ML110210619

Issuance of Amendment Changes to Shutdown Cooling System Isolation Instrumentation

ML110210619
Person / Time
Site:	Dresden
Issue date:	02/07/2011
From:	Ellen Brown Plant Licensing Branch III
To:	Pacilio J Exelon Nuclear
Brown, E, NRR-DLPM 301-415-2315
References
TAC ME3354, TAC ME3355
Download: ML110210619 (24)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 February 7, 2011 Mr. Michael J. Pacilio President and Chief Nuclear Officer Exelon Nuclear 4300 Winfield Road Warrenville, IL 60555

SUBJECT:

DRESDEN NUCLEAR POWER STATION, UNITS 2 AND 3 -ISSUANCE OF AMENDMENTS REGARDING CHANGES TO SHUTDOWN COOLING SYSTEM ISOLATION INSTRUMENTATION (TAC NOS. ME3354 AND ME3355)

Dear Mr. Pacilio:

The U.S. Nuclear Regulatory Commission (NRC, the Commission) has issued the enclosed Amendment No.236 to Renewed Facility Operating License No. DPR-19 and Amendment No. 229to Renewed Facility Operating License No. DPR-25 for Dresden Nuclear Power Station (DNPS), Units 2 and 3. The amendments are in response to your application dated February 4, 2010 (Agencywide Documents Access and Management System (ADAMS)

Accession No. ML100470776), supplemented by letters dated September 15, (ADAMS Accession No. ML102590347); October 6, (ADAMS Accession No. ML102800524); and December 13, 2010 (ADAMS No. ML103480873).

The amendments submitted by Exelon Generation Company, LLC requested to revise Technical Specification 3.3.6.1, "Primary Containment Isolation Instrumentation,"

"Table 3.3.6.1-1, "Primary Containment Isolation Instrumentation," Function 6.a "Shutdown Cooling System Isolation, Recirculation Line Water Temperature - High," to enable implementation with reactor pressure-based isolation instrumentation, for the DNPS, Units 2 and 3.

-2 A copy of the Safety Evaluation is also enclosed. The Notice of Issuance will be included in the Commission's biweekly Federal Register notice.

Sincerely, IRA!

Eva A. Brown, Senior Project Manager Plant licensing Branch 111-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. 50-237 and 50-249

Enclosures:

1. Amendment No. 236 to DPR-19

2. Amendment No. 229 to DPR-25

3. Safety Evaluation cc w/encls: Distribution via Listserv

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 EXELON GENERATION COMPANY, LLC DOCKET NO. 50-237 DRESDEN NUCLEAR POWER STATION, UNIT 2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 236 Renewed License No. DPR-19

1.

The U.S. Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by the Exelon Generation Company, LLC (the licensee) dated February 4, as supplemented by letter(s) dated September 15, October 6, and December 13,2010, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations setforth in 10 CFR Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2.

Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment and paragraph 2.C.(2) of Renewed Facility Operating License No. DPR-19 is hereby amended to read as follows:

- 2 (2)

Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No., 236,are hereby incorporated into this renewed operating license. The licensee shall operate the facility in accordance with the Technical Specifications.

3.

This license amendment is effective as of the date of its issuance and shall be implemented within 30 days of the date of issuance.

FOR THE NUCLEAR REGULATORY COMMISSION Robert D. Carlson, Chi Plant Licensing Branch 111-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to the Technical Specifications and Renewed Facility Operating License Date of Issuance: February 7, 2011

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 EXELON GENERATION COMPANY. LLC DOCKET NO. 50-249 DRESDEN NUCLEAR POWER STATION, UNIT 3 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 229 Renewed License No. DPR-25

1.

The U.S. Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by the Exelon Generation Company, LLC (the licensee) dated February 4, as supplemented by letter(s) dated September 15, October 6, and December 13, 2010, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and Oi) that such activities will be conducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2.

Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment and paragraph 3.B. of Renewed Facility Operating License No. DPR-25 is hereby amended to read as follows:

FOR THE NUCLEAR REGU TORY COMMISSION

- 2 B.

Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 229,are hereby incorporated into this renewed operating license. The licensee shall operate the facility in accordance with the Technical Specifications.

3.

This license amendment is effective as of the date of its issuance and shall be implemented within 60 days of the date of issuance.

f(UJJ )

Robert D. Carlson, Chief Plant Licensing Branch 111-2 Division of Operating Re~ctor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to the Technical Specifications and Renewed Facility Operating License Date of Issuance: February 7, 2011

ATTACHMENT TO LICENSE AMENDMENT NOS. 236AND 229 RENEWED FACILITY OPERATING LICENSE NOS. DPR-19 AND DPR-25 DOCKET NOS. 50-237 AND 50-249 Replace the following pages of the Facility Operating License and Appendix HA" Technical Specifications with the attached pages. The revised pages are identified by amendment number and contain marginal lines indicating the area of change.

Remove License DRP-19 License DPR-19 Page 3 Page 3 License DPR-25 License DPR-25 Page 4 Page 4 TSs TSs 3.3.6.1-7 3.3.6.1-7 TSs 8ases TSs 8ases 83.3.6.1-5 83.3.6.1-5 83.3.6.1-18 83.3.6.1-18 83.3.6.1-26 83.3.6.1-26

- 3 (2)

Exelon Generation Company, LLC, pursuant to the Act and 10 CFR Part 70, to receive, possess and use at any time special nuclear materials as reactor fuel, in accordance with the limitations for storage and amounts required for reactor operation, as described in the Updated Final Safety Analysis Report, as supplemented and amended; (3)

Exelon Generation Company, LLC, pursuant to the Act and 10 CFR Parts 30, 40 and 70, to receive, possess and use at any time any byproduct, source and special nuclear material as sealed neutron sources for reactor startup, sealed sources for reactor instrumentation and radiation monitoring equipment calibration, and as fission detectors in amounts as required; (4)

Exelon Generation Company, LLC, pursuant to the Act and 10 CFR Parts 30, 40 and 70, to receive, possess and use in amounts as required any byproduct, source or special nuclear material without restriction to chemical or physical form, for sample analysis or instrument calibration or associated with radioactive apparatus or components; and (5)

Exelon Generation Company, LLC, pursuant to the Act and 10 CFR Parts 30,40 and 70, to possess, but not separate, such byproduct special nuclear materials as may be produced by the operation of the facility.

C.

This renewed operating license shall be deemed to contain and is subject to the conditions specified in the Commission's regulations set forth in 10 CFR Chapter I; is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified or incorporated below:

(1)

Maximum Power Level The licensee is authorized to operate the facility at steady state reactor core power levels not in excess of 2957 megawatts thermal (100 percent rated power) in accordance with the conditions specified herein.

(2)

Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 236, are hereby incorporated into this renewed operating license. The licensee shall operate the facility in accordance with the Technical Specifications.

(3)

Operation in the coastdown mode is permitted to 40% power.

Renewed License No. DPR-19 Amendment No. 236

-4

f.

Surveillance Requirement 4.9.A.1 0 - Diesel Storage Tank Cleaning (Unit 3 and Unit 2/3 only)

Each of the above Surveillance Requirements shall be successfully demonstrated prior to entering into MODE 2 on the first plant startup following the fourteenth refueling outage (D3R14).

3.

This renewed operating license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations: 10 CFR Part 20, Section 30.34 of 10 CFR Part 30, Section 40.41 of 10 CFR Part 40, Sections 50.54 and 50.59 of 10 CFR Part 50, and Section 70.32 of 10 CFR Part 70; is subject to all applicable provisions of the Act and to the rules, regulations. and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified or incorporated below:

A.

Maximum Power Level The licensee is authorized to operate the facility at steady state power levels not in excess of 2957 megawatts (thermal), except that the licensee shall not operate the facility at power levels in excess of five (5) megawatts (thermal), until satisfactory completion of modifications and final testing of the station output transformer, the auto-depressurization interlock, and the feedwater system, as described in the licensee's telegrams; dated February 26, 1971, have been verified in writing by the Commission.

B.

Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 229, are hereby incorporated into this renewed operating license. The licensee shall operate the facility in accordance with the Technical Specifications.

C.

Reports The licensee shall make certain reports in accordance with the requirements of the Technical Specifications.

D.

Records The licensee shall keep facility operating records in accordance with the requirements of the Technical Specifications.

E.

Restrictions Operation in the coastdown mode is permitted to 40% power.

Renewed License No. DPR-25 Amendment No. 229

Primary Containment Isolation Instrumentation 3.3.6.1 Table 3.3.6.1 1 (page 3 of 3)

Primary Containment Isolation Instrumentation APPLICABLE CONDITIONS

,"10DES OR REQUIRED REFERENCED OTHER CHANNELS FROt' S?ECI FlED PER TRIP REQ~iRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS SYSTEM ACTIO~ C.1 REQUIREMENTS VALUE

5.

Reactor Water Clean~~

System.solation

a.

SLC System Initiation 1,2,3 Sf<

b.

Reactor Vessel Levei-Low Water 1,2,3 SR SR SR SR SR

6.

Shutdown Cooling System Isolation

a.

Reactor Vessel Pressure - High 1,2,3 2

F SR SR SR Reactor Vessel Level-LOW Water 3,4,5 SR SR SR SR SR 3.3.6.1.7 3.3.6.1.1 3.3.6.1.2 3.3.6.1.3 3.3.6.1.6 3.3.6.1.7 3.3.6.1.2 3.3.6.1.6 3.3.6.1.7 3.3.6.1.1 3.3.6.1.2 3.3.6.1.3 3.3.6.1.6 3.3.6.1. 7 NA 2! 2.65 inches

~ 114.1 pS~g (Loo~ 1, Reactor Wide Range Pressure)

~ 110.4 psig (Loop 2, Reactor Pressure Feedwater Control) 2! 2.65 inches (b)

In MODES 4 and ded Shutdown Cooling System integrity is maintained, only one channel per trip system with an i ation signal available to one shutdown cooling pum~ suction solation valve is required.

Dresden 2 and 3 3.3.6.1-7 Amendment No 236 / 229

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES BACKGROUND

5.

Reactor Water Cleanup System Isolation (continued) initiation switch is considered to provide 1 channel input into each trip system.

Each of the two trip systems is connected to one of the two RWCU valves.

RWCU Functions isolate the Group 3 valves.

6.

Shutdown Cooling (SOC) System Isolation The Reactor Vessel Water Level-Low Function receives input from four reactor vessel water level channels.

Each channel inputs into one of four trip strings.

Two trip strings make up a trip system and both trip systems must trip to cause an isolation of the SOC isolation valves.

Any channel will trip the associated trip string.

OfIly one trip string must trip to trip the associated trip system.

The trip strings are arranged in a one-out-of-two taken twice logic to initiate isolation.

The Reactor Vessel Pressure-High Function receives input from four reactor pressure channels.

Each channel inputs into one of two trip systems.

Two pressure channels make up a trip system in a one-out-of-two taken once logic arrangement and both trip systems must trip to cause an isolation of the SOC isolation valves.

Shutdown Cooling System Isolation Functions isolate some Group 3 valves (SOC isolation valves).

APPLICABLE The isolation signals generated by the primary containment SAFETY ANALYSES, isolation instrumentation are implicitly assumed in the LCO, and safety analyses of References 2 and 3 to initiate closure APPLICABILITY of valves to limit offsite doses.

Refer to LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs)," Applicable Safety Analyses Bases for more detail of the safety analyses.

(continued)

Dresden 2 and 3 B 3.3.6.1-5 Revision 52 Amendment No. 236/229

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABI LITY This Function isolates the Group 3 valves.

Shutdown Cooling (SOC) System Isolation (continued) 6.a.

Reactor Vessel Pressure-High The Reactor Vessel Pressure-High Function is provided to isolate the Shutdown Cooling (SOC) System.

This interlock is provided for equipment protection only to prevent exceeding the SOC system design temperature. and credit for the interlock is not assumed in the accident or transient analysis in the UFSAR.

The Reactor Vessel Pressure-High Isolation Function receives input from four reactor pressure channels.

Each pressure channel inputs into one of two trip systems.

Two pressure channels make up a trip system in a one-out-of-two taken once logic arrangement and both trip systems must trip to cause an isolation of the SOC valves.

Two pressure channels per trip system are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The !7unction is only required to be OPERABLE in HODES 1, 2, and 3, since these are the only HODES in which the reactor coolant temperature exceeds the system design temperature and equipment protection is needed.

The pressure Allowable Value was chosen to be low enough to protect the system equipment from exceeding its design temperature.

This Function isolates the Group 3 shutdown cooling valves.

(continued)

Dresden 2 and 3 B 3.3.6.1-18 Revision 52 Amendment No. 236/229

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES SURVEILLANCE REQUIREMENTS SR 3.3.6.1.2 and SR 3.3.6.1.5 (continued)

The 92 day Frequency of SR 3.3.6.1.2 is based on the reliability analyses described in References 8 and 9.

The 24 month Frequency of SR 3.3.6.1.5 is based on engineering judgement and the reliability of the components.

SR 3.3.6.1.3 Calibration of trip units provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.1-1.

If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis.

Under these conditions, the setpoint must be readjusted to be equal to or more conservative than that accounted for in the appropriate setpoint methodology.

The Frequency of 92 days is based on the reliability analyses of References 9 and 10.

SR 3.3.6.1.4 and SR 3.3.6.1.6 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor.

This test verifies the channel responds to the measured parameter within the necessary range and accuracy.

For Function 6.a only, there is a plant-specific program which verifies that the instrument channel functions as required, by verifying the as-left and as-found settings are consistent with those established by the setpoint methOdology.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Frequency of SR 3.3.6.1.4 1s based on the assumption of a 92 day calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

The Frequency of SR 3.3.6.1.6 is based on the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

(continued)

Dresden 2 and 3 B 3.3.6.1-26 Revision 0 Amendment No. 236/229

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO.236 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-19 AND AMENDMENT NO. 229TO RENEWED FACILITY OPERATING LICENSE NO. DPR-25 EXELON GENERATION COMPANY. LLC DRESDEN NUCLEAR POWER STATION, UNITS 2 AND 3 DOCKET NOS. 50-237 AND 50-249

1.0 INTRODUCTION

By letter to the Nuclear Regulatory Commission (NRC, the Commission) dated February 4, 2010 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML100470776), supplemented by letters dated September 15, (ADAMS Accession No. ML102590347), October 6, (ADAMS Accession No. ML102800524), and December 13, 2010 (ADAMS Accession No. ML103480873), Exelon Generation Company, LLC (EGC, the licensee) submitted a request to revise Technical Specification (TS) 3.3.6.1, Primary Containment Isolation Instrumentation," Table 3.3.6.1-1, "Primary Containment Isolation Instrumentation, Function 6.a, Shutdown Cooling System Isolation, Recirculation Line Water Temperature-High, to account for a modification to the Shutdown Cooling (SDC) system isolation function that replaces the temperature-based isolation instrumentation with reactor pressure-based instrumentation for Dresden Nuclear Power Station (DNPS), Units 2 and 3.

The license amendment request (LAR) modifies the automatic function that protects SDC system equipment by isolating the SDC System from the reactor vessel to prevent the SDC system from exceeding its design limit temperature of 350 degrees Fahrenheit (OF).

Specifically, the licensee proposes the following changes to the SDC system isolation function:

Implement four trip channels in a one-out-of-two-taken-twice logic configuration for Shutdown Cooling System Isolation, Reactor Vessel Pressure-High trip, Use four available pressure transmitters (two safety-related and two nonsafety) in lieu of the current four non-safety temperature sensors, Use the safety-related Safety Analog Trip System to produce two of the four trip channels based upon Reactor Wide Range Pressure transmitters, which the LAR refers to as Loop 1,

Enclosure

- 2 Use the nonsafety Bailey Feedwater System, a digital controller, in two of the four trip channels based upon Reactor Pressure Feedwater Control transmitters, which the LAR refers to as Loop 2, Provide isolation between new safety to nonsafety equipment interfaces,

• Modify the TS 3.3.6.1 and Table 3.3.6.1-1 to replace the current single Allowable Value (AV) for a temperature-based setpoint with two AVs, where the first AV applies to the two Reactor Wide Range Pressure trip channels and the second AV applies to the two Reactor Pressure Feedwater Control trip channels.

The LAR was submitted to allow these modifications, which are designed to improve equipment availability through enhanced reliability and maintainability. The supplemental information submitted by the licensee did not affect the Federal Register notice. The licensee has determined that the existing temperature sensors and their locations adversely affect availability of the SDC System.

2.0 REGULATORY EVALUATION

Section 50.36 to Title 10 to the Code ofFederal Regulations (10 CFR) Part 50, requires that TS include limiting conditions for operation (LCOs) for any structure, system, or component which operating experience or probabilistic risk assessment has shown to be significant to public health and safety. Section 50.36 to 10 CFR, also requires that TS Surveillance Requirements (SRs) be requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the LCO will be met. When an LCO for operation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specifications until the condition can be met.

Appendix A to 10 CFR 50, General Design Criteria for Nuclear Power Plants, Criterion 13 Instrumentation and Control (corresponds to DNPS Updated Final Safety Analysis Report (UFSAR) Section 3.1.1 3.2, Criterion 12) states that:

Instrumentation shall be provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated operational occurrences, and for accident conditions as appropriate to assure adequate safety, including those variables and systems that can affect the fission process, the integrity of the reactor core, the reactor coolant pressure boundary, and the containment and its associated systems.

Appropriate controls shall be provided to maintain these variables and systems within prescribed operating ranges.

Appendix A to 10 CFR 50, Criterion 24-Separation of Protection and Control Systems (corresponds to DNPS UFSAR Section 3.1.1.4.4, Criterion 22) states that:

The protection system shall be separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel which is common to the control and protection systems leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system. Interconnection of the protection

- 3 and control systems shall be limited so as to assure that safety is not significantly impaired.

Appendix A to 10 CFR 50, Criterion 34-Residual Heat Removal (corresponds to DNPS UFSAR Section 3.1.2.4.5, Criterion 34) states that:

A system to remove residual heat shall be provided. The system safety function shall be to transfer fission product decay heat and other residual heat from the reactor core at a rate such that specified acceptable fuel design limits and the design conditions of the reactor coolant pressure boundary are not exceeded.

Suitable redundancy in components and features, and suitable interconnections, leak detection, and isolation capabilities shall be provided to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished, assuming a single failure.

Regulatory Guide (RG) 1.105, Revision 3, Setpoints for Safety-Related Instrumentations, describes a method acceptable to the NRC staff for complying with the NRC's regulations for ensuring that instrumentation setpoints are initially within and remain within the TS limits. The RG endorses Part I of ISA-S67.04-1994, "Setpoints for Nuclear Safety Instrumentation," subject to the NRC staff clarifications.

Regulatory Issue Summary (RIS) 2006-17, NRC Staff Position on the requirements of Title 10 to the Code of Federal Regulations (10 CFR) Part 50, specifically 10 CFR 50.36, Technical Specifications,' Regarding Limiting Safety System Settings During Periodic Testing and Calibration of Instrument Channels, dated August 24, 2006, discusses the requirements of 10 CFR 50.36 related to Limiting Safety System Settings (LSSS) and provides an approach acceptable to the NRC to address LSSS issues. The LSSSs are settings for automatic protective devices related to those variables having significant safety functions. The RIS 2006 17 provides guidance on how to determine when an As-Found Value (AFV) is acceptable with respect to the nominal trip setpoint (NSP) and required actions to be taken when the AFV is outside predefined acceptance limits or outside the AV.

Digital Instrumentation and Controls Interim Staff Guidance (DI&C-ISG), Revision 2, (ADAMS Accession No. ML091590268) provides acceptable methods for implementing diversity and defense-in-depth in digital I&C systems deSigns. The digital Reactor Protection System, which consists of the Reactor Trip System and the Engineering Safety Features Actuation System, should be protected against common cause failures. The NRC considers that common cause failures in digital systems are beyond design basis. However, the licensee should perform a defense-in-depth analysis to demonstrate that vulnerabilities to the common cause failures are adequately addressed.

3.0 TECHNICAL EVALUATION

DNPS designates the equipment protection portion of SOC system isolation function as non safety. Even though part of modified "Primary Containment Isolation Instrumentation" will use Category 1 components, the SOC isolation function, which prevents SOC system equipment damage based upon the SOC system's deSign limit temperature of 350 OF, will also consist of

-4 other non-Class 1 E components. The modified portion of the primary containment isolation instrumentation function will remain designated as non-safety by the licensee and the associated instrumentation has not been designed to meet safety-related instrumentation and control evaluation criteria.

3.1 Setpoint Methodology and Calculation The licensee determined that a reactor vessel pressure of 119.9 pound-force per square inch gauge (psig) corresponds to 350 of under saturated conditions, and therefore uses 119.9 psig as the maximum design limit for the pressure-based SDC Isolation function. DNPS Units 2 and 3 are General Electric Boiler Water Reactor Plants/3 (BWR/3s) use pressure transmitters for SDC system isolation to ensure that their SDC Systems do not exceed system design limits.

Therefore, the NRC staff finds that use of a maximum design pressure under saturated conditions that is equivalent to the maximum design temperature is an acceptable approach for SDC isolation.

The licensee used the setpoint methodology, Analysis of Instrument Channel Set point Error and Instrument Loop Accuracy, NES-EIC-20.04, Revision 5, which is provided as Enclosure 1 to the EGC letter dated September 15, 2010 (ADAMS Accession No. ML102590347) for the proposed TS changes. By NRC letter dated March 20, 2001, (ADAMS Accession No. ML011130121) earlier revisions of this methodology were evaluated and found acceptable for use by the licensee to determine AVs.

The licensee provided a setpoint calculation within the LAR for each instrumentation trip channel type, Reactor Wide Range Pressure (Loop 1) and Reactor Pressure Feedwater Control (Loop 2). In addition to AVs, these calculations apply NES-EIC-20.04, Revision 5, to derive tolerances that correspond to AFVs with respect to the NSP, which the licensee refers to as Expanded Tolerances, and As-Left Values (ALVs) with respect to the NSP, which the licensee refers to as Setting Tolerances.

The NRC staff evaluated NES-EIC-20.04, Revision 5, and the calculations provided for each instrument trip channel using RG 1.105 and RIS 2006-17. Based upon this evaluation, the NRC staff finds that the methodology, as applied to the DNPS SDC Isolation Calculated Setpoints, Expanded Tolerances, Setting Tolerances and AVs is acceptable for the Shutdown Cooling System Isolation, Reactor Vessel Pressure-High function.

3.2 Operability Using the evaluation criteria in RG 1.105 and RIS 2006-17, the NRC staff evaluated the licensee's application of the Calculated Setpoints, Expanded Tolerances, Setting Tolerances and AVs for use in operability determinations.

The licensee stated that its procedures require resetting the setpoint to a value within its ALV.

The licensee stated that it implements engineering procedures for instrument performance trending and monitoring and provided Instrument Performance Trending, ER-AA-520, Revision 3, as Enclosure 2 to the EGC letter dated October 6, 2010 (ADAMS Accession No. ML102800524). Subparagraphs of ER-AA-520 Section 4.2.1, establish the required actions that apply when the instrument ALV cannot be reset to within the Setting Tolerance, when an AFV exceeds the Expanded Tolerance but is withfn the AV, and when an AFV exceeds the AV. The

- 5 licensee also provided Issue Identification and Screening Process, LS-AA-120, Revision 12, as to the letter. LS-AA-120 is part of EGC's Corrective Action Program procedures and includes provisions in Section 4.4.6.3 for the operating Shift Manager to evaluate the instrument's condition and determine its operability.

The NRC staff evaluated the LAR and the additional and supplemental information for consistency with RG 1.105 and RIS 2006-17. Based upon this evaluation, the NRC staff finds that the approach to determine operability of the DNPS Shutdown COOling System Isolation, Reactor Vessel Pressure-High Function using the Calculated Setpoints, Expanded Tolerances, Setting Tolerances and AVs is acceptable.

The proposed TS for SDC isolation based on the Reactor Vessel Pressure-High function identifies the "Required Channels Per Trip System" as "2" when in MODES 1, 2 or 3. Through additional and supplemental information the licensee further clarified this LCO as requiring all four trip channels to meet their respective SRs for the applicable modes. The procedures associated with SR 3.3.6.1.2 (CHANNEL FUNCTIONAL TEST), SR 3.3.6.1.6 (CHANNEL CALIBRATION), and SR 3.3.6.1.7 (LOGIC SYSTEM FUNCTIONAL TEST), may be unique for each type of trip channel (Loop 1 or Loop 2). The licensee indicated that the revised procedures will be ready to support the implementation of the proposed license amendment and the modification to the SDC System isolation instrumentation. The revised procedures include changes to the operating, maintenance and the annunciator alarm procedures.

The submittal requests that the Reactor Vessel Pressure-High function use four pressure based trip channels as inputs to a one-out-of-two-taken-twice logic configuration. The output signal from this logic is intended to act as a cut-in permissive and to automatically initiate isolation of the SDC system. A relay-based one-out-of-two-taken-twice logic configuration is a common method for meeting single failure criteria, and as such remains acceptable to the NRC staff.

3.3.

Independence and Redundancy Two pressure transmitters originate from each of two condensing chambers that are on opposite sides of the reactor vessel. This approach provides physical separation consistency consistent with Appendix A to 10 CFR 50, Criterion 24-Separation of Protection and Control Systems (DNPS Criterion 22). Two different pressure transmitters are used between Loop 1 (Reactor Wide Range) and Loop 2 (Reactor Pressure Feedwater Control) and two different processing approaches are used between Loop 1 (Safety Analog Trip System) and Loop 2 (Bailey Feedwater System). This provides a degree of diversity between Loop 1 and Loop 2 trip channels.

The licensee has defined the first stage of the logic configuration, the one-out-of-two portion, to be a 'trip system.' Each 'trip system' combines two input signals, one from each of Loop 1 and Loop 2 trip channel, so that either trip channel can generate its 'trip system' output. This maintains the previously established degree of diversity between Loop 1 and Loop 2. Then the two 'trip system' output signals are combined, so that both 'trip system' output signals are required. This combination forms the taken-twice portion of the logic.

The NRC staff evaluation of this configuration concludes that no trip channel hardware failure should either enable the cut-in permissive when it is not required or erroneously initiate an

-6 automatic isolation of the SOC System. Also, the NRC staff evaluation of this configuration concludes that no single trip channel failure, including common-cause software failure, will prevent a required isolation from occurring when needed. Nevertheless, the NRC staff's evaluation of this configuration concludes that it has the potential for a common-cause programming error in the digital Bailey Feedwater System that could generate an erroneous cut in permissive/automatic isolation signal from both Bailey Feedwater System driven trip channels that would result in an erroneous isolation of the SOC System.

The LAR states that:

EGC has evaluated the proposed instrument channel configuration and has determined that no single failure will prevent the SOC system from isolating when required and no single spurious pressure signal will cause SOC system isolation to occur.

The NRC staff has evaluated the LAR and licensee provided additional information with supplement and determined that the preceding LAR statement is correct. However, this statement does not directly address failures that may cause inadvertent SOC system isolation but are not associated with a single spurious pressure signal. Such failures are limited to include potential software common-cause failures within nonsafety Bailey Feedwater System, a digital controller, which creates two of the four isolation trip signals, one in each 'trip system.' This type of failure is not directly addressed by IEEE 279-1971, Criteria for Protection Systems for Nuclear Power Generating Stations, Section 4.7, which the licensee has stated are the requirements to which the proposed change had been designed to meet.

Single-failure criteria does not directly address software common-cause failures associated with programmable devices or the plant's ability to cope with any vulnerabilities that potential software common-cause failures may present. Additionally, the NRC staff does not typically review software identified as nonsafety and has not reviewed the EGC processes or procedures that are associated with the Bailey Feedwater System development. Therefore, the NRC staff cannot reasonably conclude that potential software common-cause failures will not exist within the modified Bailey Feedwater System and instead includes an assessment of the plant's ability to cope with vulnerabilities that potential software common-cause failures may present. This evaluation is based on information provided by the licensee. The NRC staff does not accept the assertion that the actions proposed, "ensure that no common mode software failures are introduced as part a software change or upgrade." This assertion is contrary NRC staff positions provided in the OI&C-ISG-02. The OI&C-ISG-02 states, "the effects of failures to actuate and the effects of spurious trips and actuations should be evaluated to ensure the effects are bounded by the plant design basis."

In accordance with OI&C-ISG-02, the NRC staff evaluated the plant's ability to cope with vulnerabilities to a potential software common-cause failure that could produce an erroneous cut-in permissive when the SOC System should remain isolated. The NRC staff finds that the plant should not be vulnerable to this failure, as long as un-isolating the SOC system still requires manual action and the operator will have independently verified that the reactor vessel temperature is sufficiently low prior to initiating manual action.

In accordance with OI&C-ISG-02, the NRC staff evaluated the plant's ability to cope with vulnerabilities to a potential software common-cause failure that could produce an erroneous SOC system isolation when the SOC system is in use. The licensee stated that the current

- 7 design could produce an inadvertent isolation of the SDC system based upon a single-failure to a common power source that is shared by the trip systems and isolation circuits. To address this overall vulnerability, the licensee stated that the operating procedure DOA 1000-01, Residual Heat Removal Alternatives, provides guidance to the operator on how to establish an alternative core cooling method due to a partial or complete SDC system failure and identifies alternate methods. Furthermore, the licensee stated that the safety-related emergency core cooling system could be used to remove residual heat when alternative methods are not sufficient to control reactor temperature. Based on the above review, the NRC staff determined that the alternate methods provided by the licensee are adequate.

3.4 Alternate Cote Cooling (ACe) Methods during a Loss of the SDC System Event The licensee indicated in a response dated October 6, 2010, that during a total loss of the SDC system event, various alternate core cooling (ACC) methods are available to ensure the capability to remove residual heat from the reactor. The ACC methods include the condensate/feedwater and main steam (MS) systems, the reactor water cleanup (RWCU) system, control rod drive (CRD) system and the emergency core cooling systems (including the isolation condenser, high pressure coolant injection [HPCI1, MS relief valves with the suppression pool cooling mode of the low pressure coolant injection [LPCI1 system).

The licensee indicated that to support the DHR functions at DNPS, Units 2 and 3, it would use several plant-specific procedures including: (1) Procedure DOA 1000-01, Residual Heat Removal Alternatives, (2) Procedure DOP 1000-07, Alternate Shutdown Cooling, (3) Procedure OU-DR-104, Shutdown Safety Management Program, and (4) Procedure OP-DR-104-1001, Shutdown Risk Management Contingency Plans. The procedures provide guidance on the use of ACC methods to support the DHR functions. The NRC staff concludes the he procedures appear to provide adequate support to ensure the capability to remove residual heat from the reactor.

3.5 Procedures Supporting the DHR Functions 3.5.1 Procedure DOA 1000-01 Procedure DOA 1000-01, Residual Heat Removal Alternatives, provides the alternatives available to shutdown a DNPS unit and maintain the reactor in cold or hot shutdown conditions based on the availability of specific systems and reactor temperature and pressure. Its Section A lists the entry conditions for the procedure and Section D describes the subsequent operator actions to be taken. For a total loss of the SDC system, Step D.5.b directs operators to use the MS turbine bypass valves to remove decay heat by releasing steam to the condenser and maintaining reactor water level using feedwater and condensate system. Step D.5 also addresses the use of the RWCU system, CRD system, main steamline drain valves and use of unit house loads for DHR. If the ACC methods described in above Step D.5 are not sufficient to control reactor water temperature and pressure, Step D.6 directs operators to use one or more of the following emergency core cooling system alternatives for the temperature and pressure control: the isolation condenser system, HPCI system and the electromagnetic relief valves (ERVs). The ERVs are used to dump steam from the reactor pressure vessel (RPV) to the torus for RPV depressurization.

When the plant is in Mode 5 with the reactor cavity flooded, Step D.7 directs operators to follow

-8 the Unit Supervisor's instruction on use of one or more of the following ACC condenser (ACC) methods to control reactor water temperature: the RWCU system, cross cooling from the fuel pool cooling or SDC in the fuel pool cooling mode, and realign SDC in fuel pool cooling mode back to the reactor cavity.

3.5.2 Procedure DOP 1000-07 Procedure DOP 1000-07, Alternate Shutdown Cooling, provides an alternate method for DHR when the SDC or supporting systems are unavailable and other methods of maintaining reactor coolant temperature below 212 OF are inadequate. This procedure provides guidance on use of the LPCI system for providing flow from the torus to the reactor and the relief valves for providing a pathway for the reactor coolant to flow from the reactor to the torus.

3.5.3 Procedure OU-DR-104 Procedure OU-DR-104, Shutdown Safety Management Program, defines the key safety functions and applies to the planning, scheduling, and execution of work on a unit already in or expected to be in shutdown mode of operation. Specifically, Section 4.5.1 provides guidelines for maintaining the reactor DHR key safety function. The procedure also identifies the primary and alternate sources of shutdown cooling. In addition, Section 4.5.1.6 requires that at beginning of each shift, when DHR equipment is required to be in service, operators are designated and briefed to restore DHR equipment. The briefing includes the applicable procedures and recovery actions, current conditions (including time to boil, core uncovery time, available equipment and functions), prioritizing available ACC methods to be used for the current conditions, and actions to restore secondary containment, if breached.

3.5.4 Procedure OP-DR-1 04-1 001 Procedure OP-DR-1 04-1 001, Shutdown Risk Management Contingency Plans, provides heightened awareness of plant status during outage and ensures that proper contingency plans are in place. Its Section 4.1 discusses the contingency plans to address a loss of DHR. While Step 4.1.1 directs operators to use of procedure DOA 1000-01, Residual Heat Removal Alternatives, Steps 4.1.2 and 4.1.3 present additional guidance to minimize the consequences of a loss of DHR. The guidance provided in Step 4.1.2 is for closing openings in the secondary containment, and Step 4.1.3 is for controlling containment integrity (specified in Step 4.1.3.1),

use of fuel pool cooling for DHR (Step 4.1.3.2), actions to be taken when using MS drain lines (Step 4.1.3.3), and the use of feed and bleed of reactor coolant in Modes 4 and 5 (Step 4.1.3.4).

The licensee indicates in the supplement dated December 13, 2010 that the procedures discussed in Subsections 2.1 through 2.4 above have been in place for extended period of time and they have been used as necessary during shutdown of DNPS. The operators are trained in the use of these procedures. The training in the use of Procedure DOA 1000-01, Residual Heat Removal Alternatives, involves simulator exercises. The operators are required to demonstrate their ability to respond appropriately to any given system and associated transient in simulator exercises.

Since (1) various ACC methods are available for DHR, (2) existing procedures provide guidance on use of available ACC methods for DHR, and (3) the operators are trained in use of these procedures, the NRC staff has concluded that the DNPS plant procedures and administrative

- 9 controls provide reasonable assurance that the ACC methods are adequate to ensure the capability to remove decay heat from the reactor during a total loss of the SOC system event.

3.6 Safety-to-Nonsafety System Interfaces The modification proposed creates new safety-to-nonsafety interfaces and maintains existing nonsafety to safety interfaces. Each interface signal is a discrete on/off type signal.

The licensee indicated that new safety-to-nonsafety interfaces will exist between the Safety Analog Trip System's master trip units and the nonsafety trip units that feed the one-out-of-two taken-twice logic for the Reactor Vessel Pressure-High SOC isolation function. The change provides Category 1 safety related isolators for these interfaces to provide electrical separation between the safety and nonsafety related circuits.

Nonsafety-to-safety interfaces are intended to remain between the one-out-of-two-taken-twice logic for the Reactor Vessel Pressure-High isolation function and the remaining inboard and outboard isolation valve logic circuitry. Relays will continue to provide coil-to-contact isolation for this nonsafety-to-safety interface as was the case for the temperature-based isolation function.

Based on these interfaces satisfying the criterion for separation of protection and control systems, the NRC staff finds the proposed interfaces provide acceptable separation of protection and control systems.

3.7 Technical Conclusion The NRC staff finds that the proposed LAR to replace the TS 3.3.6.1, Table 3.3.6.1-1, temperature-based Function 6.a, with a functionally equivalent pressure-based "Shutdown Cooling System Isolation, Reactor Vessel Pressure-High" complies with the regulatory evaluation criteria; and therefore is acceptable to the NRC staff.

4.0 STATE CONSULTATION

In accordance with the Commission's regulations, the Illinois State official was notified of the proposed issuance of the amendment and the State official had no comments.

5.0 ENVIRONMENTAL CONSIDERATION

The amendments change the requirements with respect to installation or use of a facility'S components located within the restricted area as defined in 10 CFR Part 20 or a change to surveillance requirements. The NRC staff has determined that the amendments involve no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendments involve no Significant hazards consideration, and there has been no public comment on such finding published (April 20, 2010; 75 FR 20635). Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Pursuant to 10 CFR 51.22(b) no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

- 10

6.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

7.0 REFERENCES

1.

Letter from J. L. Hansen (Exelon) to NRC, "Follow-up Information Supporting the Request for License Amendment Regarding Shutdown Cooling System Isolation Instrumentation," October 6,2010, (ADAMS Accession No. ML102800524).

2.

Letter from J. L. Hansen (Exelon) to NRC, "Additional Information Supporting the Request for License Amendment Regarding Shutdown Cooling System Isolation Instrumentation," September 15, 2010, (ADAMS Accession No. ML102590347).

3.

Letter from J. L. Hansen (Exelon) to NRC, "Additional Information Supporting the Request for License Amendment Regarding Shutdown Cooling System Isolation Instrumentation," December 13,2010, (ADAMS Accession No. ML103480873).

Principal Contributors: Bernard F. Dittman Summer B. Sun Date: February 7, 2011

- 2 A copy of the Safety Evaluation is also enclosed. The Notice of Issuance will be included in the Commission's biweekly Federal Register notice.

Docket Nos. 50-237 and 50-249

Enclosures:

1. Amendment No. 236 to DPR-19

2. Amendment No. 229 to DPR-25

3. Safety Evaluation cc w/encls: Distribution via Listserv DISTRIBUTION:

PUBLIC RidsNrrDorlLpl3-2 Resource RidsNrrPMDresden Resource RidsNrrDSSSRXBResource RidsRgn3MailCenter Resource SSun Amendment: M L 110210619 Sincerely, IRA!

Eva A. Brown, Senior Project Manager Plant Licensing Branch 111-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation RidsOgcRp Resource LPL3-2 RlF RidsNrrDirsltsb Resource RidsNrrDorlDpr Resource RidsNrrLATHarris Resource RidsNrrDEEICBResource ABilloch BDittman RidsAcrsAcnw_MailCTR Resource OFFICE LPL3-2/PM LPL3-2/PM LPL3-2/LA DElEICB* DSS/SRXB*

OGC LPL3-2/BC LPL3-2/PM NAME EBrown ABillochCol6n THarris WKemper AUlses MWright (NLO)

RCarlson (MMahone I v for)

EBrown DATE 217/11 1125/11 1/25/11 12/08/10 12/22/10 211/11 2/7/11 2/7/11

• SE Memo Date OFFICIAL RECORD COpy