ML13316B226

Safety Evaluation Supporting Amend 117 to License DPR-13

ML13316B226
Person / Time
Site:	San Onofre
Issue date:	12/13/1988
From:	Office of Nuclear Reactor Regulation
To:
Shared Package
ML13316B223	List: ML13316B222 ML13316B224 ML13316B226 ML13316B228
References
NUDOCS 8812280239
Download: ML13316B226 (17)

Text

FtREGUZ 0

UNITED STATES NUCLEAR REGULATORY COMMISSION:

WASHINGTON, D. C. 20555 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO.117TO PROVISIONAL OPERATING LICENSE NO. DPR-13 SOUTHERN CALIFORNIA EDISON COMPANY SAN DIEGO GAS AND ELECTRIC COMPANY SAN ONOFRE NUCLEAR GENERATING STATION, UNIT NO. 1 DOCKET NO. 50-206

1.0 INTRODUCTION

By letter dated April 15, 1988, Southern California Edison Company (SCE) requested changes to several sections of the San Onofre Nuclear Generating Station, Unit 1 (SONGS1) Technical Specifications (TS). These changes are required to provide consistency with a proposed upgrade of the SONGS1 Nuclear Instrumentation System (NIS). Attached to the request were the proposed TS changes and a Safety Review Report, dated April 1988, pre pared by Westinghouse for SCE (Ref. 1).

The report describes and presents the qualifications of the modified NIS system and presents an evaluation of how the SONGS1 licensing basis safety analyses are affected by the modifications. Supplemental information regarding electrical power supplies was provided by SCE letter dated October 18, 1988 (Ref. 2) in response to an NRC letter to SCE dated July 29, 1988.

2.0 EVALUATION -

INSTRUMENTATION AND CONTROLS Included as part of this change is the complete replacement of the NIS detectors, cabling and signal processing equipment. Some existing output devices, cable routing and power distribution to the NIS cabinets are retained. The function of the NIS is intended to remain primarily unchanged with the neutron detectors providing all of the previous trips, alarms and rod block signals.

One significant difference from the previous NIS involves the intermediate range channel.

At SONGS-1 the intermediate range channel will be used to satisfy the Regulatory Guide (RG) 1.97 post-accident monitoring requirements in addition to its existing reactor protection system functions.

The intermediate range channel will use a microprocessor based system to pro vide these functions. This section of the Safety Evaluation (SE) is limited to a review of the instrumentation portion of the NIS and the related equipment. The adequacy of the NIS intermediate range for meeting the RG 1.97 requirements will be evaluated in a separate SE. The licensing safety analysis reevaluation and the electrical power supply evaluation are presented in Sections 3.0 and 4.0, respectively.

8612280239 881213 PDR ADOCK 05000206 P

PNU,

-2

2.1 System Description

2.1.1 NIS System The NIS at SONGS-1 is similar to the existing 4-bay NIS designs at most Westinghouse plants with the exception of the use of the intermediate range for post-accident monitoring. Other features include an asymmetric power range detector configuration and two-section fission chambers for the intermediate and power range detectors.

The NIS being installed at SONGS-1 consists of four nuclear instrument channels. Two channels consist of power range only (0-120 reactor power),

and two channe s consist of power, intermediate (061 to 10 counts per second and 10 to 200% power) and source (1 to 10 counts per second) ranges. Both control and protective functions are provided by the NIS signals. Control functions are provided by source range and intermediate range high start up rate rod stop signals to the Rod Control System for rod speed control.

Protective functions are provided by intermediate range high start up rate reactor trip signals and power range low, mid and high overpower reactor trip signals.

Indication is also provided for operator monitoring.- These functions of the proposed NIS are the same as the existing NIS.

2.1.2 Hardware The-hardware changes for this modification entails the replacement of the detectors, the cabling and the processing equipment. The hardware is similar to the previous Westinghouse 4-bay NIS system with the largest exception being the use of an Intel 8095 microprocessor to perform the logarithmic functions of the wide range amplifier of the intermediate range. The 8095 microprocessor is similar to the 8086 microprocessor used previously for the RG 1.97 Neutron Flux Monitoring System (NFMS) at Vogtle (Ref. 3).

2.1.3 Software The intermediate range of the NIS is dependent upon the quality of the software used for the algorithms. The NIS hardware supplier, Westinghouse, is also the supplier of the safety-related software. ANSI/IEEE-ANS 7-4.3.2-1982, "American National Standard Application Criteria for Pro grammable Digital Computer Systems in Safety Systems of Nuclear Power Generating Stations," (Ref. 4) has been recognized and endorsed with RG 1.152 as an acceptable method of Verification and Validation (V&V).to be used in development of safety-related software.

SCE has stated (Ref. 3) that the V&V plan used for this software is virtually the same as that used for the South Texas Qualified Display System (QDPS) and the Vogtle RG 1.97 NFMS. These systems were previously reviewed by the staff (Ref. 5 and 6) and found acceptable.

-3 2.2 System Assessment 2.2.1 Design Basis The principle criteria of interest in this evaluation were ANSI/

IEEE-ANS-7-4.3.2, IEEE-279, IEEE-323, IEEE-344, IEEE-384 and Regulatory Guide 1.75.

2.2.1.1 IEEE-279-1971, IEEE-384-1977, and Regulatory Guide 1.75 Regarding IEEE-279, the staff reviewed the licensee's submittals regarding conformance to the single failure criterion, completion of protective action, independence, capability for testing and calibration, and indica tion of bypasses. The licensee has stated (Ref. 3) that the new NIS presents a significant improvement over the existing NIS in the area of RG 1.75 separation. Dedicated channelized conduits have been used extensively.

Some of the new conduit does not fully meet the IEEE-384 separation distances and some internal main control room wiring does not meet RG 1.75. In both of those cases the new wiring is at least as well separated and channelized as the existing system. The staff finds the changes made to the NIS to be a significant improvement over the existing design and is, therefore, acceptable.

The staff found that the power supplies from the batteries through the inverters and transfer switches to the NIS cabinets have common supply cables routed together and share common raceways and therefore may not meet the single failure criterion of IEEE-279-1971. These power supplies were not changed for this modification. Since these were part of the original licensing basis and have not been changed, the staff considers evaluation under the Systematic Evaluation Program (SEP) to be an appro priate vehicle for analysing the adequacy of the power supply arrangement.

SEP Topic VI-7.C.2 addresses the physical separation of the vital bus and regulated bus power supplies and associated cables and will be resolved by a later SE.

2.2.1.2 IEEE-STD-323-1974 AND 344-1975 Regarding conformance to IEEE-323 and IEEE-344, the staff has reviewed the SCE submittals and has noted that full conformance to the standards will be demonstrated. All items have been seismically qualified and most items have been environmentally qualified. The licensee has committed to having all qualification completed and documented prior to plant restart. The equipment needed to operate the source range (a technical specification required item during refueling) has been seismically qualified and there are no harsh environment operating considerations during refueling. The staff finds the use of the new NIS during refueling and the commitment to complete qualification before restart both to be acceptable.

-4 2.2.1.3 Functional Reouiremeits Functional requirements for the NIS are provided in detail in the system descriptions (Ref. 7 and 8) for the NIS and the Reactor Protection System and Permissives and were detailed in Appendix D of the Safety Review Report (Ref. 1).

In addition to the trips and permissives the existing system required some overlap of the source and power ranges by the intermediate range. The new NIS has met that requirement by not only overlapping but totally encompassing both the source and power ranges.

The functional requirements were inadequate in that the ANSI/IEEE-ANS-7-4.3.2 standard was not included in the applicable criteria. However, as described in the software section of this SE, this was compensated.for because the software was in fact designed and implemented to the requirements of the standard.

2.2.2 Failure Modes and Effects SCE revised the RPS single failure analysis (Ref. 9) to include the NIS replacement (Ref. 10).

The analysis addresses each module or tag numbered device and is listed in table 4 of the analysis. It looks at the credible failure modes for these devices on both the input and output side of the devices. Specifically, it addresses common mode, interface devices and power supplies to determine if there are any channel common failure susceptibilities. One of the most likely failures involves the loss of power to a NIS cabinet. If this occurs the affected channel or channels faiJ to a tripped condition. The staff has reviewed the NIS replacement change as a part of the larger single failure analysis and has found that the NIS section meets the single failure criteria of IEEE-279-1971. A separate SE will be written to evaluate the complete RPS single failure analysis.

2.2.3 Effects of Retrofit of New Equipment to Existing Systems The new NIS is intended, with the exception of the expanded intermediate range of RG 1.97 scope, to be-a virtual one-for-one replacement of the previous NIS functions. The RPS is unaffected by this change due to the use of the same trips and permissives. A loss of power to the NIS will be seen by the RPS to be the same as with the previous system (tripped).

2.2.4 Maintenance of the Design Basis The NIS is designed so that technicians can plug into the microprocessor and obtain the stored data. No parameters can be changed by either the technician collecting data or by the operators. Any change required would require either an analog change of part of the system which falls under the existing administrative controls for engineering changes or replace ment of the microprocessor memory to change the software which in turn would fall under the V&V program. The staff considers these controls of modification of the NIS acceptable.

-5 2.3 Hardware Assessment 2.3.1 Hardware Specifications The NIS at SONGS-1 is similar to the standard Westinghouse 4-bay NIS that has been used at 54 domestic and 27 foreign power plants. The differences between the standard NIS and the SONGS-1 NIS are described and evaluated in the other sections of this SE.

2.3.1.1 Isolation Devices Isolation devices are provided to prevent faults in Non-Class 1E equipment from propagating to the 1E equipment.

IEEE 279-1971 requires isolation to keep the Non-Class 1E fault from propagating into the safety function of the NIS. The isolation devices used at SONGS-1 have been previously approved by the staff and this application has been verified to be bounded by previous testing (Ref. 3).

2.3.1.2 Electromagnetic Interference (EMI)

The effects of EMI on the operation of the NIS has been considered during the design and the installation of the NIS at SONGS-1. Westinghouse has used military standard noise-susceptibility tests as the basis for the tests on NIS equipment. Existing installations of the very similar equipment at two operating plants also has not demonstrtated any suscepti bility to EMI.

The inputs and outputs are buffered against EMI and have been demonstrated by testing to be effective in preventing EMI from disrupting the NIS operations. As a result of the testing and experience, Westinghouse produced a Control and Electrical System Standard which was issued to SONGS-1 and provides specific direction for installation to minimize the effects of EMI. Some of the specific directions include using dedicated conduits, maintaining spatial separation from EMI sources, use of quadaxial cable and grounding requirements. The staff finds this acceptable.

2.3.2 Operating Considerations For the operations at SONGS-1, the NIS is required for several functions.

The primary function, which is operator independent, is to provide an accurate trip signal or prevent rod movement if the flux rate is not correct. Visual indications are also provided to keep the operator aware of plant status. The use of the intermediate range for RG 1.97 require ments will be evaluated in a separate SE. The operations staff has been trained in the use of the NIS and the maintenance staff has been trained by Westinghouse in the calibration and maintenance of the equipment. The staff finds this acceptable.

2.4 Software Assessment The assessment of the NIS software provided to SONGS-1 by Westinghouse is an assessment of the methodology and procedures used to develop the software. SONGS-1 has-stated (Ref. 3) that no specific V&V Plan was written for SONGS-1 but rather the V&V plan used for the South Texas QDPS and thle Vogtle NFMS was adapted for use.

-6 Verification & Validation are two separate but related activities that follow the development of software. Verification determines whether the requirements of one phase of the development cycle have been consistently, correctly, and completely transformed to the subsequent phase of the design cycle. Validation is the testing of the final product to ensure that performance of the end product conforms to the requirements of the initial specification. The need for V&V arose because software is very complex and prone to human errors of omission, commission and interpre tation. V&V provides for an independent verifier to work in parallel with, but independent of, the development team to ensure that human errors do not hinder the production of safety software that is reliable and testable.

In executing V&V, certain principles have proven over time to be very effective in software development programs. These V&V principles can serve as a comprehensive reference base for applying the applicable criteria for software evaluations of Class 1E safety systems.

o well defined systems requirements expressed in a well written document o

development methodology to guide the production of software o

comprehensive testing procedures o

independence of the V&V team from the development organization 2.4.1 Criteria The applicable criteria for the development of safety-related software products is set forth in ANSI/IEEE-ANS-7-4.3.2 (Ref. 4).

This standard defines the documentation of the computer systems requirements, the software development phases, the verification'testing of the integrated system, and the validation of the entire development process. The staff review focuses on whether a comprehensive V&V program is applied to the software development of safety-related systems, and that the V&V program was carried out according to the applicable criteria. In particular, the following elements are characteristic of a minimally acceptable V&V.

The verifier must be independent of the developing organization. The validation testing must be done by a team that did not participate in the design or implementation of the software product. Discrepancies uncovered during verification must be recorded, identified, resolved and corrected.

The software specification must be complete, correct, consistent and feasible.

-7 2.4.2 Software Evaluation No specific V&V plan was written for the SONGS-1 NIS upgrade. The V&V plan used for South Texas QDPS was adopted for use on the NIS upgrade (Ref. 3).

The South Texas QDPS V&V plan was also utilized on the Vogtle NFMS.

The verification process utilized on the NIS upgrade was the same as used on the South Texas QDPS with the exception that the NIS is a much simpler system with only 31 units versus 1300 for the QDPS. All trouble and clarification reports developed during the NIS V&V effort were successfully closed out.

The validation process consisted of the four main areas of functional requirements testing, abnormal mode testing, system prudency review and man-machine interface testing. During the validation efforts, one funct ional requirement was identified which was not addressed in the factory acceptance test. The test was modified and the validator reviewed the test results to assure that all requirements had been met.

The V&V programs used at South Texas QDPS (Ref. 6) and Vogtle NFMS (Ref.

5) have been previously evaluated by the staff and, with some comments, found acceptable. For the QDPS the staff performed four audits of the Westinghouse design and V&V. The comments by the staff included the discrepancy of the functional requirement decomposition test description and-the-actual validation test conducted. All open issues or discrepancies were resolved with the final issue of the QDPS V&V plan.

The Vogtle NFMS V&V plan was a functional derivative of the South Texas QDPS V&V plan. This plan was also audited by the staff and was found to be acceptable. Since the V&V plan for SONGS-1 is the same as that used for the above two plants which the staff has reviewed and found acceptable, the staff concludes that the V&V plan for SONGS-1 NIS is acceptable.

2.5 Technical Specifications (TS) - Instrumentaticm and Control TS 1.0 describes the definitions of terms used in the TS. The changes include an addition to the channel test definition, defines Actuation Logic Test and administrative changes. The staff finds these changes acceptable.

TS 3.5.1 describes the LCOs for the reactor trip system instrumentation.

These changes include the addition of the Power Range Dropped Rod, Rod Stop and NIS Coincidentor Logic operability and their associated action statements. These changes are consistent with the previously accepted Westinghouse STS and are therefore acceptable.

TS 3.5.6 requires that the listed accident monitoring instrumentation be operable and provides the actions required for inoperable channels. The table was been revised to include the two new wide-range neutron flux level indications that are included in the NIS upgrade. This change is consistent with the STS and is therefore acceptable.

-8 TS 3.11 describes the Incore Axial offset limits and actions required.

This section is revised to show the use of the NIS to provide this measure ment and calculation instead of the previously dedicated system. The action statements for inoperability remain consistent with previous system. The operability of the NIS is covered under TS 3.5.1.

TS 4.1 describes the surveillance requirements for the listed systems and instrumentation including the Reactor Trip System. This section is being revised to make it consistent with the STS and section 3.5.1. The new items are consistent with the STS and previously revised Westinghouse owners groups submittals. In no case were existing surveillance intervals relaxed. The staff finds these changes acceptable.

2.6 Summary The staff has reviewed all of the licensee's submittals and responses to requests for additional information. We note that three items related to this modification will be addressed via separate SEs. The first item concerns the adequacy of the power supplies to provide reliable power to the safety buses from which the NIS is powered. This issue will be resolved as a specific issue under the SEP program. The second issue is the acceptability of the intermediate range NIS for the RG 1.97 resolution; the SE for the RG 1.97 resolution will address this issue. The third issue involves the RPS single failure analysis. The NIS section has been reviewed and found acceptable; however, a separate SE will be issued to eva-luate the complete analysis.

The basic design of the hardware has been reviewed and has been shown to be the same as many other previously approved plants. The differences between the basic NIS and the specific SONGS-1 application have been reviewed in the above sections of this SE and have been shown by the licensee to be an improvement in the NIS and are therefore acceptable.

The licensees commitment to complete the EQ documentation prior to startup is acceptable.

The software has been verified and validated by the same V&V plan as previously accepted by the staff and is therefore acceptable.

The technical specification changes are consistent with the hardware changes and the standard technical specification and are acceptable. The staff finds that the NIS upgrade can be expected to perform its safety functions as well as or better than the previous NIS and is therefore acceptable.

3.0 EVALUATION - TRANSIENT AND SAFETY ANALYSIS From the point of view of the SONGS1 licensing basis safety analyses the NIS remains for the most part functionally identical to the current system. That is, the source, intermediate and power range neutron detectors generally provide the same types of output and associated alarm, block and trip signals as used in the current safety analyses.

-9 The primary functional difference for safety analysis between the current and revised NIS is the result of the relocation of one of the power range detectors from thimble 3 to thimble 4 (because of size requirements).

This changes the 900 azimuthal symmetry of the four (excore) detectors to a condition in which one detector is 450 and 1350 from adjacent detectors.

This affects what the detector would see from an azimuthally asymmetric power distribution. This requires an examination of the analyses of events such as the dropped control rod which produces asymmetric distri butions. It also requires a change in the TS 2.1 limit for asymmetric power distribution setpoint changes.

As documented in the Accident Analysis section of the Safety Review Report, Westinghouse has examined each licensing basis event safety analysis to determine the possibility of interaction of the revised NIS with the analyses. Because the functional aspects of the trips remain essentially the same the examination has indicated that with the exception of the dropped control rod events, and to a lesser extent the control rod ejection, no event analysis is changed because of the NIS revision.

Either the event is not involved with the NIS (e.g., loss of flow which trips on low flow) or the relevant NIS trip levels remain functionally the same (e.g., the zero power control rod withdrawal event for which the analysis assumes a trip at 118 percent power high neutron flux, which is unchanged with the revised NIS).

This examination has been thorough and its conclusions are reasonable and acceptable. The main body of the safety analysis events are riot affected by the NIS changes.

Only the rod ejection and rod drop events need to be further examined.

The-rod ejection event generally produces an asymmetric power distribution which could affect the scram initiation timing. However, for any ejection event of significance the power rise is sufficiently large and rapid that the small change in detection geometry is unimportant, and scram will occur in effectively the usual manner. Thus the Safety Review Report concludes that the NIS revision does not adversely affect the analyses. The staff review agrees with this conclusion and finds the current analysis to be acceptable with the revised NIS.

The dropped rod events may also involve asymmetric power distributions, and power changes (indicating reactivity changes) occurring near the 1350 detector separation may not be as easily seen by the protection system as assumed in the current safety analyses.

For this event analysis, since the rod bottom signal is assumed to be failed, the NIS must provide a negative flux rate signal trip to provide for control rod block and turbine runback (when required by operating conditions) to prevent return to power with adverse power distributions. (A trip on one of the four power range detectors is sufficient.)

For multiple dropped rods this will occur as in the current analyses since the dropped rods will be in more than one reactor quadrant and will affect at least one detector. (Oper ability requirements will be discussed later.)

Thus the staff review has congluded that the revised NIS is acceptable for multiple dropped rod events.

10 For a single dropped rod, however, the revised NIS might react differently, and a new analysis is needed. The required analysis was provided by Westinghouse for the single dropped rod assuming no trip signal from either the rod bottom signal or the excore power detectors (i.e., no assumed trip protection from turbine runback or rod block). The analysis parameters bounded both the SONGS1 nominal T program (5750 F at full power) with 20 percent steam generator tube Oligging, and the reduced T

program (5510 F) with 15 percent plugging. The analysis methodology U998 for the calculations was the "Dropped Rod Methodology" currently used by Westinghouse for all Westinghouse reactors. (The methodology description and justification along with the NRC review and approval is presented in Reference 11.)

This analysis shows that for SONGS1 Cycle 10 the single dropped rod results in a minimum DNBR above the required safety limit of 1.30 which is an acceptable conclusion. It is a requirement of this methodology that this calculation be carried out for each future SONGS1 cycle (for which the methodology is used). This methodology has been accepted by the NRC as generally applicable for Westinghouse reactors, and this review concludes that it is similarly appropriate and acceptable for SONGS1. Thus it is concluded that, at least for Cycle 10, the dropped rod event is satisfactorily handled by the revised NIS. Future cycles will require future reconfirmation.

Related to dropped rod analyses is the proposed change to the NIS which would add a keyed switch to each power range channel to bypass the over power and the dropped rod rod stops (blocks) when the channel is out of service. Normally four power range channels are operable, and one inoper able (and placed out of service) channel or one above appropriate trip levels will produce a rod block, and two a scram. This is provided for in TS 3.5. The proposed change would allow bypassing the rod block when one channel is inoperable. An appropriate signal on one of the remaining three channels would cause a block and/or scram (and the scram situation is thus unaffected). Operation could then continue with three rod block channels.

The overpower rod block is not a part of any safety analysis and the bypass of this function thus does not impact the analysis and is accept able. However, the dropped rod rod block bypass does affect the rod drop analysis and must be examined. It has been shown (above) that the single dropped rod requires no protection (for at least Cycle 10) and is thus not affected by the bypass. The multiple dropped rod situation has been reexamined by (arbitrarily) assuming that in the bypassed condition no rod block or turbine runback trip will be produced. This leads to the conclusion that for the reduced T programs, where no turbine runback is required, the rod block must be Wmanently in effect while in the bypass condition by being in manual rod control or having a permanently activated rod stop.

The proposed TS changes provide for this requirement.

For the nominal T program both rod block and turbine runback are assumed to be req Wed. As for the reduced T program this could be accomplished by requiring in the TS that the 019rnt be operated with the

rod block in effect and, in addition, with the reactor under the turbine runback power level setpoint when in a by pass condition. However, SCE has chosen to revise the TS (3.5.1, Action 28) such that only the reduced Tave program will be used in the bypass condition. This is acceptable.

3.1 Technical Specifications - Transient and Safety Analysis There are three TS for which part or all of the proposed changes are related to the safety analyses. These are Specifications 2.1 and 3.5.1 which have been previously mentioned, and 3.11 which concerns axial (flux) offset measurements. The proposed changes to Specification 2.1 and 3.11 are entirely related to safety analyses or associated operability require ments. Only part of the changes to 3.5.1 are directly related to safety analyses, and the remainder (and other TS changes) are related to NIS changes.

Specification 2.1 and Basis. The significant changes to this Specifica tion are to the second footnote of Tab.le 2.1 which reduces from 10 to 5 percent the limit for asymmetric power distributions which do not require changes to the overpower trip setpoint. This change is required because of the asymmetric location of the revised NIS power range detector which can change the system sensitivity to detect such anomalies. Westinghouse has evaluated the effect of the-change and has determined that asymmetries previously indicated, e.g., 10 percent asymmetry, might show less than 10 but greater than 5 percent with the revised NIS. This evaluation result is reasonable and provides an acceptable basis for the specification.

Other changes to 2.1, a reference addition and a nuclear overpower low trip setting addition, are acceptable minor corrections.

Specification 3.5.1, Action Statement 28. The only changes in this Specification directly relevant to the safety analysis is this action statement providing the requirement to operate in the reduced T e program mode and with a block of automatic rod withdrawal by operating 4 manual mode. This change has been discussed previously and is acceptable.

Specification 3.11, Action Statement A, B, and C and Basis. The changes to this Specification are needed to reflect the fact that the axial offset monitoring is to be done with the power range detectors of the revised NIS rather than with a separate dedicated set of detectors. This slightly changes the alternatives available when channels are inoperative and is an acceptable change.

3.2 Summary SCE has proposed changes to the NIS and several TS relating to these changes. They have presented a Safety Review Report justifying these changes. This report contains an Accident Analysis section examining the applicability of existing safety analyses to the revised NIS and updating the analyses where necessary, e.g., for the dropped control rod event.

This examination and analysis provide justification for several of the TS changes which are directly related to the accident analyses.

-12.

Based on our review of the submittal we have concluded that appropriate reviews and analyses have been done and suitable documentation has been submitted, and the proposed changes to the NIS and to the related TS are reasonable and are in accord with staff positions and previous reviews in these areas. The proposed TS are acceptable.

4.0 EVALUATION - ELECTRICAL This section addresses the electrical installation design, the capability of the electric power systems to supply the upgraded NIS, and the associated TS changes.

4.1 Electrical Installation Design The electrical installation design includes:

1. Raceways and cable systems to provide vital bus electrical power to the upgraded NIS equipment.

2. Raceways and cable systems to interconnect the Westinghouse furnished neutron flux detectors, containment electrical penetration assemblies, preamplifiers, NIS electronics processing cabinets, and coincidentor logic cabinets; and

3. Interface with existing plant systems such as the Reactor Control and Protection equipment, main control room indication, controls, annunci ators, recorders, Onsite Technical Support Center (OTSC) Computer, and remote shutdown panel.

The cables that supply electrical power for the upgraded NIS are routed in raceways from division A 125V DC bus through inverters, auto transfer switches, vital buses, and regulated buses. Alternate electric power is routed from a division B or division A motor control center through a 480/120 transformer and the same auto transfer switches, vital buses, and'regulated buses that are used to supply power from the division A 125V DC bus.

New raceways and cables from the regulated buses to the upgraded NIS are to be installed as part of the modifications. These cables (i.e., the four cables from the four regulated buses to the four new NIS cabinets) are to be routed in independent raceways which will meet the recommendation of Regulatory Guide 1.75. This routing meets current regulatory guidelines and is acceptable.

Existing plant raceways and cables from the division A 125V DC bus to the regulated buses, which were used to supply electric power to the original NIS cabinets, are to be used to supply the upgraded NIS.

These cables are routed in the same raceways. From the division A' 125V DC bus to the cabinets housing the auto transfer switches and vital buses, three of the four feeder cables are routed in the same tray system; the fourth feeder cable is routed in its own conduit.

From the vital buses to the regulated buses, all four feeder cables are routed together in the same tray system.

13 The physical separation of these cables was identified as an open issue in the Systematic Evaluation Program (SEP) for San Onofre Nuclear Generating Station, Unit 1 (NUREG-0829 dated December 1986).

Section 4.2.5, Topic VI-7.c.2, Failure Mode Analysis (Emergency Core Cooling System), of the SEP final report recommended that the vital buses 1,2,3 and 4, and the regulated buses and associated transfer switches be arranged to provide physical separation. Also the SEP recommended that physical separation be provided for the input and output cables to those vital buses which includes the cables from the division A 125V battery to the regulated buses that supply the upgraded NIS and other systems cables.

As part of the SEP, SCE committed to evaluate the merits of this recommendation (and others) to determine if modifications are warranted. The staff found this commitment acceptable. The SEP final report indicated that the licensee was to have submitted this evaluation together with recommendations for any necessary modifica tions by September 30, 1986.

By letter dated November 19, 1988 (Ref. 3), SCE indicated that the report resolving the SEP issue is presently scheduled to be submit ted to the NRC on May 31, 1989. SCE indicated that the submittal will resolve the issue of the power supply physical separation not only as it relates to the NIS and Regulatory Guide 1.97 but to other safety-related systems and components that are powered by the vital buses aDd regulated buses.

Also it is noted that the power feeder cables from the division A 125V DC battery to the upgraded NIS which are routed in the same tray system do not meet the single failure criterion in accordance with the guidelines of Regulatory Guide 1.97 for accident monitoring instrumentation. As part of its review of SONGS-1 compliance with Regulatory Guide 1.97, the licensee's contractor (Ref. 12) recom mended that the NIS cabling be upgraded to provide adequate separa tion. The issue of NIS cable separation is being-pursued by the staff-as part of their ongoing review of SONGS-1 compliance to Regulatory Guide 1.97.

The cable routing arrangement was accepted in the original licensing of the plant and is the basis of our acceptance for the upgraded NIS today. However, further consideration of this arrangement will be given both in the R.G. 1.97 review and the open SEP item discussed earlier. These reviews may result in the requirement for additional cable separation.

14 For the remaining electrical installation design (i.e., raceway and cable systems to interconnect the upgraded NIS and Westinghouse supplied equipment and interfaces with existing plant systems), SCE provided a description of proposed NIS raceway configuration (Ref. 3).

As part of this description SCE indicated that physical and electri cal separation is achieved in accordance with the guidelines of Regulatory Guide 1.75 with two exceptions. These exceptions and the staff review of them is as follows:

1. New channelized conduits do not fully meet the IEEE-384 separation distances to existing plant cable trays.

However, new dedicated conduit provides a much greater level of protection than the existing NIS cable routing and the separation distances have been optimized to the extent achievable given existing plant structural/

electrical configuration. The staff concludes that chan nelized conduits and their separation distance from exist ing plant cable trays meet interface requirements of the upgraded NIS contained in the safety report for the NIS (Ref. 1), provide an acceptable level of protection of channelized cables because they are routed in raceways separated from other plant cables, and exceed the original design basis approved for licensing of SONGS-1, and are, therefore, acceptable.

2.-

Channelized NIS protection outputs and R.G. 1.97 channelized indication signals once inside the existing main control room J-console (C03) are bundled into separate channelized wiring bundles. The internal (to the J-console) routing is optimized to the extent practicable to separate the bundles. Also the replacement mode selector switch improved the separation dis tances between channels compared to the existing mode selector switch. However, the installation of barriers between channels at the mode switch and at the R.G. 1.97 indicators is not practicable and is not provided. The acceptability of this separation will be included as part of the staff's ongoing review of SONGS-1 compliance to the guidelines of Regulatory Guide 1.97 and is thus not covered in this review.

Given compliance with the guidelines of Regulatory guide 1.75 except as noted above, the staff finds the proposed NIS raceway configurations and interfaces to be acceptable.

15 4.2 Capability of Electric Power Systems In support of the replacement upgrade of the NIS, as indicated by letter dated April 15, 1988 (Ref. 1), the upgrade of the NIS will increase the DC system load. As a consequence of this increased load, the margin of safety for DC system capacity and capability will be reduced. The impact of the increased NIS load on the maintained 120V AC and 125V DC distribution system components, from the NIS cabinets up to and including the battery, battery charger, battery charger input breakers, and the alternate supply breaker at MCC 2 was further evaluated by SCE (Refs. 13, 14, and 10) for bus capacity, proper fuse/breaker sizing/coordination, component/cable ratings, system voltages, NIS cabinet input voltages, and short circuit capabilities. SCE found each component to be adequate to provide for the increased load requirements.

Based on these results, the staff concludes that the dc system components have sufficient design-margin to assure that they will be operated within the manufacturer's recommended design limits while supplying the increased loading required by the upgraded NIS and is, therefore, acceptable.

SCE also analyzed each section of the revised battery load duty cycle profile resulting from the additional NIS loads to determine the adequacy of the existing battery. For momentary loads which occur

-during the first one minute of the battery load duty-cycle, SCE established a discrete sequence and (in accordance with the guide lines of section 4.2.3 of IEEE Standard 485-1983) used the maximum current at any instant (1285 amps) as the one-minute load for the battery duty cycle. The majority.of the momentary loads are from the sequence change of 4160V and 480V buses breaker operations. This sequencing is.governed by the load sequencer controls which are tested periodically for proper breaker operation. The remaining momentary loads or their sequence change in the one minute portion of the duty cycle is based on motor acceleration times and relay opera tion times. SCE calculated the one-minute load capacity of the battery (at its end of life or 85 percent replacement value) to be 1426 amps (Ref. 3).

The 1426 amps provides a margin of 131 amps with respect to the one-minute duty cycle load of 1285 amps. If the one-minute loads that are not controlled by the Load Sequencer (70 amps) are conservatively assumed to operate at the instant of maximum current, the additional 70 amps would still be within the 131 amps margin. SCE concluded that there is sufficient margin available in the battery to safely supply the one-minute load requirements while maintaining the required minimum required battery voltage of 106 volts.

Given periodic testing to verify that 4160V and 480V breakers will.

operate at their prescribed times, the 131 amp battery capacity margin for the one-minute load, and the required minimum end-of discharge voltage of 106 volts, the staff concludes that the battery

00

-16 will have sufficient capacity to meet its design basis safety function and is therefore acceptable. The capability and capacity of the battery to supply loads beyond one minute will be the subject of an upcoming station blackout evaluation for SONGS-1 and is not covered by this review.

4.3 Technical Specifications - Electrical SCEC proposed that the acceptance criteria required by technical specifications for battery capacity be revised from 80 to 85 percent.

The new criteria will require replacement of the battery at 85 percent capacity, will assure that sufficient battery capacity will always be available if needed to supply required safety loads, and is therefore acceptable.

5.0 ENVIRONMENTAL CONSIDERATION

Pursuant to 10 CFR 51.21, 51.32, and.51.35, an environmental assessment and finding of no significant impact have been prepared and published in the Federal Register on June 9, 1988 (53 FR 21742). Accordingly, based upon the environmental assessment, the Commission has determined that the issuance of this amendment will not have a significant effect on the quality of human environment.

6.0 CONCLUSION

We have concluded, based on the considerations discussed above, that:

(1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commis sion's regulations and (3) the issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributors: H. Richings, J. Knox, J..Stewart, C. Trammell Dated:

December 13, 1988

17 REFERENCES

1. Letter, Baskin (SCECo) to Docket 50-206, Amendment Application No. 150, April 15, 1988

2. Letter, Medford (SCECo) tu Docket 50-206, Additional Information to Application No. 150, October 21, 1988

3. Letter, Medford (SCECo) to Docket 50-206, Additional Information to Application No. 150, November 19, 1988

4. Standard, ANSI/IEEE-ANS-7-4.3.2-1982 "American National Standard Application Criteria for Programmable Digital Computer Systems in Safety Systems of Nuclear Power Generating Stations."

5. Memorandum, Coffman (NRC) to Youngblood (NRC), Safety Evaluation Report Input for the Vogtle Plant Safety Monitoring Systems, August 18, 1987

6. Memorandum, Rossi (NRC) to Kadambi (NRC), South Texas Project Units 1&2, Supplemental Ssfety Evaluation report Input:

FSAR Section 7, April 2, 1987

7. System Description, SONGS-1 Nuclear Instrumentation System, SD-S01-380, July 7, 1987

8. System Description, SONGS-1, Reactor Protection System and Permissives, SD-S01-570, June 23, 1987

9. Letter, Medford (SCECo) to Docket 50-206, RPS Single Failure Analysis, March 11, 1987

10. Letter, Nandy (SCECo) to Docket 50-206, Revised-RPS Single Failure Analysis, November 23, 1988.

11.

WCAP-10297-A or 10298-A, "Dropped Rod Methodology for Negative Flux Rate Trip Plants," June 1983, T. Morita, et. al.

12.

Letter from M. 0. Medford (SCE) to G. E. Lear (NRC), dated December 16, 1985, Reguldtory Guide 1.97 Review San Onofre Nuclear Generating Station, Unit 1.

13.

Letter from Southern California Edison Company to NRC dated October 18, 1988, "Docket No. 50-206, Nuclear Instrumentation System Upgrade San Onofre Nuclear Generating Station, Unit 1."

14.

Letter from Southern California Edison Company to the NRC dated November 10, 1988, "Docket No. 50-206, Nuclear Instrumentation Upgrade San Onofre Nuclear Generating Station, Unit 1."