ML101180249

2009 10CFR50.59 Summary Report

ML101180249
Person / Time
Site:	Catawba
Issue date:	04/22/2010
From:	Morris J Duke Energy Carolinas
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
Download: ML101180249 (13)

Text

Ph Duke JAMES R. MORRIS, VICE PRESIDENT ErEnergy Duke Energy Carolinas,LLC Carolinas Catawba Nuclear Station / CN01 VP 4800 Concord Road York, SC 29745 803-831-4251 803-831-3221 fax April 22, 2010 U. S. Nuclear Regulatory Commission Attn.: Document Control Desk Washington, DC 20555-0001

Subject:

Duke Energy Carolinas, LLC (Duke)

Catawba Nuclear Station, Units 1 and 2 Docket Nos. 50-413, 50-414 2009 10CFR50.59 Summary Report Attached please find a report containing a brief description of changes, tests, and experiments, including a summary of the safety evaluation for each, for Catawba Nuclear Station, Units 1 and 2 for year 2009. This report is submitted pursuant, the provisions of 10CFR50.59 (d) (2) and 10CFR50.4.

If there are any questions regarding this report, please contact T. K. Pasour at (803) 701-3566.

Sincerely, James R. Morris Attachment Lj-7Ec17 www. duke-energy.com

U. S. Nuclear Regulatory Commission April 22, 2010 Page 2 xc (with attachment)

L. A. Reyes Regional Administrator U. S. Nuclear Regulatory Commission - Region II Marquis One Tower 245 Peachtree Center Ave., NE Suite 1200 Atlanta, GA 30303-1257 J. H. Thompson (addressee only)

NRC Project Manager U. S. Nuclear Regulatory Commission Mail Stop 8-G9A 11555 Rockville Pike Rockville, MD 20852-2738 G. A. Hutto, III NRC Resident Inspector Catawba Nuclear Station

Attachment 2009 10CFR50.59 Summary Report

A/R Number: 00263762 Facility: CATAWBA NUCLEAR STATION Unit(s): 1&2 Activity

Title:

C2C17 Reload Core Design Summary This activity installs the core designed for Catawba Nuclear Station Unit 2 Cycle 17 (C2C17). The C2C17 Reload Design Safety Analysis Review (REDSAR), performed in accordance with Engineering Directives Manual EDM-501, "Engineering Change Program for Nuclear Fuel," and the C2C17 Reload Safety Evaluation confirm the UFSAR accident analyses remain bounding with respect to predicted C2Cl7 safety analysis physics parameters (SAPP), and fuel thermal and mechanical performance limits. The SAPP method is described in topical report DPC-NE- 3001-PA, "Multidimensional Reactor Transients and Safety Analysis Physics Parameters Methodology."

The C2C17 core reload is similar to past cycle core designs, with a design generated using approved methods. The C2C17 Core Operating Limits Report (COLR) was prepared in accordance with Technical Specification 5.6.5. Additionally, applicable Technical Specifications and the UFSAR have been reviewed and no changes are required for the operation of C2C17. This 10CFR50.59 evaluation concluded that no prior NRC approval is necessary for C2C17 operation.

SDQA Category E - Information Use Only Page I of I

A/R Number: 00272597 Facility: CATAWBA NUCLEAR STATION Unit(s): 1 &2 Activity

Title:

DPC-NE-3002-A, Revision 4a, Methodology Report Revision The purpose of this 50.59 Evaluation is to update methodology report, DPC-NE-3002-A, UFSAR Chapter 15 System Transient Analysis Methodology. Section 5.4 of DPC-NE-3002-A is the single rod withdrawal accident (UFSAR Section 15.4.3.d). The pressurizer level initial condition in Section 5.4.2 of DPC-NE-3002-A is in error as verified in the analyses of record (AOR). The conservative assumption is low initial pressurizer level and the text is changed to reflect this. Additionally, the pressurizer pressure control boundary condition in Section 5.4.4 of DPC-NE-3002-A states that pressurizer spray enabled and pressurizer power operated relief valves (PORVs) disabled is conservative. The AOR all perform sensitivities on spray and PORVs and come to different conclusions as to which combination is conservative. Examining the respective UFSARs, it is noted that the UFSARs state that a sensitivity study is performed, which is consistent with the AOR. To be consistent with the UFSAR, DPC-NE-3002-A is changed to make it clear that a sensitivity study is performed to determine the most conservative combination.

Since this evaluation is the result of an affirmative answer to screen question in #3 (Evaluation Methodology), only evaluation question #8 is addressed in this evaluation per Section 4.2.1.3 of NEI 96-07, Revision 1.

The purpose of this 50.59 Evaluation is to update the methodology report DPC-NE-3002-A. This involved revising or replacing an evaluation methodology described in the UFSAR that is used in establishing the design basis or used in the safety analysis.

However, per NEI 96-07 Section 4.3.8, changes are not considered departures from a method of evaluation described in the UFSAR for a methodology revision that is documented as providing results that are essentially the same as, or more conservative than as defined by NEI 96-07, either the previous revision of the same methodology or another methodology previously accepted by NRC through issuance of an SER. DPC-NE-3002-A provides the NRC approved methodology for the single rod withdrawal accident (as well as other accidents) through issuance of' an SER. By changing the assumed initial pressurizer level from a high value to a low value, a conservative system response is obtained for the UFSAR 15.4.3.d analysis. Also, stipulating that a sensitivity study is performed on the pressurizer spray and PORVs assumption ensures that a conservative system response is obtained for the UFSAR 15.4.3.d analysis. Thus, both changes to the methodology report were specifically made to ensure more conservative results. Consequently, this activity does not result in a departure from a method of evaluation described in the UFSAR used in establishing the design basis or in the safety analysis.

SDQA Category E - Information Use Only Page 1 of 1

A/R Number: 00290997 Facility: CATAWBA NUCLEAR STATION Unit(s): 1 Activity

Title:

EC78871 Revision 6 - 7300 Process Control System Replacement Sum11mary ~

Revision 0 to EC78871 contained UFSAR changes reflecting the many changes to the control systems located in Chapter 7 of the UFSAR. The subsequent revisions (1-5) to EC78871 did not include any additional UFSAR changes and also did not require revision of the 50.59.

Revision 6 to this EC contains an additional USFAR change to section 7.7.1.3.3 concerning the Control Bank Rod Insertion Monitoring System. It is being changed to utilize 2 nd Highest Tavg and 2 nd Highest delta T versus the current Auctioneered Hi values for both. UFSAR 15.4.6 "Boron Dilution Accident" (in Mode 1 with BDMS Inoperable) takes credit for the Rod Insertion Limit alarms (low and low-low settings) to initiate manual operator action to mitigate the event terminating the dilution and initiating reboration. This change involves an alarm which is credited in Chapter 15 to initiate manual Operator Action to mitigate an Accident. As such, this qualifies as a UFSAR Design Function, unlike the other control system changes which primarily have the potential to initiate a transientlaccident.

Additionally, this monitor is credited in the Tech Specs for Control Bank insertion limits to perform the surveillance, if OPERABLE, permitting a 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> frequency versus 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> if performed manually. Due to the significance of verifying initial conditions of safety analyses as described in the BASES to the Tech Specs combined with the alarm being referenced in Chapter 15.4.6, a revision of this 50.59 evaluation is performed for revision 6 of these ECs.

Additionally, some changes were made to this evaluation to address concerns regarding Software Hazards and the potential for Software Common Cause failures as addressed in NEI 01-01 . The conclusions of the 50.59 are unchanged.

The control (non-safety related) portion of the 7300 Process Instrumentation and Control System will be replaced with a modern Distributed Control System (DCS). The new DCS will be capable of performing the same control/monitoring functions as the existing system as well as providing the more advanced functions commonly found in modern DCSs, such as graphical displays, trending, logging, soft controls, more complex control algorithms, control algorithm detuning, automatic signal selection of process variables (e.g., median select), and diagnostic capability for field devices via digital communications.

The DCS basically consists of the following items:

" Redundant controllers and associated I/O to perform control logic.

" Network to allow communication between the controllers and other devices.

" Human Machine Interface (HMI) to the DCS, which includes three Operator Workstations and one Engineering Workstation.

Control Loop Modifications and Supporting Instrumentation Modifications SIG Level Control Following instrumentation changes will be necessary for implementation of the new control algorithm:

" The RTD for loops 1(2) CFRD5470 (S/G D Feedwater inlet temperature) will be brought into the DCS. This Will provide better RTD temperature characterization than is presently available with the current instrumentation. Currently this RTD is connected to a temperature transmitter (1 CFTT5470) in the 1IC21 cabinet and the transmitter provides input to a computer point C1A0165. Temperature transmitter 1CFTT5470 will be deleted and a cable from 1 IC21 to Process control cabinet 7 will be utilize to bring the RTD signal to DCS and then the DCS will provide hardwire output to existing computer point C1A0165.

" Provide the DCS with access to the additional S/G Narrow Range Level signal from the Protection Cabinets.

SDQA Category E - Information Use Only Page 1 of 7

Feedwater ControlValve (FCV) Positioners Originally the Main Feedwater ControlValve (MFCV) and Bypass Feedwater Control Valve (BFCV) positioners were to be replaced Fisher DVC-6000 series positioners. And for MFCV redundancy, additional alternate Fisher DVC-6000 series positioners were to be installed with a selector solenoid for selecting between the outputs of the two redundant positioners. Due to discovery of the industry OE on some failure issues associated with DVC-6000 valve position feedback device (XACT), this portion of the design change has been canceled and will not be implemented. CNS is working with the vendor to find a suitable solution to this problem so that in future this design change would be possible CondenserDump Valve Controls Control logic in "Steam Press" mode of operation for all three banks of the condenser dump valves will be changed from proportional only (P) to proportional plus integral (PI).

For both "Steam Press" and 'T-AVG" modes, the control logic will be modified to allow sequential operation of the valves within the first three banks. This will allow finer control over the steam dump process. The actual control logic, including setpoints, ranges, etc., will be determined during the design phase.

It should be noted that the M/A station for steam dump control will not have direct control over any condenser dump valve. As with other control loops, "automatic" mode will allow the DCS to determine the setpoint either through algorithmic logic or through soft controls, and "remote manual" mode will allow the M/A station to determine setpoint. However, "local manual" mode, which usually sends an output signal straight to the final control device, will perform no function, since there are potentially nine final control elements (nine condenser dump valves).

Steam GeneratorHeader Pressure When the condenser dump valves are operating in "Steam Pressure" mode, the primary control action will be based on the second highest of the median selected pressure of the four S/G loops.

A single field transmitter (1(2)SMPT5200, S/G header pressure) will be utilized as a backup in the event where two or more of the median pressures are bad. This design method for handling instrument failures is preferred over adding triple redundant pressure transmitters for steam generator header pressure due to cost factors.

Boric Acid Blender Control Flow instrumentation will be added to monitor and control Reactor Makeup Water flow to the Boric Acid Blender. Logic will be added to the DCS to sum the total flow into the blender (from BAT and RMWST) and compare to the flow out of the blender. Any non-zero value, taking into account instrument uncertainties and margins, will be indicative of an instrument failure and will be alarmed.

Pump Start/Stop contact from the pump motor contactors for Boric Acid Transfer and Reactor Makeup Water pumps will also be provided as digital inputs to the DCS. The control board total make-up and boric acid batch counters and totalizers are obsolete and will be removed and replaced with digital Red Lion counter/totalizer (Model#C48C ) counters. The functionality of the totalizer will also be available on the DCS HMI graphic.

PressurizerLevel Control Pressurizer level controls will remain the same except for the deletion of the hard Master M/A station (1(2) NCSS5161). Its functionality will be duplicated in soft controls to eliminate a single point of failure. Pressurizer level will be controlled based on the Median selected value.

Pressurizer Pressure Control The Pressurizer pressure controls will remain the same except for the deletion of the hard Master M/A station (1(2) NCSS5160). Its functionality will be duplicated in soft controls to eliminate a single point of failure. Pressurizer pressure will be controlled based on the 2nd highest value of the 4 channels.

SDQA Category E - Information Use Only Page 2 of 7

Turbine Impulse Pressure Currently two channels of turbine impulse pressure signals are provided for control logic of 7300 control system from the protection cabinets. A third transmitter to measure turbine impulse pressure will be installed and input to the DCS. This/will allow for a median select vs. the current control scheme where one turbine impulse pressure channel provides an interlock and the other channel is used for control. The electronics for the additional transmitter will be non-safety related.

The new transmitter will tap into the existing instrument tubing utilized for 1(2)SMPT5400.

Additionally, two output signals of turbine impulse pressure'will be wired to the terminals on the PCS cabinets for future use by the Main Turbine Control System.

Letdown Heat Exchanger Outlet Temperature Letdown heat exchanger Outlet Temperature (loop NVLP5590) which controls KC -132 was evaluated based on the Use of a single RTD being used for control. It was decided based on cost and the recommendation of the vendor not to add additional RTDs. The vendor recommended using the capabilities of the system to monitor the "quality" of the single RTD input and if bad quality was detected, reject the loop to Manual and provide an alarm for the Operator.

ChargingFlow and Letdown Isolation Two additional transmitters will be added to measure charging flow. They will tap into the instrument tubing for the existing charging flow transmitter. The Charging flow control and existing control board indicator for charging flow will be modified to receive a median selected charging flow value.

NOTE: The two additional charging flow transmitters will be installed and the associated new cables will be pulled per design change CD100962/CD200969during 1EOC17/2EOC16, but the new cables will not be terminated in the PCS cabinet. Therefore the new charging flow transmitters will not actually be used in the control logic until DCS design change EC78871 (CD100607)/CD200608 terminates the associated cables in the PCS cabinet during 1 EOC18/2EOC17.

Volume Control Tank Level Control The volume control tank level control scheme utilizes a primary level control loop and a backup control loop. The primary control loop implements a continuous control scheme and drives the control valve used to divert letdown flow to the Recycle Holdup Tank (RHT) as needed to maintain level. The backup control scheme provides alarms and repositions a solenoid valve to vent air from the same control valve, thus forcing all letdown flow to RHT. There is no continuous control on the backup control loop, only on/off (full divert or no divert).

The new control algorithm will allow both functions to be performed by either the primary or the backup if a failure of a single loop occurs.

Letdown Flow Control Controls for the variable flow letdown orifice 1(2)NV849 will be incorporated into the DCS. This will require the replacement of the existing manual loader 1(2)NVML8490 on 1(2)MC10 with a Westinghouse SLIM M/A station.(new tag no. 1(2)NVSS8490). A new cable will be required from process control cabinet 6 to 1(2)TBOX0146 to connect to the existing cable that goes to 1(2)NVPE8490. Letdown flow is presently monitored by 1(2)NVFT5530, which feeds the 7300.

NC Pump Seal Injection Flow (CharginqLine Backpressure Control)

The controls for 1(2)NV309 (Seal Injection Back Pressure Flow Control) will be added to the DCS.

This will require cable pulls from the existing control cabinet located in the Unit 1 Electrical Penetrationroom # 564 on elevation 594 to one or more PCS cabinets (to e determined during the detailed design phase). The existing 7300 style racks installed in these cabinets will be removed and the cabinet will be used as junction cabinet. Outage issues will need to be addressed since controls for Unit 1 & 2 are in the same cabinet.

SDQA Category E - Information Use Only Page 3 of 7

T-avg Coastdown Logic will be added to automate changes required for "T-Avg" coast down. This will allow Maintenance or Operations to adjust the full power T-Ref through the operator console. Limits to allowed adjustments will be internally set in the DCS. Reset capability is provided to return T-Ref back to its original value at end of the shutdown. T-avg coast down capability will be implemented on both Units even though currently it is used only on Unit 1.

50.59 Author Note: This functionality is being replicated into the new DCS but has been previously evaluated when procedure OP/1/AI6100/003 was revised to allow for T-avg Coastdown. There is no change to the operation of the Unit involved in this change.

Use of "Live" Instrument Loops For the purposes of this document, a "live" instrument loop is defined as one where the 4-20 mA signal that the field transmitter produces is used to directly drive a control board indicator or SLIM M/A station process variable display, without any intervening devices. Very few existing 7300 loops are "live". Most read in the 4-20 mA signal from the field transmitter, perform various signal processing, then output a 0-10 VDC signal to the control board indicator. This configuration results in a loss of control board indication if the 7300 (or DCS) is lost. However, with a "live" instrument loop, because the control board indicator or SLIM M/A station process variable display depends only on the field transmitter and associated DC power supply, the availability of the 7300 (or DCS) will not affect the control board indicator.

The new DCS has various failure modes which may result in loss of functionality of the DCS without causing an immediate unit trip. Under these conditions, it may be possible to continue to operate the plant for a specified length through use of the M/A stations and a subset of control room indicators displaying plant process variables. The M/A stations, through the use of the RLI interface modules, will be almost completely independent of the DCS.

FeedwaterPump Turbine Speed Control The GE MK VI feedwater pump turbine speed control is designed to receive 3 speed demand signals, but currently it only receives a single speed demand signal from the Digital Feedwater Control System (DFCS) and other two speed demand inputs are disabled. The new DCS will provide 3 speed demand signals to the feedwater pump turbine speed control system (GE MK VI) for increased reliability. The GE MK VI will use the median selected value for speed demand.

Enabling of 2 additional speed demand input requires a software logic change to the current GE MK VI feedwater turbine speed control, which will be made per EC78871 (CD100607)/CD200608.

Spare conductors of cables 1 1WE580 and 581 may be used for these inputs.

Also the GE Mk VI control workstations local to the feedwater pumps will be added to the KVM network to be installed for the DCS. This will allow, through the use of KVM switching, any workstation which is properly configured to access the control workstations.

QA Requirements The Process Control System is not QA 1, nuclear-safety related. The cabinets are QA 4 and are seismically mounted to the control room floor. The cabinet structure must not adversely affect any nearby safety-related equipment during a seismic event. The new DCS will also serve no nuclear-safety related function. This includes all aspects of the DCS, from controllers and I/O to network devices. The M/A Stations that will be mounted on the main control boards will be QA 4 and must be seismically mounted on the board.

Several of the instrument loops that pass through the existing 7300 cabinets, and therefore the new DCS are Reg. Guide 1.97 variables. However, the DCS will continue to meet those requirements.

The piping that the new Reactor Makeup water flow instrumentation will be installed in is QA 2 (class E),

but since this piping section is adjacent to class B piping (QA-1), a QA-1 seismic support calculation for the entire section is required. Electrical portion of this instrumentation does not serve a safety-related function and is, therefore, non-1 E.

Protection cabinets are considered QA 1, nuclear-safety related. As described above, this design change will be doing some wiring change in the protection cabinets 3 and 4 to bring over SG NR Level signals to SDQA Category E - Information Use Only Page 4 of 7

control cabinets.

Main control board is considered QA 1, nuclear-safety related. As described above, this design change will be replacing the M/A station (which includes making the control board cutouts wider for the new SLIM station) and also will be replacing the Boric acid and Reactor makeup water counter/totalizer.

In conclusion, the majority of the work as described above will be non-QA, but due to work in the protection cabinets and main control board this design change will be considered QA-1.

EC78871 revision 6 includes a UFSAR change to section 7.7.1.3.3 that replaces Auct Hi Tavg and Auct Hi Delta T with 2 d Highest values of both for the Control Bank Rod Insertion Monitoring System. The Rod Insertion Limits are calculated by the OAC with inputs from the 7300 Process Control System. This function will continue to be performed at the existing limits. This change has been evaluated as insignificant. The Rod Insertion Limits are calculated by the OAC with inputs from the 7300 Process Control System. This change is deemed an inputs change to an existing USFAR method. No safety analyses were necessary to be re-run in order to determine this change is insignificant.

Westinghouse performed a Software Hazards Analysis of the NSSS Controls identified in reference 51. The Ovation Platform and DCS specific applications have been designed, tested and controlled using established practices and methods for Software development. These provide reasonable assurance that the likelihood of failure due to software failure is sufficiently low. The software is not safety related and does not contribute to the mitigation of plant accidents.

It is not in the scope of 10CFR50 Appendix B. Instead, the analysis of software hazards performed here is focused on the prevention of the initiation of postulated events and that there are no new events not enveloped by the Safety Analyses.

Control Systems Impacted are:

" S/G level control capability via CF valve positions (DFCS related)

• Feedwater Pump Turbine Speed Demand input (DFCS related)

• Steam Dump Capability for all modes of operation - Plant Trip, Load Rejection, and Steam Pressure Mode of operation

• Reactor Control (Rod Control)

• Pressurizer Pressure

• Pressurizer Level

• Letdown Flow Control

• NCP Seal Injection Flow/Back Pressure Control

• Reactor Make-up Water Flow Control to Blender

• Letdown HX Outlet Temperature Control

• Volume Control Tank Level

• Charging Flow Control Field Sensor Changes are identified in the Scope Description but are captured here for reference. These are the only changes to sensor interface with the new DCS.

1. A 3 rd Channel of Turbine Impulse Pressure is being brought into the DCS to improve Steam Dump and Reactor (Rod) Control

2. Two additional Channels for Charging Flow are being added in the Chemical and Volume Control (NV)

System

3. A 4th Channel of NR S/G Level is being interfaced with the DCS for improved S/G Level Control

4. A 4 th Channel of Main Feedwater (CF) is being interfaced with the DCS for improved S/G Level Control

5. A Pump Start/Stop contact from the Boric Acid Transfer and Reactor Make-up Water pumps and provided as digital inputs to the DCS

6. Flow Instrumentation will be added to monitor and control Reactor Make-up Water flow to the Boric Acid Blender and be interfaced with the DCS for control

7. Two additional Feedwater Pump Speed Demand signals will be provided to the DCS resulting in three signal which will be median selected for improved reliability The current UFSAR analyses consider control system failures as potential event initiators. For example, most ANS Condition II events (incidents of moderate frequency) can be initiated by a single control system error, as well as due to operator errors and mechanical system failures, etc.

The replacement control system has been engineered to minimize the risk of controls-protection interactions in which a single control system error or failure can result in initiating a transient or an accident. In accordance with the licensing, basis for CNS, the DCS controls are separated and isolated from the protection system in accordance with IEEE Standard 279-1971.

Vulnerability to a single control system error has been minimized by the use of 2nd min/max and median-selected SDQA Category E - Information Use Only Page 5 of 7

inputs, redundant processors and power supplies. A failure modes and effects analysis (FMEA) performed by the vendor was determined to be acceptable. On the basis of these observations, it is concluded that there is no expected increase in the likelihood of a control system error or failure resulting in the initiation of a plant transient or accident.

The control board human-machine interface (HMI) has been significantly improved by the features of the proposed modification, by use of soft controls and distinctive audible alarms, and by eliminating unnecessary selector switches, manual/auto stations, and chart recorders. The risk of operator errors causing an event has been minimized in the DCS design by following the current human factors engineering standards and regulatory guidance in development of the work station screens and displays. The conclusions of the control room design review were reviewed and evaluated to remain valid following installation of the modification. On the basis of these evaluations, it is concluded that there is no expected increase in the likelihood of an operator error initiating an accident or transient. The Ovation DCS hardware is significantly more reliable and fault tolerant than the W7300 analog system it replaces. Moreover, design features are introduced to reduce the frequency of occurrence of certain events, by the use of self-diagnostic software, and the substitution of automatic median select functions instead of manual channel selector switches.

Taken together, the proposed modification is expected to yield a decrease in the frequency of transients and moderate-frequency events previously analyzed in the UFSAR. The modifications have no effect on the frequency of ANS Condition III or IV events, because the control system is not considered an initiator for any Condition Ill or IV events.

Design Functions for transient initiation have been considered, unique digital issues and the potential for adverse affects on QA-1 functions. Proper consideration to each has been made such that the claim can be made that the probability of a malfunction of an SSC ITS, evaluated in the UFSAR has not increased.

The claim is made that the likelihood of software failures is sufficiently low, such that they are less likely than existing failures considered in the UFSAR. The functioning of non-safety Control Systems, including failures, is already considered in Chapter 15. These assumptions form the basis for the initial conditions assumed to exist at the onset and during an Accident Analysis. These assumptions regarding non-safety controls generally worsen the results of a particular parameter when comparison to a limit is required. For example, since a late reactor trip generally reduces the margin to the acceptance criteria in any transient, the effect of properly functioning pressurizer pressure control in delaying reactor trip is considered for those transients where it could occur.

More discussion on this topic is contained in Section 7.0 of this document: "Chapter 15.0 Accident Analysis - Initial Conditions and Assumptions Regarding Non-Safety Control Systems".

The SHA combined with all the other aspects of the design highlighted in section 11.0 including:

" Human Factors Engineering review

" Electromagnetic Interference Compatibility

• Software Cyber Security Controls

• Software Configuration Controls

• Software Verification & Validation

.... provides a basis to claim the existing UFSAR analyses remain bounding and that no combination of control system malfunctions warrants any additional UFSAR Chapter 15 analysis.

There are no functional changes any accident mitigation systems. Specifically, the design bases, design features and specifications for all accident mitigation Systems remains unaffected following this modification. There are some interfaces with safety related signals involved with this modification where inputs are needed from protection circuits for use in non-safety control circuits. An example would be Narrow Range S/G level: this is a QA-1 parameter used in ESFAS for Auxiliary Feedwater Actuation, which is a Tech Spec parameter. NR S/G level is also used as an input to the non-safety related Digital Feedwater Control System. Where these occur, safety to non-safety isolation is being provided with appropriate isolation devices assuring no adverse affect on these safety related systems.

There is nothing that can occur as a result of this modification that is not already bounded and could not be remedied by existing safety related systems and within assumptions currently documented in the UFSAR. The main systems that are relevant in making this claim are:

1. Auxiliary Feedwater

2. RPS

3. ESFAS

4. Steam Generator PORV and Safety Valves

5. Nuclear Service Water

6. Component Cooling SDQA Category E - Information Use Only Page 6 of 7

7. ND-ECCS portion

8. NV-ECCS portion

9. NI-ECCS portion 10, NC PORVs and Safety Valves 11, D/Gs and Associated Essential Switchgear None of these systems are degraded by this modification.

The accident mitigation functions of the plant remain unchanged. The DCS is not credited in any QA-1 functions in any of the above Systems. No safety analysis assumptions are affected. Since the modified design will still be safety related and single failure proof, the response to any accidents will be unaffected. No fission product barriers are affected. No initial conditions of any UFSAR evaluated accidents are impacted. Thus, the consequences of accidents previously evaluated in the UFSAR are not increased.

Since no new malfunctions are introduced, there is no increase in the consequences of a malfunction of an SSC important to safety previously evaluated in the UFSAR.

The proposed modifications do not introduce the possibility of a new accident of a different type than previously analyzed, because the systems being modified have all been evaluated for transients resulting from control system malfunctions. These analyses remain valid for the modified system. Therefore, the activity has no potential for creating an accident of a different type than evaluated in the UFSAR.

This modification does not result in an initiator or failure whose effects are not bounded by those already evaluated in the UFSAR. All of the performance capabilities of the accident mitigation systems in the plant remain unchanged. No safety analysis results are affected. Since the Protection System will still be safety related and single failure proof, the response to any accidents will be unaffected. Since the effects of any single failure of redundant safety related (QA-1)

SSCs remain bounded by existing analyses, no malfunctions with a different result are created.

No change to the response of any accident mitigation system will result from this modification. Thus, no additional challenges will be made to any DBLFPBs as a result of the changes from this modification. The accident analysis results for all UFSAR Chapter 6 and 15 analyses will remain unchanged following this modification. Therefore, no design basis limits for a fission product barrier described in the UFSAR are being degraded or altered.

No methods of evaluation are affected in any way. No analyses used in verifying or validating the performance of any SSC to perform UFSAR Design Functions were used in support of this modification.

EC78871 rev 6 (CD100607) & EC78914 (CD200608) can be installed without prior NRC approval. No Tech Spec or SLC changes are required. UFSAR changes will be required to describe the new capabilities of the revised control systems and are included in the Design Package SDQA Category E - Information Use Only Page 7 of 7

A/R Number: 00291000 Facility: CATAWBA NUCLEAR STATION Unit(s): 1 &2 Activity

Title:

Evaluation of Alternative Shutdown Boron Concentration Methodology For Revision 2a to DPC-NF-2010 Summary The purpose of this 10 CFR 50.59 evaluation is to determine whether a license amendment request is required to update the methodology used to calculate shutdown boron concentrations in the methodology report DPC-NF-2010-A, "Nuclear Physics Methodology For Reload Design". An alternate approach for calculating shutdown boron concentrations is added to be consistent with current practice. In this approach, the all rods in (ARI) boron concentration corresponding to the appropriate shutdown margin (1.3% Ap or 1.0% Ap) is initially calculated, and then adjusted by an equivalent boron concentration to account for a stuck rod and 10% of the ARI less the highest worth stuck rod worth. The alternate approach differs from the described approach in that an ARI critical boron concentration is initially calculated versus calculating an ARI highest worth stuck rod out critical boron concentration. In the alternate approach, both the stuck rod worth and 10% of the ARI less highest stuck rod out worth are converted to a boron concentration using an appropriate boron worth, and added to the ARI critical boron concentration. In the original approach, both the magnitude of the shutdown margin (1.3% Ap or 1.0% Ap) and 10% of the ARI less stuck rod out worth are converted to a boron concentration, and then added to the ARI stuck rod out critical boron concentration. The condition at which the differential boron worth is calculated between the two approaches is also different.

Both methods preserve the essential elements of the method. These elements consist of increasing the ARI boron concentration by 1) the stuck rod worth, 2) 10% rod worth allowance calculated relative to the ARI(N-1) worth, and 3) a factor of safety.

This alternative approach for the calculating shutdown boron concentrations is considered a change in methodology used to maintain TS 3.1.1 shutdown margin, and therefore requires an evaluation. NEI 96-07, Section 4.3.8, states that changes to a methodology are not considered a departure from a method of evaluation provided the change to elements of the analysis method yield results that are essentially the same as, or more conservative than, either the previous revision for the same methodology or another methodology previously accepted by the NRC through issuance of a Safety Evaluation Report.

Demonstration calculations were performed as a function of burnup and reactor coolant temperature to demonstrate equivalency between the alternative methodology relative to the methodology described in DPC-NF-2010-A. The results of this calculation showed that the two methods were essentially the same. Therefore, this activity does not result in a departure from a method of evaluation described in the UFSAR used in establishing the design basis or in the safety analysis.

SDQA Category E - Information Use Only Page 1 of 1