

For the purpose of increased availability, each system includes several levels of redundancy and fault tolerant features. Power supplies are redundant, powering both the Control Processors and I/O Modules. The bus between the Control Processor and the I/O Modules is redundant. The Control Processors are used in Fault-Tolerant pairs, which seamlessly and bumplessly transfer WNA-LI-00038-FPL-NP, Rev. I 4-3

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam / Feedwater Flow Mismatch Reactor Trip control to one of the pair, should the other of the pair fail. Redundant 1/0 modules are used to provide redundant output capability to the final control elements.

4.2.2 Median Signal Selection Failure Considerations 4.2.2.1 Consequences of Failures The consequences of a failure are minimized by utilizing redundancy in key areas and by predetermining the desired state of device outputs and control actions for credible failures. Specific actions have been taken to minimize the consequences of a failure as follows:

1. Each steam generator level controller with its associated 1/0 modules and power supplies is physically and functionally independent from the others.

2. Redundancy is inherent in the system with fault tolerant control processor pairs and redundant field communications to 1/0 Modules. Failures of any of these redundant components are identified by the system monitor and are alarmed.

3. When multiple measurements of the same plant parameter are available, they are input to the system on individual 1/0 Modules with software algorithms combining the signals.

Failure of an input channel on one 1/0 Module is accommodated by replacement of the faulted module with no effect on the algorithm's output.

These design features provide further assurance that a component failure will not cause a control system upset. Credible failures of components will not defeat the control and protection system independence provided by the MSS function.

4.2.2.2 Duration of Failures The duration of a failure is minimized by the ability to diagnose and repair the system easily and quickly. For example,

a. In the event of a processor failure, the backup processor takes over control and becomes the primary controller, and an alarm is generated to the system monitor. This transfer of control is seamless and bumpless. The control function is unaffected. The transfer is accomplished automatically within two processing cycles, typically less than one second.

WNA-LI-00038-FPL-NP, Rev. I 4-4

Florida Power &Light Licensing Input for Deletion of Turkey Point Units 3 &4 Steam / Feedwater Flow Mismatch Reactor Trip

b. The repair methodology is to replace the failed processor. This is as simple as removing the failed processor and replacing it with a spare. This processor automatically re-boots upon power-up, and becomes the backup processor after passing the boot-up diagnostics and re-marrying (synchronization with the primary controller) routines. This reestablishment of the fault-tolerant pair is seamless and bumpless. The control function is unaffected throughout the initial failure, replacement of the faulted module, and restoration of service.

Time to repair faulted components is not a significant consideration in overall system performance because of the high reliability of the redundant components and FPL's normal maintenance practices.

The MSS to be installed at Turkey Point is designed to allow for easy detection of system failures through both self diagnostics and periodic test. These methods for failure detection are discussed below.

4.2.2.3 Diagnostics Self-diagnostics are automatically executed during the normal operation of the system and do not disrupt the real time performance of the process.

a. The system monitor constantly monitors the health and communication among and between Processors and their respective 1/0 modules. A system alarm is generated should a module fail, a processor fail, any 1/0 bus fail, or a power supply fail.

b. Deviations between redundant inputs are detected and alarmed. Redundant sensor algorithms are used to validate important inputs to the control system.

4.2.2.4 Test Capability The MSS has been provided with the capability for on-line testing. Signal selector testing consists of [ Iac the three steam generator level input signals and [

1axc will permit determination of whether or not the actual median signal is being chosen, and, consequently, whether the signal selector is functioning properly.

The MSS can be tested concurrently with the protection system instrument channels which provide its inputs. When the individual instrument channels are placed in the test mode, test signals are WNA-LI-00038-FPL-NP, Rev. I 4-5

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam / Feedwater Flow Mismatch Reactor Trip received from the protection system, in the same manner as a normal process signal. This configuration ensures that the entire signal path to the signal selector is tested. As the test signal magnitude is varied, that instrument channel which represents the median signal will also be altered allowing the technician to ensure that an improper signal is not passed through the MSS.

4.2.3 Independence of Safety-Related and Nonsafety-Related Inputs to the Median Signal Selection Function The (existing) 7100 Hagan racks will provide isolated SG level signals to the MSS function.

Qualified isolation devices are utilized to prevent a fault in the nonsafety-related feedwater control system from propagating to the safety-related reactor protection system.

(Last Page of Section 4)

WNA-LI-00038-FPL-NP, Rev. I 4-6

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 &4 Steam / Feedwater Flow Mismatch Reactor Trip SECTION 5 WESTINGHOUSE NUCLEAR SAFETY ADVISORY LETTER, NSAL-96-004, CONTROL AND PROTECTION INTERACTION Westinghouse Nuclear Safety Advisory Letter, NSAL-96-004, Control and Protection Interaction, identified an issue applicable to plants with three narrow range steam generator water level channels that have removed the low feedwater flow trip function on the basis that a median signal selector (MSS) on the level control signal input precluded the need for this protection for a control/

protection interaction scenario. The letter identified the potential for the failure of a common tap for steam flow and narrow range steam generator level for which could cause an adverse control and protection interaction. If the shared tap or impulse line were to sever, a low steam flow signal would begin to close the feedwater control valve and the level channel would fail high. Since only three SG level channels are provided, the second postulated failure of a level channel would not satisfy the Low - Low SG Level trip logic.

This issue does not apply to Turkey Point Units 3 and 4, since the steam generator water level and steam flow taps are independent of each other, such that, failure of a steam flow tap does not affect the availability of the Low - Low SG Level reactor trip, even considering a second failure of one SG level channel (Reference 16).

(Last Page of Section 5)

WNA-LI-00038-FPL-NP, Rev. I 5-1

Florida Power & Light Licensing Input for Deletion of Turkey Point Units 3 & 4 Steam / Feedwater Flow Mismatch Reactor Trip SECTION 6 CONCLUSION Based on the information provided above, it is concluded that the proposed deletion of the steam /

feedwater flow mismatch reactor trip function at Turkey Point Units 3 and 4 is acceptable once the median signal selection function is installed into the main feedwater control system. No UFSAR Chapter 14 events explicitly credit the steam / feedwater flow mismatch reactor trip function. The adverse control / protection system interaction between the main feedwater control system and the low-low SG level reactor trip function is eliminated through the use of the median signal selection function in the main feedwater control system. Therefore, the steam / feedwater flow mismatch reactor trip function is no longer required and can be eliminated.

A review was performed in accordance with IOCFR50.92, to determine if the proposed changes to the Turkey Point Units 3 and 4 Technical Specifications involve a significant hazards consideration.

Based on the review it has been determined that the proposed elimination of the steam / feedwater flow mismatch reactor trip does not (1) significantly increase the probability or consequences of an accident previously evaluated, (2) does not create the possibility of a new or different kind of accident than any accident already evaluated and (3) does not involve a significant reduction in a margin of safety; and therefore does not involve a significant hazards consideration.

(Last Page of Section 6)

WNA-LI-00038-FPL-NP, Rev. 1 6-1