ML20101G076

Corrected SE Supporting Amend 79 to License NPF-58. Inaccuracies in Description of Changes Has Been Corrected

ML20101G076
Person / Time
Site:	Perry
Issue date:	01/20/1996
From:	NRC (Affiliation Not Assigned)
To:
Shared Package
ML20101G083	List: ML20101G076
References
NUDOCS 9603270048
Download: ML20101G076 (15)

Text

-....

._ ~

-~

p RfC

/

WTED STATES l

NUCLEAR Ri:JVI.ATORY COMMISSION If WA% ' NGTON, D.C. 20006 0001

\\...../

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 79 TO FACILITY OPERATING LICENSE NO. NPF-581 THE CLEVELAND ELECTRIC ILLUMINATING COMPANY. ET AL.

PERRY NUCLEAR POWER PLANT. UNIT NO. 1 t

DOCKET NO. 50-440 l

1.0 INTRODUCTION

l By letter dated November 22, 1993, Cleveland Electric Illuminating (licensee) requested an amendment to License No. NPF-58 to change the technical specifications for the Perry Nuclear Power Plant Unit 1 (plant).

By letter dated May 5,1995, the licensee provided information on the electromagnetic and radio frequency interference mapping done at the plant and a summary of the plant-specific seismic analysis for the General Electric (GE) Nuclear Measurement Analysis and Control (NUMAC) steam leak detection monitor equipment. This proposed amendment reflects the replacement of existing i

analog Riley leak detectico equipment with the digital GE NUMAC leak detection equipment. The proposed amendment also revises technical specification surveillance requirements by reducing the channel functional test surveillance frequency for several area temperature and differential temperature trip functions from monthly to semiannually in Technical Specification Table 4.3.2.1-1, " Isolation Actuation Instrumentation Surveillance Requirements."

By letter December 20, 1995, the licensee submitted Technical Specification l

pages that took into account previously issued license amendments. The.

supplemental letters of May 5 and December 20, 1995, did not change the L

licensee's request or affect the staff's notice of no significant hazards i

consideration.

The staff evaluated replacement of the existing analog system with digital GE NUMAC equipment, and increasing the CHANNEL FUNCTIONAL TEST surveillance intervals for the associated trip functions of the Reactor Water Cleanup (RWCU), Reactor Core Isolation Cooling (RCIC) (including the Main Steam Line Tunnel Temperature Timer), and Residual Heat Removal (RHR) systems. The staff also~ evaluated. replacement of the Division 1 and 2 logic for main steam line isolation (for the temperature instrumentation located in the steam tunnel area). The proposed change does not include the main steam line temperature isolation logic for the temperature instrumentation located in the turbine building.

2.0 SYSTEM DESCRIPTION The NUMAC Leak Detection Monitor (LDM) performs safety-related and nonsafety related functions usi1g Class IE and non-Class IE components. The safety-related functions of the LDM System:

9603270048 960318

~

DR ADOCK 0500 0

4 4,

• process temperature signals from the ambient and differential temperature sensors of the RWCU system, residual heat removal (RHR) system, and RCIC system, e provide isolation signals by comparing the input signals with preselected setpoints, and

• provide main steam line tunnel temperature timer for RCIC isolation 1

function.

The LDM system also:

• measures input current from the thermocouple input unit and performs the specified temperature calculations;

• provides output trip signals to external equipment;

• performs automatic calibrations;

• performs automatic self-tests and alarms;

• displays self-test status on demand; and

• provides security by'keylock and password against unauthorized changes to setpoints.

2.1 Eonioment Description The LDM is a GE NUMAC Class-lE system, with architecture consisting of a family of firmware-based 80C86 (16 bit) and 80386 (32 bit) controllers with application-specific analog and digital modules connected via a NUMAC bus. An independent display controller connects to the Class-lE processor via a serial link and provides the man-machine interface without affecting the Class-lE processes.

The'NUMAC architecture also includes both hardware and software watchdog timers 'and an integral self-test system. The LDM chassis is comprised of the following modules:

• Thermocouple Input Unit (TCIU)

• High Speed Parallel Data Bus

• Essential Microcomputer

e. Relay Output and Analog Output Modules

• Redundant Instrument Power Supplies

• Serial Data Link

. 1

+ Display Microcomputer

• Front Panel Interface and Display The TCIU connects the ambient and differential thermocouples (TCs) to the LDM instrument chassis. The unit contains an isothermal terminal board interface and transmits the temperature measurements to the LDM chassis. Six solid state temperature devices in the TCIU are used for determining the cold junction temperature. The LDM cold calibration may be performed with the Tcs in place. Up to six TC input modules may be used to accommodate a maximum of 36 TC inputs. Maintenance is accomplished by module replacement.

Each input i

is assigned to a channel within each input module. The modules are isolated from one another such that each module will not be affected by a failure in a different module.

The high speed parallel data bus provides the communication link between the TCIU, the essential microcomputer, and the relay output modules.

The essential microcomputer controls instrument measurements, performs trip and I/O functions, communicates with the display microcomputer, and performs the tests of the Self-Test System (STS) when not processing instrument data.

The essential microcomputer consists of an 80C86 microprocessor, Random Access Memory (RAM), Electrically Alterable Read Only Memory (EAROM), Read Only Memory (ROM), a priority interrupt controller, independent timers, and the STS i

circuitry. The microcomputer has sufficient computing power to perform digital trips, digital temperature compensation, automatic ranging, automatic calibration, and digital filtering. The microcomputer automatically calibrates the TC inputs to a known internal reference, thereby compensating time dependent drift characteristics to improve accuracy and resolution.

Output trips are set digitally and thus do not drift.

i The relay output module interfaces with the NUMAC LDM chassis and provides

)

Isolation, Alarm, IN0P, and spare outputs using relay output contacts.

The assignment of the output contacts to specific functions is programmable.

Channel isolation and alarm functions are automatically bypassed (the state of the assigned output relays does not change) when any of the following activities / conditions occur:

• calibration, calibration check, or trip check activities; i

• open conditions in the channel TC; or

• critical self-test faults in the channel.

The bypass is automatically removed when the above conditions no longer exist.

A single IN0P/ Trouble output relay is provided.

The IN0P/ Trouble relay is tripped in the IN0P mode and may be programmed to trip whenever there is a self-test failure condition while in the OPERATE mode.

Each relay contact may also be manually tested when the channel is in the IN0P mode.

The analog module interfaces analog signals from within the LDM chassis to the functional controller.

The NUMAC LDM has instrument power supplies which provide power to the LDM chassis.

Each LDM chassis has two redundant diode-auctioneered low voltage power supplies for uninterruptable power in the event of a power supply failure.

The serial data lin:: provides a one-way, isolated, high-speed output communications link between the safety-related essential microcomputer and the nonsafety related display microcomputer and front panel display. The serial data link is used to minimize the possibility of injecting faults into the essential microcomputer safety-related circuits.

The display microcomputer, which_is based on a 80180 microprocessor, processes the data from the essential microcomputer for display on the front panel interface and display module. The front panel interface and display module contains all of the circuitry necessary to interface with the display microcomputer, the front panel keyboard, and electro-luminescent display.

2.2 Imorovements By replacing the existing LDM with the NUMAC LDM, the licensee expects to improve the reliability and accuracy of the leak detection function._ The current analog LDM uses temperature switch modules that have experienced a high drift rate, have been prone to spurious alarms and trips, and have been difficult to maintain.

NRC Information Notice 86-69, " Spurious System Isolations Caused By the Panalarm Model 86 Thermocouple Monitor," and General Electric Service Information Letter (SIL) Number 416 describe problems with the Riley temperature modules that have resulted in spurious system isolations.

t The ambient and differential temperature monitoring functions are performed continuously by the Riley temperature modules and are independent of the operation of any controls. When the temperature (or differential temperature) being monitored-is in the alarm condition, relay contacts are closed, which automatically initiates further actions such as annunciations or system isolations.

Indication to the operator depends on the operation of a

" READ / SET" switch, which causes the output of each thermocouple " point" moaulo to be indicated on a separate meter module. The electrical transient caused by the operation of this " READ / SET" switch has been the predominant source of the spurious isolations.

Calibration of the Riley temperature modules is time consuming and has a high potential for creating spurious ESF actuations. Over thirty channel functional surveillance tests of the Riley temperature modules are performed monthly. Testing the Riley ambient and differential temperature modules requires lifting the thermocouple leads and adding jumpers around the isolation relays.

Installation of jumpers results in unnecessary isolations and increases the risk of technician errors.

Lifting leads is labor intensive, and also could cause a spurious actuation if the leads are

. incorrectly installed after performing the tests. The instrumentation and controls-(I&C) technician can inadvertently ground /short a jumper, a thermocouple wire, or a component while working within the cabinet, leading to an isolation. Additionally, this lead lifting procedure can cause broken thermocouple lead wires.

The Riley leak detection temperature modules have created problems for the operators and I&C technicians in terms of isolations and half isolation signals. A half isolation in the two-division portion of the leak detection system (RCIC, RHR and RWCU Systems) causes an isolation of the flow path to/from the containment, since one of the containment isolation valves in the penetration flow path closes. This reduces the reliability'and availability of these systems.

The digital NUMAC LDM contains design features that address the Riley analog temperature module monitoring system problems described above. Compared to the existing analog Riley temperature modules, the NUMAC LDM will reduce the number of temperature switch module instrument drift problems because use of digital equipment with setpoints established in software avoids drift concerns. Since the NUMAC LDM is designed to facilitate channel surveillances without lifting leads or installing jumpers, spurious actuations caused by these actions will be eliminated.

In addition, the resultant maintenance i

-activities and potential problems associated with performing channel surveillances will also be reduced by the built in self-test features.

3.0 REVIEW CRITERIA The NUMAC_LDM is a safety-related monitoring instrumentation system.

Therefore, General Design Criteria (GDC) 2, 4,13 and 19, IEEE Standard 279,

" Criteria for Protection Systems for Nuclear Power Generation Stations" (10 CFR 50.55 a(h)), and the applicable acceptance criteria in Section 7.5, "Information Systems Important to Safety" of the Standard Review Plan (NUREG-0800) were used as review guidance. Additionally, ANSI /IEEE Standard 7-4.3.2-1982, " Application Criteria for Programmable Digital Computer Systems in Safety Systems of Nuclear Power Generating Stations," and corresponding Regulatory Guidance (RG) 1.152,

" Criteria for Programmable Digital Computer System Software in Safety Related Systems of Nuclear Power Plants," were used to evaluate the NUMAC LDM system software design verification and validation processes.

4.0 SYSTEM EVALUATION The staff reviewed the qualification of the NUMAC LDM hardware and software components, defense against common operations and maintenance personne, mode failure, and the training of the o

l.

The results of these reviews are discussed in the following sections.

4.1 Hardware Part 50, Appendix A, GDC 2 and 4 require that the safety system be designed to I

withstand the effects of natural phenomena and be qualified to operate in its j

l

. environment under normal and postulated accident conditions. To ensure that the NUMAC LDM will perform its intended function (s) under design basis conditions, the staff reviewed the environmental qualification of the NUMAC equipment for (1) temperature and humidity, (2) seismic, (3) radiation, and (4) electromagnetic and radio frequency interference.

4.1.1 Temnerature and Humidity GE performed temperature and humidity tests on the NUMAC instrument chassis and associated modules. The test procedures were the same as documented in Appendix C of NEDC-31974P, " Qualification Report for Nuclear Measurement and Control for Reactor Building Vents Radiation Monitor System for TVA Browns Ferry Nuclear Plant, Units 1, 2 and 3" which was previously reviewed and approved by the staff. The staff used IEEE Std 323-1974, "IEEE Standard for Qualifying Class IE Equipment for Nuclear Power Generating Stations," as review guidance for temperature and humidity qualification.

GE qualified the NUMAC LDM equipment by testing equipment unique to the LDM and analyzing equipment similar to the NUMAC product line equipment. The NUMAC LDM environmental tests consisted of component aging, printed circuit board (module) qualification, instrument qualification, and instrument heat rise. The NUMAC LDM instrument is qualified for continuous operation between 40*F and 122*F and between 10% and 90% noncondensing humidity.

The NUMAC LDM modules also demonstrated satisfactory performance up to 158'F. Maximum LDM instrument internal heat rise was measured at 18'F in the vicinity of the power supplies.

The licensee stated that the design ranges for the plant control room temperature and humidity where the NUMAC LDM equipment will be located are:

Temperature:

Normal 64 - 77'F (75'F Avg.)

Design Basis Accident (87'F Avg.)

Humidity:

Normal 20 - 90% RH(50% Avg.)

Design Basis Accident (87% Avg.)

Thus, the NUMAC LOM qualification temperature bounds the normal and accident environments.

In addition, the margin between the normal control room general area ambient temperature and the NUMAC qualification temperature is adequate to accommodate potential local heating effects inside the panel containing the LDM modules.

Humidity is not a directly controlled parameter at the plant; however, the design humidity range stated above is bounded by the 10% to 90% humidity range to which the NUMAC LDM is qualified.

Based on the foregoing review, the staff finds that the GE temperature and humidity qualification of the GE NUMAC product envelops the licensee's plant specific temperature and humidity conditions, and meets the guidance of IEEE Std 323-1974. Therefore, the staff finds the temperature and humidity qualification acceptable.

i

. i 4.1.2 Seismic Qualification The LDM equipment and panels that replace existing equipment and panels are safety-related seismic Category I components. GE performed a similarity analysis of the NUMAC LDM chassis and interface panels against the existing equipment for the licensee. GE performed the similarity analysis to show that the plant specific NUMAC LDM devices are mechanically the same or equivalent to devices GE tested. The results of the GE study are summarized in Reference 2.

The GE study demonstrated that the NUMAC LDM seismic qualification envelopes the required response spectra at the plant site.

The seismic qualification study was performed in accordance with IEEE Std 344-1987, "IEEE Recommended Practice for Seismic Qualification of Class IE Equipment for Nuclear Power Generating Stations." Therefore, the staff finds the seismic qualification acceptable.

4.1.3 Radiation The LDM components located in the control room were qualified to a maximum total. integrated dose (TID) of 1E+4 rad. This is within the plant normal and accident radiation doses for the associated areas. The test procedures and the test results~are documented in NEDC-31974P, Appendix C, which was previously approved by the staff. The staff finds the radiation qualification to be acceptable.

4.1.4 EMI & RFI Electromagnetic interference and radio frequency interference (EMI/RFI) are random noise produced by systems within the operating environment of the plant. This random noise can affect the safety of the plant since it can potentially lead to common cause failure of redundant safety-related equipment that is vulnerable to the noise.

In safety-related (and nonsafety-related) instrument and control system applications, digital equipment, which operates at higher frequencies and lower voltages than the analog equipment it replaces, is vulnerable to EMI and RFI.

Specific guidance and information for the review of EMI/RFI is contained in the following standards and documents:

1.

MIL-STD-461(A,B,C), " Electro-magnetic Emission and Susceptibility Requirements for the Control of Electro-magnetic Interference."

2.

MIL-STD-462, " Electro-magnetic Interference Characteristics Measurement."

3.

MIL-STD-1399, " Interface Standard for Shipboard Systems, DC Magnetic 4

Field Environment."

i.

4.

SAMA PMC 33.1-1978, " Electro-magnetic Susceptibility of Process Control Instrumentation."

i

. l 5.

IN 83-83, "Use of Portable Radio Transmitters Inside Nuclear Power Plants."

6.

IEC 801-2 " Electromagnetic Compatibility for Industrial-Process Measurement and Control Equipment Part 2: Electrostatic Discharge Requirements."

l 7.

NUREG CR-3270, " Investigation of Electro-magnetic Interference (EMI)

Levels in Commercial Nuclear Power Plants."

Using the above as guidance, the staff reviewed the licensee's EMI/RFI environmental qualification of the NUMAC LDM. This review included the EMI/RFI qualification methodology and range of frequencies tested, and the EMI/RFI qualification process for the installed equipment.

The qualification j

of the installed equipment consisted of a site survey to verify that the installed equipment qualification envelopes its EMI/RFI frequency / amplitude environment.

The licensee tested the LDM for susceptibility to radiated electric fields, radiated magnetic fields, conductive noise, and static discharges using test methodologies from the various standards identified previously and guidance contained in EPRI TR-102348 " Guideline on Licensing digital Upgrades" and EPRI TR-102323 " Guidelines for Electromagnetic Interference Testing in Power Plants." The licensee conducted on-site EMI/RFI mapping of the NUMAC LOM equipment locations and surrounding areas. The tests confirmed that the EMI/RFI qualification envelop bounds the plant specific noise environments for the NUMAC LDM equipment.

General Electric had conductive noise test performed in accordance with Swedish Standard Svensk Standard SS 436 15 03 and GE's conductive noise test requirements. Appropriate conductive noise protection was demonstrated.

The NUMAC LDM was qualified by GE against electrostatic discharge effects per IEC Standard 801-2.

Protection against electrostatic discharge was effectively demonstrated.

The staff finds that the above testing methodologies and results demonstrated proper qualification of the NUMAC LDM against EMI/RFI effects, and is, therefore, acceptable.

4.2 Software The LDM application software consists of the functional software for the microcomputer, including the self-test system, and the front panel keyboard and display software for the display computer. The LDM digital equipment software is written in high level languages to tra maximum extent possible to simplify software maintenance over the lifetime of the equipment. The total lines of the code required to perform the LDM functions is under 20,000 lines.

The functions performed by the software include (1) sampling and filtering sensor data, (2) comparing data to operator defined trip setpoints, (3)

. \\

updating operator. displays, (4) generating analog and trip output signals, and (5) performing self-tests.

The staff's software review included an audit of the products resulting from the software lifecycle plans for the NUMAC LDM, and examination of the NUMAC generic software development process with particular attention to the software

' management plan (SMP), the software configuration management plan (SCMP), and the software verification and validation plan (SVVP). The staff examined these plans and their implementation with regard to the guidance provided in RG 1.152 and ANSI /IEEE-7-4.3.2-1982.

GE used safety-related quality programs with supplemental verification and validation (V&V) procedures based on RG 1.152 to develop both Class IE and non-Class IE NUMAC LDM software. The GE NUMAC line of instruments is highly modularized and uses NUMAC product code where appropriate.

The lines of code are stored in two sets of firmware.

The GE V&V method is based on logical steps with baseline reviews performed at the completion of each phase of the-development process. A list of open items is documented and maintained for each review. -The V&V reviewers are independent from the software designers and communicated their review in written reports.

The validation process includes a matrix relating each validation test to a functional requirement.

The GE software development method is consistently followed and provides an internally reviewed paper trail throughout the software development process.

Testing is done using emulators, and every change requires testing. An organizationally independent configuration control engineer is required to sign-off on all baseline reviews (verification steps) and controls the NUMAC library of documents and firmware. The NUMAC review team has nine members and must approve all changes for resolutions of open items.

Strict configuration control standards are in place and all updates to the NUMAC instruments are performed at GE. Each version of the firmware includes all software modules.

Each version is controlled with a separate revision and part number. The User's Manual contains an extensive description of the NUMAC LDM system as_well as instructions for its use.

The staff finds that GE has a formally established software design, code and test review process with associated formal documentation. The staff also confirmed that (1) the GE formal configuration management plan is being consistently applied, (2) GE maintains a library wherein each software revision is a complete entity which addresses problems associated with controlling different versions of the code for each customer, and (3) an independent software V&V process was implemented in accordance with RG 1.152 The staff, therefore, finds the NUMAC LDM software is acceptable.

4.3 Defense Aaainst the Common Mode Failure GDC 13 and 19 require that instrumentation be provided for monitoring necessary variables under normal and accident conditions with indication

1

. provided in the control room. The staff reviewed the NUMAC LDM to confirm that this capability continued to be provided.

The single failure criterion requires that any single failure within a safety-related system not prevent proper function at the system level. The NUMAC LDM consists of redundant channels in order to meet this requirement.

However, common mode and common cause failures can prevent performance of intended functions even in redundant channels. A microprocessor-based digital system, such as the NUMAC LDM, which shares data bases and process equipment, has a potential for common mode or common cause failures in the software, hardware, and software / hardware interaction. Defense against common mode and common cause failures in digital systems is provided by quality and diversity in the system design.

Quality in the NUMAC LDM design is demonstrated as dire.ussed previously in sections 4.1 and 4.2 of this Safety Evaluation Report. Diversity is provided to the ambient and differential temperature monitoring trip functions of the NUMAC LDM temperature-based isolation functions for the various systems by alternative leak detection methods as described in Sections 7.3.1.1.2, 7.6.1.3 and 7.3.1 of the Perry Updated Safety Analysis Report (USAR). The alternative leak detection methods are:

System Alternative Leak Detection Method RCIC RCIC steam line flow RCIC steam line pressure RHR RHR/RCIC steam line flow j

pWCU RWCU differential flow Reactor water level MSL MSL high flow MSL low pressure These functions are physically separate from those of the NUMAC LDM and constitute diverse, redundant, safety-related backup means, with indication in the control room, that are capable of responding to a design basis line break for the various systems. Nonsafety sump level alarms are also available to the operator. A common mode failure of both divisions of the NUMAC LDM instrumentatine would, therefore, not prevent the necessary detection of -

system line breaks.

In the event of a failure of the NUMAC LDM self-diagnostic capability, the NUMAC architecture includes an INOP relay output contact that causes a System Test / Trouble control room overhead annunciator to alarm under the following circumstances:

loss of external or internal power to the NUMAC, placing the keylock switch out of OPERATE, e

. failure of a hardware module during self-test diagnostics (performed approximately each 1-2 minutes in the LDM),

detection of an open thermocouple signal circuit, e

failure of the class-lE processor to update the hardware watchdog on e

regular intervals, any software task which is not running at its expected intervals.

e Based on the above review, the staff finds that the NUMAC LDM defenses against common mode and comanon cause failures are adequate to ensure LDM functions from the control room, and provide acceptable redundancy in the event of loss of both divisions of the NUMAC LDM temperature-based isolation functions.

Therefore, the NUMAC LDM meets the requirements of GDC 13 and 19, and is acceptable.

4.4 Trainina The licensee has developed a site-specific NUMAC Leak Detection Monitor Operations and Maintenance Manual which includes the User's Manual, Perry Nuclear Power Plant LDM performance specifications, maintenance information and drawings for the instrument. The licensee is responsible for ensuring personnel who operate and maintain the LDM are trained in the performance of the equipment.

The staff finds the licensee's training to be acceptable.

5.0 TECHNICAL SPECIFICATION CHANGES The licensee requested an amendment to revise the technical specifications to reflect the replacement of existing leak detection equipment with GE NUMAC leak detection equipment, and to revise certain surveillance requirements for leak detection instrumentation.

The upgrade from analog to digital devices improves several system parameters such as channel' accuracy, drift, and loop calibration; however, the means of testing a digital channel is no different from the means of testing an analog channel, except in the data transmission from the sensor. Adding " digital" to the DEFINITION of the CHANNEL FUNCTIONAL TEST along with the currently referenced " analog" channels clarifies that the same test applies to digital channels. The staff concurs with this change.

The requested technical specification change also increases the CHANNEL i

FUNCTIONAL TEST surveillance interval from M (Monthly) to SA (Semiannually) for the ambient and differential temperature trip functions for the RWCU, RCIC (including the Main Steam Line Tunnel Temperature Timer), and RHR systems.

l The change does not include the main steam line temperature isolation logic for the temperature instrumentation located in the Turbine Building.

The licensee requested the following specific technical specification changes:

a.

Specification 1.6: CHANNEL FUNCTIONAL TEST (page 1-1)

Revise part "a" of the CHANNEL FUNCTIONAL TEST definition to recognize that this same definition applies to testing performed on digital channel s.

Add "/ Digital" after the word " Analog" in Definition 1.6.a.

. I b.

Specification 3.3.2: ISOLATION ACTUATION INSTRUMENTATION: MAIN STEAM LINE ISOLATION, TRIP FUNCTIONS 2.f and 2.g (page 3/4 3-23)

Increase the CHANNEL FUNCTIONAL TEST surveillance interval from M (Monthly) to SA (Semiannually) for the temperature and differential temperature Trip Functions listed below.

Channel l

Current New TRIP FUNCTION (SYSTEM) ISOLATION (PAGE)

Functional Item No.

Item No. Trip Function Name Test Req'at MAIN STEAM LINE ISOLATION (Page 3/4 3-23) l 2.f 2.f.1 Main Steam Line Tunnel Temperature - High SA i

l (Division 1 and 2)

I 2.g 2.g.1 Main Steam Line Tunnel A Temperature - High SA (Division 1 and 2) c.

Specification 3.3.2: ISOLATION ACTUATION INSTRUMENTATION (pages 3/4 3-24 through 3/4 3-26)

Increase the CHANNEL FUNCTIONAL TEST surveillance interval from M (Monthly) to SA (Semiannually) for the temperature and differential i

temperature Trip Functions listed below.

1 Channel TRIP FUNCTION (SYSTEM) ISOLATION (PAGE)

Functional Item'No. Trip Function Name Test Req'mt l

REACTOR WATER CLEANUP SYSTEM ISOLATION (Page 3/4 3-24) 4.c Equipment Area Temperature - High SA 1

4.d Equipment Area Ventilation A Temperature - High SA 4.f Main Steam Line Tunnel Ambient Temperature - High SA 4.g Main Steam Line Tunnel A Temperature - High SA Channel TRIP FUNCTION (SYSTEM) ISOLATION (PAGE)-

Functional Item No. Trip Function Name Test Req'mt REACTOR CORE ISOLATION COOLING SYSTEM ISOLATION (Page 3/4 3-25) 5.d RCIC Equipment Room Ambient Temperature - High SA 5.f Main Steam Line Tunnel Ambient Temperature - High SA 5.g Main Steam Line Tunnel A Temperature - High SA 5.h Main Steam Line Tunnel Temperature Timer SA

. - ~ - -. -. -...

1 1

i 1[

i i

5.1 RHR Equipment Room Ambient Temperature - High SA 5.j RHR Equipment Room A Temperature - High SA RHR SYSTEM ISOLATION (Page 3/4 3-26)

6.a RHR Equipment Area Ambient Temperature - High SA 6.b RHR Equipment Area A Temperature - High SA

= The basis for the increase in the channel functional test surveillance interval from M (Monthly) to SA (Semi-Annual) is that the NUMAC LDM self-test feature can detect potential failures that the periodic channel functional tests are intended to identify, and that the continuous self-test alerts the operator via annunciation when a problem is detected. The following NUMAC LDM d

diagnostic and self-test features are provided:

Continuous monitoring of each thermocouple input signal for out-of-bounds values.

Continuous monitoring of the two internal power supplies.(NUMAC remains functional with only one internal power supply).

Continuous monitoring of the external power input.

A self-check of each channel to confirm functionality at least once per 30 minutes.

Continuous monitoring to assure that the system is not left in an inoperable condition (e.g., card out-of-file, status switch left in the INOP mode).

Based on the staff review of the proposed TS changes, the staff finds that the NUMAC LDM self diagnostic features provide appropriate justification for 1

relaxation in channel functional test frequency, and therefore, the TS changes are acceptable.

Based on the above, the staff concludes that the design changes related to the replacement of the existing LDM systems with the GE NUMAC LDM, and the associated technical specification changos, meet the requirements of GDC 2, 4, 13 and 19, IEEE 279 for safety-related instrumentation and control systems, and the guidelines of RG 1.152 for computer-based digital systems, and are, therefore, acceptable.

6.0 STATE CONSULTATION

In accordance with the Commission's regulations, the Ohio State official was notified of the proposed issuance of the amendment. The State official had no comments.

7.0 ENVIRONMENTAL CONSIDERATION

This amendment involves a change to a requirement with respect to the installation or use of a facility component located within the restricted area

as defined in 10 CFR Part 20 or a change to a surveillance requirement. The staff has determined that the amendment involves no significant increase in the amounts, and no significant change in the types, of any effluent that may be released offsite and that there is no significant increase in individual or -

cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that this amendment involves no significant hazards consideration and there has been no public comment on such finding (59 FR 24752). Accordingly, this amendment meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of this amendment.

8.0 CONCLUSION

The staff has concluded, based on the considerations discussed above, that:

(1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributor:

M. Waterman Date:

January 29, 1996 1