ML20028H237
| ML20028H237 | |
| Person / Time | |
|---|---|
| Site: | Sequoyah  |
| Issue date: | 10/31/1990 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML20028H236 | List: |
| References | |
| NUDOCS 9011190188 | |
| Download: ML20028H237 (34) | |
Text
.
'p u cg{c,
/
UNITE D STATES l'
I %
NUCLEAR REGULATORY COMMISSION v.(
W ASHINGToN, o. C. 20bbb
,o a...*
ENCLOSURE 2 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION SUPPPORTING AMENDMENT NO.132 TO FACILITY OPERATING LICENSE NO. OPR-79 TENNESSEE VALLEY AUTHORITY SE0 W 3H_, NUCLEAR POWER PLANT, UNIT 2 DOCKET NO. 50 328
1.0 INTRODUCTION
By letters dated January 24, April 25. Hay 15, and October 2, 1990, the Tennessee Valley Authority (TVA or the licensee) proposed to modify the Sequoyah Nuclear Plant (SQN), Units 1 and 2 Technical Specifications (TSs).
The proposed changes are to revise the definition section; the Specifications 2.2.1, 3/4.3.1.1, and 3/4.3.2.1; and the associated bases for the specifica-tions to reflect reactor protection system (RPS) upgrades and enhancements to be implemented during the respective Cycle 4 refueling outage in 1990 for each unit.
Specifically, the following changes were proposed:
Add a definition for a digital channel function test and an acronym for Rated Thermal Power.
Revise the allowable values of Tables 2.2-1 and 3.3-4 to reflect rack drift allowances associated with the Eagle 21 digital process protection system.
Revise the low-low steam generator water level entries of Tables 2.2-1, 3.3-1, 3.3-2, 3.3-3, 3.3-4, 3.3-5, 4.3-1, and 4.3-2 to reflect the incor-poration of the environmental allowance modif fer (EAM) and trip time delay (TTD) features.
Delete the steam flow /feedwater flow mismatch and low steam generator water level reactor trip in Tables 2.2-1, 3.3-1, 3.3-2, and 4.3-1 to reflect the incorporation of a median signal selector (MSS) that separates the control and protection signals for steam generator water levels.
Revise the overtemperature and overpower delta-T (differential tempera-ture) entries of Tables 2.2-1 and 3.3-2 to reflect the elimination of the resistance temperature detector (RTD) bypass manifold of the reactor coolant system (RCS).
Delete the high-differential pressure between steamline signals, revise the high-steam flow coincidence signal so that low steamline pressure alone initiates the corresponding engineered safety feature, and_ add a high negative steamline pressure rate actuation for steamline isolation ooiO % e I
W C
90111 h i
eca P
i s
t 1 i in Tables 3.3-3, 3.3-4, 3.3-5 and 4.3-2 because a new steamline break (SLB) protection logic is implemented.
l Revise Actions Statements 2.b and 6.b of Table 3.3-1; Action State-ments 15, 16, 17, 18, 21, and 23 of Table 3.3-3; and the channel func-tional test intervals of Table 4.3-2 to implement the Westinghouse Owners l
Group (WOG) Technical Specification Optimization Program (TOPS) engineered safety features actuation system enhancements of Westtaghouse Electric Corporation WCAP-10271, Supplement 2.
i
)
Delete outdated footnotes and unused action statements from the reactor protection table.
This is the licensee's TS Change Request 89-27.
The letters dated April 25, May 15, and October 2, 1990, the second, third and fourth applications for TS 89-27, revise (1) setpoints and allowable values in the TS to properly reflect the setpoint methodology for Sequoyah and (2) the channel functional test l-i interval for the improved rack drift term in the Eagle-21 system or to remove redundant and unnecessary information from the TSs.
The fourth application revised the trip setpoints for the steam generator low-low water level trip which were submitted in the first and third applications.
The revisions in the third application were to reflect the reference leg heatup environmental allow-ance associated with the TTD function.
The revisions in the fourth application are to reflect the installation of modified Barton level trinsmitters at Unit 2 in the current Unit 2 Cycle 4 refueling outage.
These transmitters were not installed at Unit 1 in the Unit 1 Cycle 4 refueling outage.
The licensee stated that these transmitters will be installed at Unit I at a later date.
These revisions are few in number compared to the proposed changes in the l
original application dated January 24, 1990 and do not alter the intent of the original application or the scope of the proposed action.
In supporting the proposed changes, the licensee provided clarifying informa-tion in several letters for the above TS applications.- These letters and the applications listed above are given in Table 1.
Also listed in Table 1 are a meeting and three audits conducted by the staff to evaluate these TS applica-tions.
The additional information provided by the clarifying letters, the second and third application letters, the meete.g. and the NRC audits did not r
change the substance of the proposed action in the Federal Register Notice (55 FR 6119) published on February 21, 1990 for the proposed amendment and do not affect the staff's initial determination of no significant hazards consider-ation in that notice.
The summary for the meeting held on February 26, 1990 on the Eagle-21 process protection system was issued on March 22, 1990.
The purpose of the meeting was to discuss the Eagle-21 System for Sequoyah as compared to the Eagle-21 equip-ment to be installed at Watts Bar.
In particular, the differences in the
. Eagle-21 test, or Man-Machine Interface, carts for Sequoyah and Watts Bar were discussed.
l
-i met w-
- ~
. 2. 0 EyALUATION The staff's evaluation of the proposed changes in the TS applications dated January 24, April 25, and May 15, 1990 for RPS upgrades and enhancements will be discussed in the following sections:
(3) Instrumentation and Control System Evaluation, (2) Reactor Systems Evaluation and (3) Containment System Evalua-tion.
Each of these sections has its own list of references within the section.
When needed, the staff will reference sections in the Sequoyah Final Safety Analysis Report (FSAR).
2.1 Instrumentation and Control System Evaluation 2.1.1 Introduction i
The licensee requested changes to the TSs of Sequoyah Units 1 and 2.
The proposed changes reflect modifications to the RPS both in the logic and the hardware designs.
The major modifications include:
(1) Replace the existing Foxboro H-line analog process protection systems with a new Eagle-21 digital microprocessor-based process protection system and change the RPS and the engineering safety features actuatiom system (ESFAS) trip setpoints.
l (2) Eliminate the RID bypass loop measurement in the reactor coolant system.
(3) Modify the steamline break protection system.
(4)
Implement the EAM within the RPS and the ESFAS.
(5)
Implement the TTD within the RPS and the ESFAS.
(6)
Implement the MSS System and eliminate the low feedwater flow re6ctor trip function.
The staff's evaluation and conclusion of these changes are presented in Sec-l tion 2.1.5 of this report.
The references are listed in Section 2.1.9.
l 2.1.2 Backaround The Westinghouse Electric Corporation (Westinghouse) designed and manufactured a microprocessor-based Class IE system to replace the older analog protection and control process instrumentation system at Sequoyah.
This new system has been designated as the Eagle-21 system and is being utilized for Sequoyah (SQN), Units 1 and 2.
The Eagle-21 system has been implemented at the Watts Bar Nuclear Plant (WBN) in support of the elimination of the WBN reactor coolant system Resistance Temperature Detector (RTD) bypass manifold.
The implementation of the Eagle-21 system at SQN is broader in scope than WBN's because all of the SQN analog process racks (13 total) are being replaced with digital equipment.
Improved electronic technology and accumulated operating plant experience have led to the development of a new design to replace the older analog system.
Features of the Eagle-21 equipment include the following:
T-
- (1) Automatic surveillance testing capability.
(2) Self calibration (rack only) to reduce / eliminate rack drift and simplify calibration procedures.
(3) Self diagnostics capability to reduce troubleshooting time.
(4) Modular design to allow for a phased installation into existing process racks and use of existing field terminations.
(5) Hardware expansion capability to easily accommodate functional upgrade and plant improvements.
2.1.3 Ea01e-21 Process Protection System Description The Eagle-21 Process Protection System is a multiple microprocessor based digital protection system.
It was designed to fit into the existing analog system racks at SQN.
It will use the existing field terminal blocks and avoid new cable pulls or splices within the cabinets.
The cabinet's internal cabling is prefabricated and labeled.
The input signals include temperature, pressure, 4
level, and flow measurement.
The system also accepts analog voltage or current inputs from other nuclear process systems.
The output signals provide (1) the partial trip signal to the solid state protection logic cabinets, annunciators, status lights, plant computer, and SPDS systems, and (2) analog output signals to indicators, recorders, and other monitoring systems.
Although the generic Eagle-21 system has contact input modules, the licensee stated in its letter dated March 1,1990 that the Sequoyah design does not use these modules.
The protection channel independence is maintained in the same way as the old system.
Four independent channels are located in the separated process pro-tection racks.
A single failure of any one of these channels cannot affect the other channels.
Surveillance testing utilizes the Man-Machine Interface (MMI) cart.
The MMI cart is attached to the Eagle-21 via a cable plug into the front test panel of each Eagle rack.
Tests will be performed on one rack at a time.
Instructinns entered into the MMI via the Touch Screen Menu will allow the testing to be performed automatically.
The Eagle-21 system nas three major subsystems:
An Input / Output Subsystem, a Loop Processor Subsystem, and a Tester Subsystem.
These are discussed below:
I/O Subsystem l
The input portion of the I/O subsystem consists of customized Analog Input systems of nuclear generating stations. -These modules satisfy all of the l
signal conditioning, signal conversion, isolation, buffering, termination and testability requirements.
The signal conditioning modules are configurable to accept various process inputs including:
10-50 mA current loop (active or passive), 4-20 mA current loop (active or passive), 0-10 vde, RTD's and field contacts.
The Analog Input Module provides signals to the Loop Processor Subsystem.
These modules also interface with the Tester Subsystem for test and diagnostic purposes.
l L
o The output portion of the I/O Subsystem consists of Analog Output, Contact Output, and Partial Trip Output modules.
These modules receive data from the Loop Processor Subsystem and formulate analog, contact, and trip logic output signals.
Class IE isolation is provided for all analog ano contact output signals.
Loop Process Subsystem The Loop Processor Subsystem computes all of the algorithms and comparisons for the protective functions.
The Loop Processor Subsystem consists of a Digital Filter Processor (DFP). Loop Calculation Processor (LCP), Communication Controller, Digital I/O Module, and a Digital to Analog (0/A) Converter.
The Digital Filter Processor receives analog signals from Analog Input Modules and performs both Analog to Digital (A/0) conversions and filtering operations on the input signals.
The outputs of the Digital Filter Processor are then passed on to tta Loop Calculation Processor.
The Loop Calculation Processor performs calculations for protection channel functions, data comparison to setpoint values, and initiation of trip signals based on the data received from the Digital Filter Processor.
The Communication Controller collects information from the Loop Calculation Processor and transmits it to the Tester Subsystem.
The Digital I/O module is utilized to process contact inputs, contact outputs, and trip logic output signals.
1 The D/A Converter Module is utilized to convert digital values from the Loop i
Calculation Processor into analog values which are sent to analog output modules for further processing, Tester Subsystem The Tester Subsystem serves as the focal point of human interaction with the Eagle-21 system.
It provides a user-friendly interface that permits test personnel to configure (i.e., adjust setpoints and tuning constants), test, and maintain the system.
A Tester Subsystem consists of a Test Sequence Processor (TSP), Communication Controller, Digital to Analog (D/A) Converter Module, and a Digital I/O Hodule.
The Test Sequencer Processor reads information from the Communication Control-1er, Digital I/O Module, and the MMI test cart.
This information allows the TSP to monitor the overall status of the Eagle-21 racks, perform self diagnos-tics, and initiate surveillance testing.
The TSP provides information to the i
l 1
1 e
o
.s.
Communication Controller, Digital I/O Module 0/A Converter, and MMI test cart.
This information provides for status indiction and creation of the Signal Injection and Response (SIR) bus.
This bus is distributed through the signal q
conditioning modules and allows the Tester Subsystem to control and test each module.
The Communication Controller receives information from the Loop Processor Subsystem Communication Controller.
This information is thea read by the TSP which allows it to monitor the status of the LCP, The Tester Subsystem Communication Controller also provides a serial link to the Test Panel, which allows for information display and printing when connected to the MMI Test I
Cart.
The D/A Converter Module receives digital information from the TSP and converts it into high resolution analog signals that are used for test injection via the SIR bus.
The Digital I/O Module receives digital information from t5e TSP and converts J
it into high resolution analog signals that are used for test injection via the i
SIR bus.
The Digital I/O module receives information f rom the TSP and provides signals to a Contact Output Module that provides contacts for field devices.
2.1.4 Review Criteria The Eagle-21 system is part of the reactor protection system which includes the reactnr trip functions and the engineered safety features actuation functions.
Therefore, the General Design Criteria (GDC) of Appendix A to 10 CFR 50. IEEE Standard 279, " Criteria for Protection Systems for Nuclear Power Generating Station" (10 CFR 50.55 a(h)), and the applicable acceptance criteria listed on Table 7-1 of the Standard Review Plan (NUREG-0800) will be used as the review guidance.
In addition, the ANSI /IEEE standard ANS 7-4.3.2, 1982, " Application Criteria for Programmable Digital Computer Systems in Safety Systems of Nuclear Power Generating Stations" and R.G. 1.152.." Criteria for Programmable Digital j
Computer System Software in Safety Related Systems of Nuclear Power Plants,"
will be used to evaluate the Eagle-21 system software design verification and validation process.
2.1.5 Evaluation i
2.1.5.1. Evaluation of Proposed Changes to the SQN Technical Specifications i
The following four items have been reviewed and evaluated by the staff.
(1) A definition for a digital channel functional test is being added as Item c to Definition 1.6 for the channel functional test in the TSs, as follows:
A channel functional test shall be:
5.
O l a.
Analog channels - the injection of a simulated signal into the channel M close to the sensor as practicable to verify operability including ala c and/or trip functions.
b.
Bistable channels - the injection of a simulated signal into the sensor to verify operability including alarm and/or trip functions.
c.
Digital channels - the injection of a simulated signal into the channel as close to the sender input to the process racks as practi-cable to verify operability including alarm and/or trip functions.
Definitions 1.6.a and 1.6.b are in the TSs and Definition 1.6.c is proposed to be added to the TSs.
The staff finds that the digital channel functional test definition is consistent with the existing channel functional test definitions in the TSs and is, therefore, acceptable.
(2) The allowable values of Tables 2.2-1 and 3.3-4 are being revised to reflect rack drift allowances associated with the Eagle-21 digital process protection system.
The staff has reviewed the Sequoyah instrument setpoint methodology document WCAP-13239 and 11626 (Reference 4), and finds that the allowable values of Tables 2.2-1 and 3.3-4 are consistent with the data in the setpoint methodology document which reflects the rack drift allowances associated with the Eagle-21 digital process protection system.
These rack drif t data are smaller than the existing analog rack drift data because the Eagle-El system is more accurate than the Foxboro analog system.
Therefore, the proposed allowable values are acceptable.
(3) Actions 17 and 18 of Table 3.3-3, and the channel functional test intervals of Table 4.3-2 are being revised to implement the Westu ghouse Owners Group (WOG) Technical Specification Optimization Program (TOPS) engineered safety features actuation system enhancements of Westinghouse Electric Corporation WCAP-10271, Supplement 2.
The actions are given below:
ACTION 17 - With the number of OPERABLE Channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may proceed provided the following conditions are satisfied:
- a. The inoperable channel is placed in the tripped condition within six hours,
- b. The minimum Channels OPERABLE requirements is met; however, the inoperable channel may be bypassed for up to four hours for surveillance testing of other channels per Specification 4.3.2.1.1.
mi
4 o
8-ACTION 18 - With the number of OPERABLE Channels one less than the Total Number of Channels, operation may proceed provided the inoperable channel is placed in the bypassed condition l
and the Minimum Channels OPERABLE requirement is met, one additional channel may be bypassed for up to four hours for l
surveillance testing per Specification 4.3.2.1.1.
The staff finds that the proposed action statements No. 17 and No. 18 and the channel functional test intervals of Table 4.3-2 for quarterly tests are consistent with the staff approved Topical Report WCAP-10271 and, there-foie, are acceptable.
(4) The surveillance intervals in Table 4.3 2 are being revised to reflect the Eagle-21 system.
p The proposed surveillance intervals and applicable modes are consistent with l
the existing values in the table for ESFAS instrumentation.
Therefore, the proposed surveillance intervals and applicable modes are acceptable.
2.1.5.2 RTD Bypass Elimination 1
Mechanical Concerns The mechanical. modification removes the valves, piping snubbers, and supports associated with the RTD bypass system and replaces them with thermowell mounted fast response RTDs which are installed directly into the reactor coolant piping. Mechanical modifications begin with the removal of the existing bypass piping at each connection point to the reactor coolant system.
The existing hot and cold leg penetrations are machined to accept RTD thermowells.
On the hot leg, the scoop tip will be removed to allow the thermowell to protrude directly into the flow stream.
The thermowell is installed inside the modified i
scoop and the RTD is installed within the thermowell.
The crossover leg connection is capped and an additional cold leg boss, thermewell and RTD are added as an installed spare.
The mechanical modification eliminates the need i
for periodic maintenance of the RTD bypass manifold which will reduce the occupational radiation exposure.
The staff finds this acceptable.
The Sequoyah Eagle-21 design uses three hot leg RTD's input to obtain a single hot leg temperature (TH The system used to calculate is referNd to as l
the Temperature Averagikg)y.
D S stem (TAS).
The Temperature Averaging :;ystem (TAS)
)
becomes part of the thermal overpower and overtemperature protection system (Delta T/T viouslymedr)e.
TAS output (TH dinthebypass$b)ifoldRTD. replaces the hot leg temperature signal pre-The TH signal is used in the calculationofthedeltatemperature(DeltaT)anda@agetemperature(T ThemodulardesignoftheEagle-21electronicsallowsforinstallationofYhe)'
A digital hardware into existing process racks.
One rack per protection channel set is configured.
Channel separation is maintained througaout the Eagle-21 L.
design.
The staff finds this acce p able.
l i
=-.--.-----_,,---.---,----,--,_-_----,-----_---,_-_-._-----_--w w
m---
m v-
+ - '
e c
9 2.1.5.3
!Lew Steamline Break Protection The primary functions of the new steamline break protection system are to:
(1) isolate non-ruptured steamlines following a secondary high en'ergy line rupture and (2) inject borated water into the reactor coolant system.
The existing SQN steamline break protection logic includes a safety injection actuation based on:
(1)
Low steamline pressure coincident with high steamline flow.
(2)
Low-low average coolant temperature coincident with high steamline flow.
(3) High steamline differential pressure.
(4) Low pressurizer pressure.
(5) High containment pressure.
and a steamline isolation actuation based on:
(1)
Low steamline pressure coincident with high steamline flow.
(2)
Low-Low average coolant temperature coincident with high steamline flow.
(3) High-High containment pressure.
The new steamline break protection system is currently in use as the standard system for later vintage Westinghouse plants.
j The new steamline break protection 1agic will initiate a safety injection based on:
(1)
Low Steamline Pressure (any steamline).
l (2)
Low Pressurizer Pressure.
(3) High Containment Pressure.
l and a steamline isolation actuation based on:
(1)
Low Steamline Pressure.
(2) High-High Containment Pressure.
(3) High Negative Steamline Pressure Rate.
The new steamline break protection system modifies both the process protection system and the reactor protection system voting logic.
In the process protection system, the steamline flow channels will be deleted.
The steamline pressure channel is modified to delete the steamline differential pressure comparator output.
Two new comparators will be added to the steamline pressure channel.
One comparator detects high negative steam pressure rate (rate-lag compensated).
The rate-lag, lead-lag and comparator functions are included in the EAGLE-21 process protection cabinet and provide built-in test features to measure the lead / lag derivative, and comparator functions during periodic channel testing,
,, In the reactor protection system, the reactor protection logic will be modified to delete the safety injection on steamline differential pressure, and the steamline isolation plus safety injection upon high steamline flow coincident with low steamline pressure.
The new steamline break protection system logic requires the addition of a safety injection and steamline isolation on 2-out-of-3 coincidence of low steamline pressure, and a steamline isolation signal on 2*out-of-3 coincidence of high negative steam pressure rate.
The staff has audited the licensee's post modification test procedures and the test results to verify that the new logic is properly integrated into the reactor protection system.
No open concern was revealed during the audit.
2.1.5.4 Environmental Al*,osance Modifier (EAM)
A Watinghouse Owners Group (WOG) survey of Westinghouse operating plants found that, between 1980 and 1985, 38 percent of all unplanned reactor trips were attributable to problems with main feedwater systems.
A closer examination revealed that 43 percent of all inadvertent plant trips were initiated by either the low-low steam generator water level or the low feedwater flow trip signals.
A WOG Trip Reduction and Assessment Program (TRAP) was established to investigate mrthods 7nd design modifications to reduce the frequency of these inadvertent t-
- curring in Westinghouse plants and thereby increase plant availabilit' i d uce challenges to reactor protection systems.
By lette
,ed December 15, 1986, from L. D. Butterfield to J. Lyons, the WOG submitte' s AP-11342, " Modification of the Steam Generator Low-low Level Trip Setpoint !s Reduce Feedwater Related Trips," to the NRC for review and approval.
This WCAF as part of the WOG TRAP, oroposes a design modification which, when implemented on a plant specific basis, can reduce the inadvertent plant trips related to low steam generator level signals by an Environmental Allowance Modifier which distinguishes between normal and adverse containment environ-i mental conditions and automatically selects a low or high setpoint for the low-low level trip chosen for the corresponding normal or adverse containment conditions based on the exclusion / inclusion of instrumentation uncertainties related to the harsh environmental conditions.
By utilizing the two different setpoints, more operational flexibility (and reduced spurious trips) is provided during normal conditions, while adequate protection is still provided during accident / adverse conditions.
The staff's generic review of the EAM design revealed that it is conceptually acceptable and may be used as a basis for plant-specific applications (Reference 1).
However, in order for the staff to perform a detailed design review of the EAM design for conformance to regulatory requirements, plant-specific submittals had to include the following information:
(1) Plant-specific protection system logic diagrams accompanied by proposed revisions to Chapter 7 of the FSAR including compliance statements with the applicable, existing plant-specific safety criteria (GDC's, RG's, IEEE STD 279, etc.) covering the plant design modifications.
4 4# <
(2) Proposed changes to the plant-specific Technical Specifications with an accompanying Significant Hazards Evaluation covering the EAM installa-tion.
TMs shall include new setpoints and allowable values for the steam genera tor low-low level trip and the new containment pressure bistable > en part of their operability / surveillance requirements for the EAM circuitry.
Also a discussion of the applicability of the WCAP metho-3 dology should be provided including a determination of the pressure 4
setpoint.
{
(3) Proposed changes to the plant-specific Technical Specifications with an accompanying Significant Hazards Evaluation covering any changes related 1
to operation of containment systems, if required, to ensure acceptability of the EAM installation.
i (4) Plant specific changes to tha operator procedures to cover the use of the EAM reset controls.
($) Detailed electrical schematics covering the design modification.
(6) Plant-specific human factor analyses for any hardware modification to the control room.
(7) The EAM conceptual design provides for testing of the associated instrument channels in the bypass mode.
Since the licensing basis for a typical Westinghouse plant provides for testing with the channel under test in the trip mode, a discussion of the acceptability for testing in bypass (reference to an applicable, approved WCAP such as WCAP-10271 is acceptable) should be provided.
The licensee has provided the above plant-specific information for staff review..
Specifically, the setpoint methodology documents (Reference 4), the EAM imple-mentation documents, and the supporting document for testing in bypass and the annotated copy of the FSAR included the logic diagrams.
The staff also audited L
the design modification package, test procedures and test results at the SQN site.
No open concern was revealed during the audit.
2.1. 5. 5 Steam Generator Low-Low Level Trip Time Delay l
Low water level, in any steam generator, will trip the reactor and actuate i
the auxiliary feedwater system.
These actions are intended to protect the core and to mal'ntain an adequate heat sink for decay heat removal.
The most critical need for such protective action would occur following a total loss of l
'feedwater to all steam generators, or a major feedwater line rupture while the plant-is operating at full power.
Therefore, the low steam generator water level protection system logic and setpoints are determir.ed according to the requirements of these postulated conditions.
The same protective functions would also occur under less limiting conditions, I
such as the termination of feedwater to only one steam generator during plant startup operations.
Under these conditions, reactor protection system action 1
s c
l may safely be delayed, and thereby provide time for remedial operator action and for the natural stabilization of water level transients.
Restoration of the steam generator water level during such a programmed delay would avoid an unnecessary reactor trip, and reduce the frequency of challenges to the reactor protection system (specifically, the frequency of reactor trip demands caused by feedwater-related problems).
By letter dated December 15, 1986, from L. D. Butterfield to J. Lyons, the Westinghouse Owners Group (WOG) submitted WCAP-11325, " Steam Generator Low Water Level Protection System Modifications to Reduce Feedwater-Related Trips,"
to the NRC for generic review and approval.
This WCAP report, as part of the WOG TRAP, proposed a design modification, when implemented on a plant-specific basis, which can reduce the inadvertent plant trips related to low steam generator level signals by adding a time delay to the steam generator low-low water level initiated reactor trip and auxiliary feedwater actuation.
Through the use of adjustable timers in the protection system logic, this modification would allow added time for natural steam generator level stabilization or operator intervention to avoid an undesirable, inadvertent protection system actuation.
The staff's generic review of the TTD design and timer design revealed that they are conceptually acceptable and may be used as a basis for plant specific applications (Reference 1).
However, in order for the staff to perform a detailed design review of the time delay modifications for conformance to regulatory requirements, plant-specific submittals had to include the following information:
(1) Plant-specific protection system logic diagrams accompanied by proposed revisions to Chapter 7 of the FSAR including compliaice statements with the applicable, plant-specific safety criteria (Gent ral Design Criteria, Regulatory Guides, IEEE STD 279, etc.) covering the design modification.
(2) Proposed changes to the plant-specific technical specifications with an accompanying Significant Hazards Evaluation, covering any new response time values for reactor trip and auxiliary feedwater actuation on a low-low steam generator water level signal, the adjustment for the time delays (e.g., setpoint and allowable value accounting for calibration accuracy, drift, etc) as part of the operability / surveillance requirements of the automatic actuation logic, and new setpoint and allowable values for the P-8 and/or other interlocks utilized.
(3) Detailed electrical schematics covering the design modification with a discussion of the proposed periodic testing to be performed on the modified hardware installed.
(4) Discussion of the environmental qualification of equipment (e.g., sensors, timers, etc.) related to the design modification.
(5) Discussion of the total instrumentation uncertainties (e.g., calibration, drift, etc.) for the plant-specific power interlocks utilized and their impact upon the selection of the corresponding time delays,
l o
! I l
(6) Plant-specific changes to the operator procedures resulting from a delay of reactor trip and auxiliary feedwater initiation.
(7) Plant-specific human factors analyses for additional displays in the con-trol room.
4 The licensee has provided the above plant-specific information for staff review. Specifically, thc setpoint methodology documents (Reference 4), the TTO implementation documents, and the operator procedures resulting from a delay of j
l reactor trip and auxiliary feedwater initiation.
The staff also audited the design modification package, test procedures and test results at the Sequoyah site.
No open concern was revealed during the audit.
TTD Implementation Limit l
In the staff's SER (Reference 1) on Topical Report WCAP-11325, the staff concluded that the use of a time delay for reactor trip and auxiliary feedwater interaction on low-low steam generator level for power levels in excess of the l
P-8 permissive is not acceptable at this time.
This conclusion is based on an examination of the advantages and disadvantages of these delayc at high power t
from an overall risk standpoint.
Most low-low steam generator level trips occur from low power.
Of those that occur at high power, only a fraction of these could be reduced by a delay in the low-low steam generator level trip and auxiliary feedwater actuation.
The fraction is relatively small (approximately 12%).
On the other nand, the staff was concerned that delaying the trip and auxiliary l
feedwater actuation would introduce a complication which could reduce the steam generator inventory for the unlikely case in which the auxiliary feedwater system may not be immediately available on demand and further operator action in necessary to restore auxiliary feedwater flow.
The Sequoyan TTD design allows trip time delay up to 50% of the reactor rated thermal power.
The evaluation of the TTD implementation limit is addressed in Section 2.2.2 below.
l 2.1. 5. 6 Median Signal Selector (MSS)
Each steam generator at Sequoyah has three independent water level instrument channels which provide input to the reactor trip system (RTS) for a reactor trip on two-out-of-three low-low water levels.
This low-low steam generator water level reactor trip function is designed to protect the reactor from the l
loss of heat sink in the event of a sustained steam /feedwater mismatch or a low feedwater flow resulting from a loss of normal feedwater.
In the existing Sequoyah protection system, one of the steam gererator water level iristrument channels also suppies an input to the feedwater control i
system (FWCS).
The FWCS controls the feedwater regulating valve which in turn regulates the feedwater flow into the steam generator.
As a result, a common instrument channel is used for both the RTS and the FWCS.
IEEE Standard 279-1971 (10 CFR 50.55a(h)) Section 4.7 requires protection to prevent control l
o e
l l {
and protection system interactions.
To satisfy the IEEE Standard 279 requirements, the low feedwater flow trip function was added to initiate a
~
reactor trip during a condition of steam and feedwater flow mismatch in coincidence with low steam generator water level.
This trip provides a diverse trip function to the low-low steam generator water 'evel trip.
The primary purpose is to resolve the control and protection system interactions concern.
The accident analysis does not include the tteam/feedwater flow mismatch in mitigating the consequences of any analyzed accidents.
No credit was taken for the steam /feedwater flow mismatch because it is more conservative to use than direct low-low water level trip function.
The MSS system was proposed by the licensee for the FWCS, Instead of using one of the three steam generator water level instrument channels for control function, all three channels will be input to the FWCS.
The MSS system will select the median of the three input signals.
By selecting the median signal, the control system which causes the control and protection interactions will not be affected by a failed protection channel.
The MS$ will prevent adverse interaction between the feedwater control system and the RTS.
By letter dated March 1, 1990. TVA submitted a Topical Report WCAP-12417,
" Median Signal Selector for Foxboro Series Process Instrumentation, Application to Deletion of Low Feedwater Flow Reactor Trip" (Reference 2), to provide justification for the deletion of the steam flow /feedwater flow mismatch reactor trip function.
The lopical Report WCAP-12417 addresses the engineering issues relative to the use of a median signal selector system, the hardware configuration, the operating principal, the reliability of the system, the capability for testing and the adequacy of failure detection within the MSS system.
The staff was concerned that an undetectable failure in the MSS system may cause control and protection system interactions.
To resolve this concern, the licensee stated that the MSS has been provided with the capability for on-line testing.
The MSS can be tested concurrently with the protection instrument channels feeding the unit.
These protection channels are tes ed on a quarterly basis.
The components used in the MSS system are high quality components, and the licensee has committed to test the MSS system on a quarteriy basis concurrently with the protection channels (Reference 3).
The staff has previously approved the similar MSS design for Beaver Valley Unit 2 (Docket No. 50-412).
An amendment to the Beaver Valley license was issued on February 20, 1990.
Based on the review of the Topical Report WCAP-12417, and the discussion with the licensee during two meetings held on February 26 and March 13, 1990 respec-tively, the staff finds that the proposed MSS for the FWCS in conjunction with deletion of low feedwater flow reactor trip is acceptable.
The staff audited the licensee's test procedures to verify that the MSS system testing was properly implemented.
No open concern was revealed during the audit.
. 2.1. 6 Evaluation of Eagle-21 Software Design Implementation 2.1.6.1 Software Design and V&V Process The Westinghouse Eagle-21 system software design and its software verification and validation (V&V) process is based on the experience gained trom the South Texas Qualified Display Processing System (QDPS) design and the Watts Bar Eagle-21 System (RTD bypass elimination) design.
The software has been designed to be modular in structure. The smallest software unit is the " Pro-cedure." A typical Procedure may have 10 lines of coding or a few pages of coding.
Each procedure has a design performance specification and verification test specification.
Once the verification test has been completed, it will be treated as a qualified component that can be used by the main program for different applications.
The main program simply determines the sequence for execution of these procedures.
All software follows the standards established for software design by the vendor, which include the following:
High-level module logic is used.
No interrupts are allowed.
No reentrance is allowed.
Code format conforms to standards for both high-level and assembly language routines.
All programs are single task.
The design process of the Eagle-21 system involved three stages:
(1) Define a system design requirements.
(2) Decompose the system design requirements into hardware and software design specifications.
The software design specifications are further decomposed into subsystem, module, and procedure (unit) specification.
(3) Construct the hardware and various software into a system, and perform the validation testing of the system.
The verification process involves two stages:
(1) Review the design documents, the computer coding and the testing documents.
(2) Perform the independent software testing that includes the structural testing and the functional testing.
The validation has three major phases:
(1) Top-down functional requirement testing.
(2) Prudency review of the design and its implementation.
P
'O (3) Specific Man-Machine Interface (HMI) testing After the verification and validation process, the software is installed in the programmable read only memory (PROM).
The software and documentation are kept under strict configuration management control.
2.1.6.2 Software Verification and Validation Audit Report On April 18 through 20, 1990, the staff performed an Eagle-21 software verifi-cation and validation (V&V) audit at Westinghouse Process Control Division where the Eagle-21 system was designed and manufactured.
The staff compared the Westinghouse V&V process with the American National Standard ANS-7-4.3.2-1982, " Application Criteria for Programmable Digital Computer System in Safety i
System of Nuclear Power Generating Stations" to determine the adequacy of the software V&V process of the Eagle-21 system.
(1) Organization:
Westinghouse has a formal V&V group which maintains indepen-dence from the software design group.
The first and second levels of supervisors are independent.
Communications between the design group and the V&V group are documented in written reports.
The technical qualifica-tions of the V&V team are comparable to those of the design team. The staff finds that the organizational qualifications and independence are in conformance with the Standard ANS-7.2-4.3.2-1982, and, therefore, are acceptable.
(2) Design document verification:
The Eagle-21 system has formal auditable documentation which includes the following categories:
l a.
System Design, Verification and Validation Plan.
l b.
Functional Requirements Documents c.
Functional Decomposition Documents d.
System Design Matrix e.
Validation Basis f.
Software Coding Standards g.
Software Design Specification h.
Software Configuration Requirements 1.
Environmental and Seismic Qualification Reports j.
Noise, Fault, Surge Withstand, and RFI Test Reports k.
Reliability Study 1.
Verification Problem Reports m.
Validation Problem Reports The staff selected the New Steam Line Break Protection Program as a thread path to audit through the following documents:
a.
The functional requirement document which defines the functions required by this program, the applicable criteria and standards, the reference drawings, the environmental requirements, the indicators, status lights, controls, alarms, interlocks, trips, time response, noise levels, controller transfer functions, setpoints, requirements for associated equipment, and the failure mode requirements.
l
o 4 b.
The functional decomposition document which provides instruction for i
design validation.
The top-level functional requirements are decom-posed into M ailed sub-requirements.
For each sub-requirement, a test C
.es of tests are identified to ensure that the specific r
sub-re4-ment is satisfied.
Performance of these tests will constituse validation of the system functional requirements. This i
document provides design traceability of requirements as they pertain to the Eagle-21 process protection system replacement equipment and channels in those racks.
l The system design matrix document which provides design traceability c.
from the top-level functional requirement documents through the j
supporting software design requirements, system design specification, J
module sof tware design specifications and factory acceptance /valida-tion test results for a " top-to-bottom" design documentation road map to demonstrate system design verification compliance.
The staff's audit of all the documents related to the new steam line break protection program did not reveal any inconsistency in the V&V Process.
The documents are complete and accurate.
(3) Verification problem reporting:
There are three basic types of verifica-tion problem reports.
They are the following:
Generic Problem Reports contain multi-module related problems or a.
problems with system design requirement documentation.
i b.
Module Level Problem Reports contain issues relating to entire source file.
Units Level Problem Reports apply only to a single unit of code.
l c.
When problem reports are prepared by the V&V Group and ready to be turned over to the design group, the V&V Librarian will issue a formal release letter to the design group librarian listing the file name of the reports and their location.
The problem report will be kept in a common directory in the V&V storage area that cannot be altered without the assistance of the V&V libra-rian.
The design group will copy the released report and make corrections in the program.
When problem reports are ready to be returned to the V&V Group, the design librarian will formally release the reports to the V&V librarian L
using the standard release form.
The problem reports for a particular project I
will be kept in a common computer directory in the design storage area.
Only the design librarian will have. READ and WRITE privileges to this directory.
The V&V Group will verify and retest the corrected program and sign-off to CLEAR the problem report.
The staff audited the verification problem reporting process and random checked several problem reports, and found that the documentations are complete and r
l thorough.
The problem reporting process is acceptable.
l l
{
., (4) Validation Process:
The validation proc.ess is to complement the verification process and to ensure that the final implemented system (hardware and software) completely satisfied the system functional requirements.
The major phases of the Eagle 21 validation process includes:
Functional requirements Abnormal-Mode testing Prudency review of the design and its implementation Specific Man-Machine Interface (MMI) testing The validation documents include:
Functional Decomposition Documents Design Document Decomposition Matrix Problem Reports The validation process was performed by a team of individuals independent from the design team.
They have performed 21 comprehensive tests and 47 hardware /
software reviews.
A total of 13 validation problem reports were generated.
All validation problem reports were satisfactorily resolved.
Out of these 13 problem reports, only one required software change.
Based on the audit review of these validation problem reports, the staff concluded that there do not appear to be serious software errors in the Eagle-21 System.
At the time of the audit, the final V&V report was not completed.
By letter dated May 8, 1990, the licensee provided the V&V final report.
The final L
report presents the results of the V&V Program conducted on the Eagle-21 System for Sequoyah, i
The software verification for the Eagle-21 System for Sequoyah was completed in April.1990 with the total number of software units involved being 1100.
For these units, a total of 658 verification problem reports were generated.
All verification problem reports generated were resolved.
All changes to the soft-ware documentation were reviewed and/or tested to demonstrate successful resolution of the problems found.
The system validation program for the Eagle-21 System for Sequoyah was also completed in April 1990 including 21 comprehensive tests and 47 hardware /
software reviews.
The hardware / software reviews and validation tests have been satisfactorily completed.
All validation problem reports generated were i -
successfully resolved.
l It was noted that none of the errors identified in the validation problem reports were errors that would be expected to be identified during the verification process.
All problem reports generated during the validation process are in areas specific to validation.
$=
U 19-Based on the staff's audit finding and the results of the final V&V Report, the staff concludes that the Eagle-21 functional upgrade implemented for Sequoyah Unit 1 is demonstrated to meet its functional and design requirements.
2.1.7 Site Inspection Report On May 3 and 4, 1990, the staff performed a site inspection of the Eagle-21 system at the Sequoyah Plant, Unit 1.
The system will be installed at Unit 2 during the current Unit 2 Cycle 4 refueling outage.
The purpose of the inspection was to verify the following:
(1) The Eagle-21 System installation does not violate the existing channel separation /indepyndent criteria.
(2) The control room modif, cations agree with the Eagle-21 system design requirements.
(3) The post modificat'on tests have been properly performed.
l (4) The operator an% the instrument maintenance personnel have been
~
properly trained.
2.1. 7.1 Eagle-21 System Installation Verification There are thirteen Foxboro H-line analog process protection racks which will be replaced by the Eagle-21 racks.
The field sensors are connected to the existing cabinet-mounted terminal blocks.
The field cables were not changed except in few instances which related to the new steamline break protection system, the new annunciator windows and the new input for the post accident monitoring system where new cable routing were required.
The licensee stated that all the input / output points calibration will be completed before entering Mode 4 operation.
During the April 18, 1990 audit meeting, the staff was concerned that there was a mix of Class IE and non-class IE outputs from the partial trip l
output board. The staff requested clarification regarding the partial trip output board design and operation.
By letter dated May 8, 1990, the licensee provided the following clarification.
The Eagit-21 Process Protection Cystem Upgrade partial trip output board provides the interface between the Loop Calculation Processor (LCP) and the existing trip logic system.
Each partial trip output board provides up to four independent channels of logic output for driving relays in the trip logic system.
Each of the partial trip output boards may have a mix of Class IE and non-class IE outputs connected to the board channels.
With the exception of an indirect connection to a classic ground, the four output channels are completely independent.
During the site inspection, the licensee further clarified that for those cabinets which contain wiring for one division of Class IE and non-divisional non-IE circuits, the entire nondivisional circuit (including external cabling) must be separated from all wiring and cabling of the opposite redundant division of Class IE circuits. Based on these clarifications, there is no open concern on this issue.
L
C1 s
s-20-2.1.7.2 Control Room Alarm Modification The Eagle-21 equipment racks are located in the instrument room which is two floors below the main control room.
The operator's interface with the h.
Eagle-21 system is to acknowledge the following annunciator windows and status lights in the control room:
(1) Protection channel trouble (one status light per channel)
(2) Channel set failure (one window)
(3) Protection channel in bypass (one window per channel)
(4) RTD failure (one window per channel) l (5) TTD timer start (one window per steam generator) i (6) Adverse containment environment (one window)
During the May 3, 1990 inspection, these annunciator windows had not been installed in the main control room for Unit 1.
The system operating instruc-
'a tions (501) related to these annunciator windows had not been issued.
- However, the simulator has implemented these alarm messages and the operators have been l_
trained with the Eagle-21 System implementation.
The annunciator window modifications and the 50! will be completed before entering Mode 4 operation.
l 2.1.7.3 Post Modification Testina The staff audited the post modification testing documents including the i
l Eagle-21 hardware site acceptance test, channel functional tests, instrument calibration records, and the QA procedures tracking the Eagle-21 programmable Read Only Memory (E-PROM).
It appears that the test records are well kept and easy to trace.
Although the post modification tests to accept the system as operable have not been completed at the present time (i.e., May 3, 1990), the j
licensee has kept the resident inspector informed of the testing progress on a
_ daily bases.
These tests will be completed before entering Mode 4 operation.
L j
The post modification tests are performed on an overlapping basis.
No integrated tests are planned.
Although no ma,ior problems have been revealed from each individual test, the interactio.a between the plant live process l
signal to the Eagle-21 system and output to the solid state protection system l
has not been demonstrated.
Because the Sequoyah Eagle-21 system is a first-of-a-kind microprocessor based protection system, extra cautions during the plant startup period is warranted.
Therefore, the staff requested that the l
licensee report all the Eagle-21 system hardware / software problems to NRR during the plant startup period.
The surveillance test records of the Eagle-21 system should be available for staff audit.
A summary report of the Eagle-21 system should be submitted to the NRR on a six-month basis during the next operating cycle, l
2.1.7.4 Training
=
The staff conducted a two day inspection of the training of Sequoyah personnel
-l on the Eagle-21 system as part of the Sequoyah Inspection 90-17 on Units 1 and 2.
During the inspection, the staff determined the following:
ten surveillance i
d 4
21-maintenance personnel and all of the six shifts of reactor operators have been trained.
The surveillance / maintenance personnel were trained in a 5 week course by Westinghouse Electric Corporation which designed and built the Eagle-21 System.
These personnel had hands-on training with an Eagle-21 rack and the MMI test cart used to troubleshoot the system and perform surveillances and calibrations of the system.
In their training, these personnel used the first draft of the TVA procedures to perform the surveillance and calibrations of the system.
All three shifts, covering a 24-hour day, will be staffed with these trained personnel.
The licensed operators on shift have been trained in classes on the Sequoyah simulator for the Eagle-21 system.
The remaining licensed operators in staff positions were scheduled to be trained by May 11, 1990.
This training also included the other modifications being completed in the Unit I and Unit 2 Cycle 4 refueling outage:
UHI removal, BIT deactivation, RTD bypass manifold removal, ACI deletion, AMSAC addition, and the cold leg injection accumulator and RWST changes.
The simulator now models both Sequoyah Units 1 and 2 because these modifications will be done at Unit 2 in the current Unit 2 Cycle 4 refueling outage.
The staff reviewed the course material for training the surveillance /mainten-ance personnel and the licensed operators and discussed the material with at least one individual taking the courses.
The staff also visited the simulator.
I audited the records of software changes to the simulator to reflect the modifi-cations being completed at Units 1 and 2 and discussed the changes to the simulator with an instructor.
This training is considered to be acceptable for the use of the Eagle-21 System at Sequoyah.
Based on its review during Sequoyah Inspection 90-17, the staff concludes that the training of surveillance / maintenance and licensed operators is sufficient to allow Unit 2 to startup and operate with the Eagle-21 System.
2.1.8 Conclusion Based on our review of information provided by the licensee; the meetings held with the licensee and Westinghoust representative on February 26, March 13 and 14, 1990; the software audit on April 18 through 20, 1990; and the site inspec-tion on May 3 and 4, 1990; the staff finds that there is reasonable assurance that the Eagle-21 System conforms to the applicable regulations and guidelines.
The scope of the review included the FSAR descriptive information, 10 CFR 50.59 submittal (Reference 5), and several Westinghouse Topical Reports sub-mitted by the licensee.
All submittals are listed in in Table 1.
The staff met four times with the licensee and the NSSS vendor.
These meetings, which are also listed in Table 1 provided a focus for exchanging information and answering staff questions.
Based on the reviews noted above and the exchange of information at the four meetings, the staff has reached the following conclusions:
I l
O The Eagle-21 System adequately conforms to the guidance for periodic testing in RG 1.22, " Periodic Testing of Protection System Actuation functions," and IEEE 338, as supplemented by RG 1.118, " Periodic Testing of Electric Power and Protection Systems." The bypassed and inoperable status indication adequately i
conforms to RG 1.47, " Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems." The Eagle-21 System adequately conforms to the guidance on the application of the single-failure criterion in IEEE 379, as supplemented by RG 1.53, " Application of the single-failure criterion to Nuclear Power Plant Systems." On the basis of its review, the staff concludes that the Eagle-21 System satisfies IEEE 279 with regard to system reliability and testability.
Therefore, the staff finds that GDC 21 is satisfied.
The Eagle-21 system adequately conforms to the guidance in IEEE 384 as supplemented by RG 3.75, " Physical Independence of Electric Systems" for protection system independence.
On the basis of its review, the staff concludes that this system satisfies IEEE 279 with regard to independence of systems and hence satisfies GDC 22.
1 On the basis of its review of the interface between the Eagle-21 System and plant-operating control systems, the staff concludes that the system satisfies IEEE-279 with regard to control and protection system interaction.
Therefore, the staf( finds that GDC 24 is satisfied.
On the basis of its review of the softu.re design and its verification and validation, the staff concludes that the Eagle-21 system satisfies the requirements of ANSI /IEEE-ANS-7.4.3.2-1982,
" Application Criteria for Programmable Digital computer Systems in Safety Systems of Nuclear Power Generating Stations" and Regulatory Guide 1.152,
" Criteria for Programmable Digital Computer System Software in Safety-Related Systems of Nuclear Power Plants",
i The staff's conclusions noted above are based on the requirements of IEEE 279 with respect to the design of the safety-related portion of the Eagle-21 system.
Therefore, we find that 10 CFR 50.55 a (h) is satisfied.
In summary, we conclude that the Eagle-21 System meets all of the applicable guidelines and regulations and that its utilization as discussed previously is acceptable.
However, because this is the first Eagle-21 System in an operating plant, this acceptance is also based on the licensee's commitments (Reference 10) to:
I 1
(1) report to NRC all Eagle-21 system hardware / software problems encountered during Unit 2 startup, (2) submit to NRC a periodic six-month summary report of the Eagle-21 System operation over the next operating cycle for Unit 2, and (3) submit any software configuration changes or modifications to the NRC for staff review and approval prior to implementation if it is not consistent with the original software design process (i.e., Revision 3 of the final V&V report).
The staff may audit the surveillance test records of the Eagle-21 System for Sequoyah.
l 1
o' Q
i
~23~
2.1.9 References (1) Letter from A. Thadani (NRC) to R. Newton (WOG), " Acceptance for Referencing of Licensing Topical Reports WCAP-11325, " Steam Generator Low Water Level Protection System Modifications to Reduce Feedwater-Related Trips," and WCAP-11342, " Modification of the Steam Generator Low-Low Level Trip Setpoint to reduce feedwater Related Trips " dated January 7,1988.
(2) Letter from E.G. Wallace (TVA) to NRC, "Sequoyah Nuclear Plant ~ Median Signal Selector - Westinghouse Electric Corporation WCAPS-12417 and 12418," dated March 1, 1990.
(3) Letter from E.G. Wallace (TVA) to NRC, "Sequoyah Nuclear Plant (SQN)
Median Signal Selector (MSS) Testing," dated April 11, 1990.
(4) Letter f rom E.G. Wallace (TVA) to NRC, "Sequoyah Nuclear Plant Eagle-21 Setpoint Methodology - WCAP-11239 and 11626," dated April 23, 1990.
(5) Letter from E. G. Wallace (TVA) to NRC, Sequoyah Nuclear Plant Eagle-21 Unreviewed Safety Question (10 CFR 50.59)," dated April 11, 1990.
(6) Letter from E.G. Wallace (TVA) to NRC, "Sequoyah Nuclear Plant Eagle-21 Process Protection System Upgrade Summary Report," dated May 8,1990.
(7) Letter from E.G. Wallace (TVA) to NRC, "Sequoyah Nuclear Plant Eagle-21 Equipment Qualification Reports," dated May 8, 1990.
(8) Letter from E.G. Wallace (TVA) to NRC, "Sequoyah Nuclear Plant Eagle-21 Upgrade to SQN Reactor Protection System (RPS) Additional Information,"
dated May 8, 1990.
(9) Letter from E.G. Wallace (TVA).to NRC, "Sequoyah Nuclear Plant Eagle-21 Verification and Validation - Final Report," dated May 8, 1990.
(10) Letter from E.G. Wallace (TVA) to NRC, "Sequoyah Nuclear Plant (SQN) -
Eagle 21 Functional Upgrade Commitments," dated May 10, 1990.
- 2. 2 Reactor Systems Evaluation l
2.2.1 Introduction i
The licensee originally requested changes to TS 2.2.1, 3/4.3.1.1 and 3/4.3.2.1 and the associated bases to reflect modifications to the RPS (Reference 1, see Section 2.2.2.8 below).
Revisions to the proposed changes were submitted in letters dated April 25 and May 15, 1990.
Additional information was submitted by letters as indicated in Reference 2.
The proposed proposed changes are given in Section 1.0 above.
l 1
E Q The purpose of the changes is to improve the RPS's reliability and the plant's availability, by replacing analog RPS racks with digital equipment, lhe EAM and TTD were developed to reduce unnecessary feedwater related reactor trips, likewise the steam flow /feedwater flow mismatch reactor trip is deleted by implementing the MSS.
The RTD bypass elimination reduces radiation expo-sure, improves plant availability, and reduces the maintenance.
The new SLB protection logic eliminates inadvertent ESF actuations.
The WOG TOPS will reduce plant surveillance testing and the editorial changes are made for clarity.
The changes are based on the WCAP-11239, Revision 4. "Setpoint Methodology for Protection Systems." The EAM feature is based on WCAP-11342PA, " Modification of the Steam Generator Low-Low Level Trip Setpoint to Reduce Feedwater Related Trips" (Reference 3).
The TTD modification is based on WCAP-11325PA Rev. 1,
" Steam Generator Low Water Level Protection System Modifications to Reduce feedwater Related Trips" (Reference 3).
The MSS implementation and the justi-fication for the deletion of the steam flow /feedwater flow mismatch reactor trip is discussed in WCAP-12417. " Median Signal Selector" (MSS) (Reference 4).
The RTD bypass elimination is discussed in the setpoint methodology including the overpressure and overtemperature delta-T setpoints.
The new SLB protection logic is based on reanalyses of the affected FSAR Chapters 6 and 15 transients to demonstrate the adequacy of the new SLB logic.
2.2.2 Evaluation 2.2.2.1 Trip Time Delay (TTD), Environmental Allowance Modifier (EAM)
The TTD is a system of programmed and predetermined delay times for the low-low level steam generator (SG) reactor trip and auxiliary feedwater delay times, based on the power level at the time of the low-low level trip and the number of steam generators affected.
In the Sequoyah design, the trip delay times are determined from two equations as a function of power (below 50% of rated thermal power).
One relationship is for time delays with one SG affected and the other when more than one SG is affected.
There is no time delay for power levels above 50% of rated thermal power.
Once the low-low level setpoint is reached, the TTD acts to delay reactor trip and auxiliary feedwater system actuation to allow time for operator corrective action or for natural water level stabilization.
The time delay has been estimated using the methodology in WCA,P-11325PA Rev. 1 using the criteria:
(a) that no DNB will take place 95%
of the time at the 95% confidence level and (b) that the reactor coolant and the main steam system pressure remain below 110% of the corresponding system design pressure.
During trip time delay it has been estimated that overpres-surization will not take place.
After a reactor trip, the auxiliary feedwater supply is adequate to remove the decay heat.
However, the staff's approval of WCAP-11325PA, Revision 1, (Reference 3) limited the WCAP's applicability to power levels not above the P-8 permissive.
The Sequoyah P-8 permissive corres-ponds to 35% of plant thermal power.
However, the staff objective in approving WCAP-11325PA was to limit spurious plant trips due to the low-low steam genera-tor signal.
The intent of the limitation was to include all power levels which were subject to feedwater level variation which could activate the low-low level signal.
For Sequoyah this power level is 50%, because both units have a I
c
~25 second feedwater pump activated between 40% to 50% power.
The expression of the limitation in WCAP-11325PA in terms of the P-8 was convenient for the model plant (i.e., Callaway) in which the P-8 permissive was at the 50% thermal power level.
Therefore, the staff finds that the 50% power limit for Sequoyah is justifiable, acceptable, and in agreement with the intent of WCAP-11325PA.
The EAM steam generator low-low level trip conceptual design is discussed in WCAP-11325PA.
The EAM can be described as an automatic switch that raises the SG low-low level trip setpoint to increase the environmental error allowance in the setpoint whenever a harsh containment environment is indicated by detection of an elevated containment pressure.
The EAM can reduce the frequency of unnecessary feedwater-related trips by increasing the dif ference between the nominal SG water level and the low-low SG 1evel trip setpoint during nomal operation.
2.2.2.1.1 The ATWS Miticatino System Activation Circuity (AMSAC)
The ATWS mitigating system actuation circuitry (AMSAC) is required by 10 CFR 50.62.
The AMSAC design is not to interfere with the reactor protection functions.
The AMSAC as described in Reference 5 provides an independent back-up to the existing protection systems which initiates a turbine trip and actuates auxiliary feedwater flow in the event of an anticipated transient without a reactor trip while the power level is above 40% of rated thermal power.
As implemented in the Sequoyah units, the AMSAC will trip the turbine and initiate the auxiliary feedwater if (1) the water level in three of four 1
SGs drops 5% below the SG low-low level reactor trip setpoint and (2) the power is greater than 40%.
If the power is greater than 50%, the TTD/EAM system does not operate and, if the power is below 40%, the AMSAC does not operate.
In the 40-50% power range, if the level in more than two SGs drops below the i
AMSAC setpoint then both the AMSAC and the TTD will be actuated.
- However, 1
because the AMSAC delay is shorter than the TTO delay, the turbine could be tripped and the auxiliary feedwater initiated before the TTD had a chance to trip the reactor; in addition, the Sequoyah units are equipped with the P-9 permissive and the turbine trip will not cause a reactor trip (unless another trip is initiated somewhere else in the RPS) thus a reactor trip will not take place until the TTD delay lapses.
Thus, the staff concludes that the AMSAC does not interfere in TTD's function and vice versa.
2.2.2.1.2 Loss of Normal Feedwater A plant specific loss of normal feedwater analysis (i.e., FSAR Section 15.2.8) was carried out to demonstrate that the auxiliary feedwater system is of sufficient capacity to remove core decay heat, stored energy and RCS pump heat following reactor trip.
In this case, a reactor trip on SG low-low water level will occur.
The analyses were carried out using the LOFTRAN code (Reference 6) i for power levels below 50% of the rated thermal power.
The results showed that the auxiliary feedwater capacity is adequate and that the RCS heatup is l
controlled. This analysis also confirms that the TTD does not invalidate the i
FSAR conclusions for the feedline break transient.
s 2.2.2.1.3 LOCA Accidents Plant specific analyses showed that the LOCA related accidents are unaffected by the TTD and EAM modifications.
2.2.2.1,4 TTD and EAM Conclusions In summary, the staff concludes that the proposed TT0/EAM modifications are acceptable because of the following:
(1) within the 95% probability 95% confidence level that minimum departure from nucleate boiling ratio (MONBR) will not be reached, (2) primary and secondary pressure wili emain below 110%
of their respective design limits, (3) the pressurizer will not fill, (4) there is no detrimental interaction with the AMSAC, (5) there is no impact on the FSAR conclusions for the feedline break analysis, and (6) there is no impact on the LOCA related accident analyses.
Therefore, the staff concludes that the T10/EAM modifications are acceptable.
i 2.2.2.2
_RTD Bypass Elimination The RTO bypass line is being replaced by three RTDs mounted in thermowells 120' apart in the same location in the hot leg of the reactor coolant system (RCS).
Two RTDs will be placed in the cold leg at the reactor coolant pump (RCP) discharge.
The elimination of the RTO bypass causes an increase in the response time of the temperature detectors from 6.0 see to 8.0 see which causes the overpower delta-T and overtemperature delta-T signals to be delayed by 2.0 seconds compared to the existing analyis.
In addition, the RTDs generate delta-Ts and an average RCS temperature (T feedwaterisolati8X7) low-lowTin each loop which are used in the following:
low-T SI/steamline isola-tion, control rod conU81, steam dump control, pressurifU level control and RCS flow measurement.
RCS flow and T determination are the only parameters havingapossibleeffectontheLOCAIXIlysis.
However, the uncertainties associated with the RTDs are within the current limits.
Therefore, the RCS inlet / outlet temperature, the thermal design flow rate and the SG thermal-hydraulic data will not be affected, consequently the LOCA related accident analysis is not affected by the RTO modification.
The RTO bypass elimination was examined with respect to its impact on the non-LOCA safety analyses.
The anticipated transients which could potentially be affected are the following:
uncontrolled RCCA withdrawal at power (overtemperature delta-T or high neutron flux) uncontrolled boron dilution, excessive load increase, accidental RCS depressurization.
overpower delta-T, and steamline break with the mass / energy release outside containment.
27~
The results showed that either the delayed signal from the RTD modification is not used as a primary trip signal or whenever it is used the safety analysis criteria are met.
Therefore, the staff concludes that the RTO modification is acceptable.
2.2.2.3 New Steamline Break Protection As in the old steamline break protection, the new concept is also based on safety injection and steamline isolation.
Safety injection will result from low steamline pressure, low pressurizer pressure, or high containment pressure.
Steamline isolation will be actuated from high-high containment pressure, high negative steamline pressure rate, or low steamline pressure.
The new steamline break protection was reviewed to ascertain that the new logic is acceptable and at least an equivalent level of protection is offered in the new logic as in the old logic.
The following non-LOCA transients have been analyzed:
Uncontrolled rod cluster control assembly (RCCA), or control rod, with-drawal from a suDeritical condition (FSAR-15.2.1),
Uncontrolled RCCA withdrawal at power (FSAR-15.2.2),
RCCA misalignment (FSAR-15.2.3):
Uncontrolled boron dilution (FSAR-15..'.4),
Partial and complete loss of forced reactor coolant flow (FSAR-15.2.5),
Startup of an inactive reactor coolant loop (FSAR-15.2.6),
Loss of external electrical load / turbine trip (FSAR-15.2.7),
Loss of normal feedwater (FSAR-15.2.8),
Loss of offsite power to the station auxiliaries (FSAR-15.2.9),
Excessive heat removal due to feedwater system malfunctions, (FSAR-15.2.10),
Excessive load increase (FSAR-15.2.11),
Accidental depressurization of the RCS (FSAR-15.2.12),
Rupture of a main steam line (FSAR 15.4.2.1),
Spurious operation of a safety injection system at power (FSAR-15.2.14),
Major rupture of a main feedwater pipe (FSAR-15.2.2),
Rupture of a control rod drive mechanism housing (FSAR-15.4.6),
J e
Steamline break, coincident with rod withdrawal at power, Steamline break mass / energy release inside containment (FSAR-6.2)
The results of the analyses showed that ene of the following was true for each of the above transients:
(1) steamline. slation and safety injection were not reouired, (2) there ~is no impact from the Eagle-21 System, (3) the analyses criteria are met, or (4) there is no difference from the old analysis.
The LOCA-related and steamline break analyses are unaffected by this modification.
Therefore, the staff concludes that the proposed protection system modifica-l tions are acceptable with respect to the steamline break protection.
2.2.2.4 Elimination of the low-Feedwater Flow Reactor Trip. Using the Median Signal Selector (MSS)
Elimination of the low feedwater flow reactor trip does not require any reanalysis of the non-LOCA safety analysis because this trip was never assumed to be a primary reactor protection trip.
However, the same signal detectors and transmitters used in the low-feedwater flow trip provide the signals used for feedwater control, but the introduction of the MSS addresses all control M ' protection signals and insures that the MSS does not impact the non-LOCA u qients.
The LOCA analyses on the other hand assume reactor trip and safety injuWn signals based on low pressurizer pressure or high containment pressure, there-fore, the LOCA accident analyses are unaffected by this modification.
2.2.2.5-Steam Generator Tube Rupture (SGTR)
The Sequoyah FSAR Section 15.4.3 demon!.trated that the radiological conse-
_quences of a SGTR are below the exposure guidelines in 10 CFR 100.
The consequences of the Eagle-21 equipment and limit setting changes, including the RlD two second response time increase, are insignificant and the FSAR conclusions for the SGTR remain unchanged.
2.2.2.6 Conclusion We have reviewed the TVA proposed Eagle-21 control and safety system implemen-tation from-the safety function point of view.
Specifically, this safety evaluation addressed the RTD bypass elimination, the new steamline break protection, the median signal selector, the time trip delay, and the environ-mental allowance modifier.
In addition, we examined the trip time delay with l
the ATWS mitigation actuation circuity.
In all cases, we find that the pro-posed modifications did not exceed the design or existing regulatory limits, thus, the staff concludes that the proposed changes are acceptable.
2.2.2.7 Technical Specification Changes The proposed technicel specification changes reflect the modifications in the RPs, revise the definition sections, and revise the TS Bases of Specifications:
2.2.1, 3/4.3.1.1, and 3/4.3.2.1.
Incorporation of the Eagle-21 digital process protection system modifications are expected to improve plant availability and
x
.c w reliability.
In addition, the Westinghouse Owner's Group technical specifica-E tion optimization program for engineered safety features actuation system is implemented.
The specific changes and their evaluation follows:
(1) Tables 2.2-1, 3.3-1 to 3.3-5, 4.3-1 and 4.3-2 are revised to reflect the TTD and EAM on the low-low steam generator level trip signal.
The changes provide for the power range and the corresponding trip time delay calculation and accounts for the environmental allowance modifier based on low containment pressure.
The conditions described in the technical specification changes reflect the description of the TTD and EAM functions that have been generically approved in Reference 4 and thus are acceptable.
(2) Tables 2.2-1. 3.3-1, 3.3-2 and 4.3-1 reflect the deletion of the steam /
feedwater flow mismatch and the low-low SG water level reactor trip and the incorporation of the MSS.
The median signal selector was found acceptable in the accident analyses.
The technical specification changes reflect the deletion of steam / feed-water flow mismatch and the low-low SG water level trip, and the implemen-tation of the MSS.
These changes are acceptable, because safety analyses considerations showed that they provide an equal level of protection as the previous sets of signals.
(3) Tables 2.2-1 and 3.3-2 are revised to reflect the RTD bypass elimination and its-effect on the overtemperature delta-T and overpower delta-T.
There are several entries in Tables 2.2-1 and 3.3-2 which changed in the specifications associated with the RTD bypass elimination corresponding to time parameters in the estimation of the overtemperature delta-T and overpower delta-T.
The transients affected due to the longer response time have been reanalyzed using the trip functions incorporated in the new expressions-(in these technical specification changes) and found accept-able.
Therefore, these oecification changes are acceptable.
(4) Tables 2.3-3, 3.3-4, 3.3-5 and 4.3-2 are revised to incorporate the new steamline break protection logic which reflects deletion of (a) the high
.steamline differential pressure protection signal, (b) high steamline flow and (c). low-low average coolant temperature and the addition of (a) low steamline pressure,-(b) low pressurizer pressure, (c) high containment pressure and, (d) high negative steamline pressure rate for actuation'of safety injection and/or actuation of steamline isolation.
Reanalytes with the new steamline break protection showed that it provides an equivalent level of protection (and reduced spurious actuations) and, thus, it is acceptable.
(5)
In Table 3.3-1 actions 2.6 and 6.6, in Table 3.3-3 actions 15 to 18, 21 and 23 and the channel functional test intervals in Table 4.3-2 have been revised to implement the Westinghouse Owners Group technical specification optimization program engineered safety features actuation system enhance-ments (WCAP-10271PA, Supplement 2, Revision 1).
l
N la.
l 1 l
l.
All of the above changes have been reviewed and approved in the topical j1 report WCAP-10171PA except for Table 3.3-3 Action Statements 21 and 23 and Table 4.3-2 surveillance intervals.
These action statements are not being changed by the proposed action and the surveillance intervals are addressed in Section 2.1.5.1 above.
The other changes are acceptable because they have been generically approved.
2.2.2.8 References (1) Letter from M.J. Ray, Tennessee Valley Authority to USNRC "Sequoyah Nuclear Plant (SQN) - Technical Specification (TS) Change 89-27," dated January 24, 1990.
(2) (a) Letter from E. G. Wallace, TVA, "Sequoyah Nuclear Plant (SQN) -
'agle-21 Unreviewed Safety Questions USQ," dated April 11, 1990.
(b) Letter from M. J. Ray TVA to USNRC, "Sequoyah Nuclear Plant Technical Specification Change 89-27," dated January 24, 1990.
(c) Letter from E. G. Wallace, TVA to USNRC, "Sequoyah Nuclear Plant Steam Generator Low Water Level Trip Time Delay, Additional Informa-tion," dated May 9, 1990.
(3) WCAP-11325PA, Rev. 1, " Steam Generator Low Water Level Protection System l
Modifications to Reduce Feedwater - Related Trips" by S. Miranda et al.,
February 1988.
(4) WCAP-12417, " Median Signal Selector for Foxboro Series Process Instrumenta-tion, Application to Deletion of Low Feedwater Flow Reactor Trip" by J. F.
Mermigus, dated October 1989.
(5) WCAP-10858PA, "AMSAC Generic Design Package" by M. R. Adler, dated June 1985.
(6) WCAP-7907-P-A, "LOFTRAN Code Description" by T. W. T. Burnett et al,,
Westinghouse Electric Corporation, dated April 1984,
- 2. 3 Containment System Evaluation-TVA discussed the effect on containment integrity of the modifications to Sequoyah involved with the proposed TS changes.
In its letter dated April 11, L
1990, it stated that these modifications would not have an adverse impact on the mass and energy releases from-the design basis Loss-of-Coolant Accident
-(LOCA) and Main Steam Line Break (MSLB).
These accidents have been reanalyzed by TVA to include these modificatio..s and other modifications which were planned for the Cycle 4 refueling outages for the units.
These other.modifica-tions include upper head injection (VHI) removal, boron injection tank deactiv-ation, and VANTAGE 5 Hybrid fuel use in the core.
The reanalysis of the depressurization of the main steam system, main steam line rupture, small-break LOCA and large break LOCA were submitted by TVA in its letter dated January 12, 1990 for the removal of the UHI during the current Cycle 4 refueling outage.
~
r The reanalysis of the containment response to the large break LOCA was sub-mitted by TVA in its letter dated January 12, 1990 for its TS Change Request 90-05, the extension of the ice weighing interval for the ice condenser to 18 months.
The new peak containment pressure is 10.9 psi following the large break LOCA.
This peak pressure is below the design value of 12 psi for the containment.
The staff accepted (1) the reanalysis of the effect of the above accidents on the fuel in the core in its letter dated May 11, 1990 approving Amendment 140 in its letter dated March 2, 1990 approving Amendments 131 and 118 for Units 1 and 2, respectively.
Therefore, the staff concludes that the modifications involved with the proposed TS changes for the RPS upgrades and enhancements do not adversely affect containment integrity.
2.4 Editorial Technical Specification Changes The licensee has used the acronym "RTP" for Rated Thermal Power in its proposed changes.
Rated Thermal Power is defined in Definition 1.25 in Section 1.0 of the TSs.
The acronym "RTP" will be added to the words Rated Thermal Power in Definition 1.25.
This change is acceptable.
Action statements in Tables 3.3-1, 3.3-3, and 4.3.1 are proposed to be deleted because they are not needed for these tables.
The staff agrees that these action statements are not needed; therefore, the proposed changes are accept-able.
A note and astericks referring to the noto for item "7" in Tables 3.3-3 and 3.3-4 are proposed to be deleted because ths footnote is no longer needed for the table.
The footnote refers to when a modification must be completed.
Because the date is in the past, the footnote is not needed; therefore, the proposed change is acceptable.
2.5 Conclusion Based on the above, the staff concludes that the proposed use of the Eagle-21 System, the EAM, the TTD, the MSS, the new steamline break protection logic, and the TOPS engineering safety features actuation system enhancements of WCAP-10271, Revision 2, are acceptable for Sequoyah Units 1 and 2.
The staff also concludes that the proposed changes to the Sequoyah TSs to incorporate these upgrades and enhancements are acceptable.
These RPS upgrades and enhancements were implemented at Unit 1 during the Unit 1 Q cle 4 refueling outage.
Therefore, the proposed TSs for Unit I were issued in tic staff's letter dated May 16, 1990.
The TVA applications also proposed changes for the Unit 2 TSs.
The RPS upgrades and enhancements associated with the proposed TS changes are being implemented at Unit 2 during the current Unit 2 Cycle 4 refueling outage.
The TS changes for Unit 2 are being issoed at this time.
In the letter dated May 10, 1990, the licensee committed to (1) report Eagle-21 System hardware, design software, and maintenance problems encountered during the startup of Unit I from the current Cycle 4 refueling outage; (2) submit, for Unit 1 operating Cycle 5, six-month reports discussing the operation of the
...g 6,.
i Eagle-21 System for Unit 1 in operating Cycle 5; and (3) submit software configuration and system modifications, prior to implementation, not consistent with the staff approved Revision 3 of the final Eagle-21 System V&V Report for Sequoyah, which was submitted by letter dated May 8, 1990.
The licensee committed to submit the first report within 30 days of Unit I reaching approxi-mately 100 percent power.
By telephone conference call on October 4, 1990, the licensee committed to extend this to Unit 2 and to the Unit 2 Operating Cycle 5.
- 3. 0 ENVIRONMENTAL CONSIDERATION These amendments involve a change to a requirement with respect to the installation or use of a facility component located within the restricted area as-defined in 10 CFR Part 20 and changes to the surveillance requirements.
The staff has determined that the amendments involve no significant increase in the amounts, and no significant change in the types, of any effluents that may be rele'ased offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure.
The Commission has previously issued e proposed finding that these amendments involve no significant hazards consideration and there has been no public comment on such finding.
Accord-ingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9).
Pursuant to 10 CFR 51.22(b), no environmental impact statement nor environmental assessment need be prepared in connection with the issuance of these amendments.
4.0 CONCLUSION
The Commission made a proposed determination that the amendment involves no significant hazards consideration which was published in the Federal Register (55 FR 6119) on February 21, 1990 and consulted with the State of Tennessee.
No public comments were received and the State of Tennessee did not have any comments.
The staf f has concluded, based on the considerations discussed above, that:
(1) there is reasonable assurance that the health and safety of the public~
will not be endangered by operation in the proposed manner, and (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the commoa defense and security nor to the health and safety of the public.
Principal Contributors:
H. Li, L. Lois and J. Donohew Dated: October 31, 1990 1
l I
L.
- o, v
TABLE 1 TVA LETTERS - NRC REVIEW CHRONOLOGY Date-Subject Comment l-01/24/90 TS 89-27, Eagle-21 TS Changes TVA letter
)
02/26/90 NRC/TVA/ Westinghouse Meeting in Meeting Rockville, Md.
03/01/90 Median Signal Selector - WCAPs 12417/
TVA letter 12418 i
03/01/90 Eagle-21 Topical Report - WCAPs TVA letter 12374/12375 03/13-14/90 NRC Audit in Pittsburgh, PA NRC Audit, Note I i
04/11/90 Median Signal Selector Testing TVA letter 04/11/90 Eagle-21 10 CFR 50.59 Evaluation TVA letter 04/18-20/90 NRC Verification and Validation NRC Audit (V&V) Audit in Pittsburgh, PA 04/23/90 Setpoint Methodology - WCAP' 11239/
TVA letter 11626 04/25/90 TS 89-27, Revision 1 TVA letter, Note 3 05/03-04/90 NRC Eagle-21 Installation Audit NRC Audit at Sequoyah Site-05/04/90 Eagle-21 V&V Completion TVA letter, Note 2 05/08/90 Eagle-21 Additional Information.
TVA letter, Note 1 Partial Trip Output Board Design 05/08/90 Eagle-21'V&V Final Report TVA letter, Note 2 05/08/90 Eagle-21 Summary Report TVA letter 05/08/90 Eagle-21 Equipment Qualification TVA letter WCAPs 05/09/90
-Eagle-21 P-8/TTD Design TVA letter, Note 2-5 l
l L
i
F
< ti
(,s i
i '
05/10/90 Eagle-21 Commitment Letter TVA letter r
05/15/90 TS 89-27 Revision 2 TVA letter, Note 4 10/02/90
-TS 89-27, Revision 3 TVA letter, Note 4 m
l f
i l
Note 1 - Additional information required directly as a result of NRC audit activities.
Note 2'- Additional activities required because of V&V schedule slips.
n+
Note 3 - Changes to technical specification pages as a result of error in jl P-8 setpoint and request to include cable IR in channel error.
Note 4 - Changes to technical specification pages as a result of steam generator reference leg heatup environmental allowance correction.
~----.
. L
-.--