ML19031C905

Supplemental License Amendment Request to Revise Technical Specifications Regarding Response Time Testing of Pressure Transmitters and Request for Additional Information Response

ML19031C905
Person / Time
Site:	Palo Verde
Issue date:	01/31/2019
From:	Lacal M Arizona Public Service Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
102-07859-MLL/MDD
Download: ML19031C905 (43)

Text

Qaps 102-07859-MLL/MDD January 31, 2019 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001

Dear Sirs:

10 CFR 50.90 MARIA L. LACAL Senior Vice President, Nuciear Regulatory & Oversight Palo Verde Nuclear Generating Station P.O. Box 52034 Phoenix, AZ 85072 Mail station 7605 Tel 623.393.6491

Subject:

Palo Verde Nuclear Generating Station Units 1, 2, and 3 Docket Nos. STN 50-528, 50-529, and 50-530 Renewed Operating License Nos. NPF-41, NPF-51, NPF-74 Supplemental License Amendment Request to Revise Technical Specifications Regarding Response Time Testing of Pressure Transmitters and Request for Additional Information Response In accordance with the provisions of Section 50.90 of Title 10 of the Code of Federal Regulations (10 CFR), Arizona Public Service Company (APS) submitted a license amendment request (LAR) to revise the Technical Specifications (TS) for Palo Verde Nuclear Generating Station (PVNGS) Units 1, 2, and 3 by letter number 102-07703, dated May 25, 2018 [Agencywide Documents Access and Management System (ADAMS) Accession number ML18145A303]. The LAR would have revised TS requirements regarding response time testing of pressure transmitters.

By letter number 102-07808, dated October 12, 2018 (ADAMS Accession number ML18285A575) APS reduced the scope of the LAR to specific replacement model Rosemount pressure transmitters, and is no longer seeking approval of an engineering evaluation methodology to permit APS to exempt future transmitter model changes from periodic response time testing without prior NRC approval.

By correspondence dated January 8, 2019 (ADAMS Accession number ML19008A361), the NRC staff provided a request for additional information (RAI) to support the completion of their review of the LAR. This letter and enclosure provide the requested information. To facilitate NRC staff review, the original LAR has been updated to reflect the aforementioned reduction in scope and the RAI responses. The reduction in LAR scope resulted in the elimination of the proposed changes to the TS response time testing definitions for the Engineered Safety Feature (ESF) and Reactor Protective System (RPS). The TS Bases were also updated to reflect the request to use allocated sensor response times in lieu of periodic response time testing for specific Rosemount pressure transmitter models. No changes to the no significant hazards consideration determination were necessary as described in Section 4.3 of the enclosure.

The PVNGS TS currently authorize the elimination of periodic response time testing for specific transmitter models that have been reviewed and approved by the NRC staff. The specific vendor transmitter models approved by the NRC staff have become obsolete and are being replaced by new models of similar design and construction. This supplemental LAR A member of the STARS Alliance LLC Callaway

• Diablo Canyon

• Palo Verde

• Wolf Creek

102-07859-MLL7MDD ATTN: Document Control Desk U. S. Nuclear Regulatory Commission Supplemental LAR and Response to RAIs Regarding Response Time Testing of Pressure Transmitters Page 2 seeks NRC staff approval of the specific replacement model pressure transmitters as required by the TS definitions of ESF and RPS Response Time.

The enclosure contains three attachments. Attachment 1 provides revised marked-up existing TS Bases pages, for information. Attachment 2 provides the APS response to the RAI. Attachment 3 provides the requested APS engineering study that includes the technical basis for the use of allocated sensor response times in lieu of periodic response time testing for the specific replacement Rosemount pressure transmitters.

No new commitments are being made in this submittal. By copy of this letter, this LAR is being forwarded to the Arizona Department of Health Services in accordance with 10 CFR 50.91(b)(1).

APS requests approval of the LAR prior to March 29, 2019, to support the Unit 1 Spring refueling outage, and will implement the license amendment within 30 days following NRC approval.

Should you have any questions concerning the content of this letter, please contact Matthew S. Cox, Licensing Section Leader, Nuclear Regulatory Affairs, at (623) 393-5753.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on:

January 31, 2019 (Date)

Sincerely, KKo.rU L. Lac^\\

MLL7MDD/CJS/mg

Enclosure:

Updated Description and Assessment of Proposed License Amendment cc:

S. A. Morris S. P. Lingam C. A. Peabody T, Morales NRC Region IV Regional Administrator NRC NRR Project Manager for PVNGS NRC Senior Resident Inspector for PVNGS Arizona Department of Health Services (ADHS)

Enclosure Updated Description and Assessment of Proposed License Amendment

Enclosure Updated Description and Assessment of Proposed License Amendment TABLE OF CONTENTS 1.0

SUMMARY

DESCRIPTION 2.0 DETAILED DESCRIPTION 2.1 Proposed Changes to the Technical Specifications 2.2 Need for Proposed Changes

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements 4.2 Precedent 4.3 No Significant Hazards Consideration 4.4 Conclusion

6.0 REFERENCES

ATTACHMENTS

1. Revised Marked-up Technical Specification Bases Pages

2. Arizona Public Service Company Response to NRC Staff Request for Additional Information

3. Engineering Study 13-JS-A105, Evaluation of 3150 Series and 3051N Rosemount Pressure Transmitters for Response Time Testing Requirements

Enclosure Updated Description and Assessment of Proposed License Amendment LIST OF ACRONYMS APS Arizona Public Service Company CFR Code of Federal Regulations DC Direct Current ESF Engineered Safety Feature FMEA Failure Modes and Effects Analysis LAR License Amendment Request LCD Limiting Condition for Operation PVIMGS Palo Verde Nuclear Generating Station RPS Reactor Protective System RTT Response Time Testing SR Surveillance Requirement TS Technical Specification UFSAR Updated Final Safety Analysis Report

Enclosure Updated Description and Assessment of Proposed License Amendment 1.0

SUMMARY

DESCRIPTION In accordance with the provisions of Section 50.90 of Title 10 of the Code of Federal Regulations (10 CFR), Arizona Public Service Company (APS) submitted a license amendment request (LAR) to revise the Technical Specifications (TS) for Palo Verde Nuclear Generating Station (PVNGS) Units 1, 2, and 3 by letter number 102-07703, dated May 25, 2018 [Agencywide Documents Access and Management System (ADAMS) Accession number ML18145A303]. The LAR would have revised TS requirements regarding response time testing of pressure transmitters.

By letter number 102-07808, dated October 12, 2018 (ADAMS Accession number ML18285A575) APS reduced the scope of the LAR to specific replacement model Rosemount pressure transmitters, and is no longer seeking approval of an engineering evaluation methodology to permit APS to exempt future transmitter model changes from periodic response time testing without prior NRC approval.

By correspondence dated January 8, 2019 (ADAMS Accession number ML19008A361), the NRC staff provided a request for additional information (RAI) to support the completion of their review of the LAR. This enclosure provides the requested information and has been updated to reflect the aforementioned reduction in scope and the RAI responses.

The enclosure contains three attachments. Attachment 1 provides the marked-up existing TS Bases pages, for information. Attachment 2 provides the APS response to the RAI. provides the requested APS engineering study that includes the technical basis for the use of allocated sensor response times in lieu of periodic response time testing for the specific replacement Rosemount pressure transmitters.

2.0 DETAILED DESCRIPTION 2.1 Proposed Changes to the Technical Specifications The aforementioned reduction in LAR scope resulted in the elimination of the proposed changes to the TS response time testing definitions for the Engineered Safety Feature (ESF) and Reactor Protective System (RPS). Therefore, there are no longer any proposed changes to the TS. This LAR seeks NRC staff approval of the use of allocated sensor response times in lieu of periodic response time testing for specific replacement model pressure transmitters, as required by the TS definitions of ESF and RPS Response Time.

The NRC staff review and approval of the use of allocated sensor response times, in lieu of periodic response time testing, for the specific replacement Rosemount pressure transmitters impacts the response time testing described in the TS Bases for TS surveillance requirements (SR) 3.3.1.13, 3.3.2.5, and 3.3.5.4. Marked-up TS Bases pages are provided in Attachment 1 for information. The proposed TS Bases changes will be implemented in accordance with TS 5.5.14, Technical Specifications (TS) Bases Control Program, following NRC approval of the requested license amendment.

Enclosure Updated Description and Assessment of Proposed License Amendment 2.2 Need for Proposed Changes Summary Description Consistent with NUREG-1432, Standard Technical Specifications - Combustion Engineering Plants, the PVNGS TSs contain definitions for ESF Response Time and RPS Response Time, that are referenced in SRs. These definitions allow the response times for specific NRC-approved pressure transmitters to be verified using an approved methodology In lieu of being measured. The proposed change requested NRC staff review and approval of the use of allocated sensor response times, in lieu of periodic response time testing (RTT), for specific replacement Rosemount pressure transmitters.

Reason for the Proposed Change Periodic response time testing is resource intensive, which is why the industry owners groups pursued its elimination through TSTF-368 and TSTF-111. The RTT is generally performed in discrete steps that include components of the total protection system including the sensor and the final actuated device response times. The RTT of instrument channels that include pressure sensors requires procedures and techniques to be used for measuring the response time of the pressure sensor device(s) in those instrument channels. As such, pressure sensor RTT takes additional time and effort and often involves the use of specialized contractor services. This prompted the industry efforts to develop alternatives to periodically measuring the response time of selected components.

As components become obsolete, replacement components must be installed to support continued operation. The replacement components are not identical to the originally selected components and, therefore, are not specifically listed in the NRC-approved topical reports that justified the application of an alternative to measuring response times. Because the replacement components are not listed in the NRC-approved topical reports, the TS definitions require prior NRC review and approval to use bounding response times for the replacement components. Therefore, absent this proposed change, RTT is required to be performed on the replacement pressure transmitters in the RPS and ESF system. APS has installed a number of replacement transmitters and none have failed the installation RTT.

3.0 TECHNICAL EVALUATION

Verification Methods Related to Response Time Testing Response time testing of RPS and ESF system instrumentation has been required by TS since about 1970. The purpose of periodic RTT was to demonstrate that the instrumentation channels met the response time performance requirements assumed in the plant safety analyses.

In 1991, the Electric Power Research Institute (EPRI) published Report NP-7243, Investigation of Response Time Testing Requirements (Reference 6.1), which established the basis for justifying the elimination of the periodic response time testing required by plant TS for certain pressure sensors. The EPRI report concluded that response time testing was redundant to other TS required testing (i.e., Channel Checks and Channel Calibrations) for the pressure sensors evaluated.

Based on the results of EPRI Report NP-7243, Westinghouse created WCAP-13632-P-A, Elimination of Pressure Sensor Response Time Testing Requirements, (approved by the NRC

Enclosure Updated Description and Assessment of Proposed License Amendment in 1995 for Westinghouse plants) and the Combustion Engineering Owners Group created NPSD-1167-A, Elimination of Pressure Sensor Response Time Testing Requirements (approved by the NRC in 2000 for Combustion Engineering plants)(Reference 6.2).

These reports provided the justification for eliminating the periodic response time testing requirement for specific pressure and differential pressure transmitters in Westinghouse and Combustion Engineering plant TS. The Westinghouse and Combustion Engineering Owners Group reports also provided model TS changes that eliminated the requirements for response time testing the specified pressure sensors, which APS adopted in License Amendment 135, dated April 19, 2001 (Reference 6.3).

The aforementioned industry documents capture the NRC approved approach to determine if the component response time can be verified in lieu of measured. The approach is a combination of failure modes and effects analysis (FMEA), similarity review, field history and experience. For each component type, the analysis steps were:

Definition of the transmitter to be analyzed.

Description of the operation of the transmitter.

Definition of the analysis boundary and level of detail, Identification of the failure categories.

Completion of the FMEA worksheet, and Summary discussion of the FMEA results.

The FMEA method of systems analysis is selected for the response time investigation because it provides a valid, systematic approach for identifying failure modes. FMEAs are a semi-quantitative technique to the extent that they are not supported by explicit calculations or testing for particular failure modes. Fill fluid viscosity effects, frictional linkage forces, and capillary effects are addressed on a generic basis. The failure modes included each physical boundary and force transmitting element, regardless of the probability for a failure mechanism.

Since the quality of each FMEA is directly related to the quantity and quality level of information regarding transmitter design, component materials, and operational characteristics, the transmitter vendors provided technical documentation and design expertise needed to perform the analysis.

Recent Rosemount Pressure Transmitter Verifications to Support Elimination of RTT Among the specific pressure transmitters currently approved for RTT elimination was the Rosemount 1150 series of pressure and differential pressure transmitters. At PVNGS the 1150 series pressure transmitters are currently used in safety-related applications for level, flow, and pressure process measurements. In 2012, Rosemount Nuclear Instruments announced that the Rosemount 1150 series pressure and differential pressure transmitters were being replaced by the 3150 series.

Emerson Electric Company (the Rosemount transmitter vendor) provided a report (Reference 6.4) and APS has completed an engineering study (Reference 6.5), based on FMEA, similarity review, field history, and experience, to conclude that the new Rosemount 3150 series and 3051N models of pressure and differential pressure transmitters can be considered for elimination of periodic RTT.

Enclosure Updated Description and Assessment of Proposed License Amendment Specifically, based on FMEA, field history, and experience, the vendor report and APS study conclude that no new plausible failure modes exist with the Rosemount 3150 series and 3051N models that would alter the response time of the product without first being detected by other changes in performance characteristics such as channei monitoring with redundant instruments, functional checks, or both.

Model Differences and Similarities The 3150 series and 3051N models and 1150 series pressure transmitter designs both utilize capacitance sensing technology coupled with electronics to produce a 4 mA to 20 mA signal proportional to pressure input. The pressure sensors are physically mounted in the sensor module for both designs, which is a hermetically sealed assembly also containing selected electronics. The 3150 series and 3051N models and 1150 series designs utilize stainless steel process wetted material as the standard offering; however, there are differences in the design architecture of the flanged interface.

The 1150 series utilizes a conventional architecture; with the pressure sensing diaphragms on separate planes. This architecture is based on the Rosemount 1151 design. The 3150 series and 3051N models utilizes a "coplanar" architecture; with both pressure sensing diaphragms on the same plane. This architecture, which is based on the Rosemount 3051 design released for commercial applications in 1989, enables the use of more advanced sensor technology for improved performance. The coplanar architecture used on the 3150 Series has been in use on the Rosemount 3051C commercial pressure transmitter for approximately twenty-five years and also on the 3051N nuclear safety transmitter for approximately fifteen years.

A major benefit of the "coplanar" architecture is that the sensor is isolated from flange and welding stresses within the module. For the 1150 series, however, the capacitive sensing element (sensor) experiences stresses due to process flange bolting. The large stresses on the 1153 and 1154 sensor was the root cause of oil loss issues experienced in the late 1980 time frame, and resulted in the issuance of four Rosemount Technical Bulletins. On the other hand, the 3150 series and 3051N models, in addition to isolating the sensor from stresses, also utilizes a process c-ring that requires a much lower seating load, imparting less stress to the isolation diaphragms. Because of this design similarity between the 3150 series and 3051N models (with its long-term reliability of over 3.5 million units shipped),

any failures related to oil loss are expected to be rare for 3150 series and 3051N models.

The oil-filled system for 3150 series and 3051N models and 1150 series contain the same oil types, similar isolation diaphragms, fill tubes, and similar materials of construction. The sensor designs for 3150 series and 3051N models and 1150 series are primarily of metal and glass construction. For the 3150 series and 3051N models and 1150 series, the capacitive sensor is excited by an AC voltage, which is rectified and conditioned to provide a DC sensor current output, which is then amplified and adjusted to provide a 4mA to 20mA DC output for the intended pressure measurement.

The electrical designs of both the 3150 series and 1150 series are based on bipolar semiconductor technology and purely analog circuitry. No microprocessors or digital electronics are employed on either platform. The 3150 series electronics employ the same basic architecture of the 1150 series, yet have improved accuracy, linearity, EMC performance, scalability (range down), and ease of calibration. To optimize the performance of the 3150 series sensor, the oscillator frequency has an increased value of 110 kHz, and a temperature stable E-core transformer has replaced the toroidal core transformer used in

Enclosure Updated Description and Assessment of Proposed License Amendment the 1150 series. The 3150 series electronics provide improvements in stability, reliability, and qualified life over the 1150 series.

The 3150 series electronics circuitry is partitioned onto three circuit boards, whereas the 1150 series circuitry requires five. This reduction in circuit boards reduces number of interconnects and risk of interconnect failure. The 3150 also utilizes surface-mount packaging which performs better in shock and vibration.

The 3051N transmitter electronic module differs from the 3150 transmitter in that it uses digital microprocessor architecture. The module receives the analog pressure signal from the capacitive sensor and converts it to a digital value. This is then converted to a 4-20 mA signal that is proportional to the pressure changes in the sensor. The 3051N is referred to as a smart transmitter because it provides features such as more calibration and processing functions without the need for additional analog circuitry or complex measurement and test equipment. The digital design also provides self-diagnostics and the ability to output a high or low signal in the event of a detected failure. Similar to the damping options in the 1150 and 3150 series transmitters, the 3051N has a programmable damping option which in this case is applied via the microprocessor function.

FMEA Results The theory of operation for 3150 series and 3051N models is identical to 1150 series. The process pressure introduced to the transmitter's pressure chambers produces a displacement of the sensing diaphragm which is measured via capacitance measurements between the sensing diaphragm and the metallized surfaces on either side of the sensing diaphragm. The sensor is protected in overpressure conditions by the glassed regions which also provide electrical insulation. The sensor capacitance is processed by the transmitter electronics to provide a linearized signal through the 4 mA to 20 mA current.

Like the 1150 series transmitters, the 3150 series and 3051N model transmitters isolate the process fluid from the capacitive sensing element via dual isolation diaphragms that contain an incompressible fill fluid. For 3150 series and 3051N models, the fluid is contained in geometries that are different from the 1150 series, but the design concept is identical with the fill fluid acting as the medium that transfers pressure from the process fluid to the capacitive sensing element. The oil creates the dielectric for the capacitance signal between sensing diaphragm and metallized surfaces.

Electrical component failures are considered in the FMEA. Based on experience, electrical component failures annunciate as highly detectable changes such as large off-set, erratic output, off-scale failure, or non-linearity. Based on experience with 1150, 3150 series and 3051N model pressure transmitters, electrical component failure is random in nature, not common mode, and does not adversely affect time response without being detectable through typical channel monitoring or functional checks.

Like the 1150 series, transmitter time response of 3150 series and 3051N models can be affected by a small leak within the oil-filled system. A small leak can originate at one of several points within the system including fill tube leaks, isolating diaphragms, and glass-to-metal seals. If leaks occur within either side of the oil-filled system, the isolating diaphragm (on the leaking side) will contract proportionally to the leak, and will eventually contract to a point at which the isolating diaphragm contacts and rests against the convolution plate. At that point, the fill fluid leak would be detectable during calibration. Prior to that point, a leak would not result in a degraded response time.

Enclosure Updated Description and Assessment of Proposed License Amendment Like the 1150 series, the viscosity of the oil also affects 3150 series and 3051N models transmitter response time. If viscosity increases, so will the transmitter response time. Oil viscosity will change with ambient temperature, therefore published time constants are specified at 100°F (37.8°C). The 3150 series has undergone numerous qualification test programs and no discernable changes in transmitter response time have been noted, suggesting that the viscosity of the oil is largely unaffected by aging or radiation at levels achieved in the various 3150 series qualifications.

Operating Experience of Rosemount 3150 Series and 3051N Models The FMEA summarized above establishes an analytical assessment of failure modes associated with the Rosemount 3150 series design that could affect pressure transmitter response time. It is appropriate to discuss operating experience for the 3150 series design to determine if there is any inconsistency between the analytical approach and what has been experienced in actual service. As such, a summary of the field return history of the 3150 series pressure transmitter and the observed field failure rate for all known field failures; specifically, for field failures that could affect response time, is provided.

A summary of the field return history of the Rosemount 3051IM product and an estimate of field failure rate of this product is also provided in the same manner. Analysis of the 3051N operating history is relevant for assessment of failure modes related to the sensor design (such as oil loss), since the 3051N has been shipped for mild environment nuclear safety applications since 2001, and the sensor and oil fill system designs are consistent between Rosemount 3150 series and 3051N models.

For the purpose of this assessment, estimated failure rate is calculated using the following formula:

Estimated Failure Rate = Returned Field Failures / Estimated Cumulative Service Hours Table 1 summarizes estimated failure rates for both Rosemount 3150 series and 3051N model pressure transmitters. In this evaluation, three failure rates are calculated:

Total Failure Rate: Uses all units returned for failure analysis, whether confirmed or not confirmed in the factory. This is a highly conservative method to established estimated failure rate.

In-Service Failure Rate: Uses only units that failed in service. If it was not reported whether or not a unit failed in service, it will be conservatively assumed that it failed in service.

Oil Loss Failure Rate: Uses failures related to oil loss. This failure mode is specifically presented due to legacy industry concerns with 1150 series failures and to highlight that there have been no reported field failures in nuclear safety applications due to oil loss for either the Rosemount 3150 series or 3051N models coplanar platforms.

The data outlined in Table 1 provide high confidence that the overall failure rate of coplanar pressure transmitters used in nuclear safety applications is low and that failure modes found in service or that may impact response time are rare or have not been observed in the field.

Enclosure Updated Description and Assessment of Proposed License Amendment Table 1 - Estimated Failure Rates for 3150 Series and 3051N Series 2001 Year Launched 2009 In-Service Failure Rate (Failure/Hour)

Estimated Cumulative Service Hours Total Failure Rate (Failure/Hour)

Observed In-Service Failures Observed Oil Loss Failures Total Return Failures Units Shipped 3.93 X 10-^

12,117 2.98 X 10-^

2,767 Oil Loss Failure Rate (Failures/Hour)

Conclusions Based on the evaluation performed for the Rosemount 3150 series and 3051N model pressure transmitters, it has been concluded that no new failure modes exist for the 3150 series and 3051N models design which would alter the applicability of the conclusions for the 1150 series pressure transmitters contained in the EPRI, Westinghouse, or Combustion Engineering Owners Group reports discussed above.

In addition to following the approved approach developed above, the associated EPRI recommendations will also be retained:

Perform hydraulic RTT before installation of new transmitters and/or switches or after refurbishment.

Transmitters and/or switches that utilize capillary tubes have RTT performed after initial installation and after each maintenance or modification that has the potential to damage the capillary tubes.

If variable damping is used, implement a method to assure that the potentiometer is at the required setting and cannot be inadvertently changed.

This approach also continues to use "allocated response time" for the specified pressure sensors. Since the response time assumed in the safety analyses is the summation of all response times of components with the protective function, some assumed value for the transmitter response time value must be used in lieu of an actual measured value. In accordance with Section 3.1 of the NRC Safety Evaluation for the CEOG report (Reference 6.2), the allocated response times are obtained from two sources: either from the original equipment manufacturer specification or from a statistical analysis of the results of previous RTTs.

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements Regulatory Guide (RG) 1.118, Periodic Testing of Eiectric Power and Protection Systems, describes a method acceptable to the NRC staff for complying with the NRCs regulations with respect to the periodic testing of the electric power and protection systems. This RG endorses the use of IEEE Std. 338-1987, Criteria for the Periodic Surveiliance Testing of Nuclear Power Generating Station Safety Systems. The standard provides design and

Enclosure Updated Description and Assessment of Proposed License Amendment operational criteria for the performance of periodic testing as part of the surveillance program of nuclear power plant safety systems. The periodic testing consists of functional tests and checks, calibration verification, and time response measurements, as required, to verify that the safety system performs to meet its defined safety functions. Clause 6.3.4 of IEEE 338-1987 states response time testing shall be required only on safety systems or subsystems to verify that the response times are within the limits given in the Safety Analysis Report, including Technical Specifications. Response time testing of all safety-related equipment is not required if the response time of safety system equipment is verified by functional testing, calibration checks, other tests, or both. This is acceptable if it can be demonstrated that changes in response time beyond acceptable limits are accompanied by changes in performance characteristics that are detectable during routine periodic tests.

The proposed change will allow certain replacement pressure transmitters to use allocated sensor response times in lieu of the measurement of response times. This is consistent with Clause 6.3.4 of IEEE 338-1987, in that changes in response time beyond acceptable limits are accompanied by changes in performance characteristics that are detectable during other routine periodic tests. The replacement pressure transmitters will continue to perform the same function as the original equipment. As such, the system operation, design basis, and capability for testing will remain unchanged.

4.2 Precedent The proposed license amendment was developed using relevant information from NRC approved TSTF-111, TSTF-368, and industry technical reports.

4.3 No Significant Hazards Consideration By letter number 102-07808, dated October 12, 2018 (ADAMS Accession number ML18285A575) APS reduced the scope of the LAR to specific replacement model Rosemount pressure transmitters, and is no longer seeking approval of an engineering evaluation methodology to permit APS to exempt future transmitter model changes from periodic response time testing without prior NRC approval. APS is providing additional information that clarifies the application, does not expand the scope of the application as originally noticed, and does not change the NRC staff's original proposed no significant hazards consideration determination as published in the Federal Register on July 31, 2018 (83 FR 36973). The underlying reasoning and conclusions that the proposed licensing action is not a significant hazards consideration remain unchanged, since APS reduced the scope of the application.

4.4 Conclusion APS concludes that operation of the facility in accordance with the proposed amendment does not involve a significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of "no significant hazards consideration" is justified.

Based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or the health and safety of the public.

Enclosure Updated Description and Assessment of Proposed License Amendment

5.0 ENVIRONMENTAL CONSIDERATION

The proposed change would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, Standards for Protection Against Radiation, or would change an inspection or surveillance requirement.

However, the proposed change does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed change meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed change.

6.0 REFERENCES

6.1 EPRI Report NP-7243, Revision 1, Investigation of Response Time Testing Requirements, May 1991 6.2 CEOG NPSD-1167-A, Revision 2, Eiimination of Pressure Sensor Response Time Testing Requirements, January 2001, and NRC Letter (Stuart A. Richards - NRC to Richard Bernier - CEOG), Correction of Safety Evaluation for Combustion Engineering Owners Group Topical Report CE NPSD-1167, Revision 2, Elimination of Pressure Sensor Response Time Testing Requirements, December 5, 2000 6.3 NRC letter to Arizona Public Service Company dated April 19, 2001, Paio Verde Nuclear Generating Station Units 1, 2, and 3 - Issuance of Amendments on Response Time Testing for Engineered Safety Feature and Reactor Pressure System Pressure Sensors (ADAMS Accession number ML011130056) ^License Amendment 135) 6.4 Emerson Report, 3150 Series Pressure Transmitter FMEA and Evaluation Related to Elimination of Pressure Sensor Response Time Testing, Document Number D2015006, Revision A, dated November 7, 2017 6.5 Palo Verde Generating Station Engineering Study 13-JS-A105, Revision 0, Evaluation of 3150 Series and 305IN Rosemount Pressure Transmitters for Response Time Testing Requirements, dated November 2, 2018

Enclosure Updated Description and Assessment of Proposed License Amendment ATTACHMENT 1 Revised Marked-up Technical Specifications Bases Pages B 3.3.1-46 B 3.3.1-47 B 3.3.2-15 B 3.3.2-16 B 3.3.5-27 B 3.3.5-28

BASES RPS Instrumentation - Operating B 3.3.1 SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.1.13 This SR ensures that the RPS RESPONSE TIMES are verified to be less than or equal to the maximum values assumed in the safety analysis. Individual component response times are not modeled in the analyses. The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor to the point at which the RTCBs open. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Response time may be verified by any series of sequential, overlapping or total channel measurements, including allocated sensor response time, such that the response time is verified.

Allocations for sensor response times may be obtained from the records of test results, vendor test data, or vendor engineering specifications. Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing RequirementSr^^

(Ref. 12a) provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the Topical Report.

Rosemount pressure transmitters (Series 3150 and model 3051N) have been reviewed and approved by the NRC staff for the use of allocated sensor response times (Ref. 12b). Response time verification for other sensor types must be demonstrated by test.

The allocation of sensor response times must be verified prior to placing a new component in operation and reverified after maintenance that may adversely affect the sensor response time.

A Note is added to indicate that the neutron detectors are excluded from RPS RESPONSE TIME testing because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.4)

PALO VERDE UNITS 1,2,3 B 3.3.1-46 (continued)

REVISION 66

RPS Instrumentation - Operating B 3.3.1 BASES REFERENCES 1.

10 CFR 50, Appendix A, GDC 21 2.

10CFR 100.

3.

NRC Safety Evaluation Report, July 15, 1994.

4.

UFSAR, Chapter 7 5.

UFSAR, Chapters 6 and 15.

6.

10 CFR 50.49.

7.

"Calculation of Trip Setpoint Values, Plant Protection System". CEN-286(v), or Calculation 13-JC-SG-203 for the Low Steam Generator Pressure Trip function.

8.

UFSAR, Section 7.2, Tables 7.2-1 and 7.3-11A.

9.

CEN-327, June 2, 1986, including Supplement 1, March 3, 1989, and Calculation 13-JC-SB-200.

10.

CEN-305-P, "Functional Design Requirements for a Core Protection Calculator."

11.

CEN-304-P, "Functional Design Requirements for a Control Element Assembly Calculator."

12a.

CEOG Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements."

12b.

NRC Letter dated XX/XX/XXX. License Amendment XXX fADAMS Accession Number MLXXXXXXXX1 13.

CEN-323-P-A, "Reload Data Block Constant Installation Guidelines", Combustion Engineering, Inc.,

September, 1986.

14.

UFSAR Section 1.8, "Regulatory Guide 1.105; Instrument Setpoints (Revision 1, November 1976)

PALO VERDE UNITS 1,2,3 B 3.3.1-47 REVISION 66

BASES RPS Instrumentation - Shutdown B 3.3.2 SURVEILLANCE REQUIREMENTS SR 3.3.2.4 (continued)

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The Surveillance is modified by a Note to indicate that the neutron detectors are excluded from CHANNEL CALIBRATION because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.4).

SR 3.3.2.S This SR ensures that the RPS RESPONSE TIMES are verified to be less than or equal to the maximum values assumed in the safety analysis. Individual component response times are not modeled in the analyses. The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor to the point at which the RTCBs open. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Response time may be verified by any series of sequential, overlapping or total channel measurements, including allocated sensor response time, such that the response time is verified.

Allocations for sensor response times may be obtained from records of test results, vendor test data, or vendor engineering specifications. Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements," (Ref. 7) provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the Topical Report.

Rosemount pressure transmitters (Series 3150 and model 3051N) have been reviewed and approved by the NRC staff for the use of allocated sensor response times (Ref. 8). Response time verification for other sensor types must be demonstrated by test.

The allocation of sensor response times must be verified prior to placing a new component in operation and reverified after maintenance that may adversely affect the sensor response time.

A Note is added to indicate that the neutron detectors are excluded from RPS RESPONSE TIME testing because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.4).

PALO VERDE UNITS 1,2,3 B 3.3.2-15 (continued)

REVISION 66

BASES RPS Instrumentation - Shutdown B 3.

3.2 REFERENCES

1.

10CFR50.

2.

10CFR100.

3.

UFSAR, Section 7.2 Tables 7.2-1 and 7.3-11 A.

4.

"Calculation of Trip Setpoint Values Plant Protection System, CEN-286(v)", or Calculation 13-JC-SG-203 for the Low Steam Generator Pressure Trip Function.

5.

NRC Safety Evaluation Report, July 15, 1994.

6.

CEN-327, June 2, 1986, including Supplement 1, March 3, 1989, and Calculation 13-JC-SB-200.

7.

CEOG Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements."

8.

NRC Letter dated XX/XX/XXX. Licensing Amendment XXX fADAMS Accession Number MLXXXXXXXXX)

PALO VERDE UNITS 1,2,3 B 3.3.2-16 REVISION 66

ESFAS Instrumentation B 3.3.5 BASES SURVEILLANCE REQUIREMENTS SR 3.3.5.4 (continued)

Response time may be verified by any series of sequential, overlapping or total channel measurements, including allocated sensor response time, such that the response time is verified.

Allocations for sensor response times may be obtained from records of test results, vendor test data, or vendor engineering specifications. Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements," (Ref. 10a) provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the Topical Report.

Rosemount pressure transmitters (Series 3150 and model 3051N1 have been reviewed and approved bv the NRC staff for the use of allocated sensor response times (Ref. 10b). Response time verification for other sensor types must be demonstrated by test.

The allocation of sensor response times must be verified prior to placing a new component in operation and re-verified after maintenance that may adversely affect the sensor response time.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.5.5 SR 3.3.5.5 is a CHANNEL FUNCTIONAL TEST similar to SR 3.3.5.2, except SR 3.3.5.5 is performed within 92 days prior to startup and is only applicable to operating bypass functions. Since the Pressurizer Pressure - Low operating bypass is identical for both the RPS and ESFAS, this is the same Surveillance performed fortheRPS in SR 3.3.1.13.

The CHANNEL FUNCTIONAL TEST for proper operation of the operating bypass permissives is critical during plant heatups because the bypasses may be in place prior to entering MODE 3 but must be removed at the appropriate points during plant startup to enable the ESFAS Function. Consequently, just prior to startup is the appropriate time to verify operating bypass function OPERABILITY. Once the operating bypasses are removed, the bypasses must not fail in such a way that the associated ESFAS Function is inappropriately bypassed. This feature is verified by SR3.3.5.2.

The allowance to conduct this test with 92 days of startup is based on the reliability analysis presented in topical report CEN-327, "RPS/ESFAS Extended Test Interval Evaluation" (Ref. 9).

PALO VERDE UNITS 1,2,3 B 3.3.5-27 (continued)

REVISION 66

BASES ESFAS Instrumentation B 3.

3.5 REFERENCES

1.

UFSAR, Section 7.3.

2.

10 CFR 50, Appendix A.

3.

NRC Safety Evaluation Report, July 15, 1994 4.

IEEE Standard 279-1971.

5.

UFSAR, Chapter 15.

6.

10 CFR 50.49.

7.

"Calculation of Trip Setpoint Valves Plant Protection System", CEN-286(v), or Calculation 13-JC-SG-203 for the Low Steam Generator Pressure Trip Function.

8.

UFSAR, Section 7.2, Tables 7.2-1 and 7.3-11 A 9.

CEN-327, May 1986, including Supplement 1, March 1989, and Calculation 13-JC-SB-200.

10a.

CEOG Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements."

10b.

NRC Letter dated XX/XX/XXX. License Amendment XXX fADAMS Accession Number ML XXXXXXXXX1 11.

UFSAR Section 1.8, Regulatory Guide 1.105; Instrument Setpoints (Revision 1, November 1976)

PALO VERDE UNITS 1,2,3 B 3.3.5-28 REVISION 66

Enclosure Updated Description and Assessment of Proposed License Amendment ATTACHMENT 2 Arizona Public Service Company Response to NRC Staff Request for Additional Information

Enclosure Updated Description and Assessment of Proposed License Amendment ATTACHMENT 2 Arizona Public Service Company Response to NRC Staff Request for Additional Information

Background

By letter dated May 25, 2018 [Agencywide Documents Access and Management System (ADAMS) Accession No. ML18145A303], Arizona Public Service Company (APS) submitted a license amendment request (LAR) to revise the technical specification (TS) requirements regarding response time testing of pressure transmitters for Palo Verde Nuclear Generating Station, Units 1, 2, and 3 (PVNGS). In a letter dated October 12, 2018 (ADAMS Accession No. ML18285A575), APS confirmed that it is limiting the scope of the LAR to a specific replacement of a set of Rosemount pressure transmitters rather than seeking approval of a general methodology. The PVNGS TS currently authorize the elimination of response time testing for specific vendor transmitter models based on the previous U.S. Nuclear Regulatory Commission (NRC) approval. The existing transmitters that became obsolete are being replaced by newer model transmitters of similar design and construction.

In order for the NRC staff [Instrumentation and Controls Branch (EICB)] to complete its review, the NRC provided a request for additional information (RAI) by correspondence dated January 8, 2019 (ADAMS Accession number ML19008A361). This attachment provides the APS response to each RAI. The RAI is stated first, followed by the APS response.

EICB-1; To support the NRC staff's review, the licensee provided NRC staff electronic audit access to documentation that supports the technical basis for the subject LAR for elimination of response time testing requirements. Two key documents examined during our electronic audit includes a vendor technical report and the licensee's evaluation report. The licensee portion of the evaluation in the portal appears to provide the most up-to-date analysis.

Please provide the latest version of the licensee's evaluation portion on the docket. The licensee also has the option of substituting this latest evaluation into the revised version of the LAR (i.e., replacing the original evaluation in the LAR) in lieu of docketing a separate file. The vendor technical report does not need to be submitted. This information is needed to form the docketed basis of NRC's safety evaluation of the LAR.

APS Response: of this enclosure provides the requested APS engineering study. Appendix A of the engineering study is the vendor technical report and is proprietary to the vendor. As the vendor technical report was not requested by the NRC staff, it is not included in. In addition, the LAR has been updated to include summary information from the engineering study to facilitate NRC staff review.

EICB-2:

Section 2.1.2 of the evaluation states, in part, that the 3051N series has self-diagnostics but does not provide any further detail on what those self-diagnostics are. Section 2.2.2 states, in part, that a self-diagnostic routine monitors the processing function of the 3051N 1

Enclosure Updated Description and Assessment of Proposed License Amendment ATTACHMENT 2 Arizona Public Service Company Response to NRC Staff Request for Additional Information series. The failure modes and effects analysis also states that microprocessor failures would be detected by self-diagnostics. In concluding the study, the licensee states, in part, that failure modes that would impact sensor response times will be detected through alternate methods. It appears that self-diagnostic features have a critical role in the detection of potential new failures for the 3051 series transmitters, which is credited as supporting the overall technical justification for elimination of response time testing. Please describe the specific set of self-diagnostic features of the 3051 series of transmitters (and 3051N model) that can detect or protect against failures of transmitters and affect response time.

APS Response:

The 3051 series transmitters and specifically the 3051N, which is a quality dedicated 3051C (commercial) transmitter, perform continuous self-diagnostics. The self-diagnostics provide detection and annunciation of faulted conditions. Annunciation is provided through the ability to drive the transmitter to a saturated high or low signal based on errors that can affect transmitter operation. This is referred to as the alarm mode. Errors within the electronics module that could affect response time are expected to result in gross output changes that would be detected by the self-diagnostics and made apparent with the associated alarm mode driving the signal high or low.

The diagnostics categorize errors into two sub-groups. The first set is error messages that contain conditions that will affect transmitter operation. These errors will result in the transmitter output being driven high or low based on the transmitter's selected configuration. The second set of messages is warnings that reflect operational conditions, but do not necessarily affect transmitter operation. The reportable diagnostic messages provide insight into the checks performed by the self-diagnostics, which include memory verification routines and electronics board monitoring. The following diagnostic messages are provided in the 3051N reference manual 00809-0100-4808, Rev CA, June 2008.

ERROR MESSAGES FAIL - A detected incompatibility between the CPU board and sensor module.

FAIL MODULE - The sensor module is disconnected or is malfunctioning. Possible sources of this diagnostic error include:

Pressure or temperature updates are not being received in the sensor module A non-volatile memory fault that will effect transmitter operation has been detected in the module by the memory verification routine.

FAIL ELECT - The transmitter electronics board is malfunctioning due to an internal fault.

FAIL CONFIG - A memory fault has been detected in a location that could affect transmitter operation, and is user-addressable.

WARNING MESSAGES PRESS LIMIT - The process variable read by the transmitter is outside of the transmitters range.

Enclosure Updated Description and Assessment of Proposed License Amendment ATTACHMENT 2 Arizona Public Service Company Response to NRC Staff Request for Additional Information WARNING MESSAGES (continued^

TEMP LIMIT - The secondary temperature variable read by the transmitter is outside of the transmitter's range.

CURR SATURD - The pressure read by the module is outside of the specified range, and the analog output has been driven to saturation levels.

LOOP TEST - A loop test is in progress. During a loop test or 4-20 mA trim, the analog output is set to a fixed value.

XMTR INFO - A non-volatile memory fault has been detected in the transmitter memory by the memory verification routine. The memory fault is in a location containing transmitter information. This warning does not affect transmitter operation.

From the diagnostic messages provided in the 3051N user manual, it can be seen that the self-diagnostics monitor parameters such as output signal, electronics board, memory, and transmitter configuration. The diagnostics provide detection and annunciation of these faulted conditions which could affect transmitter operation.

EICB-3:

Section 2.2.2 of the evaluation, states, in part, that "non-specific failures" in the processor hardware or software routines that delay the processing function could theoretically increase time without an apparent gross failure of the device. This would appear to mean that non self announcing failures could impact response time by causing delays in the processing function of the electronics module. It is not clear whether the licensee is referring to issues such as errors in code or component failure within the electronics module. Please describe the non-specific failures that could affect response time.

APS Response:

Non-specific failures described in section 2.2.2 of the evaluation refer to a generic subset of microprocessor failure modes that can be described as "fail-slow" conditions. Fail-slow conditions are a state when a microprocessor continues to operate, but at reduced speed or performance. Microprocessors themselves do not have credible failure modes for causing a fail-slow condition, but can enter this condition based on associated software or hardware faults.

An example of a hardware induced fail-slow condition would be an internal power supply fault that reduces the voltage to the microprocessor. Operating at a reduced voltage can affect processor clock speed and performance due to the power limitations of the reduced voltage. Non-application specific processors are susceptible to this condition because they have higher power requirements and need external forced cooling features. For the application in the 3051N transmitter, signal processing of the pressure signal is performed by a microcontroller. These require very little power and optimum required processor clock speed is not critical for this application, as processors operate at frequencies in the megahertz range. Whereas actual mechanical pressure response time is occurring at a hertz speed as identified by allocated response times in the 0.2 and 0.5 second range. For the

Enclosure Updated Description and Assessment of Proposed License Amendment ATTACHMENT 2 Arizona Public Service Company Response to NRC Staff Request for Additional Information 3051IM, a reduced voltage would result in complete failure of the processor before affecting operation or response time.

Theoretical software or firmware fail-slow conditions could be the result of memory corruption that reduces the available memory cache size for the processor and therefore reduces its performance. However, the 3051N microcontroller does not use cache memory to perform its processing function and is not subject to this type of fail-slow condition.

Other software examples would be a corruption of the software routine that induces internal re-boots of the processor. For the 3051N application re-boots of the processing function would be apparent as the output signal would be driven high or low during the re-boot sequence. As with hardware induced fail-slow conditions, for the application of processing the 3051N pressure signal, reduced processor speeds would not reach levels that would impact response time without gross failure occurring. Additionally, software based fail-slow conditions as a result from memory errors are expected to be detected through the diagnostic memory verification routine performed by the transmitter.

Based on the discussions above, when applying these theoretical fail-slow conditions to the 3051N pressure transmitter it is not credible that these would result in undetected fail-slow conditions. Fail-slow conditions as described above are not applicable or would result in gross failure of the microcontroller. These would be apparent through calibration, channel monitoring, or self-diagnostics performed by the transmitter.

EICB-4:

Please revise the proposed TSs to remove reference to approved methodological approach, and reflect only elimination of response times for the specific equipment justified in this LAR.

APS Response:

The LAR has been updated to remove reference to an approved methodology approach and now reflects solely the elimination of response times for only the specific equipment justified. As described in greater detail in Section 2.1 of this enclosure, the reduction in LAR scope resulted in the elimination of the proposed changes to the TS response time testing definitions for the ESF and RPS.

The NRC staff review and approval of the use of allocated sensor response times, in lieu of periodic response time testing, for the specific replacement Rosemount pressure transmitters impacts the response time testing described in the TS Bases for TS surveillance requirements (SR) 3.3.1.13, 3.3.2.5, and 3.3.5.4. Marked-up TS Bases pages are provided in Attachment 1 for information.

Enclosure Updated Description and Assessment of Proposed License Amendment ATTACHMENT 3 Engineering Study 13-JS-A105 Evaluation of 3150 Series and 3051N Rosemount Pressure Transmitters for Response Time Testing Requirements (Appendix A of the Study is not included as it is proprietary to Emerson and not requested to be docketed by the NRC staff)

iQi PaloVerde' GENERATING STATION Engineering Study Identifier 13-JS-A105 No Restriction Q X

SQA SWMS ISFSI/

Contains Proprietary QAG Association Dry Cask Pending Mods Safeguards NQR N/A Changes NO No No Revision Title Evaluation of 3150 Series and 3051N Rosemount Pressure Transmitters For Response Time Testing Requirements Amendments (EDCs) Incorporated and Documents Superseded:

N/A Preparer Work Assignment: None Digitally signed by Wilson, Craig B(Z05438)

Wilson, Craiq B(Z05438) DN cn=Wilson,CraigB(Z05438)

Date:2018.11.01 15:46:00-07W Reviewer*: Work Assignment: None N/A Responsible Engineer: Work Assignment; None Digitally signed by Wilson, Craig B(Z05438)

Wilson, Craig B(Z05438)

Date:2018.11i)1 15:46:49 *07'00 Reviewer*: Work Assignment: None N/A Reviewer*: Work Assignment: None N/A Document Verifier: Vifork Assignment: None Baker, Roxton E(Z99675)

Digitally signed by Baker, Roxton E(Z99679 DN: cn^Baker, Roxton E(Z9967S)

Reason: l&C Des Eng IV Date: 2018.11.02 13:44:56 -07W Reviewer*: Work Assignment None N/A Approver: Work Assignment: None Digitally signed by Bjomn, Kent R(Z11871)

Bjornn, Kent R(Z1 1871) DN:cn=Bjornn,KentR(Z11871)

Date: 2018.11.02 14:03:14 -07W Restrictions (opt), Reason for and Description of Revision, and Regulatory Reviews

• Reason for and Description of Revision Initial Issue

• Nuclear Regulatory Review, including 50.59 Applicability Determination (3QC: NGS73)

Procedure 93DP-0LC07.R28 and Admin Guide 93DP-0LC07-01.R05 were reviewed for applicability of 10 CFR 50.59 and other 10 CFR change requirements. This study supports changes that will be made to the Technical Specifications and will require NRC approval before implementation. Approval for these changes are being sought via LDCRs 18-TOOl and 18-BOOl. In accordance with 93DP-0LC07-01.R05, section 5.3.7.2, 50.59 screening is not applicable for this supporting study.

AD performed by Craig Wilson 10/20/2018 Environmental Review Procedure 91DP-0EN02.R10, and form PV-E0039 were reviewed and none of the results from this study affect environ mental concerns.

Industrial Safety Review None of the results from this study affect industrial safety activities.

Include organization

PALO VERDE GENERATING STATION Evaluation of 3150 Series and 3051N Rosemount Pressure Transmitters For Response Time Testing Requirements 13-JS-A105 RevO 2 of 16 Table of Contents Table of Contents..............

Lists of Tables and Figures.

Revision History................

List of Acronyms...............

1 Introduction........................................................................................................................................ 6 1.1 Background...................................................................................................................................6 1.2 Terminology...................................................................................................................................7 1.3 Purpose of the Study..................................................................................................................... 7 1.4 Scope of the Study........................................................................................................................ 7 2 Evaluation............................................................................................................................................. 7 2.1 Similarity Review............................................................................................................................7 2.1.1 Mechanical Design Comparison...........................................................................................8 2.1.2 Electrical Design Comparison.............................................................................................. 9 2.1.3 Response Time Comparison............................................................................................... 9 2.2 Failure Modes and Effects Analysis............................................................................................... 10 2.2.1 FMEA Preparation............................................................................................................. 10 2.2.2 FMEA Worksheet Results...................................................................................................11 2.3 Operating History Review............................................................................................................. 14 3 Results and Conclusions......................................................................................................................14 4 References..........................................................................................................................................15 Appendix A-Emerson report D2015006, "3150 Series Pressure Transmitter FMEA and Evaluation Related to Elimination of Pressure Sensor Response Time Testing"............................. 16

PALO VERDE Evaluation of 3150 Series and 3051N Rosemount Pressure Transmitters For Response 13-JS-A105 GENERATING STATION Time Testing Requirements RevO 3 of 16 Lists of Tables and Figures Table 2-1.

Table 2-2.

Specified Response Time Comparison..........

FMEA Worksheet 3051N Electronics Module.

.10

.13 Figure 2-1. Exploded Diagrams of 3150 and 1150 Series Transmitters.

Figure 2-2. Functional Diagram of 3051N Electrical Components.......

...8

.11

PALO VERDE Evaluation of 3150 Series and 3051N Rosemount Pressure Transmitters F=br Response 13-JS-A105 GENERATING STATION Time Testing Requirements Rev 0 4 of 16 Revision History Rev Responsible Engineer Independent Verifier Other Reviewers, Dept.

Approver Approval Date Reason for and Description of Change 0

Craig B. Wilson Roxton E. Baker Kent R. Bjomn Nov 2018 Initial Issue

PALO VERDE Evaluation of 3150 Series and 3051N Rosemount Pressure Transmitters For Response 13-JS-A105 GENERATING STATION Time Testing Requirements RevO 5 of 16 List of Acronyms CEOG Combustion Engineering Owners Group EPRI Electric Power Research Institute ESFAS Engineered Safety Feature Actuation System FMEA Failure Modes and Effects Analysis NRC Nuclear Regulatory Commission PVGS Palo Verde Generating Station PWROG Pressurized Water Reactors Owners Group RNII Rosemount Nuclear Instruments, Inc.

RPS Reactor Protective System RTT Response Time Testing UFSAR Updated Final Safety Analysis Report

PALO VERDE Evaluation of 3150 Series and 3051N Rosemount Pressure Transmitters For Response 13-JS-A105 GENERATING STATION Time Testing Requirements Rev 0 6 of 16 1 Introduction

1.1 Background

PVGS Technical Specifications, section 3.3 Instrumentation, require periodic verification that the response times of the Reactor Protective System (RPS) and the Engineered Safety Feature Actuation System (ESFAS) are within time limits required by the plant accident analyses. The overall protective function response times are listed in Sections 7.2 and 7.3 of the UFSAR. The response time tests are conducted on an 18 month staggered test basis. The 18 month frequency is consistent with the typical industry refueling cycle and is based upon plant operating experience, which shows that random fail ures of instrumentation components causing serious response time degradation, but not channel fail ure, are infrequent occurrences.

The UFSAR specifies the maximum acceptable total loop actuation response times. The PVGS surveil lance test program involves dividing the total protection channel into several testable segments. An acceptance time criteria has been established for each test segment such that the combined segment times are less than or equal to the total loop actuation response times specified in the UFSAR. The acceptance criteria for the various instrumentation test segments are established in calculation 13-JC-SB-0202, "Acceptance Criteria for RPS and ESFAS Response Time Testing" (Ref. A.3).

In December 1994, Electric Power Research Institute (EPRI) published report NP-7243, Revision 1, "Investigation of Response Time Testing Requirement" (Ref. C.3). This report used failure modes and effects analysis (FMEA) to determine that periodic response time testing of selected protection channel sensors is not required where routine surveillance, such as calibrations and drift monitoring, demon strate that sensor response time remains within a pre-allocated value. Based upon this report the Com bustion Engineering Owners Group (CEOG) developed topical report CE NPSD-1167-A, revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements" (Ref. B.4). This was submitted to the Nuclear Regulatory Commission (NRC) to support a request to eliminate the requirement to peri odically measure the response times of the protection system sensors. On July 24, 2000, the NRC issued a Safety Evaluation Report (SER) defining the basis for NRC acceptance of the report. Section 2 of the SER identifies that the basis for elimination of RTT is provided in Regulatory Guide 1.118. The Regulatory Guide endorses IEEE 338-1997, "Periodic Testing of Electric Power and Protection Systems,"

(Ref. C.2), section 6.3.4, paragraph 3 (page 11), which states:

"Response time testing of all safety-related equipment, per se, is not required if, in lieu of response time testing, the response time of the safety equipment is verified by functional testing, calibration checks or other test, or both. This is acceptable if it can be demonstrated that changes in response time beyond acceptable limits are accompanied by changes in performance characteristics which are detectable during routine periodic tests."

On April 19, 2001, the NRC issued Amendment 135 to Palo Verde's Operating Licenses allowing either allocated or measured response times for RPS and ESFAS pressure sensors.

As the originally approved pressure sensors become obsolete, it became necessary to replace them with similar newer model sensors. Rosemount Nuclear Instruments, Inc. (RNII), now a part of Emer son, provided the original 1150 series pressure transmitters used at PVGS in many RPS and ESFAS pro tection channel loops. Emerson now provides newer models that are similar in design and construction.

At the request of the Pressurized Water Reactors Owners Group (PWROG), Emerson developed report D2015006, "3150 Series Pressure Transmitter FMEA and Evaluation Related to Elimination of Pressure Sensor Response Time Testing," (Appendix A) evaluating the newer 3150 series transmitters for appli cability of the conclusions in topical report CE NPSD-1167-A for the original pressure transmitters.

PALO VERDE Evaluation of 3150 Series and 3051N Rosemount Pressure Transmitters For Response 13-JS-A105 GENERATING STATION Time Testing Requirements Rev 0 7 of 16 1.2 Terminology For the purpose of this study, the terms "pressure sensor" and "pressure transmitter" are interchange able. Both terms describe the component that is being evaluated in this study, which is the sensor por tion of the instrument control loop.

Response time testing (RTT) is the method of measuring actual loop or component response time.

Total loop RTT may exempt the sensor component from measurement if it has been demonstrated that a predetermined response time value may be substituted for that component. The substitute response time is referred to as the "allocated" response time. The value is typically provided by the vendor or through statistical analysis of historical measurements. The "allocated" response time is verified on-site as part of installation or refurbishment.

"Emerson" and "Rosemount Nuclear Instruments, Inc." both describe the vendor of the 3051N and 3150 series pressure transmitters evaluated in this study.

1.3 Purpose of the Study This engineering study helps support the replacement of 1150 series Rosemount pressure transmitters with newer model 3051N and 3150 series pressure transmitters. Specifically, the Rosemount report for 3150 series pressure transmitters will be reviewed to provide justification for using allocated pressure sensor response times in lieu of measured (RTT) response times for the applicable transmitters. The study provides further analysis to extend the Emerson report conclusions to cover the Rosemount 3051N pressure transmitters.

1.4 Scope of the Study The study applies only to Rosemount 3051N and 3150 series pressure transmitters used as the sensor portion of an RPS or ESFAS protective channel loop. The study does not evaluate or approve the use of allocated response times for any other components or portions of a protection channel loop.

2 Evaluation 2.1 Similarity Review The objective of this similarity review is to compare the original and replacement transmitter design elements that could affect a failure modes and effect analysis (FMEA). Appendix A, Emerson Report D2015006, section 7, provides a detailed design elements review for the 1150 and 3150 series trans mitters. Table A-1 of the Emerson report (Appendix A) comprises the following design elements:

1.

Process flange

2.

Process seal

3. Sensor module

4.

Electronics

5.

Electronics housing

PALO VERDE GENERATINO STATION Evaluation of 3150 Series and 3051N Rosemount Pressure Transmitters For Response Time Testing Requirements 13-JS-A105 Rev 0 8 of 16 Figure 2-1. Exploded Diagrams of 3150 and 1150 Series Transmitters

-f GJ" llll 3150 Series Transmitter 1150 Series Transmitter Figure excerpted from Emerson report D2015006, Figure A-1 A summary of the Emerson design element review is provided below with additional discussion of the 3051N model pressure transmitter.

2.1.1 Mechanical Design Comparison Both the 1150 and 3150 series pressure transmitters use a capacitance sensing element. Both designs house the eiement in a hermeticaiiy sealed sensor module which also contains selected electronics.

The process pressure is applied to the sensing element through the process flange and process seal. These are critical components for the integrity of the pressure boundary. Both models use stainless steel for process wetted materials. There are differences in the architecture of the flanged interface. The 1150 series sensing diaphragms were located on two separate planes, while the 3150 series sensing diaphragms are located on the same plane (coplanar). The major benefit of the coplanar design is that the sensing diaphragm is isolated from flange and welding stresses within the module. Additionally, the coplanar design enables the use of improved sensor elements and results in a lower seating load. These changes address historical causes for oil loss failures in the original 1150 series design. Per the original FMEA analysis performed by EPRI, oil loss failure modes were the primary failure mode that could impact sensor response time.

The oil filled portion of the sensors use similar materials in construction and the same oil type. Sen sor and diaphragm material are of metal and glass construction. The original 1150 series uses a direct weld method for attaching the sensor to the sensor module, while the 3150 series uses brazed joints. The brazing method in this application is considered less stressful to the sensor

PALO VERDE OENERATINO STATION Evaluation of 3150 Series and 3051N Rosemount Pressure Transmitters For Response Time Testing Requirements 13-3S-A105 RevO 9 of 16 materials because it does not directly melt or fuse the sensor material as is the case with direct welding. The entire 3150 series oil-filled system is encapsulated in silicon potting which provides robust vibration support to mitigate mechanical stresses.

The Emerson report also discusses similarities between the 3051N and 3150 series pressure trans mitters. The 3051N uses the same sensing element and coplanar architecture for the sensing dia phragms. This similarity permits the use of extended operating experience for the 3051N in identifying reliability and failure modes for both types of pressure transmitters.

2.1.2 Electrical Design Comparison Both the Rosemount 1150 and 3150 series pressure transmitters use analog electronics to produce a 4-20 mA signal proportional to changes in the capacitive sensor. Although the basic circuit archi tecture is the same, the use of improved electrical components over the 1150 series results in the 3150 series having better performance in stability, reliability and qualified life. Electronic compo nent changes include using a temperature stable E-core transformer in lieu of a toroidal core trans former, use of a higher frequency oscillator, and surface-mount devices which will be less susceptible to shock and vibration. Additionally, the 1150 series uses five circuit boards whereas the 3150 series uses only three; this increases reliability because it reduces the number of required interconnects.

Both the 1150 and 3150 series pressure sensors offer optional adjustable frequency response damping. A comparison of the models show that these damping circuits are functionally and physi cally equivalent.

The 3051N transmitter electronic module differs from the above in that it uses a digital micropro cessor architecture. The module receives the analog pressure signal from the capacitive sensor and converts it to a digital value. This is then converted to a 4-20 mA signal that is proportional to the pressure changes in the sensor. The 3051N is referred to as a Smart transmitter because it provides features such as more calibration and processing functions without the need for additional analog circuitry or complex M&TE. The digital design also provides self-diagnostics and the ability to out put a high or low signal in the event of a detected failure. Similar to the damping options in the 1150 and 3150 series transmitters, the 3051N has a programmable damping option which in this case is applied via the microprocessor function.

2.1.3 Response Time Comparison The following table provides a comparison of response times for Rosemount 1150 series pressure transmitters and the associated Rosemount 3150 series replacement pressure transmitters. The response times below are from PVGS design equivalency change package DEC-00825 (Ref. A.1). An example replacement 3051N pressure transmitter (used for refueling water tank level) response time is also included. In all cases, the appropriately ranged replacement pressure transmitters have equivalent manufacturer specified response times.

PALO VERDE Evaluation of 3150 Series and 3051N Rosemount Pressure Transmitters For Response 13-JS-A105 GENERATING STATION Time Testing Requirements Rev 0 10 of 16 Table 2-1. Specified Response Time Comparison Function Pressurizer Pressure-HI&Lo Steam Generator Level-Hi Narrow Range Steam Generator Level-Lo Wide Range Pressurizer Over Pres sure Refueling Water Tank Level - Lo Model Numbers 1154SH9 3154NA6 1154DP4 3154ND2 1154DP5 3154ND3 1153GD9 3154NG6 Vendor Specified Response Time (Seconds) 0.2 0.2 0.5 0.2 0.2 0.2 0.2 1153DB5 3051ND3 0.2 0.2 Result Same Same Same Same Same 2.2 Failure Modes and Effects Analysis The FMEA will be based on the original FMEA performed under the EPRI-7243 study (Ref. C.3) for the Rosemount 1150 series pressure transmitters. Design differences between the models will be consid ered. FMEA guidance is provided in IEEE 352-2016, "Guide for General Principles of Reliability Analysis of Nuclear Power Generating Station Systems and Other Nuclear Facilities."(Ref. C.l) The FMEA is a systematic approach for identifying the mode of failure and for evaluating the consequences. The essential function of an FMEA is to consider each major part of the SSC, how it may fail, and what the effect of the failure on the SSC would be. For the purpose of evaluating RTT requirements, the FMEA will focus on the failure consequence of a change in response time.

In accordance with the recommendation of IEEE 352-2016, section 5.2.4, the FMEA will consist of a preparation section and the FMEA worksheet. FMEA preparation will establish the following;

1. Definition of the component being analyzed

2.

Description of operation

3.

Failure categories

4.

Environmental considerations.

2.2.1 FMEA Preparation

1. The FMEA will review the Rosemount 3150 and 3051N series pressure transmitters. These share a common sensor and oil filled system design. The objective of the FMEA is to identify failure modes that can adversely impact the sensor response time. Failure mode detection method will also be reviewed to determine if actual response time testing or other technique would be effective for the failure mode.

2. The 3051N and 3150 series transmitters separate the process fluid from the sensing unit through dual isolating diaphragms filled with an incompressible fluid. The fluid transfers the process pressure to the capacitive sensing element. This develops a change in electrical capac itance proportional to pressure. The electrical portion of the sensor converts this to a linear 4-20 milliamp output signal. As discussed in the similarity review above, although the geometries

PALO VERDE OENEBATINO STATION Evaluation of 3150 Series and 3051N Rosemount Pressure Transmitters For Response Time Testing Requirements 13-3S-A105 RevO 11 of 16 of the Rosemount 3150 and 3051N pressure transmitters were changed from the Rosemount 1150 series, the theory of operation remains the same.

3. Failure modes considered include but are not limited to, electrical failures, leakage within the oil filled system, and crimping. Leakage within the oil filled system will be reviewed through all the interfacing mechanical elements of the design. Electronic module failures are treated sepa rately. Table 1 of the Emerson report (Appendix A) contains a detailed list of the principal design components and their functions that were used to develop this FMEA.

Because the Emerson report did not include the electrical module of the Rosemount 3051N pressure transmitter, its failure modes will be addressed in this study. The components of this module are shown in the functional diagram below.

Figure 2-2. Functional Diagram of 3051N Electrical Components Oigital-to-Aulog Signal Conversion Digital Communication Pressure Input Temp.

Sensor Signal Processing Memory Configuration Microprocessor Sensor linearvation Rerange Damping Diagnostics Engineering units Communication 4-20mA HART Output

4. Environmental conditions are considered to be the same for all the transmitter models. The FMEA is not intended to address environmental failure modes unless they would affect sensor response time. As previously identified in the EPRI NP-7243 study (Ref. C.3) temperature may impact the viscosity of the oil fill fluid. Large changes in viscosity have the potential to impact sensor response time.

2.2.2 FMEA Worksheet Results Emerson report D2015006 (Appendix A), section 9, contains the detailed FMEA worksheet for the 3150 series pressure sensor. The results are summarized below.

The FMEA worksheet identified two failure modes that were unique to the Rosemount 3150 series and were not applicable to the Rosemount 1150 series. The first was leakage via the brazed joint in the pressure sensor. Leakage in this location may increase response time as the affected isolation diaphragm moves toward the convolution plate. The second failure mode unique to the Rosemount 3150 series pressure transmitter is leakage through the sensor signal wire path. The result is simi lar to leakage at the brazed joint and may increase response time. Small leakage would be detected by a change in range or signal drift. Large leakage, in both cases, would immediately

PALO VERDE Evaluation of 3150 Series and 3051N Rosemount Pressure Transmitters For Response 13-JS-A105 GENERATING STATION Time Testing Requirements RevO 12 of 16 affect the range and result in a large signal drift. All other identified failure modes were common to both the original 1150 and new 3150 series of pressure transmitters.

Changes in fill fluid viscosity are applicable to both the original and replacement series transmitters.

However, no mechanism for causing gross viscosity changes was identified. Changes caused by temperature have been demonstrated to be within the application limits of the pressure sensors.

The failure mode of capillary tube crimping was not explicitly identified in the FMEA worksheet, but was discussed in the FMEA preparation. The failure mode is not considered to be credible during operation, but could be introduced during handling or maintenance of a transmitter. As with the Rosemount 1150 series, response time testing of the Rosemount 3150 series transmitters after installation or maintenance will detect response time degradation resulting from capillary tube crimping.

Electrical failure modes identified for the Rosemount 3150 series transmitters are, as with the 1150 series, considered random and not common mode. Such failures would be detectable through channel monitoring and functional checks because they would result in large changes in signal off set, range and/or linearity.

Electrical failure modes for the Rosemount 3051N series transmitter are reviewed below in a sepa rate FMEA worksheet. The components of the electronics module are analyzed at the functional level including the three major functions identified in the FMEA preparation (Figure 2-2). These are signal processing, microprocessor, and the digital to analog conversion. The signal processing and digital to analog conversion failure modes would result in similar consequences to the electronic failures in the original Rosemount 1150 series pressure transmitters. Failures within the micropro cessor function would result in large changes in the output signal such as step change, linearity, offset, or range. Non-specific failures in the processor hardware or software routines that delay the processing function could theoretically increase response time without proceeding to gross failure.

However, this is extremely unlikely and, unique to the Rosemount 3051N, the processing function is supervised by a self-diagnostic routine that can be configured to alarm and drive the process value signal beyond saturation high or low. This will reveal electrical failures that would otherwise be hid den. Additionally, electronic module performance is verified during routine calibrations which per form advanced self-diagnostics that are more comprehensive than the continuously running diagnostic routines.

Failure modes in the variable damping feature were also identified for both the 3150 and 3051N series transmitters. As with the 1150 series, mis-adjustment or failure of a damping potentiometer or digital setting can result in an increased response time. In order to address or detect this failure mode, a method must be in place to ensure correct initial setting and function of the damping fea ture. For the digital 3051N transmitters at PVGS, the stored configuration is ensured by the use of a security jumper that precludes the ability to change the pressure transmitter's memory or config uration. These settings are controlled in document VTD-R369-00084, "Rosemount 3051N Smart Pressure Transmitter for Nuclear Service Reference Manual" (Ref. D.3). Proper function of the damping feature for all transmitter types can be demonstrate through initial installation response time testing.

I II

§2

<1

£3 OJ 3

Z U

I iH ino fO V

w

£ (A

I.

o$

lU Z

u.

ri

.a Similarity between 1150 and 3051N Same 305 IN Only Same Same Remarks Failures in signal processing would have similar consequences to that of the analog circuits in the original 1150 series transmitters Microprocessor failures will be detected by self diagnostics with the ability to alarm with a Hi or Lo output signal upon detection of a failure Failure in the 4-20 mA signal generation would have similar consequences to that of the original 1150 series transmitters A method is required to ensure proper configuration of the damping setting Effects on Sensor Response Time Response time not affected Processing failures are likely to have large signal changes but will not change response time.

A slowed or delayed pro cessing function could increase response time Response time not affected Response time could increase if the damping function is incorrectly set Method of Detection Step change in signal Hi or Lo signal based on transmitter alarm configu ration Comparison to other signals Hi or Lo signal based on transmitter alarm configu ration Comparison to other channel signals Ramp or step changes in signal Initial installation response time testing to validate damping configuration Symptoms and Effects Loss of signal input to the microprocessor, or changes in signal value, offset, range or linearity Failure of the microprocessor hardware or software routines could result in a loss of signal, offset, range, and/or linearity changes A non-specific processor failure could theo retically result in a delayed processing func tion Loss of 4-20 mA signal or changes in signal value, offset, range or linearity Unintended application of the damping function, or failure of the stored damping configuration Failure Mode Connection or electrical component failure Processing failure Connection or electrical component failure Damping applied to the process signal Name Signal Processing Analog to Digital Microprocessor Digital to analog signal conversion 4-20 mA Damping configuration failure

PALO VERDE GENERXrrNG STATION Evaluation of 3150 Series and 3051N Rosemount Pressure Transmitters For Response Time Testing Requirements 13-JS-A105 RevO 14 of 16 2.3 Operating History Review At PVGS, a sample of initial installation and routine response time testing of 3150 and 3051N series pressure transmitters show that all have been within the manufacturer specified response time.

Additionally, the INPO ICES operating experience database was searched using key words such as "Rosemount" and various 3150 and 3051N series model numbers. No OE was identified for 3150 series pressure transmitters. Model 3051N yielded 10 results. After review, only three of these were deter mined to be failures of the actual pressure transmitter, which were detected through gross drift of the signal output:

ICES OE 228049 - Electronic failure of the pressure sensor ICES OE 237673 - Gross drift attributed to non-specific internal failure ICES OE 314063 - Gross drift attributed to non-specific internal failure Section 10 of Emerson report D2015006 (Appendix A) provides detailed vendor operating history for the Rosemount 3150 series and 3051N model pressure transmitters. At the time of the report, of the known population of 12,117 3150 series pressure sensors and 2,767 3051N pressure sensors, the ven dor noted only 15 total failures for 3150 series transmitters and 15 total failures for 3051N transmit ters. None of these were determined to be related to fill-oil leakage nor would any impact response time.

3 Results and Conclusions The theory of operation for the replacement Rosemount 3150 and 3051N series pressure transmitters is the same as for the original 1150 series transmitters. The only major design differences are the use of coplanar architecture for the sensing diaphragms, and the digital electronics module in the 3051N trans mitters. As discussed in the analysis, the primary benefit of the coplanar architecture is alleviating stresses on the sensing diaphragms which had historically contributed to oil leak failure modes. The updated FMEA worksheets reached the same conclusions as the FMEA performed in the EPRI report NP-7243 for the orig inal Rosemount 1150 series pressure transmitters. Unique failure modes identified for the Rosemount 3150 and 3051N series transmitters were determined to be detectable through performance characteristic changes that would be discovered via channel monitoring, functional checks, or both. Therefore, the con clusions reached in EPRI report NP-7243 (Ref. C.3) section 4 and CEOG topical report CE NPGS-1167-A (Ref. B.4), section 6, are applicable to the Rosemount 3150 and 3051N series pressure sensors. Addition ally, the four recommendations identified in the CEOG topical report remain valid with the exception of periodic drift monitoring. Such monitoring was recommended based on vendor technical bulletins and NRC bulletin 90-01 (Ref. C.4). However, these bulletins are specific to Rosemount 1150 series pressure trans mitters, and are not applicable to the Rosemount 3150 or 3051N series; therefore this recommendation is not applicable. The following recommendations from CE Topical report NPSD-1167-A, revision 2 (Ref. B.4) section 3.4 do remain applicable for the 3150 and 3051N series pressure transmitters.

Perform a hydraulic RTT prior to installation of a new transmitter or following refurbishment of the transmitter to determine an initial sensor-specific response time value. The purpose of this test is to verify sensor response time is within the limits of the allocated value for the transmitter function.

For transmitters that use capillary tubes, RTT should be performed after initial installation and after any maintenance or modification activity that could damage the capillary tubes.

• If variable damping is used, implement a method to ensure that the potentiometer, or digital value for the Rosemount 3051N series, is at the required setting and cannot be inadvertently changed.

PALO VERDE GENERATINO STATION Evaluation of 3150 Series and 3051N Rosemount Pressure Transmitters For Response Time Testing Requirements 13-JS-A105 RevO 15 of 16 Based on Emerson report D2015006 (Appendix A), and the review performed in this study, Rosemount 3150 and 3051N series pressure transmitters are candidates for RTT elimination. Failure modes that would impact sensor response time will be detected through alternate methods based on performance character istic changes in the pressure transmitter. The use of vendor specified allocated response times, identified in Table 2-1, are appropriate when determining total instrument loop response time. Based on the compari son of allocated response times between original and replacement pressure transmitters, the existing allo cated response times used in calculation 13-JC-SB-0202 are unchanged.

4 References 4.A Method & General References A.i Design Equivalent Change package DEC-00825, "Rosemount 1153D, 1154 & 1154H Transmitter Model Replacement," revision 1, 2016-Nov-18 A.2 Emerson Report D2015006, "3150 Series Pressure Transmitter FMEA and Evaluation Related to Elimi nation of Pressure Sensor Response Time Testing," revision A, 2017-Nov-8 A. 3 13-JC-SB-0202, "Acceptance Criteria for RPS and ESFAS Response Time Testing," revision 20, 2011-Dec-12 4.B Regulatory, License, & NRC Guidance Documents B. i UFSAR - Updated Final Safety Analysis Report, revision 19B, 2018-June B.2 OL-TS - Operating License - Technical Specifications, through amendment 206 B.3 TSB - Technical Specification Bases, revision 67, 2018-September-14 B. 4 Topical Report CE NPSD-1167-A, revision 2, 2001-January-18 4.C Industry Standards & Guides Cl IEEE 352-2016, "Guide for General Principles of Reliability Analysis of Nuclear Power Generating Sta tion Systems and Other Nuclear Facilities," Revision 2016, 2016-December-7 C. 2 IEEE 338-1997, "Periodic Testing of Electric Power and Protection Systems," Revision 1997 C.3 Electric Power Research Institute - "Investigation of Response Time Testing Requirements - NP-7243,"

1991-May C. 4 NRC Bulletin 90-01, "Loss of Fill-Oil In Transmitters Manufactured by Rosemount," 1990-March-9 4.D Instrument Vendor Documents D. i VTD-R369-00095 - "Rosemount 3154N Nuclear Qualified Pressure Transmitter," revision 1 D.2 VTD-R369-00097 - "Rosemount 3150 Series Nuclear Pressure Transmitters including the Rosemount 3152, 3153 and 3154," revision 0 D.3 VTD-R369-00084, "Rosemount 3051N Smart Pressure Transmitter for Nuclear Service Reference Man ual," revision 1

PALO VERDE Evaluation of 3150 Series and 3051N Rosemount Pressure Transmitters For Response 13-3S-A105 GENERATING STATION Time Testing Requirements Rev 0 16 of 16 Appendix A - Emerson report D2015006, "3150 Series Pressure Transmitter FMEA and Evaluation Related to Elimination of Pressure Sensor Response Time Testing"