ML20043H905
| ML20043H905 | |
| Person / Time | |
|---|---|
| Site: | Sequoyah  |
| Issue date: | 05/16/1990 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML20043H904 | List: |
| References | |
| NUDOCS 9006270056 | |
| Download: ML20043H905 (34) | |
Text
!
{
p* *te
[f U%ITED STATES NUCLEAR REGULATORY COMMISSION j
W AaMINGTON, D. C. 20666 l
g l
[
ENCLOSURE 2 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION j
SUPPORTING AMENDMENT NO.141 TO FACILITY OPERATING LICENSE NO. DPR-77 TENNESSEE VALLEY AUTHORITY t
SEQUOYAH NUCLEAR PLANT, UNIT 1 DOCKET NO. 50-327 j
l I
1.0 INTRODUCTION
By letters dated January 24, April 25, and May 15, 1990, the Tennessee Valley Authority (TVA or the licensee) proposed to modify the Se.luoyah Nuclear Plant (SQN), Units 1 and 2. Technical Specifications (TSs).
The proposed changes are to revise '.he definition section; the Specifications 2.2.1, 3/4.3.1.1, and 3/4.3.2.1; and the associated bases for the specifications to reflect reactor protectionsystem(RPS)upgradesandenhancementstobeimplementedduringthe respective Cycle 4 refueling outage in 1990 for each unit.
Specifically, the following changes were proposed:
Add a definition for a digital channel functiori test and an acronym for Rated Thermal Power.
Revise the allowable values of Tables 2.2-1 anc 3.3-4 to reflect rack drif t allowances associated with the Eagle 21 digital process protection system.
t Revise the low-low steam generator water level entries of Tables 2.2-1, 3.3-1, 3.3-2, 3.3-3, 3.3-4, 3.3-5, 4.3-1, and 4.3-2 to reflect the incor-poration of the environmental allowance modifier (EAM) and trip time delay (TTD) features.
Delete the steam flow /feedwater flow mismatch and low steam generator water level reactor trip in Tables 2.2-1, 3.3-1, 3.3-2, and 4.3-1 to i
l reflect the incorporation of a median signal selector (MSS) that-separates the control and protection signals for steam generator water levels.
Revise the overtemperature and overpower delta-T (differential tempera-ture) entries of Tables 2.2-1 and 3.3-2 to reflect the elimination of the resistance temperature detector (RTD) bypass manifold of the reactor coolantsystem(RCS).
Delete the high-differential pressure between steamline signals, revise the high-steam flow coincidence signal so that. low steamline pressure alone initiates the corresponding engineered safety feature, and add a
~
high negative stedmline pressure rate actuation for steamline isolation 9006270056 900516.,
DR ADOCK 0500
/
t
1 i e
in Tables 3.3-3, 3.3-4, 3.3-5 and 4.3-2 because a new steamline break (SLB) protection logic is implemented, j
Revise Actions Statenents 2.b and 6.b of Table 3.3-1; Action Statements i
15, 16, 17, 18, 21, and 23 of Table 3.3-3; and the channel functional test l
intervals of Table 4.3-2 to implement the. Westinghouse Owners Group (WOG)
Technical Specification Optimization Program (TOPS) engineered safety features actuation system enhancements of Westinghouse Electric Corpora-tion WCAP-10271, Supplement 2.
3 Delete outdated footnotes and unused action statements from the reactor protection tables.
5 This is the licensee's TS Change Request 89-27.
The letters dated April 25 15, 1990, the secoLd and third applications for TS 89-27, revise and May (1) setpoints and allowable values in the TS to properly reflect the setpoint
)
nethodology for Sequoyah and (2) the channel functional test interval for the improved rack drif t term in the Eagle-21 system or to remove redundant and These revisions are few in number compared unnecessary information from the TSs.
to the proposed changes in the original application dated January 24, 1990 i
and do not alter the intent of the original application or the scope of the proposed action.
In supporting the proposed changes, the licensee provided clarifying informa-tion in several letters for the above TS applications. These letters and the applications listed above are given in Table 1.
Also listed in Table 1 are a L
I meeting and three audits conducted by the staff to evaluate these TS applica-tions. The additional information provided by the clarifying letters, the second and third application letters, the meeting, and the NRC audits did not change the substance of the proposed action in the Federal Resister Notice (55 FR 6119) published on February 21, 1990 for the proposed amencment and do not affect the staff's initial determination of no significant hazards considera-tion in that notice.
The summary for the meeting held on February 26, 1990 on the Eagle-21 process protection system was issued on March 22, 1990.
The purpose of the meeting was to discuss the Eagle-21 System for Sequoyah as compared to the Eagle 21 equipment to be installed at Watts Bar.
In particular, the differences in the Eagle-21 test carts for Sequoyah and Watts Bar were discussed.
In its letters dated April 24 and 26,1990, the licensee requested approval for the use of certain channels of the Eagle-21 System in Mode 5 for Unit 1.
The staff approved the use of these channels only for Mode 5 in its letter dated April 27, 1990 This approval did not extend to the Eagle-21 System for Modes 1, 2, 3 and 4 and to the other RPS upgrades and enhancenents discussed above.
This evaluation is given below.
l 1
1 k 2.0 EVALVATION The staff's evaluation of the proposed changes in the TS applications dated January 24, April 25, and May 15, 1990 for RPS upgrades and enhancements will be discussed in the following sections:
(1)InstrumentationandControlSystem Evaluation, (2) Reactor Systems Evaluation and (3) Containment System Evaluation.
Each of these sections has its own list of references within the section.
When needed the staff will reference sections in the Sequoyah Final Safety AnalysisReport(FSAR).
2.1 Instrumentation and Control System Evaluation
)
2.1.1 Introduction The licensee requested changes to the TSs of Sequoyah Units 1 and 2.
The proposed changes reflect modifications to the RPS both in the logic and the hardware designs. The major modifications include (1) Replace the existing Foxboro H-line analog process protection system with l
a new Eagle-21 digital microprocessor-based process protection system and change the RPS and the engineered safety features actuation system (ESFAS) trip setpoints.
(2) Eliminate the RTD bypass loop measurement in the reactor coolant system.
(3) Modify the steamline break protection system.
(4)
Implement the EAM within the RPS and the ESFAS.
(5)
Implement the TTD within the RPS and the ESFAS.
(6)
Implement the MSS System and eliminate the low feedwater flow reactor trip function.
The staff's evaluation and conclusion of these changes are presented in Section 2.1.5 of this report.
The references are listed in Section 2.1.9.
2.1.2 Background the Westinghouse Electric Corporation (Westinghouse) cesigned and manufactured a microprocessor based Class 1E system to replace the older analog protection and control process instrumentation system.
This system has been designated as the Eagle-21 system and is being utilized for Sequoyah Nuclear Plant (SQN),
Units 1 and 2.
The Eagle-21 system has been implemented at the Watts Bar Nuclear Plant (WBN) in support of the elimination of the WGN cetor coolant system Resistance Temperature Detector (RTD) bypass manifold.
The implementa-tion of the Eagle-21 system at SQN is broader in scope than WBN's because all of the SQN analog process racks (13 total) are being replaced with digital equi pnent.
i
, Improved electronic technology and accumulated operating plant experience have led to the development of a new design to replace the older analog system.
Features of the Eagle-21 equipment include the following:
(1) Automatic surveillance testing capability.
(2) Self calibration (rack only) to reduce / eliminate rack drif t and simplify calibration procedures.
(3) Self diagnostics capability to reduce troubleshooting time.
l (4) Modular design to allow for a phased installation into existing process racks and use of existing field terminations.
(S) Hardware expansion capability to easily accommodate functional upgrade and plant improvements.
2.1.3 Eagle-21 Process Protection System Description The Eagle-21 Process Protection System is a multiple microprocessor based digital protection system.
It was designed to fit into existing racks at Sequoyah.
It will use the existing field terminal blocks and avoid new cable 4
pulls or splices within the cabinets.
The cabinet's internal cabling is prefabricated and labeled.
The input signals include temperature, pressure, level, and flow measurement.
The system also accepts analog voltage or current inputs from other nuclear process systems.
The output signals provide the partial trip signal to the solid state protection logic cabinets, annunciators, status lights, plant computer, and SPDS systems; and analog output signals to indicators, recorders, and other monitoring systems.
Although the generic Eagle-21 system has contact input modules, the licensee stated in its letter dated March 1, 1990 that the Sequoyah design does not use these modules.
The protection channel independence is maintained in the same way as the old
(
system.
Four independent channels are located in the separated process pro-tection racks. A single failure of any one of these channels cannot affect the other channels.
Surveillance testing utilizes the Man-Machine Interface (MMI)
L cart. The MMI cart is attached to the Eagle-21 via a cable plug into the front test panel of each Eagle rack.
Tests will be performed on one rack at a. time, instructions entered into the MMI via the Touch Screen Menu will allow the testing to be performed automaticolly.
The Eagle-21 system has three major subsystems: An Input /0utput Subsystem, a Loop Processor Subsystem, and a Tester Subsystem.
These are discussed below:
I/O Subsystem The input portion of the I/O subsystem consists of customized Analog Input signal conditioning modules specially designed for use in process protection systems of nuclear generating stations.
These modules satisfy all of the signal conditioning, signal conversion, isolation, buffering, termination and testability requirements.
-S-1 The signal conditioning modules are configurable to accept various process inputs including:
10-50mA current loop (active or passive), 4-20 mA current loop (active or passive). 0-10 yde, RTD's and field contacts.
The Analog Input Module provides signals to the Loop Processor Subsystem.
These modules also interface with the Tester Subsystem for test and diagnostic purposes.
The output portion of the I/O Subsystem consists of Analog Output, Contact Output and Partial Trip Output modules.
These modules receive data from the Loop Processor Subsystem and formulate analog, contact, and trip logic output signals.
Class 1E isolation is provided for all analog and contact output signals.
Loop Process Subsystem The Loop Processor Subsystem computes all of the algorithms and comparisons for the protective functions.
The Loop Processor Subsystem consists of a Digital Filter Processor (DFP), Loop Calculation Processor (LCP) Communication Controller, Digital I/O Module, and a Digital to Analog (D/A) Converter.
The Digital Filter Processor receives analog signals from Analog Input Modules and performs both Analog to Digital (A/D) conversions and filtering operations on the input signals.
The outputs of the Digital Filter Processor are then passed on to the Loop Calculation Processor.
The Loop Calculation Processor performs calculations for protection channel functions, data comparison to setpoint values, and initiation of trip signals based on the data received from the Digital Filter Processor.
The Comunication Controller collects information from the Loop Calculation Processor and transmits it to the Tester Subsystem.
The Digital 1/0 module is utilized to process contact inputs, contact outputs, and trip logic output. signals.
The D/A Converter Module is utilized to convert digital values from the Loop Calculation Processor into analog values which are ser.t to analog output modules for further processing.
Tester Subsystem l
l The Tester Subsystem serves as the focal point of human interaction with the Eagle-21 system.
It provides a user-friendly interface that permits test personnel to configure (i.e., adjust setpoints and tuning constants), test, and maintain the system.
A Tester Subsystem consists of a Test Sequence Processor (TSP), Communication Controller, Digital to Analog (D/A) Converter Module, and a Digital I/O Module.
The Test Sequencer Processor reads information from the Comunication Control-1er, Digital I/O Module, and the MMI test cart.
This information allows the TSP to monitor the overall status of the Eagle-21 racks, perforr self diagnos-tics, and initiate surveillance testing.
The TSP provices information to the
i l
! Communication Controller, Digital 1/0 Module. D/A Converter, and MMI test cart.
This information provides for status indiction and creation of the Signal Injection and Response (SIR) bus.
This bus is distributed through the signal conditioning modules and allows the Tester Subsystem to control and test each module.
The Communication Controller receives information from the Loop Processor Subsystem Communication Controller. This information is then read by the TSP which allows it to monitor the status of the LCP.
The Tester Subsystem Communication Controller also provides a serial link to the Test Panel, which allows for information display and printing when connected to the MMI Test Cart.
The D/A Converter Module receives digital information from the TSP and converts it into high resolution analog signals that are used for test injection via the Signal Injection and Response (SIR) bus.
The Digital I/O Module receives digital information froa the TSP ano converts it into high resolution analog signals that are used fot' test injection via the SIR bus.
The Digital I/O module receives information from the TSP and provides signals to a Centact Output Module that provides contact.t for field devices.
2.1,4 Raview Criteria The Eagle-21 system is part of the reactor protectier. system which includes the reactor trip functions and the engineered safety featares actuation functions.
Therefore, the General Design Criteria (GDC) of Appendix A to 10 CFR 50 IEEE Standard 279, " Criteria for Protection Systems for Nuclear Power Generating Station" (10 CFR 50.55 a(h)) and the applicable acceptonce criteria listed oi:
Table 7-1 of the Standard Review Plan (NUREG-0800) will be used as the review guidance.
In addition, the ANSI /IEEE standard ANS 7-4.3.2, 1982, " Application Criteria for Programmable Digital Computer Systems in Safety Systems of Nuclear Power Generating Stations" and R.G.1.152, " Criteria for Programmable Digital i
Computer System Software in Safety Related Systems of Nuclear Power Plants,"
will be used to evaluate the Eagle-21 system software design verification and validation process.
i 2.1.5 Evaluation 2.1.5.1 Evaluation of Proposed Changes to the SQN Technical Specifications-The following four items have been reviewed and evaluated by the staff.
(1) A definition for a digital channel functional test is being added as item c to Definition 1.6 for the channel functional test in the TSs.
as follows:
A channel functional test shall be:
i I
?
- 7 Analog channels - the injection of a simulated signal into the channel a.
i as close to the sensor as practicable to verify operability including alarm and/or trip functions.
b.
Bistable channels - the injection of a simulated signal into the sensor to verify operability including alarm and/or trip functions.
Digital channels - the injection of a simulated signal into the c.
channel as close to the sender input to the process racks as practi-cable to verify operability including alarm and/or trip functions.
Definitions 1.6.a and 1.6.b are in the TSs and Definition 1.6.c is proposed to The staff finds that the digital channel functional test defiliition be added.
is consistent with the existing channel functional test definitions in the TSs and is, therefore, acceptable.
The allowable values of Tables 2.2-1 and 3.3-4 are being revised to reflect (2) rack drif t allowances associated with the Eagle-21 digital process protection system.
The staff has reviewed the Sequoyah instrument setpoint methodology document WCAP-11239 and 11626 (Reference 4), and finds that the allowable values of Tables 2.2-1 and 3.3-4 are consistent with the data in the setpoint methodology document which reflects the rack drift allowances associated with the Eagle-21 digital process protection system.
These rack drif t <*ata are smaller than the i
existing analog rack drift data because the Eagle-21 System is more accurate than the Foxboro analog system. Therefore, the propused allowable values are acceptable.
(3) Actions 17 and 18 of Table 3.3-3, and the channel functional test intervals of Table 4.3-2 are being revised to implement ~the Westinghouse Owners Group (WOG) Technical Specification Optimization Program (TOPS) engineered safety features actuation system enhancements of Westinghouse Electric Corporation WCAP-10271 Supplement 2.
The actions are given below:
l l
ACTION 17 -
With the number of OPERABLE Channels one less than the
~
Total Number of Channels, STARTUP and/or POWER OPERATION may proceed provided the following: conditions are satisfied:
i a.
The inoperable channel is placed in the tripped condition within six hours.
l l
b.
The minimum Channels OPERABLE requirements is mett L
however, the inoperable channel may be bypassed fe" up to four hours for surveillance testing of other channels per Specification 4.3.2.1.1.
L
ACTION 18 -
With the number of OPERABLE Channels one less than the l
Total Number of Channels, operation may proceed provided l
the inoperable channel is placed in the bypassed condition and the Minimum Channels OPERABLE requirement is met, one additional channel may be bypassed for up to four hours for surveillance testing per Specification 4.3.2.1.1.
l The staff finds that the proposed action statements No. 17 and No. 18 and the channel functional test intervals of Table 4.3-2 for quarterly tests are consistent with the appr,ved Topical Report WCAP-10271 and, therefore, are acceptable.
(4) The nrveillance intervals in Table 4.3-2 are being revised to reflect i
i the Eagle-21 system.
The proposed surveillance intervals and applicable modes are consistent with the existing values in the table for ESFAS instrumentation.
Therefore, the
(
proposed surviellance intervals and applicable modes are acceptable, i
2.1.5.2 RTD Bypass Elimination i
i Mechanical Concerns The mechanical modification removes the valves, piping, snubbers, and supports associated with the RTD bypass system and replaces them with thermowell mounted i
f fast response RTDs which are installed directly into' the reactor coolant piping.
Mechanical modifications begin with the removal of tre existing bypass piping at each connection point to the reactor coolant system.
The existing hot and cold leg penetrations are machined to accept RTD thermowells.
On the hot leg, the scoop tip will be removed to allow the thermowell to protrude directly into the flow stream.
The thermowell is installed inside the modified scoop and the t
RTD is installed within the thermowell.
The crossover leg connection is capped and an additional cold leg boss, thermowell and RTD are added as an installed L
spare.
The mechanical modification eliminates the need for periodic maintenance of the RTD bypass manifold which will reduce the occupational radiation exposure.
The staff finds this acceptable, t
The Sequoyah Eagle-21 design uses three hot leg RTD's input to obtain a single The s stem used to calculate is referred hot leg average temperature (THto as the Temperature Averaging hs) tem (TA t
A The Temperature Averaging System (TAS) becomes part of the thermal overpower and overtemperature protection edinthebypasskn)ifoldRTD.
TAS output (TH replaces the hot leg temperature signalpreviouslyme$hu)r.
system (Delto T / TA A
The TH signal is usedinthecalculationofthedeltatemperature(DeltaT)andNeragetempera-A The modular design of the Eagle-21 electronics allows for tu'.e (TinstallNko)n. of the digital hardware into existing process racks.
One rack per l
protection channel set is configured.
Channel separation is maintained throughout the Eagle-21 design.
The staff finds this acceptable.
4
.g.
2.1.5.3 New Steamline Break Protection The primary functions of the new steamline break protection system are to: (1) isolate non-ruptured steamlines following a secondary high energy line rupture and (2) inject borated water into the reactor coolant system.
The existing Sequoyah steamline break protection logic includes a safety injection actuation based on:
(1) Low steamline pressure coincident with high steamline flow.
(2) Low-low average coolant temperature coincident with high steamline
- flow, i High steamline differential pressure.
))
Low pressurizer pressure.
High containment pressure, and a steamline isolation actuation based on:
(1) Low steamline pressure coincident with high steamline flow.
(2) Low-Low average ecolaint temperature coincident with high steamline flow.
(3) High-High containment pressure.
The new steamline break protection system is currently in use as the standard l
system for later vintage Westinghouse plants.
The new steamline break protection logic will initiate a safety injection based on:
p Low Steamline Pressure (any steamline).
Low Pressurizer Pressure.
')I High Containment Pressure, and a steamline isolation actuation based on:
Low Steamline Pressure.
High-High Containment P* essure.
High Negative Steamline Pressure Rate.
The new steamline break protet tion system modifies both the process protection system and the reactor protection system voting logic.
In the process protection system, the steamline flow chtnnels will be deleted.
The steamline l
pressure channel is modified to delete tiie steamline differential pressure comparator output.
Two new comparators vill be added to the steamline pressure channel.
One comparator detects high nesdtive steam pressure rate (rate-lag compensated).
The rate-lag, lead-lag ano comparator functions are included in the EAGLE-21 process protection cabinet provides built-in test features to measure the lead / lag, derivative and cor.parator functions during periodic channel testing.
- c w
2 In the reactor protection system, the reactor protection logic will be modified to delete the safety injection on steamline differential pressure, and the steamline isolation plus safety injection upon high steamline flow coincident with low steamline pressure.
The new steamline break protection system logic requires the addition of a safety injection and steamline isolation on 2-out-of-3 coincidence of low steamline pressure, and a steamline isolation signal on 2-out of-3 coincidence of high negative steam pressure rate.
The staff has audited the licensee's post modification test procedures and the test results to verify that the new logic is properly integrated into the reactor protection system.
No open concern was revealed during the audit.
2.1.5.4 Environmental Allowance Modifier (EAM)
A Westinghouse Owners Group (WOG) survey of Westinghouse operating plants found that, between 1980 and 1985, 38 percent of all unplanned reactor trips were attributable to problems with main feedwater systems.
A closer examination revealed that 43 percent of all inadvertent plant trips were initiated by either the low low steam generator water level or the low feedwater flow trip signals.
A WOG Trip Reduction and Assessment Program (TRAP) was established to investigate methods and design modifications to reduce the frequency of these inadvertent trips occurring in Westinghouse plants and thereby increase plant availability and reduce challenges to reactor protection systems.
By letter dated December 15, 1986, from L. D. Butterfield to J. Lyons, the WOG submitted WCAP 11342, " Modification of the Steam Generator Low-Low Level Trip Setpoint to Reduce Feedwater Related Trips," to the MC for review and approval.
This WCAP, as part of the WOG TRAP, proposes a design modification which, when implemented on a plant specific basis, can reduce the inadvertent plant trips related to low steam generator level signals by an Environmental Allowance Modifier which distinguishes between normal and adverre containment environmental conditions and automatically selects a low or hig.1 setpoint for the low-low level trip chosen for the corresponding normal or I.dverse containment conditions based on the exclusion / inclusion of instrumentation uncertainties related to the harsh environmental conditions.
By utilizing the two dif ferent setpoints, more operational flexibility (and retuced serious trips) is provided during normai conditions, while adequate protection is still provided during accident / adverse conditions.
L The staff's generic review of the EAM design revealed that it is conceptually acceptable and may be used as a basis for plant-specific applications (Reference 1).
However, in order for the staff to perform a detailed design review of the EAM design for conformance to regulatory requirements, plant-specific submittals had to include the following information:
(1)
Plant-specific protection system logic diagrams accompanied by proposed revisions to Chapter 7 of the FSAR including compliance statenants with the applicable, existing plant-specific safety criteria (GDC's, RG's, IEEE STD 279, etc.) covering the plant design mcdifications.
I-l (2) Proposed changes to the plant-specific technical specifications with an accompanying Significant Hazards Evaluation covering the EAM installa-tion. This shall include new setpoints and allowable values for the low steam generator low-low level trip and the new containment pressure bistables as part of their operability / surveillance requirements for the EAM circuitry. Also a discussion of the applicability of the WCAP methodology should be provided including a determination of the pressure setpoint.
(3) Proposed changes to the plant-specific technical specifications with an accompanying Significant Hazards Evaluation covering any changes related to caeration of containment systems, if required, to ensure acceptability of tie EAM installation.
(4) Plant-specific changes to the operator procedures to cover the use of the EAM reset controls.
(5) Detailed electrical schematics covering the design modification.
(6) Plant-specific human factor analyses for any hardware modification to the control room.
(7) The EAM conceptu61 design provides for testing of the associated instrument 4
channels in the bypass mode. Since the licensirs basis for a typical Westinghouse plant provides for testing with the channel under test in the trip mode, a discussion of the acceptability for testing in bypass (reference to an applicable, approved WCAP such as WCAP-10271 is acceptable) should be provided.
The licensee has provided the above plant-specific information for staff review.
Specifically, the setpoint methodology documents (Reference 4), the EAM imple-mentation documents, and the supporting document for testing in bypass and the annotated copy of the FSAR included the logic diagrams.
The staff also audited the design modification package, test procedures and test results at Sequoyah site.
No open concern was revealed during the audit.
2.1.5.5 Steam Generator Low-Low Level Trip Time Delay Low water level, in any steam generator, will trip the reactor and actuate the auxiliary feedwater system. These actions are intended to protect the core and to maintain.an adequate heat sink for decay heat remuval.
The most critical need for such protective action would occur following a total loss of feedwater to all steam generators, or a major feedwater line rupture while the plant is operating at full power.
Therefore, the low steam generator water i
level protection system logic and setpoints are determined according to the
. requirements of these postulated conditions.
The same protective functions would also occur under less limiting conditions, such as the termination of feedwater to only one steam generator during plant startup operations.
Under these conditions, reactor protection system action I
r
, may safely be delayed, and thereby provide time for remedial operator action and for the natural stabilization of water level transients, Restoration of the water level during such a programmed delay would avoid an unnecessary reactor trip, and reduce the frequency of challenges to the reactor protection j
system (specifically, the frequency of reactor trip demands caused by feedwater-relatedproblems).
By letter dated December 15, 1986, f rom L. D. Butterfield to J. Lyons, the Westinghouse Owners Group (WOG) submitted WCAP-11325 " Steam Generator Low Water Level Protection System Modifications to Reduce feedwater Related Trips,"
to the NRC for generic review and approval.
This WCAP report, as part of the WOG TRAF, proposes a design modification, when implemented on a plant-specific basis, which can reduce the inadvertent plant trips related to low steam generator level signals by adding a time delay to the steam generator low-low Through water level initiated reactor trip and auxiliary feedwater actuation.
the use of adjustable timers in the protection system logic, this modification would allow added time for natural steam generator level stabilization or
'i operator intervention to avoid an undesirable inadvertent protection system actuation.
The staff's generic review of the TTD design and timer dosign revealed that they.are conceptually acceptable and may be used as a basis for plant-specific appHeations (Reference 1).
However, in order for t% staff to perform a detailed design review of the time delay modificatians for conformance to regulatory requirements, plant-specific submittalt had to include the following information:
(1) Plant-specific protection system logic diagrams accompanied by proposed revisions to Chapter 7 of the FSAR including coapliance statements with the applicable, plant-specific safety criteria (General Design Criteria, Regulatory Guides, IEEE STD 279, etc.) covering the design modification.
(2) Proposed changes to the plant-specific technical specifications with an dCCompanying Significant Hazards Evaluation, covering any new response time values for reactor trip and auxiliary feedw ter actuation on a l
low-low steam generator water level signal, the adjustment for the time delays (e.g., setpoint and allowable value accounting for calibration accuracy, drift, et() as part of the operability / surveillance requirements of the automatic actuation logic, and new setpoint and allowable values for the P-8 and/or other interlocks utilized.
(3)
Detailed electrical schematics covering the design modification with a discussion of the proposed periodic testing to be performe6 on the modified hardware installed.
(4)
Discussionoftheenvironmentalqualificationofequipment(e.g., sensors, timers, etc.) related to the design modification.
(5) Discussion of the total instrumentation uncertainties (e.g., calibration, drif t, etc.) for the plant-specific power interlocks utilized and their 1mpact upon the selection of the corresponding time delays.
i t
l (6) Plant-specific changes to the operator procedures resulting from delay of reactor trip and auxiliary feedwater initiation.
l l
(7) Plant-specific human factors analyses for additional displays in the con-1 l
(
trol room.
The licensee has provided the above plant-specific information for staff review.
l Specifically, the setpoint methodology documents (Reference 4), the TTD imple-mentation documents and the operator procedures resulting from delay of reactor trip auxiliary feedwater initiation.
The staff also audited the design modi-No fication package, test procedures and test results at the Sequoyah site.
open concern was revealed during the audit.
TTD Implementation Limit In the staff's SER (Reference 1) on Topical Report WCAP-11325, the staff concluded that the use of a time delay for reactor trip and auxiliary feedwater interaction on low low steam generator level for power levels in excess of the P-8 permissive is not acceptable at this. time.
This conclusion is based on an exainination of the advantages and disadvantages of these delays at high power from an overall risk standpoint. Most low-low steam generator level trips occur from low power.
Of those that occur at high power, only a fraction of these could be reduced by a delay in the low-low steam generatcr level trip and I
auxiliary feedwater actuation.
The fraction is relatively small (approximately 12%).
)
On the other hand, the staff was concerned that delaying the trip and auxiliary l
i feedwater actuation would introduce a complication which could reduce the steam generator inventory for the unlikely case in which the auxiliary feedwater system may not be imediately available on demand and further operator action i
l in necessary to restcre auxiliary feedwater flow.
The Sequoyah TTD design allows trip time delay up to 50% of the reactor re.ted thermal power.
The evaluation of the TTD implementation limit is addressed in Section 2.P.2 below.
2.1.5.o Median Signal Selector (MSS)
Each steam generator at Sequoyah has three independent water level instrument channels which provide input to the reactor trip system (RTS) for a reactor l
trip on two-out-of-three low-low water levels.
This low-low steam generator water level reactor trip function is designed to protect the reactor from the loss of heat sink in the event of a sustained steam /teedwater mismatch or a low feedwater flow resulting from a loss of normal feedwater, in the existing Sequoyah protection system, one of the steam generator _ water level instrument channels also supplies an input to the feedwater control system (FWCS).
The FWCS controls the feedwater regulating valve which-in turn regulates the feedwater flow into the steam generator.
As a result, a comon L
instrument channel is used for both the RTS and the FWCS.
IEEE Standard
,u..
,,w
. 279-1971 (10CFR50.55a(h)) Section 4.7 requires protection to prevent control and protection system interactions.
To satisfy the IEEE Standard 279 requirements, the low feedwater flow trip function was added to initiate a reactor trip during a condition of steam and feedwater flow mismatch in coincidence with low steam generator water level.
This trip provides a diverse trip function to the low-low steam generator water level trip.
The primary purpose is to resolve the control and protection system interactions concern.
The accident analysis does not include the steam /feedwater flow mismatch in mitigating the consequences of any analyzed accidents.
No credit was taken for the steam /feedwater flow mismatch because it is more conservative to use than direct low-low water level trip function.
The MSS system was proposed by the licensee for the FWCS, Instead of using one of the three steam generator water level instrument channels for control function, all three channels will be input to the FWCS.
The MSS system will select the median of the three input signals.
By selecting the median signal, the control system which causes the control and protection interactions will not be affected by a failed protection channel.
The MSS will prevent adverse interaction between the feedwater control system and the RTS.
By letter dated March 1, 1990, TVA submitted a Topical Report WCAP-12417
" Median Signal Selector for Foxboro Series Process Instrumentation Application to Deletion of Low feedwater Flow Reactor Trip" (Reference 2) to provide justification for the deletion of steam flow /feedwater flow mismatch reactor trip function.
The Topical Report WCAP-12417 addresses the engineering issues relative to the use of a median signal selector system; the hardware configuration, the operating principal, the reliability of the system, the capability for testing and the adequacy of failure detection within the MSS system.
The staff was concerned that an undetectable 'ailure in the MSS system may cause consrol and protection system interactiois.
To resolve-this concern, the licensee st0ted that the MSS has been provided with the capability for on-line testing.
The MSS can be tested concurrently with the protection instrument channels feeding the unit.
These protection channels are tested on a quarterly basis.
The components used in-the MSS system ara high quality components, and concurrently with the protection channels (Reference 3) quarterly basis the licensee has comitted to test the MSS system on ;
The staff has previously approved the similar MSS design for Beaver Valley Unit 2 (Docket No. 50-412).
An amendment to the Beaver Valley license was issued on February 20, 1990.
Based on the review of the Topical Report WCAP-12417, and the discussion with licensee during two meetings held on February 26 and March 13, 1990 respectively, the staff finds that the proposed MSS for FWCS in conjunction with deletion of low feedwater flow reactor trip is acceptable.
The staff audited the licensee's test procedures to verify that the MSS system testing l
was properly implemented.
No open concern was revealed during the audit, i
l
2.1.6 Evaluation of Eagle-21 Sof tware Design Implementation 2.1.6.1 Software Design and V&V Process i
The Westinghouse Eagle-21 system sof tware design and its sof tware verification validation (V&V) process is based on the experience gained from the South Texas Qualified Display Processing System (QDPS) design and the Watts Bar Eagle-21 System (RTD bypass elimination) design.
The software has been designed to be l
modular in structure. The smallest software unit is the " Procedure." A typical Procedure may have 10 lines of coding or a few pages of coding.
Each Procedure has a design performance specification and verification test specification.
Once the verification test has been completed, it will be treated as.a qualified component that can be used by the main program for different applications.
The main program simply determines the sequence for execution of these procedures.
All software follows the standards established for software design by the vendor, which include the following:
High-level module logic is used.
No interrupts are allowed.
i No reentrance is allowed, Code format conforms to standards for both high-level and assembly language routines.
All programs are single task.
The design process of the Eagle-21 system involved three stages:
I (1) Define a system design requirements.
(2) Decompose the system design requirements into hardware and software design specifications.
The software design specifications are further decomposed into subsystem, module, and procedure (unit) specification.
(3) Construct the hardware end various software into a system, and perform the validation testing of the system.
The verifb,ation process involves two stages:
(1)
Review the design documents, the computer coding and the testing documents..
(2)
Perform the independer t software testing that includes the structural testing and the functional testing.
The validation has three major phases:
(1) Top-down functional reluirement testing.
l l
(2) Prudency review of the design and its implementation, i
I i
16 -
(3) Specific Man-Machine Interface (MMI) testing.
After the verification and validation process, the software is installed in the programmable read only memory (PROM).
The software and documentation are kept under strict configuration management control.
2.1.6.2 Software Verification and Validation Audit Report On April 18 through 20, 1990, the staff performed an Eagle-21 software verifi-cation and validation (VAV) audit at Westinghouse Process Control Division where the Eagle-21 system was designed and manufactured.
The staff compared the Westinghouse V&V process with the American National Standard ANS-7-4.3.2-1982, " Application Criteria for Programmable Digital Computer System in Safety System of Nuclear Power Generating Stations" to determine the adequacy of the software V&V process of the Eagle-21 system.
(1) Organization: Westinghouse has a formal V&V group which maintains independence from the software design group.
The first and second levels of supervisors are independent.
Communications between the design group and the V&V group are documented in written reports.
The technical qualifications of the V&V team are comparable to those of the design team.
The staff finds that the organizational qualifications and independence dre in Conformance with the Standard ANS-7,1-4.3.2-1982, and, therefore, are acceptable.
(2) Design document verification:
The Eagle-21 system has formal auditable documentation which includes the following categories:
a.
System Design, Verification and Validation Plan, b.
Functional Requirements Documents c.
Functional Decomposition Documents d.
System Design Matrix e.
Validation Basis f.
Software Coding Standards 9
Sof tware Design Specification h.
Software Configuration Requirements 1.
Environmental and Seismic Qualification Reports t
j.
Noise, Fault, Surge Withstand and RFI Test Reports k.
Reliability Study 1.
Verification Problem Reports m.
Validation Problem Reports The staff selected the New Steam Line Break Protection Program as a thread path to audit through the following documents:
a.
The functional requirement document which defines the functions required by this program, the applicable criteria and standards, the reference drawings, the environmental requirements, the indicators, status lights, controls, alarms, interlocks, trips, time response, noise levels, controller transfer functions, setpoints, requirements for associated equipment, and the failure rode' requirements.
i b.
The functional decomposition document which provides instruction for design validation.
The top-level functional requirements are decomposed into detailed sub-requirements.
For each sub-require-ment, a test or series of tests are identified to ensure that the specific sub-requirement is satisfied.
Performance of these tests will constitute validation of the system functional requirements.
This document provides design traceability of requirements as they pertain to the Eagle-21 process protection system replacement equip-l ment and channels in those racks.
The system design matrix document which provides design traceability c.
from the top-level functional requirement documents through the supporting software design requirements, system design specification, module sof tware design specifications and factory l
acceptance / validation test results for a " top-to-bottom" design documentation road map to demonstrate system design verification compliance.
The staff's audit of all the documents related to the new steam line break protection program did not reveal any inconsistency in the V&V Process.
The documents are complete and accurate.
(3) Verification problem reporting:
There are three basic types of verification problem reports.
They are the following:
a.
Generic Problem Reports contain multi-module related problems or problems with system design requirement documentation.
b.
Module Level Problem Reports contain issues relating to entire source file, c.
Units Level Problem Reports apply only to a single unit of code.
When problem reports are prepared by the V&V Group and ready to be turned over to the design group, the V&V Librarian will issue a formal release letter to the design group librarian listing the file name of the reports and their location.
The problem report will be kept in a common directory in the V&V storage area that cannot be altered without the assistance of the V&V librarian.
The oesign group will copy the released report and make corrections in the program.
When problem reports are ready to be returned to the V&V Group, the design librarian will formally release the.
reports to the Y&V librarian using the standard release form.
The problem-reports for a particular project will be kept in a connon computer direc-tory in the design storage area.
Only the design librarian will have READ dnd WRITE privileges to this directory.
The V&V Group will verify and retest the corrected program and sign-off to CLEAR the problem report.
The staff audited the verification problem reporting process and random checked several problem reports, and found that the documentations are complete and thorough.
The problem reporting process is acceptable.
' i (4) Validation Process: The validation process is to compit. ment the verifica.
t tion process and to ensure that the final implemented system (hardware and The software) completely satisfied the system functional requirements.
major phases of the Eagle-21 validation process includes:
)
Functional requirements Abnormal-Mode testing Prudency review of the design and its implementation Specific Man-Machine Interface (MMI) testing The validation documents include:
Functional Decomposition Documents Design Document Decomposition Matrix Problem Reports The validation process was performed by a team of individuals independent from the design team.
They have performed 21 ccaprehensive tests'end 47 hardware / software reviews.
A total of 13 validttion problem reports were generated.
All validation problem reports welv satisfactorily resolved.
Out of these 13 problem reports, only one requires software change.
Based on the audit review of these validation problem reports, the staff con-cluded that it does not appear.to have serious software errors in the system.
At the time of the audit, the final V&V report was r,ct completed.
By letter c
l dated May 8,1990, the licensee provided the V&V final report.
The final report presents the results of the V&V Program conducted on the Eagle-21 System for l
Sequoyah.
The software verification for the Eagle-21 System for Srquoyah we empleted in April 1990 with the total number of software units inv91ved b ing 1100.
.% r these units, a total of 658 verification prn51:n:: reprte were generated.
Ai!
verification problem reports generated were resolved.
All changes to the soft ware documentation were reviewed and/or testeo t; demonstrate successful resolution of the problems found.
The system validation program for the Eagle-21 System for Sequoyah was also completed in April 1990 including 21 comprehensive tests and 47 hardware / soft-were reviews. The hardware / software reviews and validation tests have been satisfactorily completed.
All validation problem reports generated were successfully resolved, it was noted that none of the errors identified in the validation problem reports were errors that would be expected to be identified during the verification process. All problem reports generated during the validation process are in areas specific to validation.
Based on the staff's audit finding and the results of the final V&Y Report, the staff concludes that the Eagle-21 functional upgrade implemented for Sequoyah Unit 1 is demonstrated to meet its functional and design requirements.
. 2.1.7 Site Inspection Report On May 3 and 4,1990, the staff performed a site inspection of the Eagle-21 system at the Sequoyah Plant, Unit 1.
The system will be installed at Unit 2 during the upcoming Unit 2 Cycle 4 refueling outage.
The purpose of the inspection was to verify the following:
(1) The Eagle-21 system installation does not violate the existing channel separation / independent criteria.
(2) The control room modifications agree with the Eagle system design-requirements.
(3) The post modification tests have been properly performed.
l (4) The operator and the instrument maintenance personnel have been properly trained.
2.1.7.1 Eagle-21 System Installation Verification There are thirteen Foxboro H-line analog process protection racks which have been replaced by the Eagle-21 racks. The field sensors are connected to the existing cabinet-mounted terminal blocks.
The field cables were not changed except in few instances which related to the new steasine break protection system, the new annunciator windows and the new inpu u for the post accident monitoring system where new cable routing were required. On May 3, 1990 the licensee had completed 89% of the input / output points calibration procedures.
The licensee stated that all the input / output points calibration will be completed before entering Mode 4 operation.
During the April 18, 1990 audit meeting, the staff was concerned that there was a mix of Class 1E and non-class 1E outputs from the partial trip output board.
The staff requested clarification regarding the partici trip output board design and operation.
By letter dated May 8, 1990, the licensee provided the following clarificatM.
The Eagle-21 Process Protection System Upgrade partial trip output board provides the interface between the Loop Calculation Processor (LCP) and the existing trip logic system.
Each partial trip output board provides up to four independent channels of logic output for driving relays in the trip logic system.
Each of the partial trip output boards may have a mix of Class 1E and non-class 1E outputs connected to the board chan-nels. With the exception of an indirect connection to a classic ground, the I
four output channels are completely independent.
During the site inspection, I
the licensee further clarified that for those cabinets which contain wiring for one division of Class 1E and non-divisional non-1E circuits, the entire non--
divisional circuit (including external cabling) must be separated from all wiring and cabling of the opposite redundant division of. Class 1E circuits.
Based on these clarifications, there is no open concern on this issue.
I
o 2.1.7.2 Control Room Alarm Modification The Eagle-21 equipment racks are located in the instrument room which is two floors below the main control room. The operator's interface with the Eegle-21 system is to acknowledge the following annunciator windows and status lights in the control room:
- 1) Protection channel trouble (one status light per channel)
Channel set failure (one window)
)/ Protection channel in. bypass (one window per channel)
J RTD failure (one window per channel)
J TTD timer start (one window per steam generator)
J Adversecontainmentenvironment(onewindow)
During the May 3 inspection, these annunciator windows had not been installed in the main control room.
The system operating instructions (501) related to these annunciator windows had not been issued.
However, the simulator has implemented these alarm messages and the operators have been trained with the Eagle-21 system implementation.
The annunciator window modifications and the l
S01 will be completed before entering Mode 4 operation.
2.1.7.4 Post Modification Testing The staff audited the post modification testing docurents itcluding the Eagle-21 hardware site acceptance test, channel functional tests, instrument calibration records, and the QA procedures tracking the Eagle-21 programable Read Only Memory (E-PROM).
It appears that the test records are well kept and easy to trace.
Although the post modification tests to accept the system as operable have not been completed at the present time (i.e., May 3, 1990), the licensee has kept the resident inspector informed of the testing progress on a daily bases.
These tests will be completed before entering Mode 4 operation.
The post modification tests are performed on an overlapping basis.
No integrated tests are planned.
Although no major problems have been revealed frnm each individual test, the interaction between the plant live process signal to the Eagle-21 system and output to the solid state protection system has not been demonstrated.
Because the Sequoyah Eagle-21 system is a first-of-a-kind microprocessor based protection system, extra cautions-during 3
the plant startup period is warranted.
Therefore, tre staff requested that the
?
licensee report all the Eagle-21 system hardware / software problems to NRR during the plant startup period.
The surveillance test records of the Eagle-21 system should be available for staff audit.
A summary report of the Eagle-21 system should be submitted to the NRR on a six-month basis during the next operating cycle.
I
. 2.1.7.4 Training The staff conducted a two day inspection of the training of Sequoyah personnel on the Eagle-21 system as part of the Sequoyah Inspection 90-17 on Units 1 and 2.
During the inspection, the staff determined the following:
ten surveil-lance / maintenance personnel and all of the six shifts of reactor operators have been trained.
The surveillance / maintenance personnel were trained in a 5. week course by Westinghouse Electric Corporation which designed and built the Eagle-21 system.
These personnel had hands-on training with an Eagle-21 rack and the MMI test cart used to troubleshoot the system and perform surveillances and calibrations of the system.
In their training, these personnel used the first draft of the TVA procedures to perform the surveillance and calibrations of the system. All three shifts, covering a 24-hour day, will bestaffed with these trained personnel.
The licensed operators on shif t have been trained in classes on the Sequoyah simulator for the Eagle-21 system.
The remaining licensed operators in staff positions were scheduled to be trained by May 11, 1990.
Tht:; training also included the other modifications being completed in the Unit 1 Cycle 4 refuel-ing outage:
UHI removal, BIT deactivation, RTD bypass manifold removal, ACI deletion, AMSAC addition, and the cold leg injection accumulator and RWST changes.
The simulator now only models Sequoyah Unit 1 because these modifica-tions will not be done at Unit 2 until the Unit 2 Cycle 4 refueling outage, which is scheduled for the fall of 1990.
The staff reviewed the course material for training the surveillance /mainten-ance personnel and the licensed operators and discussed the material with at least one individual taking the courses.
The staff ciso visited the simulator, audited the records of software changes to the simulator to reflect the modifi-cations being completed at Unit 1 and discussed the change to the simulator with an instructor.
This training is considered to be acceptable for the use of the Eagle-21 system at Sequoyah.
Based on its review during Sequoyah inspection 90-17, the staff concludes that the training of surveillance / maintenance and licensed operators is sufficient to allow Unit 1 to startup and operate with the Eagle-21 system.
2.1.8 Conclusion Based on our review of information provided by the licensee; the meetings held with the licensee and Westinghouse representative on February 26 March 13 and 14, 1990; the software audit on April 18 through 20, 1990; and the site inspection on May 3 and 4, 1990; the staff finds that there is reasonable assurance that the Eagle-21 system conforms to the applicable regulations and guidelines.
The scope of the review included the FSAR cescriptive information, 10 CFR 50.59 submittal (Reference 5), and several Westinghouse Topical Reports submitted by the licensee. All submittals are listed in Table 1.
The staff met four times with the licensee and the NSSS vendor.
These meetings, which are also listed in Table 1, provided a focus for exchanging information and answering staff questions.
Based on the reviews noted above and the exchange of information at the four meetings, the staff has reached the following conclusions:
. The Eagle-21 system adequately conforms to the guidance for periodic testing in RG 1.22. " Periodic Testing of Protection System Actuation Functions," and IEEE 358, as supplemented by RG 1.118. " Periodic Testing of Electric Power and Protection Systems." The bypassed and inoperable status indication adequately conforms to RG 1.47, "8ypassed and inoperable Status Indication for Nuclear Power Plant Safety Systems." The Eagle-21 system adequately conforms to the guidance on the application of the single-failure criterion in IEEE 379, as supplemented by RG 1.53, " Application of the single-failure criterion to Nuclear Power Plant Systems." On the basis of its review, the staff concludes that the Eagle-21 system satisfies IEEE 279 with regard to system reliability and testability.
Ther1! fore, the staff finds that GDC 21 is satisfied.
The Eagle-21 system adequately conforms to the guidance in IEEE 384 as supplemented by RG 1.75, %hysical Independence of Electric Systems," for protection system independence.
On the basis of its review, the staff concludes that this system satisfies IEEE 279 with regard to independence of systems and hence satisfies GDC 22.
On the basis of its review of the interface between the Eagle-21 ;ystem and plant operating control systems, the staff concludes that the tystem satisfies IEEE-279 with riegard to control and protection system inter'.ction.
Therefore, the staff finds that GDC 24 is satisfied.
On the basis of its review of the sof tware design and its verification and validation, the staff concludes that the Eagle-21 system satisfies the requirements of ANSI /IEEE-ANS-7.4.3.2-1982,
" Application Criteria for Programmable Digital Computer Systems in Safety Systems of Nuclear Power Generating Stations" and Regulatory Guide 1.152,
" Criteria for Programmable Digital Computer System Software in Safety-related Systems of Nuclear Power Plants".
The staff's conclusions noted abova are based on the requirements of IEEE 279 with respect to the design of the safety-related portion of the Eagle-21 system. Therefore, we find that 10 CFR 50.55 a (h) is satisfied, in summary, we conclude that the Eagle-21 system meets all of the applicable guidelines and regulations and that its utilization as discussed previously is acceptable.
However, because this is the first Eagle-21 system in an operating plant, this acceptance is based on the licensee's commitments (Reference 10) to:
(1) report startup, (2) gle-21 system hardware /sof tware problems encountered during Unit I to NRC all Easubmit to NRC a perindic six-month summary report of the Eagle-21 system operation over the next operating cycle for Unit 1, and (3) submit any sof tware configuration changes or modifications to the hRC for staff review and approval prior to implementation if it is not Consistent with the original software design process (i.e., Revision 3 of the final V&V report).
The staff may audit the surveillance test records of the Eagle-21 system for Sequoyah.
2.1.9 References (1) Letter from A. Thadani (NRC) to R. Newton (WOG), " Acceptance for Referencing of Licensing Topical Reports WCAP-11325 " Steam Generator Low Water level Protection System Modifications to Reduce Feedwater-Related Trips " and WCAP-11342, " Modification of the Steam Generator low-low Level Trip Setpoint to reduce Feedwater Related Trips," dated January 7, 1988.
u '(2) Letter from E.G. Wallace (TVA) to NRC, "Sequoyah Nuclear Plant - Median Signal Selector - Westinghouse Electric Corporation WCAPS-12417 and 12418," dated March 1, 1990.
(3) Letter from E.G. Wallace'(TVA) to NRC, "Sequoyah Nuclear Plant _(SQN) -
Median Signal Selector (MSS) Testing," dated April 11, 1990.
(4) Letter from E.G. Wallace-(TVA) to NRC, "Sequoyah Nuclear Plant Eagle-21' Setpoint Methodology - WCAP-11239 and 11626," dated April 23, 1990.
- 5) Letter from'E. G. Wallace (TVA) to NRC, "Sequoyah Nuclear Plant Eagle-21 UnreviewedSafetyQmtion.(10CFR50.59)",datedApril' 11, 1990 (6) Letter from E.G. Wallace (TVA) to NRC, "Sequoyah Nuclear Plant Eagle-21 Process Protection' System Upgrade Summary Report," dated May 8, 1990.
(7) Letter from E.G. Wallace (TVA) to NRC, "Sequoyah Nuclear Plant Eagle-21 Equipment Qualification Reports,"-dated May 8, 1990.
(8) Letter from E.G. Wallace (TVA) to'NRC, "Sequoyah' Nuclear Plant Eagle-21 Upgrade to SQN Reactor. Protection System (RPS) _- Additional Information,"
dated May 8, 1990.
-(9) LetterfromE.G.Wallace(TVA)toNRC,"SequoyahNuclearPlantEagle-21 Verification and. Validation - Final Report," dati.d May 8,1990.
(10) Letter from E.G. Wallace (TVA) to NRC, "Sequoyah Nuclear Plant (SQN).- Eagle 21 Functional Upgrade Commitments," dated May 10, 1990.
2.2 Reactor Systems Evaluation 2.2.1 Introduction The licensee originally requested changes to TS 2.2.1, 3/4.3.1.1 and.3/4.3.2.1 and the associated bases to reflect modifications to the RPS (Reference '1, see Section 2.2.2.8 below).
Revisions to the proposed changes were' submitted in letters dated April.25 and May 15, 1990.
Additional information was submitted by letters as indicated in Reference 2.
The proposed proposed changes are given in Section 1.0 above.
The purpose of the changes is to improve the PPS's reliability and the plant's availability, by replacing analog RPS racks with digital equipment.
The EAM and TTD were developed to reduce unnecessary feedwater related reactor trips, likewise the steam flow / feed flow mismatch reactor trip is deleted by imple-menting the MSS.
the RTD bypass elimination reduces radiation exposure, improves plant availability and reduces the maintenance.
The new SLB
-protection logic eliminates, inadvertent ESF actuations.
The WOG TOPS will reduce plant surveillance testing and the editorial changes are made for clarity.
. The changes are based on the WCAP-11239. Revision 4. "Setpoint Methodology for Protection Systems." The EAM feature is based on WCAP-11342PA," Modification of the Steam Generator Low-low Level Trip Setpoint to Reduce Feedwater Related Trips" (Reference 3). The TTD modification is based on WCAP-11325PA Rev.1,
" Steam Generator low Water Level Protection System Modifications to Reduce FeedwaterRelatedTrips"(Reference 3).
The MSS implementation and the justification for the deletion of the steam flow /feedwater flow mismatch reactortrip)isdiscussedinWCAP-12417."MedianSignalSelector(MSS)"The RTD (Reference 4.
methodology including the overpressure'and overtemperature delta-T setpoints.:
The new SLB protection logic is based on reanalyses of the affected FSAR Chapters 6 and 15 transients to demonstrate the adequacy of the new SLB logic.
2.2.2 Evaluation-2.2.2.1 Trip Time Delay (TTD), Environmental Allowance Modifier (EAM)
The TTD is a system of programmed and predetermined delay times for the low-low level steam generator (SG) reactor trip and auxiliary feedwater delay times, based on the power level at the time of the low-low level trip and the number of steam generators affected.
In the Sequoyah design, the trip delay times are determined from two equations as a function of power (below 50% of rated.
thermal power). One relationship is for time delays with one SG affected and the other when more than one SG is affected.
There is-~no time delay for power levels above 50% of rated thermal power.
Once the low-low level setpoint is reached, the TTD acts to delay reactor tri_p and auxiliary feedwater system actuation to allow time for operator corrective action or for natural water level stabilization.
The time delay has been estimated using the methodology in WCAP-11325PA Rev. 1 using the criteria:
(a) that no DNB will take place 95%
of the time at the 95% confidence level and (b) that the reactor coolant and the main steam system pressure remain below 110% of the corresponding system design pressure.
During trip time delay it has been estimated that overpres-surization will not take place. After reactor trip the auxiliary feedwater supply is adequate to remove the decay heat.
However, the staff's approval of WCAP-11325PA, Rev. 1, (Reference 3) limited the WCAP's applicability to power levels not above the P-8 permissive.
The Sequoya5 P-8 permissive corresponds to 35% of plant thermal power.
However, the staff objective in _ approving WCAP-11325PA was to limit spurious plant trips due to the low-low steam genera-tor signal.
The intent of the limitation was to include all power levels which were subject to feedwater level variation which could activate the low-low level signal.
For Sequoyah this power level is 50%, because both units have a second feedwater pump activated between 40% to 50% power. _ The expression of the limitation in WCAP-11325PA in terms of the P-8 was convenient for.the model plant (i.e., Callaway) in which the P-8 permissive was at the 50% thermal power level.
Therefore, the staff finds that the 50% power limit for Sequoyah is justifiable, acceptable, and in agreement with the intent of WCAP-11325PA.
The EAM steam generator low-low level trip conceptual design is discussed in WCAP-11325PA.
The EAM can be described as an automatic switch that raises ~ the SG low-low level trip setpoint to increase the-environmental error allowance in d
)
the setpint whenever a harsh containment environment is indicated by detection l
l; The EAM can reduce the frequency of of an elevated containment pressure.
unnecessary feedwater-related trips by increasi.'g the difference between the nominal SG water level and the low-low: SG level t.-ip setpoint during normal opera tion. -
2.2.1.1.1 The ATWS Mitigating System Activation Circuity (AMSAC)
The ATWS mitigatin'g system actuation circuitry -(AMSAC) is required by 10 CFR 50.62. The AMSAC design is not to interfere with the reactor protection functions.
The AMSAC as described in Reference 5'provides an independent back-up to the existing protection systems which initiates a turbine trip and actuates euxiliary feedwater flow in the event of an anticipated transient without a reactor trip while the power level is above 40%.of rated thermal i
As implemented in the Sequoyah units, the AMSAC will tria the turbine power.
and initiate the auxiliary feedwater if-(1) the water. level in t1ree of four SGs drops 5% below the' SG low-low level reactor trip setpoint and (2) the power 1
-is greater than 40%.
If the power.is greater than 50%, the TT0/EAM system does not operate and, if the power is below 40%, the AMSAC does not operate.
In the 40-50% power range. -if the level in more than two SGs drops below the AMSAC setaoint then both the AMSAC and,the TTD will be actuated.
- However, because t1e AMSAC delay is shorter than the TTO delay, the turbine could be tripped and the auxiliary feedwater initiated before the TTO had a chance to 1
trip the reactor; in addition, the Sequoyah units are equipped with the'P-9 permissive and the turbine trip will not cause a reactor trip,(unless another trip is initiated somewhere else in'the RPS) thus a reactor. trip will not take place until the TTD delay lapses.
Thus, the staff cercludes that the AMSAC does not interfere in TTO's function and vice versa.
2.2.1.2 Loss of Normal Feedwater A plant specific loss of normal feedwater analysis (i.e., FSAR Section 15.2.8) was carried out to demonstrate that the auxiliary feedwater system is of sufficient capacity to remove core decay heat, stored energy and RCS pump heat following reactor trip.
In tb 4 e se: e. reactor trip on SG low-low water level will The analyses were carried oc+ using the LOFTRAN code (Reference 6) for occur.
I powers below 50% of the rated thermal pwer. The results showed that the auxiliary feedwater capacity is adequate a d that the RCS heatup is controlled.
This analysis also confirms that-the TTD does not invalidate the FSAR conclu-sions for the feedline break transient.
2.2.2.1.3 LOCA Accidents Plant specific analyses showed that the LOCA related accidents are unaffected by the TTD and EAM modifications.
2.2.2.1.4 TTD and EAM Conclusions In summary, the staff concludes that the proposed TTD/EAM modifications are acceptable because of the following:
(1) within the 95% probability 95%
.- confidence level that minimum departure from nucleate boiling ratio (MDtiBR) will not be reached, (2) primary and secondary pressure will remain below 1107, of their respective design limits, (3) the pressurizer will not fill, (4) there is no detrimental interaction with the AMSAC, (5) there is no impact on the FSAR conclusions for the feedline break analysis, and_ (6) there is no impact on the LOCA related accident analyses.
Therefore, the staff concludes that'the-TTD/EAM modifications are acceptable.
2.2.2.2 RTD Bypass Elimination The RTD bypass line is being replaced by three RTDs mounted in thermowells 120' apart in the same location in= the hot leg.of-the reactor coolant system (RCS).
Two RTDs will be placed in the cold' leg at _the reactor coolant pump (RCP) disenarge. The elimination of the RTD bypass causes an increase in the response 4
time of the temperature detectors from 6.0 sec to 8.0 see which causes the overpower delta-T and overtemperature delta-T signals to be' delayed by 2.0 seconds compared to the existing analysis, in addition, the RTDs generate delta-Ts'and an average RCS temperature.(Tfeedwater isolati8X') low-low Tin each loop w the following:- low-T SI/steamline isola-tion,controlrodconU81,steamdumpcontrol,pressurillflevelcontroland RCS flow measurement.
RCS flow and T determination are the only parameters havingapossibleeffectontheLOCA$Ellysis.
However, the uncertainties.
associated with=the RTDs are within the current limits.
Therefore, the RCS inlet / outlet temperature, the thermal design flow rate and.the SG thermal-hydraulic data will not be affected, consequently the LOCA related accident l
analysis is not affected by the RTD modification.
The RTD bypass eliminution was examined with respect to.its impact on the non-LOCA safety analyses.
The anticipated transients which could potentially be affected are the following:
- uncontrolled RCCA withdrawal at power (overtemperature delta-T or high' neutron flux) uncontrolled boron dilution, i
- excessive load increase,
'I
- accidental RCS depressurization, overpower delta-T, and steamline break with the mass / energy release outside containment.
i The results showed that either the delayed signal from the RTD modification is not used as a primary trip signal or whenever it is used the safety analysis criteria are met.
Therefore, the staff concludes that the RTD' modification-is acceptable.
l
2.2.2.3 New Steamline Break Protection As in the old steamline break protection, the new concept-is also based on safety injection and steamline isolation.
Safety injection will result from..
low steamline pressure, low pressurizer pressure, or high containment pressure.
Steamline isolatior, will ba actuated from high-high containment pressure,. high negative steamline pressure rate or low steamline pressure.
The new steamline
~
break protection was reviewed to ascertain that the new logic is acceptable and at least an equivalent level of protection is offered in the new logic as in
(
the old logic.
- The following non-LOCA transients have been-analyzed:
Uncontrolled rod cluster control assembly (RCCA), or control rod, with-drawal from a subcritical condition (FSAR-15.2.1),
- Uncontr olled RCCA withdrawal at power (FSAR-15.2.2),
- RCCA misalignment (FSAR-15.2.3),
Uncontrolledboror, dilution (FSAR-15.2.4),
Partial and complete loss of forced reactor coolant flow (FSAR-15.2.5),
- Startup of an inactive reactor coolant loop (fSAR-15.2.~6),
- Loss of external electrical load / turbine trip (FSAR-15.2.7),
- Loss of normal feedwater (FSAR-15.2.8),
- Loss of offsite power to the station auxiliaries (FSAR-15.2.9),
- Excessive heat removal due to feedwater system malfunctions (FSAR-15.2.10).
Excessive load increase (FSAR-15.2.11),
- Accidental depressurization of the RCS (FSAR-15.2.12),
- Rupture of a main-steam line (FSAR-15.4.2.1)
' Spurious operation of a safety injection system at power (FSAR-15.2.14),
f
' Major rupture of a main feedwater pipe (FSAR-15.2.2),
Rupture of a control rod drive mechanism housing (FSAR-15.4;6),
Steamline break, coincident with rod withdrawal at power Steamline break mass / energy release'inside containment (FSAR-6.2) 4
I The results of the analyses showed that one of the following was true for each l
of the above transients:
(1) steamline isolation and safety injection were not required, (2) there is no impact from the Eagle-21 system, (3) the analyses i
criteria are met, or (4) there is no difference from the old analysis.
The LOCA-related and steamline break analyses are unaffected by this modifica-i" tion. Therefore, the staff concludes that the proposed protection system modifications are acceptable with respect to the steamline break protection.
2.2.2.4 Elimination of the Low-Feedwater Flow Reactor Trip, Using the Median Signal Selector (MSS) i Elimination.of the low feedwater flow reactor trip does not require any l
reanalysis of the non-LOCA safety analysis because this trip was never assumed to be a primary reactor protection trip.
However, the same signal detectors 6nd transmitters used-in the low-feedwater flow trip provide the signals used l'
for feedwater control, but the introduction of the MSS addresses all-control and protection signals and insures that the MSS does not impact the non-LOCA transients.
The LOCA analyses on the other hand assume reactor trip and safety injection signals based on low pressurizer pressure or high containment pressure; therefore, the t.0CA accident analyses are unaffected by this modification.
L.2.2.5 Steam Generator Tube Rupture (SGTR)
The Sequoyah FSAR Section 15.4.3 demonstrated that the radiological consequences of a SGTR are below the exposure guidelines in 10 CFR 100.
The consequences of the Eagle-21 equipment and limit settino changes, including the RTD two second response time increase, are insignificant and the FSAR conclusions for SGTR D
remain unchanged.
2.2.2.6 Conclusion We have reviewed the TVA proposed Eagle-21 control and safety system implemen-tation from the safety function point of view.
Specifically, this safety evaluation addressed.the RTD bypass elimination, the new steamline break.
- ,rotection -the median signal selector, the time trip delay, and'the environ-mental allowance modifier.
In addition, we examined the trip time delay with the ATWS mitigation actuation circuity.
In all cases, we find that the pro-posed modifications did not exceed the design or existing regulatory limits, thus, the staff concludes that the proposed changes are acceptable.
2.2.2.7 Technical Specification Changes The proposed technical specification changes reflect the modifications in the RPS, revise the definition sections, and revise the TS Bases of Specifications:
2.2.1, 3/4.3.1.1,'and 3/4.3.2.1.
Incorporation of the Eagle-21 digital process protection system modifications are expected to improve plant availability and reliability.
In addition, the Westinghouse Owner's Group, technical specifica-tion optimization program for engineered safety features actuation system is implemented.
The specific changes and their evaluation follows:
l
0 i
. (1) Tables 2.2-1, 3.3-1 to 3.3-5, 4.3-1 and 4.3-2 are revised to reflect the TTD and EAM cc the low-low steam generator level trip signal.
i The changes provide for the power range and the' corresponding trip time delay calculation and accounts for the environmental allowance modifier based on low containment pressure.
The conditions described in the technical specification changes reflect the description of the TTD and EAM functions have been generically approved in Reference 4 andlthus are acceptable.
(2) Tables 2.2-1, 3.3-1, 3.3-2 and 4.3-1 reflect the deletion of the steam /
1 feedwater flow' mismatch and the-low-low SG water level reactor trir and-the incorporation of the MSS.
The median signal selector was;found acceptable in the accident analyses.
The technical specification changes reflect the deletion of steam /feedwater-mismatch and the low-low SG water level trip'and the implementation of;the MSS.
These changes are acceptable, because safety analyses considerations-showed that they provide equal level of protection as the previous sets of signals.
(3) Tables 2.2-1 and 3.3-2 are revised to. reflect th'e RTD bypass elimination and its effect on the overtemperature delta-T'and overpower delta-T..
There are several entries-in ta'bles 2.2-l'and 3.'3-2 which changed in the i
specifications associated with the RTD bypass elimination. corresponding to time parameters in the. estimation of the.overtemperature delta-T and overpower delta-T.
The transients affected due o the longer response.
time have been reanalyzed using the trip functions incorporated in the new expressions (in these technical specification. changes) and-found acceptable. Therefore, these specification changes are acceptable.
(4) Tables 2.3-3, 3.3-4, 3.3-5 and 4.3-2 are revised to incorporate the new steamline break protection logic which reflects deletion of_(a) the high
~
steamline differential pressure protection' signal-(b) high'steamline flow and (c) low-low average coolant temperature and the addition of (a) low steamline pressure (b) low pressurizer pressure ~(c) high containment 1
pressure and (d) high negative steamline pressure rate for actuation of safety injection.and/or actuation of steamline isolation. - Reanalyses with the new steamline break protection showed that it,provides an equivalent level of protection (and reduced spurious actuations) and, thus, it is acceptable.
(5)
In Table 3.3-1 actions 2.6 and 6.6, in Table 3.3-3 actions 15 to 18, 21 and 23 and the channel functional test intervals in Table 4.3-2 have been revised to implement the Westinghouse Owners Group technical specification optimization program engineered safety features actuation system enhance-ments (WCAP-10271PA, Supplement 2, Rev.1).
e
-a
S l
i
> t All of the above changes have been reviewed and approved in the topical ~
report WCAP-10171PA except for Table 3.3-3 Action Statements 21 and 23 and Table 4.3-2 surveillance intervals. These action statements are not.
being changed by _the proposed action.and the surveil _ lance intervals are addressed in Section 2.1.5.1 above. The other changes are acceptable because they have been generically approved.
2.2.2.8 References (1) Letter from M.J. Ray, Tennessee Valley Authority to USNRC'"Sequoyah
-f Nuclear Plant (SQN).- Technical Specification (TS) Change 89-27,"' dated 1
January 24, 1990.
Letter from E. G. Wallace TVA, "Ssquoyah Nuclear Plant (SQNh -; Eagle;
.(2) (a) 21 Unreviewed Safety Questf ons USQ," dated April 11,1990.
'f i
(b) Letter from M._J. Ray TVA to USNRC, "Sequoyah Nuclear Plant Technical l Specification Change 89-27," dated January 24,.1990.
1 l
(c) Letter from E. G. Wallace, TVA to USNRC, "Sequoyah Nuclear Plant l
Steam Generator Low Water Level Trip Time-Delay, Additional Information," dated May 9, 1990.
(3) WCAP-11325PA, Rev. 1, " Steam Generator Low Water Level Protection System Modifications to Reduce Feedwater - Related Trips" by S. Miranda et al.,
February 1988.
(4) WCAP-12417, " Median Signal Selector 'for Foxboro Series Processi Instrumentation, Application to Deletion of Low Feedwater Flow Reactor Trip" by J. F. Hermigus, dated October 1989.
(5) WCAP-10858PA, "AMSAC Generic Design Package" by M. R. Adler, dated June l
1985.
(6) WCAP-7907-P-A, '"LOFTRAN Code Description" by T. W. T. Burnett et al., _
Westinghouse Electric Corporation, dated April 1984.
2.3. Containment System Evaluation TVA discussed the effect on containment. integrity of the modifications to
~
Sequoyah involved with the proposed TS changes.
In its letter dated April 11, 150, it stated that these modifications would not have an adverse impact on the mass and energy releases from the design basis _ Loss-of-Coolant Accident'.
l l
(LOCA) and Main Steam Line Break (MSLB).
These accidents have been reanalyzed-by TVA to' include these modifications;and other modifications which were-L planned.for the Cycle 4 refueling outages for the units.
These other modifica-tions include upper head injection-(UHI) removal, boron injection tank'deactiva-:
q tion, and VANTAGE 5 Hybrid-fuel use in the core.
The reanalysis of the depres "
surization of the. main steam system, main. steam line rupture, small break' LOCA and large break LOCA were submitted by TVA in its letter dated January 12, 1990 for the removal of-the UHI during the current Cycle 4 refueling outage..
.m a
.. The reanalysis of the containment response to the large break LOCA was submitted by TVA in its letter dated January 12, 1990 for its TS Change Request
)
90-05, the extension of ice weighing interval-for the ice condenser to 18 monchs. The new peak containment pressure is 10.9 psi following the large break LOCA. This peak pressure is below the design value of 12 ps1 for the containment.
The staff accepted (1) the reanalysis of the effect of the above accidents on the fuel in the core in its letter dated May 11, 1990 approving Amendment 140 in its letter dated March 2, 1990 approving Amendments 131 and 118 for Units 1 and 2, respectively.
Therefore, the staff concludes that the modifications involved with the proposed TS changes-for the RPS upgrades and enhancements do not adversely affect containment integrity.
2.4 Editorial Technical Specification Changes The licensee has used the acronym "RTP" for Rated Thermal Power in its proposed changes. Rated Thermal Power is defined in Definition 1.25 in Section 1.0 of the TSs.
The acronym "RTP" will be added to the words Rated Thermal Power in Definition 1.25.
This change is acceptable, Action statements in Tables 3.3-1, 3.3-3, and 4.3.1 are proposed to be deleted because they are not needed for these tables.
The staff agrees that these action statements are not needed; therefore, the proposed changes are acceptable.
A note and astericks referring to the note for item "7" in Tables 3.3-3 and 3.3-4 are proposed to be deleted because the footnote-is no longer needed for 2
the table.
The footnote refers to when a modification must be completed.
Because the date is in the past,-the footnote is not needed; therefore, the proposed change is acceptable.
2.5 Conclusion Based on the above, the staff concludes that the proposed use of the Eagle-21 System, the EAM, the TTD, the MSS, the new steamline break protection logic, and the TOPS engineering safety features actuation system enhancements of WCAP-10271,. Revision 2, are acceptable for Sequoyah Units 1 and 2.
The staff also concludes that the proposed changes to the Sequoyah TSs to incorporate these upgrades and enhancements are acceptable.
These RPS upgrades and enhancements were implemented at Unit 1 during the-current Unit 1 Cycle 4 refueling outage.
Therefore, the proposed TSs for Unit 1 are being issued at this time.
The TVA applications also proposed changes for the Unit 2 TSs.
The RPS upgrades and enhancements associated with the proposed TS changes will be implemented-at Unit 2 during the Unit 2 Cycle 4 refueling outage which is scheduled to begin in October 1990.
The TS changes for Unit' 2 will be issued during this outage. This Safety Evaluation also applies to Unit 2.
i
T -
In the letter dated May 10, 1990, the licensee comitted to.(1) report Eagle-21 system hardware, design software, and maintenance problems encountered during the startup of Unit 1 from the current Cycle 4 refueling outage; (2) submit, for Unit 1 operating Cycle 5, six-month reports discussing the operation of-
- the Eagle-21 system for Unit 1 in operating Cycle 5; and (3) submit sof tware configuration and system modifications, prior to implementation, not consistent with the staff approved Revision 3 of the final Eagle-21 system V&Y Report for Sequoyah, which was submitted by letter dated May 8, 1990.
The licensee-comitted to submit the: first report within 30 days of Unit I reaching approxi-mately 100 percent power.
3.0 ENVIRONMENTAL CONSIDERATION
This amendment involves a change to a requirement with respect to the installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20 and changes to the surveillance requirements. The-staff has determined that this amendment involves no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational-radiation exposure..The Comission has' previously -
issued a proposed finoing that this amendment involves no significant hazards l
Accord-L consideration and there has been no public coment on such finding.
ingly, the amendment meets the eligibility criteria for categorical exclusion l
set forth in 10 CFR 51.22(c)(9).
Pursuant to 10'CFR 51.22(b), no environmental impact statement nor environmental assessment need be prepared in connection-with the issuance of this amendment.
4.0 CONCLUSION
The Comission made a proposed determination that the amendment' involves no significant hazards consideration which was published in the Federal ' Register (55 FR 6119) on February 21, 1990 and consulted-with the State of Tennessee INo public coments were received and the State of Tennessee did not have any comments.
The staff has concluded, based on the considerations discussed above, that: (l')
there is reasonable assurance that the health and safety of the public will'not be endangered by operation in the proposed manner, and (2) such activities will be conducted in compliance.with the' Commission's regulations, and the' issuance -
of the amendments will not be inimical to the common defense and security nor to the health and safety of the public.
i l:
l' Principal Contributor:
H. Li, L. Lois and J. Donohew i
Dated: May 16, 1990 l-
.l
[.
l-L
s 3
J TABLE 1 1
TVA LETTERS - NRC REVIEW CHRONOLOGY Date Subject'-
Comment 01/24/90 TS 89-27, Eagle-21 TS Changes TVA letter 02/26/90 NRC/TVA/ Westinghouse Meeting in Meeting Rockville, Md.
03/01/90-Median Signal Selector - WCAPs 12417/
TVA letter 12418 03/01/90 Eagle-21 Topical Report - WCAPs TVA letter 12374/12375 03/13-14/90 NRC Audit in Pittsburgh, PA NRC Audit, Note 1 04/11/90 Median Signal Selector Testing TVA letter 04/11/90 Eagle-21 10 CFR 50.59 Evaluation TVA letter 04/18-20/90 NRC Verification and Validation NRC Audit (V&V) Audit in Pittsburgh, PA 04/23/90 Setpoint Methodolegy - WCAPs 11239/
TVA letter 11626 04/24/90 Eagle-21 Operation in Mode 5 TVA letter, Note 2
~TS 89-27. Revision 1 TVA. letter, Note 3 -
l 04/25/90 04/26/90 Eagle-21 Operation in Mode 5 -
TVA letter, Note 2 Revision 1 05/03-04/90 NRC Eagle-21 Installation Audit NRC Audit-at=Sequoyah Site
-05/04/90 Eagic-21 V&V Completion TVA letter, Note 2 l
05/08/90 Eagle-21 Additional Information.
TVA letter, Note 1 l
Partial Trip Output Board Design-05/08/90 Eagle-21 V&V Final Report TVA letter, Note 2:
05/08/90 Eagle-21 Summary Report TVA letter 05/08/90 Eagle-21 Equipment Qualification TVA letter WCAPs 05/09/90 Eagle-21 P-8/TTD Design TVA letter, Note 2 l
t
^
o l
2-TABLE 1(Continued)
- s Date Subject-Comment 05/10/90 Eagle-21 Commitment Letter TVA letter 05/15/90 TS 89-27, Revision 2 TVA letter _ Note 4-1 j
i 0
j a
1 i
i Note 1 - Additional information required directly as a result of NRC ' audit activities.
Note 2 - Additional activities required because of.VSV schedule slips.
Note 3 - Changes to technical. specification pages as a result of error in P-8 setpoint and request to include cable IR in channel error.
Note 4 - Changes to technical specification pages as.a result of steam generator.
reference. leg heatup environmental allowance correction.
.